bazis 0.98.27 → 0.98.28

package/core/di/ServiceProvider.ts

@@ -15,6 +15,7 @@ import { ServiceRegistry } from "./internal/ServiceRegistry";
 import { ResolutionTracker, type ResolutionActivation } from "./internal/ResolutionTracker";
 import { ScopeLifecycle } from "./internal/ScopeLifecycle";
 import { ServiceScope } from "./ServiceScope";
+import { RESOLVE_DEPENDENCY_LIST } from "./internal/resolveDependencyList";
 import { getConstructorDeps, getProviderDeps } from "./internal/providerDeps";
 import type { BuildServiceProviderOptions, ServiceKey, ServiceResolver } from "./types";
 import type {
@@ -550,7 +551,29 @@ export class ServiceProvider implements ServiceResolver {
         return this.tryResolveInternal(token, key, scopeState, stack(), ownerLifetime);
       },
       has: (token: Token<unknown>, key?: ServiceKey): boolean => this.has(token, key),
-    };
+      [RESOLVE_DEPENDENCY_LIST]: (key: object, deps: ProviderDependencyList): unknown[] => {
+        assertOriginScopeLive();
+        return this.resolveListIn(key, deps, scopeState, stack(), ownerLifetime);
+      },
+    } as ServiceResolver;
+  }
+
+  /** @internal See resolveDependencyList: the root resolver is the provider itself. */
+  [RESOLVE_DEPENDENCY_LIST](key: object, deps: ProviderDependencyList): unknown[] {
+    return this.resolveListIn(key, deps, this.lifetime.root, [], undefined);
+  }
+
+  // A dependency list resolved outside a registered provider (a DbContext's
+  // generated constructor dependencies). The synthetic provider is cached per
+  // key, so its plan is built once like any provider's.
+  private readonly listProviders = new WeakMap<object, Provider<unknown>>();
+  private resolveListIn(key: object, deps: ProviderDependencyList, scopeState: ResolutionScopeState, stack: ResolutionActivation[], ownerLifetime: ProviderLifetime | undefined): unknown[] {
+    let provider = this.listProviders.get(key);
+    if (provider === undefined || getProviderDeps(provider) !== deps) {
+      provider = { provide: key as Token<unknown>, useFactory: () => undefined, deps } as unknown as Provider<unknown>;
+      this.listProviders.set(key, provider);
+    }
+    return this.resolveDeps(this.getPlan(provider), scopeState, stack, ownerLifetime ?? "scoped");
   }
 
   private resolveDeps(

package/core/di/internal/resolveDependencyList.ts

@@ -0,0 +1,19 @@
+import type { ProviderDependencyList } from "../provider";
+import type { ServiceResolver } from "../types";
+
+/** @internal A resolver created by ServiceProvider resolves a dependency list in its own scope. */
+export const RESOLVE_DEPENDENCY_LIST = Symbol("bazis.di.resolveDependencyList");
+
+type ListResolver = ServiceResolver & { readonly [RESOLVE_DEPENDENCY_LIST]?: (key: object, deps: ProviderDependencyList) => unknown[] };
+
+/**
+ * Resolves `deps` (tokens, keyed, named, lazy or optional dependencies, as
+ * codegen records them) in the scope of `resolver`. `key` identifies the list
+ * so its resolution plan is built once. For framework factories that construct
+ * a class with generated dependencies, such as a DbContext.
+ */
+export function resolveDependencyList(resolver: ServiceResolver, key: object, deps: ProviderDependencyList): unknown[] {
+  const resolve = (resolver as ListResolver)[RESOLVE_DEPENDENCY_LIST];
+  if (resolve === undefined) throw new TypeError("resolveDependencyList() needs a resolver created by the container");
+  return resolve(key, deps);
+}

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.27" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.28" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/orm/buildOrmProviders.ts

