@vantreeseba/drizzle-graphql 7.5.0 → 7.6.0

package/dist/index.js

@@ -38,6 +38,7 @@ import {
   One as One2,
   or,
   relationsFilterToSQL,
+  SQL,
   sql as sql2
 } from "drizzle-orm";
 import {
@@ -1154,7 +1155,7 @@ var batchedPaginatedRelationQuery = async (db, targetTable, foreignCol, whereCon
   }
   return rows;
 };
-var createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limits) => ({ tableName, relationName, relEntry, isOne }) => {
+var createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limits, scopes) => ({ tableName, relationName, relEntry, isOne }) => {
   const parentTable = tables[tableName];
   const targetTableName = relEntry.targetTableName;
   const targetTable = tables[targetTableName];
@@ -1215,10 +1216,16 @@ var createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limits
     const loader = getOrCreateLoader(context, loaderKey, async (parentIds) => {
       const executor = resolveExecutor(db, context);
       const uniqueIds = [...new Set(parentIds)];
-      let whereCondition = and(
-        inArray(foreignCol, uniqueIds),
-        whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0,
-        cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0
+      const scope = resolveScope(scopes, context, filterCtx);
+      let whereCondition = withScope(
+        scope,
+        targetTableName,
+        targetTable,
+        and(
+          inArray(foreignCol, uniqueIds),
+          whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0,
+          cursorValues ? buildCursorCondition(targetTable, cursorEntries, cursorValues, nullOrdering) : void 0
+        )
       );
       if (distinct) {
         const keys = await selectDistinctKeys({
@@ -2124,9 +2131,11 @@ var generateTableTypes = (tableName, tables, relationMap, withReturning, relatio
   const table = tables[tableName];
   const columns = visibleColumns(table);
   const columnEntries = Object.entries(columns);
+  const contextColumns = cacheCtx.contextValuesOf?.(tableName);
+  const writableEntries = contextColumns ? columnEntries.filter(([columnName]) => !(columnName in contextColumns)) : columnEntries;
   const relaxedColumns = nestedWrites?.relaxedColumns(tableName);
   const insertFields = Object.fromEntries(
-    columnEntries.map(([columnName, column]) => {
+    writableEntries.map(([columnName, column]) => {
       const converted = drizzleColumnToGraphQLType(
         column,
         columnName,
@@ -2142,7 +2151,7 @@ var generateTableTypes = (tableName, tables, relationMap, withReturning, relatio
     })
   );
   const updateFields = Object.fromEntries(
-    columnEntries.map(([columnName, column]) => {
+    writableEntries.map(([columnName, column]) => {
       const converted = drizzleColumnToGraphQLType(column, columnName, tableName, true, false, true);
       const operations = cacheCtx.featureOf(tableName).fieldUpdateOperations ? fieldUpdateInputType(column, columnName, tableName) : void 0;
       const field = operations ? { ...converted, type: operations } : converted;
@@ -2665,7 +2674,69 @@ var extractFilters = (table, tableName, filters, relationCtx) => {
   }
   return variants.length ? variants.length > 1 ? and(...variants) : variants[0] : void 0;
 };
-var extractRelationsParamsInner = (relationMap, tables, tableName, typeName, originField, typeNameMapper, _isInitial = false, filterCtx, limits) => {
+var resolveScope = (scopes, context, filterCtx) => {
+  if (!scopes) {
+    return void 0;
+  }
+  return {
+    has: (tableName) => !!scopes(tableName),
+    on: (tableName, table) => {
+      const hook = scopes(tableName);
+      if (!hook) {
+        return void 0;
+      }
+      const predicate = hook(context, table);
+      if (predicate === void 0 || predicate === null) {
+        return void 0;
+      }
+      if (is3(predicate, SQL)) {
+        return predicate;
+      }
+      if (typeof predicate !== "object") {
+        throw new GraphQLError4(
+          `Drizzle-GraphQL Error: the scope for '${tableName}' returned a ${typeof predicate}. A scope returns a filter object, a Drizzle SQL expression, or undefined.`
+        );
+      }
+      return extractFilters(table, tableName, predicate, relationFilterCtx(filterCtx, tableName));
+    }
+  };
+};
+var withScope = (scope, tableName, table, condition) => {
+  const predicate = scope?.on(tableName, table);
+  return predicate ? and(condition, predicate) : condition;
+};
+var bindPolicies = (policies, filterCtx) => policies?.scope || policies?.contextValues ? {
+  scope: policies.scope ? (context) => resolveScope(policies.scope, context, filterCtx) : void 0,
+  contextValues: policies.contextValues
+} : void 0;
+var applyContextValues = (values, hooks, context) => {
+  if (!hooks) {
+    return values;
+  }
+  for (const [columnName, hook] of Object.entries(hooks)) {
+    values[columnName] = hook(context);
+  }
+  return values;
+};
+var applyContextValuesAll = (rows, hooks, context) => {
+  if (!hooks) {
+    return rows;
+  }
+  for (const row of rows) {
+    applyContextValues(row, hooks, context);
+  }
+  return rows;
+};
+var stripContextValues = (values, hooks) => {
+  if (!hooks) {
+    return values;
+  }
+  for (const columnName of Object.keys(hooks)) {
+    delete values[columnName];
+  }
+  return values;
+};
+var extractRelationsParamsInner = (relationMap, tables, tableName, typeName, originField, typeNameMapper, _isInitial = false, filterCtx, limits, scope) => {
   const relationsForTable = relationMap[tableName];
   if (!relationsForTable) {
     return void 0;
@@ -2711,8 +2782,13 @@ var extractRelationsParamsInner = (relationMap, tables, tableName, typeName, ori
     const offset = relationArgs?.offset ?? void 0;
     const limit = is3(relEntry.relation, One2) ? relationArgs?.limit ?? void 0 : applyLimitPolicy(relationArgs?.limit, limits?.(targetTableName), `${tableName}.${relName}`);
     const relWhere = relationArgs?.where;
-    thisRecord.where = relWhere ? {
-      RAW: (aliasedTable2) => extractFilters(aliasedTable2, relName, relWhere, relationFilterCtx(filterCtx, targetTableName))
+    thisRecord.where = relWhere || scope?.has(targetTableName) ? {
+      RAW: (aliasedTable2) => withScope(
+        scope,
+        targetTableName,
+        aliasedTable2,
+        relWhere ? extractFilters(aliasedTable2, relName, relWhere, relationFilterCtx(filterCtx, targetTableName)) : void 0
+      )
     } : void 0;
     const hasPagination = offset != null || limit != null;
     const pkNames = targetPkNames ?? [];
@@ -2728,14 +2804,15 @@ var extractRelationsParamsInner = (relationMap, tables, tableName, typeName, ori
       typeNameMapper,
       false,
       filterCtx,
-      limits
+      limits,
+      scope
     ) : void 0;
     thisRecord.with = relWith;
     args[relName] = thisRecord;
   }
   return args;
 };
-var extractRelationsParams = (relationMap, tables, tableName, info, typeName, typeNameMapper, filterCtx, limits) => {
+var extractRelationsParams = (relationMap, tables, tableName, info, typeName, typeNameMapper, filterCtx, limits, scope) => {
   if (!info) {
     return void 0;
   }
@@ -2748,7 +2825,8 @@ var extractRelationsParams = (relationMap, tables, tableName, info, typeName, ty
     typeNameMapper,
     true,
     filterCtx,
-    limits
+    limits,
+    scope
   );
 };
 var pruneNonEagerRelations = (relationMap, shouldEagerLoad) => {
@@ -3158,7 +3236,8 @@ var prepareMutationRelationColumns = (params) => {
     typeName,
     typeNameMapper,
     void 0,
-    params.limits
+    params.limits,
+    params.scope
   ) : void 0;
   const hasRelations = !!(withParams && Object.keys(withParams).length);
   const baseColumns = extractSelectedColumnsFromTreeSQLFormat(parsedInfo.fieldsByTypeName[typeName], table, {
@@ -3392,7 +3471,8 @@ var runRelationalSelect = async (opts) => {
     single,
     filterCtx,
     pkNames,
-    after
+    after,
+    scope
   } = opts;
   const distinct = opts.distinct?.length ? opts.distinct : void 0;
   const cursorSelected = !single && isCursorFieldSelected(parsedInfo.fieldsByTypeName[typeName], table);
@@ -3424,7 +3504,12 @@ var runRelationalSelect = async (opts) => {
       tableName,
       distinct,
       pkNames: pkNames ?? [],
-      where: where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0,
+      where: withScope(
+        scope,
+        tableName,
+        table,
+        where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+      ),
       orderBy,
       limit: single ? 1 : opts.limit,
       offset
@@ -3451,15 +3536,23 @@ var runRelationalSelect = async (opts) => {
       // exactly the ordering the cursor encodes and the keyset predicate compares against.
