@vantreeseba/drizzle-graphql 7.5.0 → 7.7.0

package/dist/index.d.cts

@@ -251,7 +251,7 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor, policies?: TablePolicies) => RelationResolverFactory;
 /** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
 type ResolvedLimitPolicy = {
     defaultLimit: number | undefined;
@@ -307,6 +307,60 @@ interface RelationFilterContext {
  */
 type RelationFilterBase = Pick<RelationFilterContext, 'tables' | 'relationMap'>;
 declare const extractFilters: <TTable extends Table>(table: TTable, tableName: string, filters: Filters<TTable>, relationCtx?: RelationFilterContext) => SQL | undefined;
+/**
+ * A table's row-level scope: the predicate every generated read, update and delete on that
+ * table is narrowed by. See `BuildSchemaConfig.scope`.
+ *
+ * `table` is the table the predicate must be built against. On the relational-query path
+ * drizzle hands its callbacks an *aliased* proxy (`d0`, `d1`, …), so a predicate built from
+ * the imported schema table would reference a name that isn't in the query — always build
+ * from the argument. Returning a filter object instead (the same shape as the field's
+ * `where`) sidesteps aliasing entirely, and is the only form that can reach through a
+ * relation — which is what ownership through a join table needs.
+ */
+type ScopeHook<TContext = any> = (context: TContext, table: any) => SQL | Record<string, any> | undefined | null;
+/** Build-time lookup: the scope configured for a table, if any. */
+type ScopeFor = (tableName: string) => ScopeHook | undefined;
+/**
+ * One table's soft-delete convention, resolved against the real column at build time.
+ *
+ * `nullable` picks the shape of the predicate. A nullable column marks a row deleted by
+ * holding a value at all (`deletedAt IS NOT NULL`), which is the common timestamp form; a
+ * non-nullable one marks it by holding `marker` (`isDeleted = true`), so the column has to
+ * have a constant that means "deleted" and another that means "not deleted".
+ */
+type SoftDeleteInfo = {
+    /** Property name of the column on the drizzle table — also the key on an aliased proxy. */
+    columnName: string;
+    column: Column;
+    nullable: boolean;
+    /** Evaluated per delete, so a timestamp form stamps the moment of the delete. */
+    writeDeleted: () => any;
+    /** Written by the restore mutation. */
+    writeRestored: any;
+    /** Non-nullable form only: the constant that means "this row is deleted". */
+    marker?: any;
+};
+/** Build-time lookup: the soft-delete convention of a table, if it declares one. */
+type SoftDeleteFor = (tableName: string) => SoftDeleteInfo | undefined;
+/** Produces one column's value from the GraphQL context. See `BuildSchemaConfig.contextValues`. */
+type ContextValueHook<TContext = any> = (context: TContext) => any;
+/** Build-time lookup: the context-derived columns of a table, keyed by column property name. */
+type ContextValuesFor = (tableName: string) => Record<string, ContextValueHook> | undefined;
+/**
+ * The two request-time policies a generated resolver applies, passed to the dialect
+ * generators as one value so a table's read scope and its server-owned columns travel
+ * together. Both stay `undefined` when nothing is configured, and every call site checks
+ * before doing any work — an unconfigured build generates exactly the SQL it did before.
+ */
+type TablePolicies = {
+    /** See `BuildSchemaConfig.scope`. */
+    scope?: ScopeFor;
+    /** See `BuildSchemaConfig.contextValues`. */
+    contextValues?: ContextValuesFor;
+    /** See `BuildSchemaConfig.softDelete`. */
+    softDelete?: SoftDeleteFor;
+};
 /**
  * Where a dialect's default sort places NULLs relative to non-NULL values:
  * - `nulls-largest` — PostgreSQL: NULLs sort as the largest values (last in ASC, first in DESC).
@@ -821,6 +875,59 @@ type LimitsConfig = TableLimitPolicy & {
     /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
     tables?: Record<string, TableLimitPolicy>;
 };
+/**
+ * What a {@link RowScope} may return: a Drizzle `SQL` expression, a filter object in the same
+ * shape as the generated `where` argument, or `undefined`/`null` for "no restriction".
+ *
+ * The filter-object form is compiled with the same code that compiles a client `where`, so it
+ * supports relation filters — `{ author: { orgId: { eq: 1 } } }` scopes a table through a join
+ * rather than a column it owns.