@@ -1,6 +1,8 @@
-import { DI, HOSTED_SERVICE, type InjectionToken, type ModuleOwnedContributionSnapshot, type ProviderDefinition } from "../di";
+import { DI, HOSTED_SERVICE, type InjectionToken, type ModuleOwnedContributionSnapshot, type ProviderDefinition, type ProviderDependencyList, type ServiceResolver } from "../di";
+import { getGeneratedClassDeps } from "../di/module/autoDeps";
+import { resolveDependencyList } from "../di/internal/resolveDependencyList";
 import { HEALTH_CHECK } from "../kernel";
-import { DbContextOptions, type DatabaseProvider, type DbContext } from "../../library/orm";
+import { DbContextOptions, OrmError, type DatabaseProvider, type DbContext } from "../../library/orm";
 import { OrmLifecycle } from "./OrmLifecycle";
 import { ownedStoreLifecycleFor, ownedStoreLifecycleHealthFor } from "./OrmOwnedStoreLifecycle";
 import { effectiveOrmModuleConfig, ownedStoreRegistrations } from "./ownedStoreContributions";
@@ -9,7 +11,9 @@ import { DATABASE_PROVIDER } from "./DATABASE_PROVIDER";
 import type { OrmModuleConfig } from "./ormModule";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 type OrmBuildConfig<TContext extends DbContext> = OrmModuleConfig<TContext> & {
   readonly context: ContextClass<TContext>;
@@ -27,6 +31,27 @@ function createContextOptions<TContext extends DbContext>(
   });
 }
 
+const contextDependencies = new WeakMap<object, ProviderDependencyList>();
+
+/**
+ * Creates a context with `options` and the rest of its constructor
+ * dependencies (generated by codegen) resolved in the request scope, so a
+ * context may read the current user or tenant: `constructor(options:
+ * DbContextOptions, private readonly user: CurrentUser)`.
+ */
+function constructContext<TContext extends DbContext>(context: ContextClass<TContext>, options: DbContextOptions, resolver: ServiceResolver): TContext {
+  const generated = getGeneratedClassDeps(context);
+  if (generated === undefined || generated.length === 0) return new context(options);
+  const first = generated[0];
+  if (first !== DbContextOptions && !(typeof first === "function" && first.name === "DbContextOptions")) {
+    throw new OrmError(`${context.name}: the first constructor parameter of a DbContext must be DbContextOptions; put its other dependencies after it.`);
+  }
+  if (generated.length === 1) return new context(options);
+  let rest = contextDependencies.get(context);
+  if (rest === undefined) { rest = generated.slice(1); contextDependencies.set(context, rest); }
+  return new context(options, ...resolveDependencyList(resolver, context, rest));
+}
+
 function createOrmLifecycle<TContext extends DbContext>(
   config: OrmBuildConfig<TContext>,
   options: DbContextOptions,
@@ -72,9 +97,9 @@ export function buildOrmModuleProviders<TContext extends DbContext>(
     const token = providerOrToken;
     const providers: ProviderDefinition[] = [
       DI.scoped(
-        DI.factoryProvider(config.context, [token, SERVICE_PROVIDER] as const, (provider: DatabaseProvider, serviceProvider) => {
+        DI.factoryProviderWithResolver(config.context, [token, SERVICE_PROVIDER] as const, (resolver, provider: DatabaseProvider, serviceProvider) => {
           const current = effectiveConfigFor(serviceProvider, registrationIdentity, config);
-          return new current.context(createContextOptions(current, provider));
+          return constructContext(current.context, createContextOptions(current, provider), resolver);
         }),
       ),
       DI.singleton(
@@ -105,10 +130,10 @@ export function buildOrmModuleProviders<TContext extends DbContext>(
 
   const provider = providerOrToken;
   const providers: ProviderDefinition[] = [
-    DI.scoped(DI.factoryProvider(config.context, [SERVICE_PROVIDER], (serviceProvider) => {
+    DI.scoped(DI.factoryProviderWithResolver(config.context, [SERVICE_PROVIDER], (resolver, serviceProvider) => {
       const current = effectiveConfigFor(serviceProvider, registrationIdentity, config);
       const context = current === config ? config.context : current.context;
-      return new context(current === config && optionsAtModuleCall !== undefined ? optionsAtModuleCall : createContextOptions(current, provider));
+      return constructContext(context, current === config && optionsAtModuleCall !== undefined ? optionsAtModuleCall : createContextOptions(current, provider), resolver);
     })),
     // Standalone mode: the context owns its provider and closes it.
     DI.singleton(DI.factoryProvider(HOSTED_SERVICE, [SERVICE_PROVIDER], (serviceProvider) => {

