@memberjunction/server 5.51.3 → 5.51.4

package/dist/resolvers/AdhocQueryResolver.d.ts

@@ -1,3 +1,5 @@
+import type { DatabaseProviderBase, UserInfo } from '@memberjunction/core';
+import type { AdhocSQLAuthorizer } from '@memberjunction/actions';
 import { AppContext } from '../types.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { RunQueryResultType } from './QueryResolver.js';
@@ -14,34 +16,54 @@ declare class AdhocQueryInput {
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
  *
  * Auto-discovered by MJServer's dynamic resolver import.
  */
 export declare class AdhocQueryResolver extends ResolverBase {
     ExecuteAdhocQuery(input: AdhocQueryInput, context: AppContext): Promise<RunQueryResultType>;
     /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
      *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
-     */
-    private executeDataAndCount;
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
      */
-    private runSqlWithDeadline;
+    AuthorizeRenderedSQL(sqlText: string, provider: DatabaseProviderBase, contextUser: UserInfo | undefined): string | null;
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    private toResultType;
     private buildErrorResult;
 }
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export declare function CreateAdhocSQLAuthorizer(requestTimeoutMs: number): AdhocSQLAuthorizer;
 export {};
 //# sourceMappingURL=AdhocQueryResolver.d.ts.map

package/dist/resolvers/AdhocQueryResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAsH9B;;;;;;;;;OASG;YACW,mBAAmB;IA6BjC;;;;OAIG;YACW,kBAAkB;IAwBhC,OAAO,CAAC,gBAAgB;CAc3B"}
+{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAkB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAoC9B;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAU9H,iFAAiF;IACjF,OAAO,CAAC,YAAY;IA6BpB,OAAO,CAAC,gBAAgB;CAc3B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,gBAAgB,EAAE,MAAM,GAAG,kBAAkB,CAMrF"}

package/dist/resolvers/AdhocQueryResolver.js

@@ -12,13 +12,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Arg, Ctx, Query, Resolver, Field, Int, InputType } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { SQLExpressionValidator } from '@memberjunction/global';
 import { RenderPipeline } from '@memberjunction/generic-database-provider';
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
+import { configInfo } from '../config.js';
+import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
-import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
-import sql from 'mssql';
+import { ClampAdhocTimeoutSeconds } from './adhocTimeout.js';
 /**
  * Input type for executing ad-hoc SQL queries directly.
  * The SQL is validated server-side to ensure it's a safe SELECT/WITH statement.
@@ -47,182 +47,108 @@ AdhocQueryInput = __decorate([
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Authorizes the RENDERED SQL: every table reference must be an entity base view the caller
+ *   reads unscoped (CanRead, no row-level filter, no denied fields). Entities with row/field
+ *   policy for this user are refused — raw SQL cannot apply that policy, so those reads belong
+ *   on RunView.
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
  *
  * Auto-discovered by MJServer's dynamic resolver import.
  */
 let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
     async ExecuteAdhocQuery(input, context) {
         const startTime = Date.now();
+        // SECURITY: refuse principals whose read authority is narrower than their role grant.
+        // Ad-hoc SQL does not go through RunView, entity permissions or row-level security, so the
+        // RLS scope tokens that confine a magic-link session are never substituted. There is no
+        // filter to narrow, so the only correct answer for such a principal is no.
+        if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+            return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+        const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
+        if (!provider) {
+            return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
+        }
+        const contextUser = context.userPayload?.userRecord;
+        const refusal = this.AuthorizeRenderedSQL(input.SQL, provider, contextUser);
+        if (refusal) {
+            return this.buildErrorResult(refusal, Date.now() - startTime);
+        }
+        const timeoutSeconds = ClampAdhocTimeoutSeconds(input.TimeoutSeconds, configInfo.databaseSettings.requestTimeout);
+        // A negative offset must not reach paging, where it would turn paging off.