+ */
+type RowScopeFilter = Record<string, any> | undefined | null;
+/**
+ * A per-table row scope: given the GraphQL context, the predicate every read and write of that
+ * table is confined to.
+ *
+ * `table` is the table instance the current statement runs against. For a relational read that
+ * is Drizzle's *aliased* copy of the table, so build the predicate from this argument rather
+ * than from the imported table object — `eq(table.orgId, ctx.orgId)` is always correct, while
+ * `eq(users.orgId, ctx.orgId)` refers to the wrong alias inside a nested read.
+ *
+ * See {@link BuildSchemaConfig.scope}.
+ */
+type RowScope<TContext = any> = (context: TContext, table: any) => RowScopeFilter | object;
+/** {@link BuildSchemaConfig.scope} — a row scope per table, keyed by the Drizzle schema key. */
+type ScopeConfig<TContext = any> = Record<string, RowScope<TContext>>;
+/**
+ * {@link BuildSchemaConfig.contextValues} — columns whose value the server derives from the
+ * request context, keyed by Drizzle schema key and then by column property name.
+ */
+type ContextValuesConfig<TContext = any> = Record<string, Record<string, (context: TContext) => any>>;
+/**
+ * How one table marks a row deleted: the column's property name, or that name plus the values
+ * written on delete and on restore. See {@link BuildSchemaConfig.softDelete}.
+ */
+type SoftDeleteColumn = string | {
+    /** Property name of the column that marks a row deleted. */
+    column: string;
+    /**
+     * Written when a row is deleted. A function is evaluated per delete. Defaults by column
+     * type: `new Date()` for a timestamp, an ISO string for text, `Date.now()` for a number,
+     * `true` for a boolean. Required, as a constant, when the column is NOT NULL and not a
+     * boolean — the predicate that hides marked rows has to compare against it.
+     */
+    deletedValue?: any;
+    /**
+     * Written when a row is restored. Defaults to `null` for a nullable column and `false`
+     * for a NOT NULL boolean; required for any other NOT NULL column.
+     */
+    restoredValue?: any;
+};
+/**
+ * Per-table soft-delete declarations, either keyed by Drizzle schema key or as a rule applied
+ * to every table. See {@link BuildSchemaConfig.softDelete}.
+ */
+type SoftDeleteConfig = Record<string, SoftDeleteColumn> | ((table: any, tableName: string) => SoftDeleteColumn | undefined | null);
 /**
  * {@link BuildSchemaConfig.exclude} — tables and columns to keep out of the generated schema.
  *
@@ -879,6 +986,11 @@ type BuildSchemaConfig = {
         update?: string;
         /** Prefix for upsert mutations (e.g., 'users' -> 'upsertUsers') */
         upsert?: string;
+        /**
+         * Prefix for the restore mutations of a soft-deleting table (e.g., 'users' ->
+         * 'restoreUsers'). Only used when {@link BuildSchemaConfig.softDelete} names the table.
+         */
+        restore?: string;
     };
     /**
      * Customizes query name suffixes for generated GraphQL operations.
@@ -1049,6 +1161,110 @@ type BuildSchemaConfig = {
      *   agree.
      */
     limits?: LimitsConfig;
+    /**
+     * Row-level scoping: a predicate, derived from the GraphQL context, that every read and
+     * write of a table is confined to. This is the multi-tenancy / ownership knob — the one
+     * rule a wrapper cannot enforce from outside, because a nested relation field never passes
+     * through a root resolver.
+     *
+     * ```ts
+     * import { and, eq } from 'drizzle-orm';
+     *
+     * buildSchema(db, {
+     *   scope: {
+     *     posts: (ctx, table) => eq(table.orgId, ctx.orgId),
+     *     // A filter object works too, and can scope through a relation:
+     *     comments: (ctx) => ({ post: { orgId: { eq: ctx.orgId } } }),
+     *   },
+     * });
+     * ```
+     *
+     * - The predicate is ANDed on **last**, after the client's `where`, so a client filter can
+     *   only ever narrow the scope, never widen it.
+     * - It applies to every path that reads the table: list and single queries, aggregates and
+     *   `groupBy`, relation fields (batched and eager), relation aggregates, and cursor pages.