       (aliasedTable2) => cursorOrderExprs(aliasedTable2, cursorEntries)
     ) : orderBy ? (aliasedTable2) => extractOrderBy(aliasedTable2, orderBy, relationFilterCtx(filterCtx, tableName), where) : needsDefaultOrder && pkNames?.length ? (aliasedTable2) => primaryKeyOrderExprs(aliasedTable2, pkNames) : void 0,
-    where: distinctKeys ? { RAW: (aliasedTable2) => primaryKeyRestriction(aliasedTable2, pkNames, distinctKeys) } : where || cursorValues ? {
-      RAW: (aliasedTable2) => and(
-        where ? extractFilters(aliasedTable2, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0,
-        cursorValues ? buildCursorCondition(
-          aliasedTable2,
-          cursorEntries,
-          cursorValues,
-          opts.nullOrdering ?? "nulls-smallest"
-        ) : void 0
+    where: distinctKeys ? (
+      // The distinct pass already ran inside the scope, so the keys it picked are in it.
+      { RAW: (aliasedTable2) => primaryKeyRestriction(aliasedTable2, pkNames, distinctKeys) }
+    ) : where || cursorValues || scope?.has(tableName) ? {
+      RAW: (aliasedTable2) => withScope(
+        scope,
+        tableName,
+        aliasedTable2,
+        and(
+          where ? extractFilters(aliasedTable2, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0,
+          cursorValues ? buildCursorCondition(
+            aliasedTable2,
+            cursorEntries,
+            cursorValues,
+            opts.nullOrdering ?? "nulls-smallest"
+          ) : void 0
+        )
       )
     } : void 0,
     with: relationMap[tableName] ? extractRelationsParams(
@@ -3470,7 +3563,8 @@ var runRelationalSelect = async (opts) => {
       typeName,
       typeNameMapper,
       filterCtx,
-      opts.limits
+      opts.limits,
+      scope
     ) : void 0
   };
   if (single) {
@@ -3807,7 +3901,7 @@ var assembleAggregateRow = (row, request, target) => {
   }
   return result;
 };
-var generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs, filterCtx) => {
+var generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs, filterCtx, scopes) => {
   const target = aggregateTarget(table, tableName, typeName);
   const queryArgs = {
     where: { type: filterArgs }
@@ -3821,8 +3915,14 @@ var generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs,
           return {};
         }
         let query = resolveExecutor(db, context).select(request.selection).from(table);
-        if (args.where) {
-          query = query.where(extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)));
+        const where = withScope(
+          resolveScope(scopes, context, filterCtx),
+          tableName,
+          table,
+          args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0
+        );
+        if (where) {
+          query = query.where(where);
         }
         const rows = await query;
         return assembleAggregateRow(rows[0] ?? {}, request, target);
@@ -3834,7 +3934,7 @@ var generateAggregate = (db, tableName, table, typeName, fieldName, filterArgs,
   };
 };
 var GROUP_KEY = "__dgql_group_key";
-var createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, filterCtx) => {
+var createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, filterCtx, scopes) => {
   return ({ tableName, relationName, relEntry }) => {
     const parentTable = tables[tableName];
     const targetTableName = relEntry.targetTableName;
@@ -3869,9 +3969,14 @@ var createRelationAggregateFactory = (db, tables, cacheCtx, typeNameMapper, filt
         const loader = getOrCreateLoader(context, loaderKey, async (parentIds) => {
           const executor = resolveExecutor(db, context);
           const uniqueIds = [...new Set(parentIds)];
-          const whereCondition = and2(
-            inArray2(foreignCol, uniqueIds),
-            whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0
+          const whereCondition = withScope(
+            resolveScope(scopes, context, filterCtx),
+            targetTableName,
+            targetTable,
+            and2(
+              inArray2(foreignCol, uniqueIds),
+              whereArg ? extractFilters(targetTable, targetTableName, whereArg, relationFilterCtx(filterCtx, targetTableName)) : void 0
+            )
           );
           const rows = await executor.select({ [GROUP_KEY]: foreignCol, ...request.selection }).from(targetTable).where(whereCondition).groupBy(foreignCol);
           const byKey = new Map(rows.map((row) => [row[GROUP_KEY], row]));
@@ -4004,7 +4109,7 @@ var buildHavingCondition = (having, columns) => {
   }
   return conditions.length ? and2(...conditions) : void 0;
 };
-var generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs, groupByEnum, havingInput, filterCtx) => {
+var generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs, groupByEnum, havingInput, filterCtx, scopes) => {
   const target = aggregateTarget(table, tableName, typeName);
   const groupable = groupableColumns(table, tableName);
   const columns = getColumns3(table);
@@ -4038,8 +4143,14 @@ var generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs, gr
           ...request.selection
         };
         let query = resolveExecutor(db, context).select(selection).from(table);
-        if (args.where) {
-          query = query.where(extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)));
+        const where = withScope(
+          resolveScope(scopes, context, filterCtx),
+          tableName,
+          table,
+          args.where ? extractFilters(table, tableName, args.where, relationFilterCtx(filterCtx, tableName)) : void 0
+        );
+        if (where) {
+          query = query.where(where);
         }
         query = query.groupBy(...keyColumns.map(([, column]) => column));
         const havingCondition = buildHavingCondition(args.having, columns);
@@ -4065,7 +4176,7 @@ var generateGroupBy = (db, tableName, table, typeName, fieldName, filterArgs, gr
 };
 
 // src/util/builders/mysql.ts
-var generateSelectArray = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits) => {
+var generateSelectArray = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits, policies) => {
   const queryBase = db.query[tableName];
   if (!queryBase) {
     throw new Error(
@@ -4100,6 +4211,7 @@ var generateSelectArray = (db, tableName, tables, relationMap, orderArgs, filter
           single: false,
           filterCtx,
           limits,
+          scope: policies?.scope?.(context),
           pkNames,
           db: executor,
           // MySQL sorts NULLs as the smallest values (first in ASC).
@@ -4112,7 +4224,7 @@ var generateSelectArray = (db, tableName, tables, relationMap, orderArgs, filter
     args: queryArgs
   };
 };
-var generateSelectSingle = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits) => {
+var generateSelectSingle = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits, policies) => {
   const queryBase = db.query[tableName];
   if (!queryBase) {
     throw new Error(
@@ -4141,6 +4253,7 @@ var generateSelectSingle = (db, tableName, tables, relationMap, orderArgs, filte
           single: true,
           filterCtx,
           limits,
+          scope: policies?.scope?.(context),
           pkNames,
           db: executor
         });
@@ -4151,7 +4264,7 @@ var generateSelectSingle = (db, tableName, tables, relationMap, orderArgs, filte
     args: queryArgs
   };
 };
-var generateInsertArray = (db, _tableName, table, baseType, fieldName, txCtx) => {
+var generateInsertArray = (db, tableName, table, baseType, fieldName, txCtx, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull5(new GraphQLList5(new GraphQLNonNull5(baseType)))
@@ -4162,7 +4275,11 @@ var generateInsertArray = (db, _tableName, table, baseType, fieldName, txCtx) =>
     resolver: async (_source, args, context, info) => {
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
-          const input = remapFromGraphQLArrayInput(args.values, table);
+          const input = applyContextValuesAll(
+            remapFromGraphQLArrayInput(args.values, table),
+            policies?.contextValues?.(tableName),
+            context
+          );
           if (!input.length) {
             throw new GraphQLError6("No values were provided!");
           }
@@ -4176,7 +4293,7 @@ var generateInsertArray = (db, _tableName, table, baseType, fieldName, txCtx) =>
     args: queryArgs
   };
 };
-var generateInsertSingle = (db, _tableName, table, baseType, fieldName, txCtx) => {
+var generateInsertSingle = (db, tableName, table, baseType, fieldName, txCtx, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull5(baseType)
@@ -4187,7 +4304,11 @@ var generateInsertSingle = (db, _tableName, table, baseType, fieldName, txCtx) =
     resolver: async (_source, args, context, info) => {
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
-          const input = remapFromGraphQLSingleInput(args.values, table);
+          const input = applyContextValues(
+            remapFromGraphQLSingleInput(args.values, table),
+            policies?.contextValues?.(tableName),
+            context
+          );
           await executor.insert(table).values(input);
           return { isSuccess: true };
         });
@@ -4198,7 +4319,7 @@ var generateInsertSingle = (db, _tableName, table, baseType, fieldName, txCtx) =
     args: queryArgs
   };
 };
-var generateUpsert = (db, table, baseType, onConflictType, fieldName, single, txCtx) => {
+var generateUpsert = (db, tableName, table, baseType, onConflictType, fieldName, single, txCtx, policies) => {
   const queryArgs = {
     values: {
       type: single ? new GraphQLNonNull5(baseType) : new GraphQLNonNull5(new GraphQLList5(new GraphQLNonNull5(baseType)))