+        const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
         try {
-            // 1. Security: validate SQL using SQLExpressionValidator
-            const validator = SQLExpressionValidator.Instance;
-            const validation = validator.validateFullQuery(input.SQL);
-            if (!validation.valid) {
-                return this.buildErrorResult(validation.error || 'SQL validation failed');
-            }
-            // 2. Get READ-ONLY data source (no fallback to read-write)
-            let readOnlyDS;
-            try {
-                readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
-            }
-            catch {
-                return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
-            }
-            // 3. Resolve platform from the read-only provider for the render pipeline.
-            let platform = 'sqlserver';
-            try {
-                const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
-                if (provider?.PlatformKey)
-                    platform = provider.PlatformKey;
-            }
-            catch {
-                // Provider not configured — keep the default platform.
-            }
-            const contextUser = context.userPayload?.userRecord;
-            // 4. Route the SQL through RenderPipeline so composition tokens
-            // resolve, comments and templates are processed, and the row cap
-            // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
-            //
-            // Page whenever a positive MaxRows is requested — INCLUDING the first
-            // page (StartRow 0). This yields OFFSET/FETCH data SQL *and* a
-            // COUNT(*) query so the response reports the true total row count
-            // rather than just the returned page size. It mirrors the saved-query
-            // path (GenericDatabaseProvider.InternalRunQuery → WrapWithPaging).
-            // (Previously paging was gated on StartRow > 0, so page 1 fell back to
-            // a TOP-N cap with TotalRowCount = page size — hiding the pager.)
-            // Clamp StartRow to a non-negative integer. A negative offset must not slip
-            // past the paging gate (which would then run the query with no row cap at all).
-            const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
-            const maxRows = input.MaxRows;
-            const usePaging = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
-            let dataSQL;
-            let countSQL = null;
-            try {
-                const rendered = RenderPipeline.Run(input.SQL, {
-                    Platform: platform,
-                    ContextUser: contextUser,
-                    ...(usePaging ? { Paging: { StartRow: startRow, MaxRows: maxRows } } : {}),
-                });
-                dataSQL = rendered.FinalSQL;
-                countSQL = rendered.PagingResult?.CountSQL ?? null;
-            }
-            catch (renderErr) {
-                const renderMsg = renderErr instanceof Error ? renderErr.message : String(renderErr);
-                return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
-            }
-            // 5. Execute the page (and, only when a full page needs it, the count) under
-            // a shared wall-clock deadline derived from the request's timeout budget.
-            const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
-            const { recordset, totalRowCount } = await this.executeDataAndCount(readOnlyDS, dataSQL, countSQL, startRow, usePaging ? maxRows : null, deadline);
-            const executionTimeMs = Date.now() - startTime;
-            // 6. Return as RunQueryResultType
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: true,
-                Results: JSON.stringify(recordset),
-                RowCount: recordset.length,
-                TotalRowCount: totalRowCount,
-                PageNumber: usePaging ? Math.floor(startRow / maxRows) + 1 : undefined,
-                PageSize: usePaging ? maxRows : undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: ''
-            };
+            const result = await provider.RunQuery({
+                SQL: input.SQL,
+                MaxRows: input.MaxRows,
+                StartRow: startRow,
+                TimeoutSeconds: timeoutSeconds,
+            }, contextUser);
+            return this.toResultType(result, startRow, input.MaxRows, timeoutSeconds, Date.now() - startTime);
         }
         catch (err) {
-            const executionTimeMs = Date.now() - startTime;
             const errorMessage = err instanceof Error ? err.message : String(err);
-            // Handle timeout
-            if (errorMessage.includes('timeout') || errorMessage.includes('Timeout')) {
-                return {
-                    QueryID: '',
-                    QueryName: 'Ad-Hoc Query',
-                    Success: false,
-                    Results: '[]',
-                    RowCount: 0,
-                    TotalRowCount: 0,
-                    PageNumber: undefined,
-                    PageSize: undefined,
-                    ExecutionTime: executionTimeMs,
-                    ErrorMessage: `Query execution exceeded ${input.TimeoutSeconds ?? 30} second timeout`
-                };
-            }
             LogError(`Ad-hoc query execution failed: ${errorMessage}`);
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: false,
-                Results: '[]',
-                RowCount: 0,
-                TotalRowCount: 0,
-                PageNumber: undefined,
-                PageSize: undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: `Query execution failed: ${errorMessage}`
-            };
+            return this.buildErrorResult(`Query execution failed: ${errorMessage}`, Date.now() - startTime);
         }
     }
     /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
+     * SECURITY: authorizes the READ itself, against the SQL that will actually run. The provider
+     * validates that the SQL is a single read statement but places no restriction on WHAT is read.