+     * - It applies to every path that writes it: `update`, `updateMany`, `delete`, the
+     *   conflict-update half of an upsert (PostgreSQL and SQLite), and the rows a nested
+     *   `connect` / `disconnect` / `set` is allowed to reach. An out-of-scope row is simply not
+     *   matched — a scoped `delete` reports zero rows rather than refusing.
+     * - It cannot apply to a plain `insert`: there is no existing row to filter. Use
+     *   {@link BuildSchemaConfig.contextValues} to stamp the owning column on the way in.
+     * - `table` is the table the current statement runs against, which for a relational read is
+     *   Drizzle's aliased copy — always build the predicate from that argument.
+     * - Returning `undefined` means "no restriction for this context", so a hook can let an
+     *   admin through. A table with no entry is unscoped.
+     * - MySQL's `ON DUPLICATE KEY UPDATE` takes no predicate, so a MySQL upsert cannot be
+     *   scoped on the conflict path; scope the table's `update` and rely on `contextValues`
+     *   for the insert half.
+     */
+    scope?: ScopeConfig;
+    /**
+     * Columns whose value the server derives from the request context rather than accepting
+     * from the client — the write-side half of {@link BuildSchemaConfig.scope}.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   contextValues: {
+     *     posts: {
+     *       orgId: (ctx) => ctx.orgId,
+     *       authorId: (ctx) => ctx.userId,
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - The column is removed from the generated insert and update inputs, so a client cannot
+     *   send it at all — the schema itself documents that it is server-owned.
+     * - Every insert stamps it, including the rows created by a nested `create`.
+     * - Updates never write it: an update cannot hand a row to another owner.
+     * - Keyed by the Drizzle schema key, then by the column's property name (not its database
+     *   name), the same keying {@link BuildSchemaConfig.exclude} uses.
+     */
+    contextValues?: ContextValuesConfig;
+    /**
+     * Tables that mark rows deleted instead of removing them.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   softDelete: {
+     *     users: 'deletedAt',                          // nullable timestamp: stamped on delete
+     *     posts: { column: 'isDeleted', deletedValue: true, restoredValue: false },
+     *   },
+     * });
+     *
+     * // or as a convention across the whole schema:
+     * buildSchema(db, { softDelete: (table) => ('deletedAt' in table ? 'deletedAt' : undefined) });
+     * ```
+     *
+     * For a table that declares one:
+     *
+     * - `delete<Table>` and `delete<Table>Single` issue an `UPDATE` of the marker column
+     *   instead of a `DELETE`, and return the rows as they now stand.
+     * - `restore<Table>` and `restore<Table>Single` are generated alongside them, matching only
+     *   marked rows and writing the restored value. The prefix is configurable through
+     *   {@link BuildSchemaConfig.prefixes}.
+     * - Every generated read hides marked rows: list and single queries, aggregates, `groupBy`,
+     *   relation fields on both the eager and the batched path, and relation aggregates. Each
+     *   of those fields takes a `deleted: EXCLUDE | INCLUDE | ONLY` argument (default
+     *   `EXCLUDE`); `ONLY` is a trash view.
+     * - Every generated write skips them too: an `update`, a `delete`, or a nested `connect`
+     *   cannot reach a row that is already marked.
+     * - The marker column is removed from the create and update inputs, so the only ways to set
+     *   or clear it are the delete and restore mutations.
+     * - The predicate is ANDed on before {@link BuildSchemaConfig.scope}, and both are ANDed
+     *   after the client's `where` — a request can only ever narrow them.
+     *
+     * Two consequences of the pattern itself, which this does not paper over:
+     *
+     * - A marked row still occupies its unique keys, so inserting a row that reuses the natural
+     *   key of a deleted one still fails on the constraint.
+     * - An upsert whose conflict target hits a marked row updates nothing on PostgreSQL and
+     *   SQLite (the conflict predicate excludes it) but revives it on MySQL, whose
+     *   `ON DUPLICATE KEY UPDATE` takes no predicate.
+     *
+     * Marking a parent deleted does not mark its children — a cascade is a schema decision.
+     */
+    softDelete?: SoftDeleteConfig;
     /**
      * Tables and columns to leave out of the generated schema entirely.