@@ -4214,7 +4335,11 @@ var generateUpsert = (db, table, baseType, onConflictType, fieldName, single, tx
     resolver: async (_source, args, context, info) => {
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
-          const input = single ? [remapFromGraphQLSingleInput(args.values, table)] : remapFromGraphQLArrayInput(args.values, table);
+          const input = applyContextValuesAll(
+            single ? [remapFromGraphQLSingleInput(args.values, table)] : remapFromGraphQLArrayInput(args.values, table),
+            policies?.contextValues?.(tableName),
+            context
+          );
           if (!input.length) {
             throw new GraphQLError6("No values were provided!");
           }
@@ -4241,7 +4366,7 @@ var generateUpsert = (db, table, baseType, onConflictType, fieldName, single, tx
     args: queryArgs
   };
 };
-var generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, single, requireWhere, filterCtx, txCtx) => {
+var generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, single, requireWhere, filterCtx, txCtx, policies) => {
   const queryArgs = {
     set: {
       type: new GraphQLNonNull5(setArgs)
@@ -4256,12 +4381,21 @@ var generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, sing
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where, set } = args;
-          const input = remapUpdateInput(set, table, tableName);
+          const scope = policies?.scope?.(context);
+          const input = stripContextValues(
+            remapUpdateInput(set, table, tableName),
+            policies?.contextValues?.(tableName)
+          );
           if (!Object.keys(input).length) {
             throw new GraphQLError6("Unable to update with no values specified!");
           }
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -4279,7 +4413,7 @@ var generateUpdate = (db, tableName, table, setArgs, filterArgs, fieldName, sing
     args: queryArgs
   };
 };
-var generateUpdateMany = (db, tableName, table, updateManyInput, fieldName, filterCtx, txCtx) => {
+var generateUpdateMany = (db, tableName, table, updateManyInput, fieldName, filterCtx, txCtx, policies) => {
   const queryArgs = {
     updates: {
       type: new GraphQLNonNull5(new GraphQLList5(new GraphQLNonNull5(updateManyInput)))
@@ -4294,14 +4428,21 @@ var generateUpdateMany = (db, tableName, table, updateManyInput, fieldName, filt
           if (!updates.length) {
             throw new GraphQLError6("No updates were provided!");
           }
+          const scope = policies?.scope?.(context);
+          const contextColumns = policies?.contextValues?.(tableName);
           const entries = updates.map(({ where, set }) => {
-            const input = remapUpdateInput(set, table, tableName);
+            const input = stripContextValues(remapUpdateInput(set, table, tableName), contextColumns);
             if (!Object.keys(input).length) {
               throw new GraphQLError6("Unable to update with no values specified!");
             }
             return {
               set: input,
-              filters: where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              filters: withScope(
+                scope,
+                tableName,
+                table,
+                where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              )
             };
           });
           await executor.transaction(async (tx) => {
@@ -4322,7 +4463,7 @@ var generateUpdateMany = (db, tableName, table, updateManyInput, fieldName, filt
     args: queryArgs
   };
 };
-var generateDelete = (db, tableName, table, filterArgs, fieldName, single, requireWhere, filterCtx, txCtx) => {
+var generateDelete = (db, tableName, table, filterArgs, fieldName, single, requireWhere, filterCtx, txCtx, policies) => {
   const queryArgs = {
     where: {
       type: single || requireWhere ? new GraphQLNonNull5(filterArgs) : filterArgs
@@ -4334,8 +4475,14 @@ var generateDelete = (db, tableName, table, filterArgs, fieldName, single, requi
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where } = args;
+          const scope = policies?.scope?.(context);
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -4383,12 +4530,16 @@ var generateSchemaData = (db, schema, relations, options) => {
   attachTargetPrimaryKeys(namedRelations, tables, mysqlPrimaryKeyPropNames);
   const eagerRelations = pruneNonEagerRelations(namedRelations, shouldEagerLoad);
   const filterCtx = { tables, relationMap: namedRelations };
+  const scopes = options.policies?.scope;
+  const contextValuesOf = options.policies?.contextValues;
+  const policies = bindPolicies(options.policies, filterCtx);
   const resolverFactory = createRelationResolverFactory(
     db,
     tables,
     "nulls-smallest",
     filterCtx,
-    limits
+    limits,
+    scopes
   );
   const cacheCtx = {
     genericFilterCache: /* @__PURE__ */ new Map(),
@@ -4406,9 +4557,10 @@ var generateSchemaData = (db, schema, relations, options) => {
     limits,
     docs: options.docs ?? {},
     primaryKeyOf: (name) => tables[name] ? mysqlPrimaryKeyPropNames(tables[name]) : [],
+    contextValuesOf,
     featureOf
   };
-  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
+  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx, scopes) : void 0;
   const queries = {};
   const mutations = {};
   const mutationTxCtx = createMutationTxCtx(options.transactions);
@@ -4478,7 +4630,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       typeNameMapper,
       filterCtx,
       tableFeatures.distinct,
-      limits
+      limits,
+      policies
     );
     const selectSingleGenerated = generateSelectSingle(
       db,
@@ -4491,7 +4644,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       typeName,
       typeNameMapper,
       filterCtx,
-      limits
+      limits,
+      policies
     );
     const insertArrGenerated = tableFeatures.insert ? generateInsertArray(
       db,
@@ -4499,7 +4653,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       schema[tableName],
       insertInput,
       createArrayFieldName,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const insertSingleGenerated = tableFeatures.insert ? generateInsertSingle(
       db,
@@ -4507,7 +4662,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       schema[tableName],
       insertInput,
       createSingleFieldName,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const onConflictInput = tableFeatures.upsert ? generateOnConflictInput({
       table: schema[tableName],
@@ -4518,21 +4674,25 @@ var generateSchemaData = (db, schema, relations, options) => {
     }) : void 0;
     const upsertArrGenerated = onConflictInput ? generateUpsert(
       db,
+      tableName,
       schema[tableName],
       insertInput,
       onConflictInput,
       upsertArrayFieldName,
       false,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const upsertSingleGenerated = onConflictInput ? generateUpsert(
       db,
+      tableName,
       schema[tableName],
       insertInput,
       onConflictInput,
       upsertSingleFieldName,
       true,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateGenerated = tableFeatures.update ? generateUpdate(
       db,
@@ -4544,7 +4704,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       false,
       tableFeatures.requireWhere,
       filterCtx,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateSingleGenerated = tableFeatures.update ? generateUpdate(
       db,
@@ -4556,7 +4717,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       true,
       tableFeatures.requireWhere,
       filterCtx,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateManyInput = tableFeatures.update && tableFeatures.updateMany ? generateUpdateManyInput({ typeName, updatePrefix: prefixes.update, updateInput, tableFilters }) : void 0;
     const updateManyGenerated = updateManyInput ? generateUpdateMany(
@@ -4566,7 +4728,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       updateManyInput,
       updateManyFieldName,
       filterCtx,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const deleteGenerated = tableFeatures.delete ? generateDelete(
       db,
@@ -4577,7 +4740,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       false,
       tableFeatures.requireWhere,
       filterCtx,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const deleteSingleGenerated = tableFeatures.delete ? generateDelete(
       db,
@@ -4588,7 +4752,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       true,
       tableFeatures.requireWhere,
       filterCtx,
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateCountGenerated = tableFeatures.update && tableFeatures.countMutations ? generateWriteCount({
       db,
@@ -4621,7 +4786,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       typeName,
       aggregateFieldName,
       tableFilters,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     const groupByType = tableFeatures.aggregates && tableFeatures.groupBy ? generateGroupByType(schema[tableName], tableName, typeName, cacheCtx) : void 0;
     const groupByEnum = groupByType ? generateGroupByEnum(schema[tableName], tableName, typeName) : void 0;
@@ -4635,7 +4801,8 @@ var generateSchemaData = (db, schema, relations, options) => {
       tableFilters,
       groupByEnum,
       havingInput,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
@@ -4874,8 +5041,9 @@ var createNestedWriteTypes = (params) => {
       return cached;
     }
     const omitted = plan.fkSide === "child" ? plan.foreignColPropName : void 0;
+    const contextColumns = cacheCtx.contextValuesOf?.(plan.targetTableName);
     const fields = Object.fromEntries(
