naystack 1.8.0 → 1.8.2

package/dist/graphql/client.cjs.js

@@ -115,9 +115,10 @@ var tokenContext = (token) => {
     credentials: `omit`
   };
 };
-function useAuthQuery(query, variables) {
+function useAuthQuery(query, variables, options) {
   const [fetch, result] = (0, import_client.useLazyQuery)(query, {
-    fetchPolicy: "no-cache"
+    fetchPolicy: "no-cache",
+    ...options
   });
   const prevVarsRef = (0, import_react.useRef)(null);
   (0, import_react.useEffect)(() => {

package/dist/graphql/client.d.mts

@@ -1,5 +1,5 @@
 import * as _apollo_client from '@apollo/client';
-import { InMemoryCacheConfig, OperationVariables, MutationHookOptions, ApolloClient } from '@apollo/client';
+import { InMemoryCacheConfig, OperationVariables, LazyQueryHookOptions, MutationHookOptions, ApolloClient } from '@apollo/client';
 import { TypedDocumentNode } from '@graphql-typed-document-node/core';
 import React__default, { PropsWithChildren } from 'react';
 
@@ -25,10 +25,14 @@ declare const tokenContext: (token?: string | null) => {
  * Hook to run a GraphQL query with the current user's token. The query auto-fires when both the token
  * and variables are available. Returns a refetch function and the Apollo query result.
  *
- * Uses `fetchPolicy: "no-cache"` by default to always get fresh data.
+ * Uses Apollo's default `fetchPolicy` (`cache-first`) unless you override it via
+ * `options`. Pass `{ fetchPolicy: "no-cache" }` for always-fresh, viewer-keyed data
+ * (e.g. the current user), or `{ fetchPolicy: "cache-and-network" }` to show cached
+ * data instantly while refetching.
  *
  * @param query - A `TypedDocumentNode` for the query (e.g. from codegen or a `gql` template).
  * @param variables - Optional initial variables (the `input` value). Automatically wrapped as `{ input: variables }` before sending. Query fires automatically when this and token are set; change to refetch.
+ * @param options - Optional Apollo `LazyQueryHookOptions` (e.g. `fetchPolicy`, `notifyOnNetworkStatusChange`). Merged into the underlying `useLazyQuery`.
  * @returns Tuple: `[refetch, result]`.
  *   - `refetch(input)` — runs the query again with the given input (wrapped as `variables.input`).
  *   - `result` — `{ data, loading, error, hasAuth }` from Apollo. `hasAuth` is `true` when an auth token is available.
@@ -58,7 +62,7 @@ declare const tokenContext: (token?: string | null) => {
  *
  * @category GraphQL
  */
-declare function useAuthQuery<T, V extends OperationVariables>(query: TypedDocumentNode<T, V>, variables?: V["input"]): readonly [(input?: V["input"]) => Promise<_apollo_client.QueryResult<T, V>>, _apollo_client.QueryResult<T, V>];
+declare function useAuthQuery<T, V extends OperationVariables>(query: TypedDocumentNode<T, V>, variables?: V["input"], options?: LazyQueryHookOptions<T, V>): readonly [(input?: V["input"]) => Promise<_apollo_client.QueryResult<T, V>>, _apollo_client.QueryResult<T, V>];
 /**
  * Hook to run a GraphQL mutation with the current user's token. Returns a function you call with the mutation input.
  *

package/dist/graphql/client.d.ts

@@ -1,5 +1,5 @@
 import * as _apollo_client from '@apollo/client';
-import { InMemoryCacheConfig, OperationVariables, MutationHookOptions, ApolloClient } from '@apollo/client';
+import { InMemoryCacheConfig, OperationVariables, LazyQueryHookOptions, MutationHookOptions, ApolloClient } from '@apollo/client';
 import { TypedDocumentNode } from '@graphql-typed-document-node/core';
 import React__default, { PropsWithChildren } from 'react';
 