+     * Rendering comes first because composition (`{{query:"..."}}`) and templates can introduce
+     * table references the raw input never named. Every table reference must be an entity base
+     * view the caller can read UNSCOPED — CanRead with no row-level filter and no denied fields —
+     * because raw SQL applies neither (see assertFullQueryUsesReadableEntityViews). The provider
+     * renders the same input the same way and only wraps it in server-built paging and a count,
+     * so the rendered SQL is the full set of reads. Returns the refusal message, or null.
      *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
+     * `provider` is the read-only provider the SQL will run on; it supplies the platform and the
+     * entity metadata. {@link CreateAdhocSQLAuthorizer} exposes this check to the action engine.
      */
-    async executeDataAndCount(ds, dataSQL, countSQL, startRow, maxRows, deadline) {
-        const dataResult = await this.runSqlWithDeadline(ds, dataSQL, deadline);
-        const recordset = (dataResult.recordset ?? []);
-        // Total already known from the page alone (unpaged, or a short page)? Skip the count.
-        const exact = exactTotalFromPage(startRow, recordset.length, maxRows);
-        if (exact != null || !countSQL) {
-            return { recordset, totalRowCount: exact ?? recordset.length };
-        }
-        // Full page — a COUNT(*) is required to know the true total.
-        const lowerBound = startRow + recordset.length;
+    AuthorizeRenderedSQL(sqlText, provider, contextUser) {
         try {
-            const countResult = await this.runSqlWithDeadline(ds, countSQL, deadline);
-            return { recordset, totalRowCount: resolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: contextUser, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, contextUser, 'ad-hoc SQL');
+            return null;
         }
-        catch (countErr) {
-            const msg = countErr instanceof Error ? countErr.message : String(countErr);
-            LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);
-            return { recordset, totalRowCount: lowerBound };
+        catch (err) {
+            return err instanceof Error ? err.message : String(err);
         }
     }
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
-     */
-    async runSqlWithDeadline(ds, sqlText, deadline) {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            throw new Error('Query timeout exceeded');
-        }
-        let timer;
-        try {
-            return await Promise.race([
-                new sql.Request(ds).query(sqlText),
-                new Promise((_, reject) => {
-                    timer = setTimeout(() => reject(new Error('Query timeout exceeded')), remaining);
-                }),
-            ]);
-        }
-        finally {
-            if (timer) {
-                clearTimeout(timer);
-            }
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    toResultType(result, startRow, maxRows, timeoutSeconds, executionTimeMs) {
+        if (!result.Success) {
+            const message = result.ErrorMessage ?? 'Ad-hoc query failed';
+            return this.buildErrorResult(/timeout/i.test(message) ? `Query execution exceeded ${timeoutSeconds} second timeout` : message, executionTimeMs);
         }
+        const paged = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
+        return {
+            QueryID: '',
+            QueryName: 'Ad-Hoc Query',
+            Success: true,
+            Results: JSON.stringify(result.Results),
+            RowCount: result.RowCount,
+            TotalRowCount: result.TotalRowCount,
+            PageNumber: paged ? Math.floor(startRow / maxRows) + 1 : undefined,
+            PageSize: paged ? maxRows : undefined,
+            ExecutionTime: executionTimeMs,
+            ErrorMessage: ''
+        };
     }
-    buildErrorResult(errorMessage) {
+    buildErrorResult(errorMessage, executionTimeMs = 0) {
         return {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
@@ -232,7 +158,7 @@ let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
             TotalRowCount: 0,
             PageNumber: undefined,
             PageSize: undefined,
-            ExecutionTime: 0,
+            ExecutionTime: executionTimeMs,
             ErrorMessage: errorMessage
         };
     }
@@ -249,4 +175,18 @@ AdhocQueryResolver = __decorate([
     Resolver()
 ], AdhocQueryResolver);
 export { AdhocQueryResolver };
+/**
+ * The ad-hoc SQL checks MJServer registers with the action engine, so that Run Ad-hoc Query applies
+ * the same checks as {@link AdhocQueryResolver.ExecuteAdhocQuery}: the rendered SQL must be one read
+ * statement that reads only entity views the caller may read in full, and the timeout is limited by
+ * the server's request timeout.