-      Object.entries(visibleColumns(plan.targetTable)).filter(([columnName]) => columnName !== omitted).map(([columnName, column]) => [
+      Object.entries(visibleColumns(plan.targetTable)).filter(([columnName]) => columnName !== omitted && !contextColumns?.[columnName]).map(([columnName, column]) => [
         columnName,
         drizzleColumnToGraphQLType(column, columnName, plan.targetTableName, false, true, true)
       ])
@@ -4974,8 +5142,8 @@ var createNestedWriteTypes = (params) => {
 var mergedOps = (entries) => Object.assign({}, ...entries.map((entry) => entry.ops));
 var asArray = (value) => Array.isArray(value) ? value : value === void 0 ? [] : [value];
 var createNestedWriteRuntime = (params) => {
-  const { plans, filterCtx } = params;
-  const conditionOf = (plan, filter, operation) => {
+  const { plans, filterCtx, scopes, contextValues } = params;
+  const conditionOf = (plan, filter, operation, scope) => {
     const condition = extractFilters(
       plan.targetTable,
       plan.targetTableName,
@@ -4987,7 +5155,7 @@ var createNestedWriteRuntime = (params) => {
         `Drizzle-GraphQL Error: '${operation}' on '${plan.relationName}' needs a filter that selects rows \u2014 it was given one that matches everything.`
       );
     }
-    return condition;
+    return withScope(scope, plan.targetTableName, plan.targetTable, condition);
   };
   const assertSingleOperation = (plan, op) => {
     const supplied = ["create", "connect", "disconnect"].filter((key) => op[key] !== void 0 && op[key] !== null);
@@ -4997,7 +5165,7 @@ var createNestedWriteRuntime = (params) => {
       );
     }
   };
-  const detachAll = async (executor, plan, key) => executor.update(plan.targetTable).set({ [plan.foreignColPropName]: null }).where(eq3(plan.foreignCol, key));
+  const detachAll = async (executor, plan, key, scope) => executor.update(plan.targetTable).set({ [plan.foreignColPropName]: null }).where(withScope(scope, plan.targetTableName, plan.targetTable, eq3(plan.foreignCol, key)));
   return {
     enabled: (tableName) => !!plans[tableName],
     split: (tableName, values) => {
@@ -5031,12 +5199,13 @@ var createNestedWriteRuntime = (params) => {
       }
       return columns;
     },
-    applyParentSide: async (executor, tableName, ops) => {
+    applyParentSide: async (executor, tableName, ops, context) => {
       const tablePlans = plans[tableName];
       const patch = {};
       if (!tablePlans) {
         return patch;
       }
+      const scope = resolveScope(scopes, context, filterCtx);
       for (const [relationName, op] of Object.entries(ops)) {
         const plan = tablePlans[relationName];
         if (!plan || plan.fkSide !== "parent") {
@@ -5044,7 +5213,11 @@ var createNestedWriteRuntime = (params) => {
         }
         assertSingleOperation(plan, op);
         if (op["create"] !== void 0) {
-          const values = remapFromGraphQLSingleInput({ ...op["create"] }, plan.targetTable);
+          const values = applyContextValues(
+            remapFromGraphQLSingleInput({ ...op["create"] }, plan.targetTable),
+            contextValues?.(plan.targetTableName),
+            context
+          );
           const inserted = await executor.insert(plan.targetTable).values(values).returning();
           const created = inserted[0];
           if (!created) {
@@ -5054,7 +5227,7 @@ var createNestedWriteRuntime = (params) => {
           }
           patch[plan.localColPropName] = created[plan.foreignColPropName];
         } else if (op["connect"] !== void 0) {
-          const rows = await executor.select().from(plan.targetTable).where(conditionOf(plan, op["connect"], "connect"));
+          const rows = await executor.select().from(plan.targetTable).where(conditionOf(plan, op["connect"], "connect", scope));
           if (rows.length !== 1) {
             throw new GraphQLError7(
               `Drizzle-GraphQL Error: 'connect' on '${relationName}' matched ${rows.length} rows \u2014 it attaches a single row, so its filter must match exactly one.`
@@ -5067,11 +5240,12 @@ var createNestedWriteRuntime = (params) => {
       }
       return patch;
     },
-    applyChildSide: async (executor, tableName, ops, parentRows) => {
+    applyChildSide: async (executor, tableName, ops, parentRows, context) => {
       const tablePlans = plans[tableName];
       if (!tablePlans) {
         return;
       }
+      const scope = resolveScope(scopes, context, filterCtx);
       for (const [relationName, op] of Object.entries(ops)) {
         const plan = tablePlans[relationName];
         if (!plan || plan.fkSide !== "child") {
@@ -5088,34 +5262,38 @@ var createNestedWriteRuntime = (params) => {
             );
           }
           if (op["set"] !== void 0) {
-            await detachAll(executor, plan, key);
+            await detachAll(executor, plan, key, scope);
             for (const filter of asArray(op["set"])) {
-              await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: key }).where(conditionOf(plan, filter, "set"));
+              await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: key }).where(conditionOf(plan, filter, "set", scope));
             }
           }
           if (op["disconnect"] !== void 0) {
             if (plan.isOne) {
               if (op["disconnect"] === true) {
-                await detachAll(executor, plan, key);
+                await detachAll(executor, plan, key, scope);
               }
             } else {
               for (const filter of asArray(op["disconnect"])) {
-                await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: null }).where(and3(eq3(plan.foreignCol, key), conditionOf(plan, filter, "disconnect")));
+                await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: null }).where(and3(eq3(plan.foreignCol, key), conditionOf(plan, filter, "disconnect", scope)));
               }
             }
           }
           const attaches = op["connect"] !== void 0 || op["create"] !== void 0;
           if (plan.isOne && attaches && plan.canDetach && op["set"] === void 0) {
-            await detachAll(executor, plan, key);
+            await detachAll(executor, plan, key, scope);
           }
           if (op["connect"] !== void 0) {
             for (const filter of asArray(op["connect"])) {
-              await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: key }).where(conditionOf(plan, filter, "connect"));
+              await executor.update(plan.targetTable).set({ [plan.foreignColPropName]: key }).where(conditionOf(plan, filter, "connect", scope));
             }
           }
           if (op["create"] !== void 0) {
             const rows = asArray(op["create"]).map((row) => ({
-              ...remapFromGraphQLSingleInput({ ...row }, plan.targetTable),
+              ...applyContextValues(
+                remapFromGraphQLSingleInput({ ...row }, plan.targetTable),
+                contextValues?.(plan.targetTableName),
+                context
+              ),
               [plan.foreignColPropName]: key
             }));
             if (rows.length) {
@@ -5128,30 +5306,30 @@ var createNestedWriteRuntime = (params) => {
   };
 };
 var writeWithNestedOps = async (params) => {
-  const { executor, runtime, tableName, entries, remapValues, write } = params;
+  const { executor, runtime, tableName, entries, remapValues, write, context } = params;
   return executor.transaction(async (tx) => {
     const rows = [];
     for (const entry of entries) {
-      const patch = await runtime.applyParentSide(tx, tableName, entry.ops);
+      const patch = await runtime.applyParentSide(tx, tableName, entry.ops, context);
       const written = await write(tx, { ...remapValues(entry.columns), ...patch });
-      await runtime.applyChildSide(tx, tableName, entry.ops, written);
+      await runtime.applyChildSide(tx, tableName, entry.ops, written, context);
       rows.push(...written);
     }
     return rows;
   });
 };
 var updateWithNestedOps = async (params) => {
-  const { executor, runtime, tableName, columns, ops, remapValues, write } = params;
+  const { executor, runtime, tableName, columns, ops, remapValues, write, context } = params;
   return executor.transaction(async (tx) => {
-    const patch = await runtime.applyParentSide(tx, tableName, ops);
+    const patch = await runtime.applyParentSide(tx, tableName, ops, context);
     const rows = await write(tx, { ...remapValues(columns), ...patch });
-    await runtime.applyChildSide(tx, tableName, ops, rows);
+    await runtime.applyChildSide(tx, tableName, ops, rows, context);
     return rows;
   });
 };
 
 // src/util/builders/pg.ts
-var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits) => {
+var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits, policies) => {
   const queryBase = db.query[tableName];
   const table = tables[tableName];
   const limitPolicy = limits?.(tableName);
@@ -5167,6 +5345,7 @@ var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filte
       try {
         const parsedInfo = parseResolveInfo3(info, { deep: true });
         const { executor, queryBase: requestQueryBase } = resolveQueryExecutor(db, context, tableName, queryBase);
+        const scope = policies?.scope?.(context);
         const limit = applyLimitPolicy(args.limit, limitPolicy, fieldName);
         if (requestQueryBase) {
           return await runRelationalSelect({
@@ -5185,6 +5364,7 @@ var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filte
             limits,
             pkNames,
             db: executor,
+            scope,
             // PostgreSQL sorts NULLs as the largest values (last in ASC).