      *
@@ -1337,7 +1553,7 @@ type DrizzleFieldKind = 'query' | 'mutation' | 'relation' | 'aggregate' | 'type'
  * What the field does. Arity is carried separately by `single`, so `select` covers both
  * the list query and its `…Single` sibling rather than being spelled twice.
  */
-type DrizzleFieldOperation = 'select' | 'insert' | 'update' | 'updateMany' | 'upsert' | 'delete' | 'aggregate' | 'groupBy' | 'relation' | 'relationAggregate';
+type DrizzleFieldOperation = 'select' | 'insert' | 'update' | 'updateMany' | 'upsert' | 'delete' | 'restore' | 'aggregate' | 'groupBy' | 'relation' | 'relationAggregate';
 /** The argument holding the rows a field is about, when it has one. */
 type DrizzleTargetArg = 'where' | 'values' | 'updates';
 /** `extensions.drizzle` on a generated field. */
@@ -1511,4 +1727,4 @@ declare const resolveSelection: (info: GraphQLResolveInfo | ResolveTree, options
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type DrizzleExtension, type DrizzleFieldExtension, type DrizzleFieldKind, type DrizzleFieldOperation, type DrizzleTargetArg, type DrizzleTypeExtension, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type FeatureSwitch, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type IdentifiedRows, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ResolveSelectionOptions, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type SelectionOptions, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, drizzleExtension, extractFilters, extractOrderBy, extractRelationJoinColumns, identifyRows, isDrizzleFieldExtension, resolveSelection, selectionToWith, singularizeMapper };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type ContextValuesConfig, type DeleteResolver, type DeleteSingleResolver, type DrizzleExtension, type DrizzleFieldExtension, type DrizzleFieldKind, type DrizzleFieldOperation, type DrizzleTargetArg, type DrizzleTypeExtension, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type FeatureSwitch, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type IdentifiedRows, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ResolveSelectionOptions, type RowScope, type RowScopeFilter, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type ScopeConfig, type SelectResolver, type SelectSingleResolver, type SelectionOptions, type SoftDeleteColumn, type SoftDeleteConfig, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, drizzleExtension, extractFilters, extractOrderBy, extractRelationJoinColumns, identifyRows, isDrizzleFieldExtension, resolveSelection, selectionToWith, singularizeMapper };

package/dist/index.d.ts

@@ -251,7 +251,7 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor, policies?: TablePolicies) => RelationResolverFactory;
 /** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
 type ResolvedLimitPolicy = {
     defaultLimit: number | undefined;
@@ -307,6 +307,60 @@ interface RelationFilterContext {
  */
 type RelationFilterBase = Pick<RelationFilterContext, 'tables' | 'relationMap'>;
 declare const extractFilters: <TTable extends Table>(table: TTable, tableName: string, filters: Filters<TTable>, relationCtx?: RelationFilterContext) => SQL | undefined;
+/**
+ * A table's row-level scope: the predicate every generated read, update and delete on that
+ * table is narrowed by. See `BuildSchemaConfig.scope`.
+ *
+ * `table` is the table the predicate must be built against. On the relational-query path
+ * drizzle hands its callbacks an *aliased* proxy (`d0`, `d1`, …), so a predicate built from
+ * the imported schema table would reference a name that isn't in the query — always build
+ * from the argument. Returning a filter object instead (the same shape as the field's
+ * `where`) sidesteps aliasing entirely, and is the only form that can reach through a
+ * relation — which is what ownership through a join table needs.
+ */
+type ScopeHook<TContext = any> = (context: TContext, table: any) => SQL | Record<string, any> | undefined | null;
+/** Build-time lookup: the scope configured for a table, if any. */
+type ScopeFor = (tableName: string) => ScopeHook | undefined;
+/**
+ * One table's soft-delete convention, resolved against the real column at build time.
+ *
+ * `nullable` picks the shape of the predicate. A nullable column marks a row deleted by
+ * holding a value at all (`deletedAt IS NOT NULL`), which is the common timestamp form; a
+ * non-nullable one marks it by holding `marker` (`isDeleted = true`), so the column has to
+ * have a constant that means "deleted" and another that means "not deleted".