@@ -25,10 +25,14 @@ declare const tokenContext: (token?: string | null) => {
  * Hook to run a GraphQL query with the current user's token. The query auto-fires when both the token
  * and variables are available. Returns a refetch function and the Apollo query result.
  *
- * Uses `fetchPolicy: "no-cache"` by default to always get fresh data.
+ * Uses Apollo's default `fetchPolicy` (`cache-first`) unless you override it via
+ * `options`. Pass `{ fetchPolicy: "no-cache" }` for always-fresh, viewer-keyed data
+ * (e.g. the current user), or `{ fetchPolicy: "cache-and-network" }` to show cached
+ * data instantly while refetching.
  *
  * @param query - A `TypedDocumentNode` for the query (e.g. from codegen or a `gql` template).
  * @param variables - Optional initial variables (the `input` value). Automatically wrapped as `{ input: variables }` before sending. Query fires automatically when this and token are set; change to refetch.
+ * @param options - Optional Apollo `LazyQueryHookOptions` (e.g. `fetchPolicy`, `notifyOnNetworkStatusChange`). Merged into the underlying `useLazyQuery`.
  * @returns Tuple: `[refetch, result]`.
  *   - `refetch(input)` — runs the query again with the given input (wrapped as `variables.input`).
  *   - `result` — `{ data, loading, error, hasAuth }` from Apollo. `hasAuth` is `true` when an auth token is available.
@@ -58,7 +62,7 @@ declare const tokenContext: (token?: string | null) => {
  *
  * @category GraphQL
  */
-declare function useAuthQuery<T, V extends OperationVariables>(query: TypedDocumentNode<T, V>, variables?: V["input"]): readonly [(input?: V["input"]) => Promise<_apollo_client.QueryResult<T, V>>, _apollo_client.QueryResult<T, V>];
+declare function useAuthQuery<T, V extends OperationVariables>(query: TypedDocumentNode<T, V>, variables?: V["input"], options?: LazyQueryHookOptions<T, V>): readonly [(input?: V["input"]) => Promise<_apollo_client.QueryResult<T, V>>, _apollo_client.QueryResult<T, V>];
 /**
  * Hook to run a GraphQL mutation with the current user's token. Returns a function you call with the mutation input.
  *

package/dist/graphql/client.esm.js

@@ -90,9 +90,10 @@ var tokenContext = (token) => {
     credentials: `omit`
   };
 };
-function useAuthQuery(query, variables) {
+function useAuthQuery(query, variables, options) {
   const [fetch, result] = useLazyQuery(query, {
-    fetchPolicy: "no-cache"
+    fetchPolicy: "no-cache",
+    ...options
   });
   const prevVarsRef = useRef(null);
   useEffect(() => {

package/dist/graphql/index.cjs.js

@@ -770,8 +770,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -779,11 +787,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -801,11 +811,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -827,8 +839,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -903,8 +915,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/index.esm.js

@@ -764,8 +764,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -773,11 +781,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return cache(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -795,11 +805,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return cache(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -821,8 +833,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -897,8 +909,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/utils.cjs.js

@@ -117,8 +117,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -126,11 +134,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -148,11 +158,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return (0, import_react.cache)(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -174,8 +186,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -250,8 +262,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/dist/graphql/utils.d.mts