             nullOrdering: "nulls-largest"
           });
@@ -5223,7 +5403,12 @@ var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filte
           }
         }
         const cursorCondition = after != null && cursorEntries ? buildCursorCondition(table, cursorEntries, decodeCursor(after, cursorEntries), "nulls-largest") : void 0;
-        const baseWhereSql = where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0;
+        const baseWhereSql = withScope(
+          scope,
+          tableName,
+          table,
+          where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+        );
         const whereSql = cursorCondition ? and4(baseWhereSql, cursorCondition) : baseWhereSql;
         let distinctKeys;
         if (distinct?.length) {
@@ -5278,7 +5463,7 @@ var generateSelectArray2 = (db, tableName, tables, relationMap, orderArgs, filte
     args: queryArgs
   };
 };
-var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits) => {
+var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits, policies) => {
   const queryBase = db.query[tableName];
   const queryArgs = selectSingleArgs(orderArgs, filterArgs);
   const table = tables[tableName];
@@ -5289,6 +5474,7 @@ var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filt
       try {
         const parsedInfo = parseResolveInfo3(info, { deep: true });
         const { executor, queryBase: requestQueryBase } = resolveQueryExecutor(db, context, tableName, queryBase);
+        const scope = policies?.scope?.(context);
         if (requestQueryBase) {
           return await runRelationalSelect({
             queryBase: requestQueryBase,
@@ -5304,7 +5490,8 @@ var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filt
             filterCtx,
             limits,
             pkNames,
-            db: executor
+            db: executor,
+            scope
           });
         }
         const { offset, orderBy, where } = args;
@@ -5314,8 +5501,14 @@ var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filt
           { tableName, relationMap, tables }
         );
         let q = executor.select(selectedColumnsSql).from(table);
-        if (where) {
-          q = q.where(extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)));
+        const whereSql = withScope(
+          scope,
+          tableName,
+          table,
+          where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+        );
+        if (whereSql) {
+          q = q.where(whereSql);
         }
         if (orderBy) {
           q = q.orderBy(...extractOrderBy(table, orderBy, relationFilterCtx(filterCtx, tableName), where));
@@ -5336,7 +5529,7 @@ var generateSelectSingle2 = (db, tableName, tables, relationMap, orderArgs, filt
   };
 };
 var pgPrimaryKeyPropNames = (table) => getPrimaryKeyPropNamesFromConfig(table, getTableConfig2);
-var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits) => {
+var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull7(new GraphQLList7(new GraphQLNonNull7(baseType)))
@@ -5353,7 +5546,13 @@ var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType,
           }
           const entries = nested?.enabled(tableName) ? args.values.map((values) => nested.split(tableName, values)) : void 0;
           const nestedEntries = entries?.some((entry) => nested.hasOps(entry.ops)) ? entries : void 0;
-          const input = nestedEntries ? [] : remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : args.values, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntries ? [] : applyContextValuesAll(
+            remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : args.values, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo3(info, {
             deep: true
           });
@@ -5366,7 +5565,8 @@ var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType,
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntries ? nested.withJoinColumns(tableName, mergedOps(nestedEntries), { ...columns }, table) : columns;
           const runInsert = async (target, values) => {
@@ -5381,8 +5581,9 @@ var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType,
             runtime: nested,
             tableName,
             entries: nestedEntries,
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: (tx, values) => runInsert(tx, [values])
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: (tx, values) => runInsert(tx, [values]),
+            context
           }) : await runInsert(executor, input);
           const enriched = hasRelations ? await eagerLoadMutationRelations(executor, tableName, result, pkNames, withParams) : result;
           return remapToGraphQLArrayOutput(enriched, tableName, table, relationMap);
@@ -5394,7 +5595,7 @@ var generateInsertArray2 = (db, tableName, table, tables, relationMap, baseType,
     args: queryArgs
   };
 };
-var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits) => {
+var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull7(baseType)
@@ -5408,7 +5609,13 @@ var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const entry = nested?.enabled(tableName) ? nested.split(tableName, args.values) : void 0;
           const nestedEntry = entry && nested.hasOps(entry.ops) ? entry : void 0;
-          const input = nestedEntry ? {} : remapFromGraphQLSingleInput(entry ? entry.columns : args.values, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntry ? {} : applyContextValues(
+            remapFromGraphQLSingleInput(entry ? entry.columns : args.values, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo3(info, {
             deep: true
           });
@@ -5421,7 +5628,8 @@ var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntry ? nested.withJoinColumns(tableName, nestedEntry.ops, { ...columns }, table) : columns;
           const runInsert = async (target, values) => {
@@ -5436,8 +5644,9 @@ var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType
             runtime: nested,
             tableName,
             entries: [nestedEntry],
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: runInsert
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: runInsert,
+            context
           }) : await runInsert(executor, input);
           if (!result[0]) {
             if (!conflictDoNothing) {
@@ -5455,7 +5664,7 @@ var generateInsertSingle2 = (db, tableName, table, tables, relationMap, baseType
     args: queryArgs
   };
 };
-var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onConflictType, uniqueSets, fieldName, typeName, single, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onConflictType, uniqueSets, fieldName, typeName, single, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: single ? new GraphQLNonNull7(baseType) : new GraphQLNonNull7(new GraphQLList7(new GraphQLNonNull7(baseType)))
@@ -5477,7 +5686,13 @@ var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onCo
           }
           const entries = nested?.enabled(tableName) ? supplied.map((values) => nested.split(tableName, values)) : void 0;
           const nestedEntries = entries?.some((entry) => nested.hasOps(entry.ops)) ? entries : void 0;
-          const input = nestedEntries ? [] : remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : supplied, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntries ? [] : applyContextValuesAll(
+            remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : supplied, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo3(info, { deep: true });
           const { columns, hasRelations, withParams } = prepareMutationRelationColumns({
             relationMap,
@@ -5488,7 +5703,8 @@ var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onCo
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntries ? nested.withJoinColumns(tableName, mergedOps(nestedEntries), { ...columns }, table) : columns;
           const runUpsert = async (target, values) => {
@@ -5503,7 +5719,8 @@ var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onCo
               buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName))
             });
             let query = target.insert(table).values(values).returning(returning);
-            query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? { target: plan.target } : void 0) : query.onConflictDoUpdate({ target: plan.target, set: plan.set, setWhere: plan.setWhere });
+            const setWhere = withScope(scope, tableName, table, plan.setWhere);
+            query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? { target: plan.target } : void 0) : query.onConflictDoUpdate({ target: plan.target, set: plan.set, setWhere });
             return await query;
           };
           const result = nestedEntries ? await writeWithNestedOps({
@@ -5511,8 +5728,9 @@ var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onCo
             runtime: nested,
             tableName,
             entries: nestedEntries,
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: (tx, values) => runUpsert(tx, [values])
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: (tx, values) => runUpsert(tx, [values]),
+            context
           }) : await runUpsert(executor, input);
           if (single && !result[0]) {
             return void 0;
@@ -5527,7 +5745,7 @@ var generateUpsert2 = (db, tableName, table, tables, relationMap, baseType, onCo
     args: queryArgs
   };
 };
-var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filterArgs, fieldName, typeName, single, requireWhere, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filterArgs, fieldName, typeName, single, requireWhere, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     set: {
       type: new GraphQLNonNull7(setArgs)
@@ -5543,6 +5761,7 @@ var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filte
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where, set } = args;
+          const scope = policies?.scope?.(context);
           const parsedInfo = parseResolveInfo3(info, {
             deep: true
           });
@@ -5555,16 +5774,25 @@ var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filte
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const entry = nested?.enabled(tableName) ? nested.split(tableName, set) : void 0;
           const nestedOps = entry && nested.hasOps(entry.ops) ? entry.ops : void 0;
-          const input = remapUpdateInput(entry ? entry.columns : set, table, tableName);
+          const input = stripContextValues(
+            remapUpdateInput(entry ? entry.columns : set, table, tableName),
+            policies?.contextValues?.(tableName)
+          );
           if (!Object.keys(input).length && !nestedOps) {
             throw new GraphQLError8("Unable to update with no values specified!");
           }
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -5584,7 +5812,8 @@ var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filte
             columns: input,
             ops: nestedOps,
             remapValues: (values) => values,