package/core/orm/ormModule.ts

@@ -20,7 +20,9 @@ import { OrmConnectionLifecycle } from "./OrmLifecycle";
 import { attachOrmGraphContribution, attachOwnedStoreRegistration } from "./ownedStoreContributions";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 /**
  * The single ORM registration shape. One function, three scenarios depending

package/core/orm/registerRepositories.ts

@@ -3,7 +3,9 @@ import { Repository, type DbContext, type DbContextOptions } from "../../library
 import { repositoryFor } from "./repository";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 /**
  * Registers a scoped `IRepository<T>` for each context entity and the

package/library/orm/DbContext.ts

@@ -36,7 +36,7 @@ export abstract class DbContext {
     this.#options = options;
     this.changeTracker = new ChangeTracker();
     const provider = observedProvider(this, options.provider);
-    this.#runtime = { provider, models: options.model, tracker: this.changeTracker, runImmediateOperation: (operation) => monitorImmediateOperation(this, operation) };
+    this.#runtime = { context: this, provider, models: options.model, tracker: this.changeTracker, runImmediateOperation: (operation) => monitorImmediateOperation(this, operation) };
     this.database = new DatabaseFacade(provider, options.model);
   }
 

package/library/orm/Metadata/ModelBuilder.ts

@@ -143,6 +143,7 @@ export class ModelBuilder {
       relations,
       foreignKeys,
       queryFilters: raw.queryFilters ?? [],
+      contextQueryFilters: raw.contextQueryFilters ?? [],
       softDeleteProperty: raw.softDeleteProperty,
       propertyByName: (name: string) => byName.get(name),
       relationByName: (name: string) => relationByName.get(name),

package/library/orm/Metadata/decorators.ts

@@ -1,6 +1,6 @@
 import type { ColumnOptionsType, RelationKind, PropertyConvention } from "./types";
 import type { ValueConverter } from "./ValueConverter";
-import { evaluatePredicate, type PredicateFn } from "../Query/conditions";
+import { evaluatePredicate, type FieldSelector, type PredicateFn, type Predicate } from "../Query/conditions";
 import type { Condition } from "../Query/conditions";
 import { compileCheck, type CheckPredicate } from "../Schema/CheckExpression";
 
@@ -114,6 +114,8 @@ export interface RawEntity {
   properties: Map<string, RawProperty>;
   relations: RawRelation[];
   queryFilters?: Condition[];
+  /** `@QueryFilter((entity, context) => …)`: evaluated per query with the context. */
+  contextQueryFilters?: ContextQueryFilter[];
   /** Soft-delete property name (see `@SoftDelete` / `@Entity({ softDelete })`). */
   softDeleteProperty?: string;
   keyDeclaration?: { properties: readonly string[]; name?: string; anchor: string; composite: boolean };
@@ -135,7 +137,7 @@ function cloneRaw(source: RawEntity): RawEntity {
   for (const [name, prop] of source.properties) {
     properties.set(name, { ...prop, index: prop.index ? { ...prop.index } : undefined });
   }
-  return { ...source, properties, relations: source.relations.map((relation) => ({ ...relation })), keyDeclaration: source.keyDeclaration && { ...source.keyDeclaration, properties: [...source.keyDeclaration.properties] }, indexes: source.indexes?.map((index) => ({ ...index, properties: [...index.properties] })), foreignKeys: source.foreignKeys?.map((foreignKey) => ({ ...foreignKey, properties: [...foreignKey.properties] })), checks: source.checks?.map((check) => ({ ...check })), queryFilters: source.queryFilters?.map(cloneCondition) };
+  return { ...source, properties, relations: source.relations.map((relation) => ({ ...relation })), keyDeclaration: source.keyDeclaration && { ...source.keyDeclaration, properties: [...source.keyDeclaration.properties] }, indexes: source.indexes?.map((index) => ({ ...index, properties: [...index.properties] })), foreignKeys: source.foreignKeys?.map((foreignKey) => ({ ...foreignKey, properties: [...foreignKey.properties] })), checks: source.checks?.map((check) => ({ ...check })), queryFilters: source.queryFilters?.map(cloneCondition), contextQueryFilters: source.contextQueryFilters && [...source.contextQueryFilters] };
 }
 
 function cloneCondition(condition: Condition): Condition {
@@ -364,14 +366,30 @@ export function HasConversion(converter: ValueConverter) {
   };
 }
 