@@ -26,6 +26,23 @@ type ParsedGQLTypeWithArray<T, MergeNullUndefined extends boolean> = T extends A
 type ParsedGQLTypeWithNullability<T, IsNullable extends boolean, MergeNullUndefined extends boolean> = IsNullable extends true ? ParsedGQLTypeWithArray<T, MergeNullUndefined> | null | undefined : ParsedGQLTypeWithArray<T, MergeNullUndefined>;
 /** Allows resolver to return T or Promise<T>. */
 type Promisify<T> = T | Promise<T>;
+/**
+ * Return type of `.authCall()` / `.call()` for a definition.
+ *
+ * `authorized: true` promises the resolver an `AuthorizedContext` (non-null
+ * `userId`). Server-side callers can't be forced to hold a session, so when
+ * there's no refresh cookie the only way to keep that promise is to not call the
+ * resolver at all — hence the added `null`, which surfaces the logged-out case in
+ * the types instead of passing a null `userId` through the cast.
+ *
+ * `[IsAuth] extends [true]` (not `IsAuth extends true`) is deliberate: `field()`
+ * has no `= false` default and can't reverse-infer `IsAuth` from a `ctx: Context`
+ * signature, so a non-authorized field infers `IsAuth = boolean`. A naked
+ * conditional would distribute over `true | false` and union `null` into every
+ * public field's return. The tuple wrapper stops the distribution, so only a
+ * literal `true` adds `null`.
+ */
+type AuthCallReturn<IsAuth extends boolean, R> = [IsAuth] extends [true] ? Awaited<R> | null : Awaited<R>;
 /** Base for query/field definition (output, input, options). */
 interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false> {
     output: T;
@@ -42,10 +59,16 @@ interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable ex
  */
 interface QueryDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId. */
-    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components. */
-    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components.
+     * Resolves to `null` when `authorized: true` and there is no session — guard it, or gate the page ahead of it.
+     */
+    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
     mutation?: boolean;
 }
 /**
@@ -109,10 +132,26 @@ declare function resolver<T, U, IsAuth extends boolean = false, OutputNullable e
  */
 interface FieldResolverDefinition<T, U, Root, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (root: Root, ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the field resolver server-side. For authorized fields, reads the refresh cookie. */
-    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the field resolver server-side with authentication (always reads the refresh cookie). */
-    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the field resolver server-side. For authorized fields, reads the refresh cookie.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the field resolver server-side with authentication (always reads the refresh cookie).
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Skip `FieldLibrary`'s short-circuit, which returns a pre-hydrated `root[key]`
+     * without ever calling this resolver.
+     *
+     * Set this on any field that gates on `ctx` — an auth check inside the resolver
+     * is silently bypassed the moment a parent query selects the field's value into
+     * its own columns. The resolver stays responsible for reusing `root[key]` when
+     * present, so hydration still avoids the N+1.
+     */
+    alwaysResolve?: boolean;
 }
 /**
  * Defines a type-graphql field resolver with typed root, context, and input.

package/dist/graphql/utils.d.ts

@@ -26,6 +26,23 @@ type ParsedGQLTypeWithArray<T, MergeNullUndefined extends boolean> = T extends A
 type ParsedGQLTypeWithNullability<T, IsNullable extends boolean, MergeNullUndefined extends boolean> = IsNullable extends true ? ParsedGQLTypeWithArray<T, MergeNullUndefined> | null | undefined : ParsedGQLTypeWithArray<T, MergeNullUndefined>;
 /** Allows resolver to return T or Promise<T>. */
 type Promisify<T> = T | Promise<T>;
+/**
+ * Return type of `.authCall()` / `.call()` for a definition.
+ *
+ * `authorized: true` promises the resolver an `AuthorizedContext` (non-null
+ * `userId`). Server-side callers can't be forced to hold a session, so when
+ * there's no refresh cookie the only way to keep that promise is to not call the
+ * resolver at all — hence the added `null`, which surfaces the logged-out case in
+ * the types instead of passing a null `userId` through the cast.
+ *
+ * `[IsAuth] extends [true]` (not `IsAuth extends true`) is deliberate: `field()`
+ * has no `= false` default and can't reverse-infer `IsAuth` from a `ctx: Context`
+ * signature, so a non-authorized field infers `IsAuth = boolean`. A naked
+ * conditional would distribute over `true | false` and union `null` into every
+ * public field's return. The tuple wrapper stops the distribution, so only a
+ * literal `true` adds `null`.
+ */
+type AuthCallReturn<IsAuth extends boolean, R> = [IsAuth] extends [true] ? Awaited<R> | null : Awaited<R>;
 /** Base for query/field definition (output, input, options). */
 interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false> {
     output: T;
@@ -42,10 +59,16 @@ interface BaseDefinition<T, U, IsAuth extends boolean = false, OutputNullable ex
  */
 interface QueryDefinition<T, U, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId. */
-    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components. */
-    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the resolver server-side. For authorized queries, reads the refresh cookie; for non-authorized, passes null userId.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the resolver server-side with authentication (always reads the refresh cookie). Use in Server Components.
+     * Resolves to `null` when `authorized: true` and there is no session — guard it, or gate the page ahead of it.
+     */
+    authCall: (data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
     mutation?: boolean;
 }
 /**
@@ -109,10 +132,26 @@ declare function resolver<T, U, IsAuth extends boolean = false, OutputNullable e
  */
 interface FieldResolverDefinition<T, U, Root, IsAuth extends boolean = false, OutputNullable extends boolean = false, InputNullable extends boolean = false, R extends Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>> = Promisify<ParsedGQLTypeWithNullability<T, OutputNullable, true>>> extends BaseDefinition<T, U, IsAuth, OutputNullable, InputNullable> {
     fn: (root: Root, ctx: IsAuth extends true ? AuthorizedContext : Context, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => R;
-    /** Calls the field resolver server-side. For authorized fields, reads the refresh cookie. */
-    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
-    /** Calls the field resolver server-side with authentication (always reads the refresh cookie). */
-    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<Awaited<R>>;
+    /**
+     * Calls the field resolver server-side. For authorized fields, reads the refresh cookie.
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    call: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Calls the field resolver server-side with authentication (always reads the refresh cookie).
+     * Resolves to `null` when `authorized: true` and there is no session.
+     */
+    authCall: (root: Root, data: ParsedGQLTypeWithNullability<U, InputNullable, false>) => Promise<AuthCallReturn<IsAuth, R>>;
+    /**
+     * Skip `FieldLibrary`'s short-circuit, which returns a pre-hydrated `root[key]`
+     * without ever calling this resolver.
+     *
+     * Set this on any field that gates on `ctx` — an auth check inside the resolver
+     * is silently bypassed the moment a parent query selects the field's value into
+     * its own columns. The resolver stays responsible for reusing `root[key]` when
+     * present, so hydration still avoids the N+1.
+     */
+    alwaysResolve?: boolean;
 }
 /**
  * Defines a type-graphql field resolver with typed root, context, and input.