-            write: runUpdate
+            write: runUpdate,
+            context
           }) : await runUpdate(executor, input);
           if (single && result.length > 1) {
             throw new GraphQLError8(`${fieldName}: 'where' matched more than one row!`);
@@ -5602,7 +5831,7 @@ var generateUpdate2 = (db, tableName, table, tables, relationMap, setArgs, filte
     args: queryArgs
   };
 };
-var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateManyInput, fieldName, typeName, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateManyInput, fieldName, typeName, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     updates: {
       type: new GraphQLNonNull7(new GraphQLList7(new GraphQLNonNull7(updateManyInput)))
@@ -5618,6 +5847,8 @@ var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateMany
           if (!updates.length) {
             throw new GraphQLError8("No updates were provided!");
           }
+          const scope = policies?.scope?.(context);
+          const contextColumns = policies?.contextValues?.(tableName);
           const parsedInfo = parseResolveInfo3(info, {
             deep: true
           });
@@ -5630,19 +5861,28 @@ var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateMany
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const entries = updates.map(({ where, set }) => {
             const split = nested?.enabled(tableName) ? nested.split(tableName, set) : void 0;
             const ops = split && nested.hasOps(split.ops) ? split.ops : void 0;
-            const input = remapUpdateInput(split ? split.columns : set, table, tableName);
+            const input = stripContextValues(
+              remapUpdateInput(split ? split.columns : set, table, tableName),
+              contextColumns
+            );
             if (!Object.keys(input).length && !ops) {
               throw new GraphQLError8("Unable to update with no values specified!");
             }
             return {
               set: input,
               ops,
-              filters: where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              filters: withScope(
+                scope,
+                tableName,
+                table,
+                where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              )
             };
           });
           const returning = entries.some((entry) => entry.ops) ? nested.withJoinColumns(
@@ -5656,7 +5896,7 @@ var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateMany
           const perEntry = await executor.transaction(async (tx) => {
             const results = [];
             for (const entry of entries) {
-              const values = entry.ops ? { ...entry.set, ...await nested.applyParentSide(tx, tableName, entry.ops) } : entry.set;
+              const values = entry.ops ? { ...entry.set, ...await nested.applyParentSide(tx, tableName, entry.ops, context) } : entry.set;
               const writes = Object.keys(values).length > 0;
               let query = writes ? tx.update(table).set(values) : tx.select(returning).from(table);
               if (entry.filters) {
@@ -5664,7 +5904,7 @@ var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateMany
               }
               const rows = await (writes ? query.returning(returning) : query);
               if (entry.ops) {
-                await nested.applyChildSide(tx, tableName, entry.ops, rows);
+                await nested.applyChildSide(tx, tableName, entry.ops, rows, context);
               }
               results.push(rows);
             }
@@ -5693,7 +5933,7 @@ var generateUpdateMany2 = (db, tableName, table, tables, relationMap, updateMany
     args: queryArgs
   };
 };
-var generateDelete2 = (db, tableName, table, filterArgs, fieldName, typeName, single, requireWhere, filterCtx, selectionCtx, txCtx) => {
+var generateDelete2 = (db, tableName, table, filterArgs, fieldName, typeName, single, requireWhere, filterCtx, selectionCtx, txCtx, policies) => {
   const queryArgs = {
     where: {
       type: single || requireWhere ? new GraphQLNonNull7(filterArgs) : filterArgs
@@ -5705,6 +5945,7 @@ var generateDelete2 = (db, tableName, table, filterArgs, fieldName, typeName, si
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where } = args;
+          const scope = policies?.scope?.(context);
           const parsedInfo = parseResolveInfo3(info, {
             deep: true
           });
@@ -5714,7 +5955,12 @@ var generateDelete2 = (db, tableName, table, filterArgs, fieldName, typeName, si
             selectionCtx
           );
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -5772,12 +6018,16 @@ function generateSchemaData2(db, schema, relations, options) {
   attachTargetPrimaryKeys(namedRelations, tables, pgPrimaryKeyPropNames);
   const eagerRelations = pruneNonEagerRelations(namedRelations, shouldEagerLoad);
   const filterCtx = { tables, relationMap: namedRelations };
+  const scopes = options.policies?.scope;
+  const contextValuesOf = options.policies?.contextValues;
+  const policies = bindPolicies(options.policies, filterCtx);
   const resolverFactory = createRelationResolverFactory(
     db,
     tables,
     "nulls-largest",
     filterCtx,
-    limits
+    limits,
+    scopes
   );
   const cacheCtx = {
     genericFilterCache: /* @__PURE__ */ new Map(),
@@ -5795,6 +6045,7 @@ function generateSchemaData2(db, schema, relations, options) {
     limits,
     docs: options.docs ?? {},
     primaryKeyOf: (name) => tables[name] ? pgPrimaryKeyPropNames(tables[name]) : [],
+    contextValuesOf,
     featureOf
   };
   const nestedPlans = features.nestedWrites ? buildNestedWritePlans(
@@ -5805,8 +6056,8 @@ function generateSchemaData2(db, schema, relations, options) {
     extractRelationJoinColumns
   ) : void 0;
   const nestedTypes = nestedPlans ? createNestedWriteTypes({ plans: nestedPlans, cacheCtx, typeNameMapper, insertPrefix: prefixes.insert }) : void 0;
-  const nestedRuntime = nestedPlans ? createNestedWriteRuntime({ plans: nestedPlans, filterCtx }) : void 0;
-  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
+  const nestedRuntime = nestedPlans ? createNestedWriteRuntime({ plans: nestedPlans, filterCtx, scopes, contextValues: contextValuesOf }) : void 0;
+  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx, scopes) : void 0;
   const queries = {};
   const mutations = {};
   const mutationTxCtx = createMutationTxCtx(options.transactions);
@@ -5866,7 +6117,8 @@ function generateSchemaData2(db, schema, relations, options) {
       typeNameMapper,
       filterCtx,
       tableFeatures.distinct,
-      limits
+      limits,
+      policies
     );
     const selectSingleGenerated = generateSelectSingle2(
       db,
@@ -5879,7 +6131,8 @@ function generateSchemaData2(db, schema, relations, options) {
       typeName,
       typeNameMapper,
       filterCtx,
-      limits
+      limits,
+      policies
     );
     const insertArrGenerated = tableFeatures.insert ? generateInsertArray2(
       db,
@@ -5894,7 +6147,8 @@ function generateSchemaData2(db, schema, relations, options) {
       conflictDoNothing,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const insertSingleGenerated = tableFeatures.insert ? generateInsertSingle2(
       db,
@@ -5909,7 +6163,8 @@ function generateSchemaData2(db, schema, relations, options) {
       conflictDoNothing,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const uniqueSets = tableFeatures.upsert ? getUniqueColumnSets(schema[tableName], getTableConfig2) : [];
     const onConflictInput = tableFeatures.upsert ? generateOnConflictInput({
@@ -5935,7 +6190,8 @@ function generateSchemaData2(db, schema, relations, options) {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const upsertSingleGenerated = onConflictInput ? generateUpsert2(
       db,
@@ -5953,7 +6209,8 @@ function generateSchemaData2(db, schema, relations, options) {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateGenerated = tableFeatures.update ? generateUpdate2(
       db,
@@ -5971,7 +6228,8 @@ function generateSchemaData2(db, schema, relations, options) {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateSingleGenerated = tableFeatures.update ? generateUpdate2(
       db,
@@ -5989,7 +6247,8 @@ function generateSchemaData2(db, schema, relations, options) {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateManyInput = tableFeatures.update && tableFeatures.updateMany ? generateUpdateManyInput({ typeName, updatePrefix: prefixes.update, updateInput, tableFilters }) : void 0;
     const updateManyGenerated = updateManyInput ? generateUpdateMany2(
@@ -6005,7 +6264,8 @@ function generateSchemaData2(db, schema, relations, options) {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const deleteGenerated = tableFeatures.delete ? generateDelete2(
       db,
@@ -6018,7 +6278,8 @@ function generateSchemaData2(db, schema, relations, options) {
       tableFeatures.requireWhere,
       filterCtx,
       { tableName, relationMap: namedRelations, tables },
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const deleteSingleGenerated = tableFeatures.delete ? generateDelete2(
       db,
@@ -6031,7 +6292,8 @@ function generateSchemaData2(db, schema, relations, options) {
       tableFeatures.requireWhere,
       filterCtx,
       { tableName, relationMap: namedRelations, tables },
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateCountGenerated = tableFeatures.update && tableFeatures.countMutations ? generateWriteCount({
       db,
@@ -6065,7 +6327,8 @@ function generateSchemaData2(db, schema, relations, options) {
       typeName,
       aggregateFieldName,
       tableFilters,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     const groupByType = tableFeatures.aggregates && tableFeatures.groupBy ? generateGroupByType(schema[tableName], tableName, typeName, cacheCtx) : void 0;
     const groupByEnum = groupByType ? generateGroupByEnum(schema[tableName], tableName, typeName) : void 0;
@@ -6079,7 +6342,8 @@ function generateSchemaData2(db, schema, relations, options) {
       tableFilters,
       groupByEnum,
       havingInput,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
@@ -6286,7 +6550,7 @@ import {
   GraphQLNonNull as GraphQLNonNull8
 } from "graphql";
 import { parseResolveInfo as parseResolveInfo4 } from "graphql-parse-resolve-info";
-var generateSelectArray3 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits) => {
+var generateSelectArray3 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, distinctEnabled = true, limits, policies) => {
   const queryBase = db.query[tableName];
   if (!queryBase) {
     throw new Error(
@@ -6323,6 +6587,7 @@ var generateSelectArray3 = (db, tableName, tables, relationMap, orderArgs, filte
           limits,
           pkNames,
           db: executor,
+          scope: policies?.scope?.(context),
           // SQLite sorts NULLs as the smallest values (first in ASC).