+ */
+type SoftDeleteInfo = {
+    /** Property name of the column on the drizzle table — also the key on an aliased proxy. */
+    columnName: string;
+    column: Column;
+    nullable: boolean;
+    /** Evaluated per delete, so a timestamp form stamps the moment of the delete. */
+    writeDeleted: () => any;
+    /** Written by the restore mutation. */
+    writeRestored: any;
+    /** Non-nullable form only: the constant that means "this row is deleted". */
+    marker?: any;
+};
+/** Build-time lookup: the soft-delete convention of a table, if it declares one. */
+type SoftDeleteFor = (tableName: string) => SoftDeleteInfo | undefined;
+/** Produces one column's value from the GraphQL context. See `BuildSchemaConfig.contextValues`. */
+type ContextValueHook<TContext = any> = (context: TContext) => any;
+/** Build-time lookup: the context-derived columns of a table, keyed by column property name. */
+type ContextValuesFor = (tableName: string) => Record<string, ContextValueHook> | undefined;
+/**
+ * The two request-time policies a generated resolver applies, passed to the dialect
+ * generators as one value so a table's read scope and its server-owned columns travel
+ * together. Both stay `undefined` when nothing is configured, and every call site checks
+ * before doing any work — an unconfigured build generates exactly the SQL it did before.
+ */
+type TablePolicies = {
+    /** See `BuildSchemaConfig.scope`. */
+    scope?: ScopeFor;
+    /** See `BuildSchemaConfig.contextValues`. */
+    contextValues?: ContextValuesFor;
+    /** See `BuildSchemaConfig.softDelete`. */
+    softDelete?: SoftDeleteFor;
+};
 /**
  * Where a dialect's default sort places NULLs relative to non-NULL values:
  * - `nulls-largest` — PostgreSQL: NULLs sort as the largest values (last in ASC, first in DESC).
@@ -821,6 +875,59 @@ type LimitsConfig = TableLimitPolicy & {
     /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
     tables?: Record<string, TableLimitPolicy>;
 };
+/**
+ * What a {@link RowScope} may return: a Drizzle `SQL` expression, a filter object in the same
+ * shape as the generated `where` argument, or `undefined`/`null` for "no restriction".
+ *
+ * The filter-object form is compiled with the same code that compiles a client `where`, so it
+ * supports relation filters — `{ author: { orgId: { eq: 1 } } }` scopes a table through a join
+ * rather than a column it owns.
+ */
+type RowScopeFilter = Record<string, any> | undefined | null;
+/**
+ * A per-table row scope: given the GraphQL context, the predicate every read and write of that
+ * table is confined to.
+ *
+ * `table` is the table instance the current statement runs against. For a relational read that
+ * is Drizzle's *aliased* copy of the table, so build the predicate from this argument rather
+ * than from the imported table object — `eq(table.orgId, ctx.orgId)` is always correct, while
+ * `eq(users.orgId, ctx.orgId)` refers to the wrong alias inside a nested read.
+ *
+ * See {@link BuildSchemaConfig.scope}.
+ */
+type RowScope<TContext = any> = (context: TContext, table: any) => RowScopeFilter | object;
+/** {@link BuildSchemaConfig.scope} — a row scope per table, keyed by the Drizzle schema key. */
+type ScopeConfig<TContext = any> = Record<string, RowScope<TContext>>;
+/**
+ * {@link BuildSchemaConfig.contextValues} — columns whose value the server derives from the
+ * request context, keyed by Drizzle schema key and then by column property name.
+ */
+type ContextValuesConfig<TContext = any> = Record<string, Record<string, (context: TContext) => any>>;
+/**
+ * How one table marks a row deleted: the column's property name, or that name plus the values
+ * written on delete and on restore. See {@link BuildSchemaConfig.softDelete}.
+ */
+type SoftDeleteColumn = string | {
+    /** Property name of the column that marks a row deleted. */
+    column: string;
+    /**
+     * Written when a row is deleted. A function is evaluated per delete. Defaults by column
+     * type: `new Date()` for a timestamp, an ISO string for text, `Date.now()` for a number,
+     * `true` for a boolean. Required, as a constant, when the column is NOT NULL and not a
+     * boolean — the predicate that hides marked rows has to compare against it.
+     */
+    deletedValue?: any;
+    /**
+     * Written when a row is restored. Defaults to `null` for a nullable column and `false`
+     * for a NOT NULL boolean; required for any other NOT NULL column.
+     */
+    restoredValue?: any;
+};
+/**
+ * Per-table soft-delete declarations, either keyed by Drizzle schema key or as a rule applied
+ * to every table. See {@link BuildSchemaConfig.softDelete}.