+/** A query filter that reads the `DbContext` of the query (a tenant, the current user). */
+export type ContextQueryFilter = (entity: FieldSelector<never>, context: never) => Predicate;
+
 /**
  * Global query filter for the entity (multi-tenant, flags and so on).
  * Applied automatically; disabled with `ignoreQueryFilters()`.
+ *
+ * With one parameter the filter is fixed when the class is declared:
+ * `@QueryFilter<Note>((n) => n.archived.eq(false))`. With a second parameter
+ * it receives the `DbContext` of each query and is evaluated then:
+ * `@QueryFilter<Note, NotesDb>((n, db) => n.tenantId.eq(db.tenantId))`. If it
+ * throws, the query fails instead of running unfiltered.
  */
-export function QueryFilter<T extends object>(predicate: PredicateFn<T>) {
+type QueryFilterDecorator = (value: abstract new (...args: never[]) => unknown, context: ClassDecoratorContext) => void;
+export function QueryFilter<T extends object>(predicate: PredicateFn<T>): QueryFilterDecorator;
+export function QueryFilter<T extends object, C extends object>(predicate: (entity: FieldSelector<T>, context: C) => Predicate): QueryFilterDecorator;
+export function QueryFilter<T extends object>(predicate: PredicateFn<T> | ((entity: FieldSelector<T>, context: never) => Predicate)): QueryFilterDecorator {
   return (_value: abstract new (...args: never[]) => unknown, context: ClassDecoratorContext): void => {
     const raw = ownRaw(context.metadata);
-    const node = evaluatePredicate(predicate, "@QueryFilter").node;
+    if (predicate.length >= 2) {
+      raw.contextQueryFilters = [...(raw.contextQueryFilters ?? []), predicate as unknown as ContextQueryFilter];
+      return;
+    }
+    const node = evaluatePredicate(predicate as PredicateFn<T>, "@QueryFilter").node;
     raw.queryFilters = [...(raw.queryFilters ?? []), node];
   };
 }

package/library/orm/Metadata/types.ts

@@ -131,6 +131,8 @@ export interface EntityModel {
   readonly foreignKeys: readonly ForeignKeyModel[];
   /** Global query filters (`@QueryFilter`), applied to every SELECT. */
   readonly queryFilters: readonly Condition[];
+  /** Query filters that read the query's `DbContext`; evaluated per query (see `effectiveQueryFilters`). */
+  readonly contextQueryFilters?: readonly import("./decorators").ContextQueryFilter[];
   /** Soft-delete property name (NULL = not deleted). `@SoftDelete` / `@Entity({ softDelete })`. */
   readonly softDeleteProperty?: string;
   /** Property by name. */

package/library/orm/Query/EntityQuery.ts

@@ -6,6 +6,7 @@ import { IncludeLoader } from "./IncludeLoader";
 import { materialize, materializeProjection } from "./materialize";
 import { EMPTY_PLAN, withCondition, withOrder, type QueryPlan } from "./QueryPlan";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 import { executeImmediateDelete, executeImmediateUpdate, type OrmMutationResultV1, type OrmUpdateValuesV1 } from "./ImmediateMutations";
 
 export interface ForUpdateOptionsV1 { readonly skipLocked?: boolean; }
@@ -144,7 +145,7 @@ export class EntityQuery<T extends object, TResult = T> {
   }
 
   protected translator(): SqlTranslator {
-    return new SqlTranslator(this.model, this.runtime.provider.dialect);
+    return new SqlTranslator(this.model, this.runtime.provider.dialect, this.plan.ignoreQueryFilters ? [] : effectiveQueryFilters(this.model, this.runtime.context));
   }
 