package/dist/graphql/utils.esm.js

@@ -102,8 +102,16 @@ function resolver(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getAuthCaller(fn),
-    call: options.authorized ? getAuthCaller(fn) : getCaller(fn)
+    authCall: getAuthCaller(
+      fn,
+      options.authorized
+    ),
+    call: options.authorized ? getAuthCaller(
+      fn,
+      options.authorized
+    ) : getCaller(
+      fn
+    )
   };
 }
 var getUserId = async () => {
@@ -111,11 +119,13 @@ var getUserId = async () => {
   const refresh = Cookie.get(REFRESH_COOKIE_NAME)?.value;
   return refresh ? getUserIdFromRefreshToken(refresh) : null;
 };
-function getAuthCaller(fn) {
+function getAuthCaller(fn, authorized) {
   return cache(
     async (data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(ctx, data);
@@ -133,11 +143,13 @@ function getCaller(fn) {
     }
   );
 }
-function getFieldAuthCaller(fn) {
+function getFieldAuthCaller(fn, authorized) {
   return cache(
     async (root, data) => {
+      const userId = await getUserId();
+      if (authorized && !userId) return null;
       const ctx = {
-        userId: await getUserId(),
+        userId,
         isRefreshID: true
       };
       return await fn(root, ctx, data);
@@ -159,8 +171,8 @@ function field(fn, options) {
   return {
     ...options,
     fn,
-    authCall: getFieldAuthCaller(fn),
-    call: options.authorized ? getFieldAuthCaller(fn) : getFieldCaller(
+    authCall: getFieldAuthCaller(fn, options.authorized),
+    call: options.authorized ? getFieldAuthCaller(fn, options.authorized) : getFieldCaller(
       fn
     )
   };
@@ -235,8 +247,12 @@ function FieldLibrary(type, queries) {
     const def = queries[key];
     if (!def) continue;
     Object.defineProperty(GeneratedResolver.prototype, key, {
+      // `alwaysResolve` fields must run `fn` even when the parent pre-hydrated
+      // `root[key]`: they gate on `ctx`, and the short-circuit would return the
+      // pre-hydrated value without ever applying that check. Such a resolver is
+      // responsible for reusing `root[key]` itself, so the N+1 win is preserved.
       value: async function(root, ctx, input) {
-        if (root[key]) return root[key];
+        if (!def.alwaysResolve && root[key]) return root[key];
         return def.fn(root, ctx, input);
       },
       writable: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "naystack",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "A stack built with Next + GraphQL + S3 + Auth",
   "main": "dist/index.cjs.js",
   "module": "dist/index.esm.js",