+ */
+type SoftDeleteConfig = Record<string, SoftDeleteColumn> | ((table: any, tableName: string) => SoftDeleteColumn | undefined | null);
 /**
  * {@link BuildSchemaConfig.exclude} — tables and columns to keep out of the generated schema.
  *
@@ -879,6 +986,11 @@ type BuildSchemaConfig = {
         update?: string;
         /** Prefix for upsert mutations (e.g., 'users' -> 'upsertUsers') */
         upsert?: string;
+        /**
+         * Prefix for the restore mutations of a soft-deleting table (e.g., 'users' ->
+         * 'restoreUsers'). Only used when {@link BuildSchemaConfig.softDelete} names the table.
+         */
+        restore?: string;
     };
     /**
      * Customizes query name suffixes for generated GraphQL operations.
@@ -1049,6 +1161,110 @@ type BuildSchemaConfig = {
      *   agree.
      */
     limits?: LimitsConfig;
+    /**
+     * Row-level scoping: a predicate, derived from the GraphQL context, that every read and
+     * write of a table is confined to. This is the multi-tenancy / ownership knob — the one
+     * rule a wrapper cannot enforce from outside, because a nested relation field never passes
+     * through a root resolver.
+     *
+     * ```ts
+     * import { and, eq } from 'drizzle-orm';
+     *
+     * buildSchema(db, {
+     *   scope: {
+     *     posts: (ctx, table) => eq(table.orgId, ctx.orgId),
+     *     // A filter object works too, and can scope through a relation:
+     *     comments: (ctx) => ({ post: { orgId: { eq: ctx.orgId } } }),
+     *   },
+     * });
+     * ```
+     *
+     * - The predicate is ANDed on **last**, after the client's `where`, so a client filter can
+     *   only ever narrow the scope, never widen it.
+     * - It applies to every path that reads the table: list and single queries, aggregates and
+     *   `groupBy`, relation fields (batched and eager), relation aggregates, and cursor pages.
+     * - It applies to every path that writes it: `update`, `updateMany`, `delete`, the
+     *   conflict-update half of an upsert (PostgreSQL and SQLite), and the rows a nested
+     *   `connect` / `disconnect` / `set` is allowed to reach. An out-of-scope row is simply not
+     *   matched — a scoped `delete` reports zero rows rather than refusing.
+     * - It cannot apply to a plain `insert`: there is no existing row to filter. Use
+     *   {@link BuildSchemaConfig.contextValues} to stamp the owning column on the way in.
+     * - `table` is the table the current statement runs against, which for a relational read is
+     *   Drizzle's aliased copy — always build the predicate from that argument.
+     * - Returning `undefined` means "no restriction for this context", so a hook can let an
+     *   admin through. A table with no entry is unscoped.
+     * - MySQL's `ON DUPLICATE KEY UPDATE` takes no predicate, so a MySQL upsert cannot be
+     *   scoped on the conflict path; scope the table's `update` and rely on `contextValues`
+     *   for the insert half.
+     */
+    scope?: ScopeConfig;
+    /**
+     * Columns whose value the server derives from the request context rather than accepting
+     * from the client — the write-side half of {@link BuildSchemaConfig.scope}.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   contextValues: {
+     *     posts: {
+     *       orgId: (ctx) => ctx.orgId,
+     *       authorId: (ctx) => ctx.userId,
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - The column is removed from the generated insert and update inputs, so a client cannot
+     *   send it at all — the schema itself documents that it is server-owned.
+     * - Every insert stamps it, including the rows created by a nested `create`.
+     * - Updates never write it: an update cannot hand a row to another owner.
+     * - Keyed by the Drizzle schema key, then by the column's property name (not its database
+     *   name), the same keying {@link BuildSchemaConfig.exclude} uses.
+     */
+    contextValues?: ContextValuesConfig;
+    /**
+     * Tables that mark rows deleted instead of removing them.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   softDelete: {
+     *     users: 'deletedAt',                          // nullable timestamp: stamped on delete
+     *     posts: { column: 'isDeleted', deletedValue: true, restoredValue: false },
+     *   },
+     * });
+     *
+     * // or as a convention across the whole schema:
+     * buildSchema(db, { softDelete: (table) => ('deletedAt' in table ? 'deletedAt' : undefined) });
+     * ```
+     *
+     * For a table that declares one:
+     *
+     * - `delete<Table>` and `delete<Table>Single` issue an `UPDATE` of the marker column
+     *   instead of a `DELETE`, and return the rows as they now stand.