   async toList(): Promise<TResult[]> {

package/library/orm/Query/ImmediateMutations.ts

@@ -8,6 +8,7 @@ import type { SqlParam } from "../Providers/types";
 import type { QueryPlan } from "./QueryPlan";
 import { Operand, type Condition, type FieldSelector } from "./conditions";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 
 export interface OrmMutationResultV1 { readonly affectedRows: number; }
 export interface OrmInsertIfAbsentResultV1 { readonly inserted: boolean; }
@@ -17,7 +18,7 @@ export type OrmUniqueKeySelectorV1<T extends object> = (entity: FieldSelector<T>
 export function executeImmediateUpdate<T extends object>(model: EntityModel, runtime: DbContextRuntime, plan: QueryPlan, values: OrmUpdateValuesV1<T>): Promise<OrmMutationResultV1> {
   return runtime.runImmediateOperation(async () => {
     guard(model, runtime); const admittedPlan = admitPlan(plan, "executeUpdate");
-    const conditions = effectiveConditions(model, admittedPlan); const assignments = encodeAssignments(runtime, admitUpdateValues(model, values));
+    const conditions = effectiveConditions(model, admittedPlan, runtime); const assignments = encodeAssignments(runtime, admitUpdateValues(model, values));
     const compiled = new SqlTranslator(model, runtime.provider.dialect).immediateUpdate(assignments, conditions, (property, value) => encode(runtime, property, snapshot(value), true));
     Object.freeze(compiled.params);
     guard(model, runtime);
@@ -28,7 +29,7 @@ export function executeImmediateUpdate<T extends object>(model: EntityModel, run
 
 export function executeImmediateDelete(model: EntityModel, runtime: DbContextRuntime, plan: QueryPlan): Promise<OrmMutationResultV1> {
   return runtime.runImmediateOperation(async () => {
-    guard(model, runtime); const admittedPlan = admitPlan(plan, "executeDelete"); const conditions = effectiveConditions(model, admittedPlan);
+    guard(model, runtime); const admittedPlan = admitPlan(plan, "executeDelete"); const conditions = effectiveConditions(model, admittedPlan, runtime);
     const compiled = new SqlTranslator(model, runtime.provider.dialect).immediateDelete(conditions, (property, value) => encode(runtime, property, snapshot(value), true));
     Object.freeze(compiled.params);
     guard(model, runtime);
@@ -177,8 +178,8 @@ function conflictTarget<T extends object>(model: EntityModel, options: { readonl
   return Object.freeze(columns as string[]);
 }
 
-function effectiveConditions(model: EntityModel, plan: AdmittedImmediatePlan): readonly Condition[] {
-  const source: Condition[] = plan.ignoreQueryFilters ? [] : readConditionList(model.queryFilters);
+function effectiveConditions(model: EntityModel, plan: AdmittedImmediatePlan, runtime: DbContextRuntime): readonly Condition[] {
+  const source: Condition[] = plan.ignoreQueryFilters ? [] : readConditionList([...effectiveQueryFilters(model, runtime.context)]);
   if (!plan.ignoreQueryFilters && model.softDeleteProperty) source.push({ kind: "null", property: model.softDeleteProperty, negated: false });
   source.push(...plan.explicitConditions); const active = new Set<object>(); const memo = new WeakMap<object, Condition>();
   return Object.freeze(source.map((condition) => cloneCondition(model, condition, active, memo)));

package/library/orm/Query/IncludeLoader.ts

@@ -6,6 +6,7 @@ import type { DbContextRuntime } from "../runtime";
 import { materialize } from "./materialize";
 import { EMPTY_PLAN } from "./QueryPlan";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 
 interface Level {
   readonly model: EntityModel;
@@ -156,7 +157,7 @@ export class IncludeLoader {
   }
 
   private async queryIn(model: EntityModel, property: string, values: readonly unknown[], noTracking: boolean): Promise<object[]> {
-    const translator = new SqlTranslator(model, this.runtime.provider.dialect);
+    const translator = new SqlTranslator(model, this.runtime.provider.dialect, effectiveQueryFilters(model, this.runtime.context));
     const result: object[] = [];
     const chunkSize = maxParametersPerInList(this.runtime.provider);
     for (let start = 0; start < values.length; start += chunkSize) {
@@ -180,7 +181,7 @@ export class IncludeLoader {
 