           nullOrdering: "nulls-smallest"
         });
@@ -6333,7 +6598,7 @@ var generateSelectArray3 = (db, tableName, tables, relationMap, orderArgs, filte
     args: queryArgs
   };
 };
-var generateSelectSingle3 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits) => {
+var generateSelectSingle3 = (db, tableName, tables, relationMap, orderArgs, filterArgs, fieldName, typeName, typeNameMapper, filterCtx, limits, policies) => {
   const queryBase = db.query[tableName];
   if (!queryBase) {
     throw new Error(
@@ -6363,7 +6628,8 @@ var generateSelectSingle3 = (db, tableName, tables, relationMap, orderArgs, filt
           filterCtx,
           limits,
           pkNames,
-          db: executor
+          db: executor,
+          scope: policies?.scope?.(context)
         });
       } catch (e) {
         throw toGraphQLError(e);
@@ -6373,7 +6639,7 @@ var generateSelectSingle3 = (db, tableName, tables, relationMap, orderArgs, filt
   };
 };
 var sqlitePrimaryKeyPropNames = (table) => getPrimaryKeyPropNamesFromConfig(table, getTableConfig3);
-var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits) => {
+var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull8(new GraphQLList8(new GraphQLNonNull8(baseType)))
@@ -6390,7 +6656,13 @@ var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType,
           }
           const entries = nested?.enabled(tableName) ? args.values.map((values) => nested.split(tableName, values)) : void 0;
           const nestedEntries = entries?.some((entry) => nested.hasOps(entry.ops)) ? entries : void 0;
-          const input = nestedEntries ? [] : remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : args.values, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntries ? [] : applyContextValuesAll(
+            remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : args.values, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo4(info, {
             deep: true
           });
@@ -6403,7 +6675,8 @@ var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType,
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntries ? nested.withJoinColumns(tableName, mergedOps(nestedEntries), { ...columns }, table) : columns;
           const runInsert = async (target, values) => {
@@ -6418,8 +6691,9 @@ var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType,
             runtime: nested,
             tableName,
             entries: nestedEntries,
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: (tx, values) => runInsert(tx, [values])
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: (tx, values) => runInsert(tx, [values]),
+            context
           }) : await runInsert(executor, input);
           const enriched = hasRelations ? await eagerLoadMutationRelations(executor, tableName, result, pkNames, withParams) : result;
           return remapToGraphQLArrayOutput(enriched, tableName, table, relationMap);
@@ -6431,7 +6705,7 @@ var generateInsertArray3 = (db, tableName, table, tables, relationMap, baseType,
     args: queryArgs
   };
 };
-var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits) => {
+var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType, fieldName, typeName, typeNameMapper, conflictDoNothing = false, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: new GraphQLNonNull8(baseType)
@@ -6445,7 +6719,13 @@ var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const entry = nested?.enabled(tableName) ? nested.split(tableName, args.values) : void 0;
           const nestedEntry = entry && nested.hasOps(entry.ops) ? entry : void 0;
-          const input = nestedEntry ? {} : remapFromGraphQLSingleInput(entry ? entry.columns : args.values, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntry ? {} : applyContextValues(
+            remapFromGraphQLSingleInput(entry ? entry.columns : args.values, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo4(info, {
             deep: true
           });
@@ -6458,7 +6738,8 @@ var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntry ? nested.withJoinColumns(tableName, nestedEntry.ops, { ...columns }, table) : columns;
           const runInsert = async (target, values) => {
@@ -6473,8 +6754,9 @@ var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType
             runtime: nested,
             tableName,
             entries: [nestedEntry],
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: runInsert
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: runInsert,
+            context
           }) : await runInsert(executor, input);
           if (!result[0]) {
             if (!conflictDoNothing) {
@@ -6492,7 +6774,7 @@ var generateInsertSingle3 = (db, tableName, table, tables, relationMap, baseType
     args: queryArgs
   };
 };
-var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onConflictType, uniqueSets, fieldName, typeName, single, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onConflictType, uniqueSets, fieldName, typeName, single, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     values: {
       type: single ? new GraphQLNonNull8(baseType) : new GraphQLNonNull8(new GraphQLList8(new GraphQLNonNull8(baseType)))
@@ -6514,7 +6796,13 @@ var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onCo
           }
           const entries = nested?.enabled(tableName) ? supplied.map((values) => nested.split(tableName, values)) : void 0;
           const nestedEntries = entries?.some((entry) => nested.hasOps(entry.ops)) ? entries : void 0;
-          const input = nestedEntries ? [] : remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : supplied, table);
+          const contextColumns = policies?.contextValues?.(tableName);
+          const scope = policies?.scope?.(context);
+          const input = nestedEntries ? [] : applyContextValuesAll(
+            remapFromGraphQLArrayInput(entries ? entries.map((entry) => entry.columns) : supplied, table),
+            contextColumns,
+            context
+          );
           const parsedInfo = parseResolveInfo4(info, { deep: true });
           const { columns, hasRelations, withParams } = prepareMutationRelationColumns({
             relationMap,
@@ -6525,7 +6813,8 @@ var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onCo
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const returning = nestedEntries ? nested.withJoinColumns(tableName, mergedOps(nestedEntries), { ...columns }, table) : columns;
           const runUpsert = async (target, values) => {
@@ -6540,7 +6829,8 @@ var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onCo
               buildWhere: (where) => extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName))
             });
             let query = target.insert(table).values(values).returning(returning);
-            query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? { target: plan.target } : void 0) : query.onConflictDoUpdate({ target: plan.target, set: plan.set, setWhere: plan.setWhere });
+            const setWhere = withScope(scope, tableName, table, plan.setWhere);
+            query = plan.action === "NOTHING" ? query.onConflictDoNothing(plan.target ? { target: plan.target } : void 0) : query.onConflictDoUpdate({ target: plan.target, set: plan.set, setWhere });
             return await query;
           };
           const result = nestedEntries ? await writeWithNestedOps({
@@ -6548,8 +6838,9 @@ var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onCo
             runtime: nested,
             tableName,
             entries: nestedEntries,
-            remapValues: (values) => remapFromGraphQLSingleInput(values, table),
-            write: (tx, values) => runUpsert(tx, [values])
+            remapValues: (values) => applyContextValues(remapFromGraphQLSingleInput(values, table), contextColumns, context),
+            write: (tx, values) => runUpsert(tx, [values]),
+            context
           }) : await runUpsert(executor, input);
           if (single && !result[0]) {
             return void 0;
@@ -6564,7 +6855,7 @@ var generateUpsert3 = (db, tableName, table, tables, relationMap, baseType, onCo
     args: queryArgs
   };
 };
-var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filterArgs, fieldName, typeName, single, requireWhere, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filterArgs, fieldName, typeName, single, requireWhere, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     set: {
       type: new GraphQLNonNull8(setArgs)
@@ -6580,6 +6871,7 @@ var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filte
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where, set } = args;
+          const scope = policies?.scope?.(context);
           const parsedInfo = parseResolveInfo4(info, {
             deep: true
           });
@@ -6592,16 +6884,25 @@ var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filte
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const entry = nested?.enabled(tableName) ? nested.split(tableName, set) : void 0;
           const nestedOps = entry && nested.hasOps(entry.ops) ? entry.ops : void 0;
-          const input = remapUpdateInput(entry ? entry.columns : set, table, tableName);
+          const input = stripContextValues(
+            remapUpdateInput(entry ? entry.columns : set, table, tableName),
+            policies?.contextValues?.(tableName)
+          );
           if (!Object.keys(input).length && !nestedOps) {
             throw new GraphQLError9("Unable to update with no values specified!");
           }
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -6621,7 +6922,8 @@ var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filte
             columns: input,
             ops: nestedOps,
             remapValues: (values) => values,
-            write: runUpdate
+            write: runUpdate,
+            context
           }) : await runUpdate(executor, input);
           if (single && result.length > 1) {
             throw new GraphQLError9(`${fieldName}: 'where' matched more than one row!`);
@@ -6639,7 +6941,7 @@ var generateUpdate3 = (db, tableName, table, tables, relationMap, setArgs, filte
     args: queryArgs
   };
 };
-var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateManyInput, fieldName, typeName, typeNameMapper, filterCtx, txCtx, nested, limits) => {
+var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateManyInput, fieldName, typeName, typeNameMapper, filterCtx, txCtx, nested, limits, policies) => {
   const queryArgs = {
     updates: {
       type: new GraphQLNonNull8(new GraphQLList8(new GraphQLNonNull8(updateManyInput)))
@@ -6655,6 +6957,8 @@ var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateMany
           if (!updates.length) {
             throw new GraphQLError9("No updates were provided!");
           }
+          const scope = policies?.scope?.(context);
+          const contextColumns = policies?.contextValues?.(tableName);
           const parsedInfo = parseResolveInfo4(info, {
             deep: true
           });
@@ -6667,19 +6971,28 @@ var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateMany
             table,
             pkNames,
             parsedInfo,
-            limits
+            limits,
+            scope
           });
           const entries = updates.map(({ where, set }) => {
             const split = nested?.enabled(tableName) ? nested.split(tableName, set) : void 0;