+     * - `restore<Table>` and `restore<Table>Single` are generated alongside them, matching only
+     *   marked rows and writing the restored value. The prefix is configurable through
+     *   {@link BuildSchemaConfig.prefixes}.
+     * - Every generated read hides marked rows: list and single queries, aggregates, `groupBy`,
+     *   relation fields on both the eager and the batched path, and relation aggregates. Each
+     *   of those fields takes a `deleted: EXCLUDE | INCLUDE | ONLY` argument (default
+     *   `EXCLUDE`); `ONLY` is a trash view.
+     * - Every generated write skips them too: an `update`, a `delete`, or a nested `connect`
+     *   cannot reach a row that is already marked.
+     * - The marker column is removed from the create and update inputs, so the only ways to set
+     *   or clear it are the delete and restore mutations.
+     * - The predicate is ANDed on before {@link BuildSchemaConfig.scope}, and both are ANDed
+     *   after the client's `where` — a request can only ever narrow them.
+     *
+     * Two consequences of the pattern itself, which this does not paper over:
+     *
+     * - A marked row still occupies its unique keys, so inserting a row that reuses the natural
+     *   key of a deleted one still fails on the constraint.
+     * - An upsert whose conflict target hits a marked row updates nothing on PostgreSQL and
+     *   SQLite (the conflict predicate excludes it) but revives it on MySQL, whose
+     *   `ON DUPLICATE KEY UPDATE` takes no predicate.
+     *
+     * Marking a parent deleted does not mark its children — a cascade is a schema decision.
+     */
+    softDelete?: SoftDeleteConfig;
     /**
      * Tables and columns to leave out of the generated schema entirely.
      *
@@ -1337,7 +1553,7 @@ type DrizzleFieldKind = 'query' | 'mutation' | 'relation' | 'aggregate' | 'type'
  * What the field does. Arity is carried separately by `single`, so `select` covers both
  * the list query and its `…Single` sibling rather than being spelled twice.
  */
-type DrizzleFieldOperation = 'select' | 'insert' | 'update' | 'updateMany' | 'upsert' | 'delete' | 'aggregate' | 'groupBy' | 'relation' | 'relationAggregate';
+type DrizzleFieldOperation = 'select' | 'insert' | 'update' | 'updateMany' | 'upsert' | 'delete' | 'restore' | 'aggregate' | 'groupBy' | 'relation' | 'relationAggregate';
 /** The argument holding the rows a field is about, when it has one. */
 type DrizzleTargetArg = 'where' | 'values' | 'updates';
 /** `extensions.drizzle` on a generated field. */
@@ -1511,4 +1727,4 @@ declare const resolveSelection: (info: GraphQLResolveInfo | ResolveTree, options
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type DrizzleExtension, type DrizzleFieldExtension, type DrizzleFieldKind, type DrizzleFieldOperation, type DrizzleTargetArg, type DrizzleTypeExtension, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type FeatureSwitch, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type IdentifiedRows, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ResolveSelectionOptions, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type SelectionOptions, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, drizzleExtension, extractFilters, extractOrderBy, extractRelationJoinColumns, identifyRows, isDrizzleFieldExtension, resolveSelection, selectionToWith, singularizeMapper };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type ContextValuesConfig, type DeleteResolver, type DeleteSingleResolver, type DrizzleExtension, type DrizzleFieldExtension, type DrizzleFieldKind, type DrizzleFieldOperation, type DrizzleTargetArg, type DrizzleTypeExtension, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type FeatureSwitch, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type IdentifiedRows, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ResolveSelectionOptions, type RowScope, type RowScopeFilter, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaExclusions, type SchemaFeatures, type ScopeConfig, type SelectResolver, type SelectSingleResolver, type SelectionOptions, type SoftDeleteColumn, type SoftDeleteConfig, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, drizzleExtension, extractFilters, extractOrderBy, extractRelationJoinColumns, identifyRows, isDrizzleFieldExtension, resolveSelection, selectionToWith, singularizeMapper };