   private async queryTuples(model: EntityModel, properties: readonly string[], values: readonly (readonly unknown[])[], noTracking: boolean): Promise<object[]> {
     const result: object[] = []; const perTuple = properties.length; const chunkSize = Math.max(1, Math.floor(maxParametersPerInList(this.runtime.provider) / perTuple));
-    for (let start = 0; start < values.length; start += chunkSize) { const translator = new SqlTranslator(model, this.runtime.provider.dialect); const { sql, params } = translator.selectAll({ ...EMPTY_PLAN, conditions: [{ kind: "tuples", properties, values: values.slice(start, start + chunkSize) }], noTracking }); for (let entity of (await this.runtime.provider.query(sql, params)).map((row) => materialize<object>(model, row, this.runtime.provider.dialect))) { if (!noTracking) entity = this.runtime.tracker.trackLoaded(entity, model); result.push(entity); } }
+    for (let start = 0; start < values.length; start += chunkSize) { const translator = new SqlTranslator(model, this.runtime.provider.dialect, effectiveQueryFilters(model, this.runtime.context)); const { sql, params } = translator.selectAll({ ...EMPTY_PLAN, conditions: [{ kind: "tuples", properties, values: values.slice(start, start + chunkSize) }], noTracking }); for (let entity of (await this.runtime.provider.query(sql, params)).map((row) => materialize<object>(model, row, this.runtime.provider.dialect))) { if (!noTracking) entity = this.runtime.tracker.trackLoaded(entity, model); result.push(entity); } }
     return result;
   }
   private tuple(model: EntityModel, values: readonly unknown[]): string | undefined {

package/library/orm/Query/SqlTranslator.ts

@@ -35,9 +35,11 @@ export function quotedColumnList(model: EntityModel, dialect: SqlDialect): strin
  * parameter array (no concatenation of user data).
  */
 export class SqlTranslator {
+  /** `filters`: the query filters to apply (see `effectiveQueryFilters`); the model's fixed ones by default. */
   constructor(
     private readonly model: EntityModel,
     private readonly dialect: SqlDialect,
+    private readonly filters: readonly Condition[] = model.queryFilters,
   ) {}
 
   /** SELECT of all columns (or a projection) with WHERE/ORDER/LIMIT/OFFSET. */
@@ -98,7 +100,7 @@ export class SqlTranslator {
   private whereClause(plan: QueryPlan, params: SqlParam[], encode: ConditionValueEncoder = (property, value) => encodeProperty(property, value, this.dialect)): string {
     const parts: string[] = [];
     if (!plan.ignoreQueryFilters) {
-      for (const filter of this.model.queryFilters) {
+      for (const filter of this.filters) {
         parts.push(this.condition(filter, params, encode));
       }
       if (this.model.softDeleteProperty) {

package/library/orm/Query/queryFilters.ts

@@ -0,0 +1,16 @@
+import type { EntityModel } from "../Metadata/types";
+import { evaluatePredicate, type Condition, type FieldSelector } from "./conditions";
+
+/**
+ * The query filters of `model` for a query of `context`: the fixed ones plus
+ * the context filters evaluated now. A context filter that throws fails the
+ * query; it never runs without the filter.
+ */
+export function effectiveQueryFilters(model: EntityModel, context: object | undefined): readonly Condition[] {
+  const dynamic = model.contextQueryFilters ?? [];
+  if (dynamic.length === 0) return model.queryFilters;
+  return [
+    ...model.queryFilters,
+    ...dynamic.map((filter) => evaluatePredicate((entity) => filter(entity as FieldSelector<never>, context as never), "@QueryFilter").node),
+  ];
+}

package/library/orm/runtime.ts

@@ -7,6 +7,8 @@ import type { ChangeTracker } from "./Tracking/ChangeTracker";
  * module to break import cycles between the context, the set and the tracker.
  */
 export interface DbContextRuntime {
+  /** The DbContext that owns this runtime; context query filters read it. */
+  readonly context?: object;
   readonly provider: DatabaseProvider;
   readonly models: OrmModel;
   readonly tracker: ChangeTracker;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.27",
+  "version": "0.98.28",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",