             const ops = split && nested.hasOps(split.ops) ? split.ops : void 0;
-            const input = remapUpdateInput(split ? split.columns : set, table, tableName);
+            const input = stripContextValues(
+              remapUpdateInput(split ? split.columns : set, table, tableName),
+              contextColumns
+            );
             if (!Object.keys(input).length && !ops) {
               throw new GraphQLError9("Unable to update with no values specified!");
             }
             return {
               set: input,
               ops,
-              filters: where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              filters: withScope(
+                scope,
+                tableName,
+                table,
+                where ? extractFilters(table, tableName, where, relationFilterCtx(filterCtx, tableName)) : void 0
+              )
             };
           });
           const anyNested = entries.some((entry) => entry.ops);
@@ -6697,7 +7010,7 @@ var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateMany
             return query.returning(returning).all();
           };
           const runNestedEntry = async (tx, entry) => {
-            const values = entry.ops ? { ...entry.set, ...await nested.applyParentSide(tx, tableName, entry.ops) } : entry.set;
+            const values = entry.ops ? { ...entry.set, ...await nested.applyParentSide(tx, tableName, entry.ops, context) } : entry.set;
             const writes = Object.keys(values).length > 0;
             let query = writes ? tx.update(table).set(values) : tx.select(returning).from(table);
             if (entry.filters) {
@@ -6705,7 +7018,7 @@ var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateMany
             }
             const rows = await (writes ? query.returning(returning) : query);
             if (entry.ops) {
-              await nested.applyChildSide(tx, tableName, entry.ops, rows);
+              await nested.applyChildSide(tx, tableName, entry.ops, rows, context);
             }
             return rows;
           };
@@ -6758,7 +7071,7 @@ var generateUpdateMany3 = (db, tableName, table, tables, relationMap, updateMany
     args: queryArgs
   };
 };
-var generateDelete3 = (db, tableName, table, filterArgs, fieldName, typeName, single, requireWhere, filterCtx, selectionCtx, txCtx) => {
+var generateDelete3 = (db, tableName, table, filterArgs, fieldName, typeName, single, requireWhere, filterCtx, selectionCtx, txCtx, policies) => {
   const queryArgs = {
     where: {
       type: single || requireWhere ? new GraphQLNonNull8(filterArgs) : filterArgs
@@ -6770,6 +7083,7 @@ var generateDelete3 = (db, tableName, table, filterArgs, fieldName, typeName, si
       try {
         return await runMutation(db, context, info, txCtx, async (executor) => {
           const { where } = args;
+          const scope = policies?.scope?.(context);
           const parsedInfo = parseResolveInfo4(info, {
             deep: true
           });
@@ -6779,7 +7093,12 @@ var generateDelete3 = (db, tableName, table, filterArgs, fieldName, typeName, si
             selectionCtx
           );
           const relationCtx = relationFilterCtx(filterCtx, tableName);
-          const filters = single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0;
+          const filters = withScope(
+            scope,
+            tableName,
+            table,
+            single || requireWhere ? extractRequiredFilters(table, tableName, where, fieldName, relationCtx) : where ? extractFilters(table, tableName, where, relationCtx) : void 0
+          );
           if (single) {
             await assertSingleMatch(executor, table, filters, fieldName);
           }
@@ -6838,12 +7157,16 @@ var generateSchemaData3 = (db, schema, relations, options) => {
   attachTargetPrimaryKeys(namedRelations, tables, sqlitePrimaryKeyPropNames);
   const eagerRelations = pruneNonEagerRelations(namedRelations, shouldEagerLoad);
   const filterCtx = { tables, relationMap: namedRelations };
+  const scopes = options.policies?.scope;
+  const contextValuesOf = options.policies?.contextValues;
+  const policies = bindPolicies(options.policies, filterCtx);
   const resolverFactory = createRelationResolverFactory(
     db,
     tables,
     "nulls-smallest",
     filterCtx,
-    limits
+    limits,
+    scopes
   );
   const cacheCtx = {
     genericFilterCache: /* @__PURE__ */ new Map(),
@@ -6861,6 +7184,7 @@ var generateSchemaData3 = (db, schema, relations, options) => {
     limits,
     docs: options.docs ?? {},
     primaryKeyOf: (name) => tables[name] ? sqlitePrimaryKeyPropNames(tables[name]) : [],
+    contextValuesOf,
     featureOf
   };
   if (features.nestedWrites && db.resultKind === "sync") {
@@ -6876,8 +7200,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
     extractRelationJoinColumns
   ) : void 0;
   const nestedTypes = nestedPlans ? createNestedWriteTypes({ plans: nestedPlans, cacheCtx, typeNameMapper, insertPrefix: prefixes.insert }) : void 0;
-  const nestedRuntime = nestedPlans ? createNestedWriteRuntime({ plans: nestedPlans, filterCtx }) : void 0;
-  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx) : void 0;
+  const nestedRuntime = nestedPlans ? createNestedWriteRuntime({ plans: nestedPlans, filterCtx, scopes, contextValues: contextValuesOf }) : void 0;
+  const relationAggregateFactory = anyTable("relationAggregates") ? createRelationAggregateFactory(db, tables, cacheCtx, typeNameMapper, filterCtx, scopes) : void 0;
   const queries = {};
   const mutations = {};
   if (options.transactions && db.resultKind === "sync") {
@@ -6942,7 +7266,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       typeNameMapper,
       filterCtx,
       tableFeatures.distinct,
-      limits
+      limits,
+      policies
     );
     const selectSingleGenerated = generateSelectSingle3(
       db,
@@ -6955,7 +7280,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       typeName,
       typeNameMapper,
       filterCtx,
-      limits
+      limits,
+      policies
     );
     const insertArrGenerated = tableFeatures.insert ? generateInsertArray3(
       db,
@@ -6970,7 +7296,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       conflictDoNothing,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const insertSingleGenerated = tableFeatures.insert ? generateInsertSingle3(
       db,
@@ -6985,7 +7312,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       conflictDoNothing,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const uniqueSets = tableFeatures.upsert ? getUniqueColumnSets(schema[tableName], getTableConfig3) : [];
     const onConflictInput = tableFeatures.upsert ? generateOnConflictInput({
@@ -7011,7 +7339,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const upsertSingleGenerated = onConflictInput ? generateUpsert3(
       db,
@@ -7029,7 +7358,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateGenerated = tableFeatures.update ? generateUpdate3(
       db,
@@ -7047,7 +7377,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateSingleGenerated = tableFeatures.update ? generateUpdate3(
       db,
@@ -7065,7 +7396,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const updateManyInput = tableFeatures.update && tableFeatures.updateMany ? generateUpdateManyInput({ typeName, updatePrefix: prefixes.update, updateInput, tableFilters }) : void 0;
     const updateManyGenerated = updateManyInput ? generateUpdateMany3(
@@ -7081,7 +7413,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       filterCtx,
       mutationTxCtx,
       nestedRuntime,
-      limits
+      limits,
+      policies
     ) : void 0;
     const deleteGenerated = tableFeatures.delete ? generateDelete3(
       db,
@@ -7094,7 +7427,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       tableFeatures.requireWhere,
       filterCtx,
       { tableName, relationMap: namedRelations, tables },
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const deleteSingleGenerated = tableFeatures.delete ? generateDelete3(
       db,
@@ -7107,7 +7441,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       tableFeatures.requireWhere,
       filterCtx,
       { tableName, relationMap: namedRelations, tables },
-      mutationTxCtx
+      mutationTxCtx,
+      policies
     ) : void 0;
     const updateCountGenerated = tableFeatures.update && tableFeatures.countMutations ? generateWriteCount({
       db,
@@ -7141,7 +7476,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       typeName,
       aggregateFieldName,
       tableFilters,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     const groupByType = tableFeatures.aggregates && tableFeatures.groupBy ? generateGroupByType(schema[tableName], tableName, typeName, cacheCtx) : void 0;
     const groupByEnum = groupByType ? generateGroupByEnum(schema[tableName], tableName, typeName) : void 0;
@@ -7155,7 +7491,8 @@ var generateSchemaData3 = (db, schema, relations, options) => {
       tableFilters,
       groupByEnum,
       havingInput,
-      filterCtx
+      filterCtx,
+      scopes
     ) : void 0;
     queries[selectArrGenerated.name] = {
       type: selectArrOutput,
@@ -7547,6 +7884,43 @@ var buildSchema = (db, config) => {
     limitPolicyCache.set(tableName, resolved);
     return resolved;
   } : void 0;
+  const scopeConfig = config?.scope;
+  const contextValuesConfig = config?.contextValues;
+  if (scopeConfig || contextValuesConfig) {
+    const tableNames = new Set(tableKeys);
+    for (const [tableName, hook] of Object.entries(scopeConfig ?? {})) {
+      if (!tableNames.has(tableName)) {
+        throw new Error(
+          `Drizzle-GraphQL Error: config.scope names '${tableName}', which is not a table in the Drizzle schema.`
+        );
+      }
+      if (typeof hook !== "function") {
+        throw new Error(`Drizzle-GraphQL Error: config.scope.${tableName} must be a function.`);
+      }
+    }
+    for (const [tableName, columnHooks] of Object.entries(contextValuesConfig ?? {})) {
+      if (!tableNames.has(tableName)) {
+        throw new Error(
+          `Drizzle-GraphQL Error: config.contextValues names '${tableName}', which is not a table in the Drizzle schema.`
+        );
+      }
+      const columns = getColumns6(schema[tableName]);
+      for (const [columnName, hook] of Object.entries(columnHooks)) {
+        if (!columns[columnName]) {
+          throw new Error(
+            `Drizzle-GraphQL Error: config.contextValues names '${tableName}.${columnName}', which is not a column of that table.`
+          );
+        }
+        if (typeof hook !== "function") {
+          throw new Error(`Drizzle-GraphQL Error: config.contextValues.${tableName}.${columnName} must be a function.`);
+        }
+      }
+    }
+  }
+  const policies = scopeConfig || contextValuesConfig ? {
+    scope: scopeConfig ? (tableName) => scopeConfig[tableName] : void 0,
+    contextValues: contextValuesConfig ? (tableName) => contextValuesConfig[tableName] : void 0
+  } : void 0;
   const exclude = config?.exclude;
   if (exclude) {
     const tableNames = new Set(tableKeys);
@@ -7664,6 +8038,7 @@ var buildSchema = (db, config) => {
     enumNameMapper: config?.enumNameMapper,
     transactions,
     limits,
+    policies,
     exclude,
     docs: {
       describeColumn: config?.describeColumn,