+ * @param requestTimeoutMs the server's request timeout in milliseconds; 0 or less means no limit
+ */
+export function CreateAdhocSQLAuthorizer(requestTimeoutMs) {
+    const resolver = new AdhocQueryResolver();
+    return {
+        Authorize: (sql, provider, contextUser) => resolver.AuthorizeRenderedSQL(sql, provider, contextUser),
+        ClampTimeoutSeconds: (requestedSeconds) => ClampAdhocTimeoutSeconds(requestedSeconds, requestTimeoutMs),
+    };
+}
 //# sourceMappingURL=AdhocQueryResolver.js.map

package/dist/resolvers/AdhocQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AdhocQueryResolver.js","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAoB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,GAAG,MAAM,OAAO,CAAC;AAExB;;;GAGG;AAEH,IAAM,eAAe,GAArB,MAAM,eAAe;CAYpB,CAAA;AAVG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,CAAC;;4CAC5F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACvE;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;gDACvH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;;iDACvK;AAXhB,eAAe;IADpB,SAAS,EAAE;GACN,eAAe,CAYpB;AAED;;;;;;;;;;GAUG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;IAE1C,AAAN,KAAK,CAAC,iBAAiB,CACkB,KAAsB,EACpD,OAAmB;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACD,yDAAyD;YACzD,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC;YAClD,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC9E,CAAC;YAED,2DAA2D;YAC3D,IAAI,UAA8B,CAAC;YACnC,IAAI,CAAC;gBACD,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YACjG,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;YAClG,CAAC;YAED,2EAA2E;YAC3E,IAAI,QAAQ,GAAqB,WAAW,CAAC;YAC7C,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7F,IAAI,QAAQ,EAAE,WAAW;oBAAE,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACL,uDAAuD;YAC3D,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;YAEpD,gEAAgE;YAChE,iEAAiE;YACjE,+DAA+D;YAC/D,EAAE;YACF,sEAAsE;YACtE,+DAA+D;YAC/D,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,4EAA4E;YAC5E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YAE9E,IAAI,OAAe,CAAC;YACpB,IAAI,QAAQ,GAAkB,IAAI,CAAC;YACnC,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3C,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,WAAW;oBACxB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAC5B,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI,CAAC;YACvD,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrF,OAAO,IAAI,CAAC,gBAAgB,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,6EAA6E;YAC7E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACjE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/D,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CACjF,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE/C,kCAAkC;YAClC,OAAO;gBACH,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAClC,QAAQ,EAAE,SAAS,CAAC,MAAM;gBAC1B,aAAa,EAAE,aAAa;gBAC5B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,SAAS;gBAC1C,aAAa,EAAE,eAAe;gBAC9B,YAAY,EAAE,EAAE;aACnB,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEtE,iBAAiB;YACjB,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,OAAO;oBACH,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,CAAC;oBACX,aAAa,EAAE,CAAC;oBAChB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,SAAS;oBACnB,aAAa,EAAE,eAAe;oBAC9B,YAAY,EAAE,4BAA4B,KAAK,CAAC,cAAc,IAAI,EAAE,iBAAiB;iBACxF,CAAC;YACN,CAAC;YAED,QAAQ,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;YAC3D,OAAO;gBACH,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;gBAChB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,eAAe;gBAC9B,YAAY,EAAE,2BAA2B,YAAY,EAAE;aAC1D,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,mBAAmB,CAC7B,EAAsB,EACtB,OAAe,EACf,QAAuB,EACvB,QAAgB,EAChB,OAAsB,EACtB,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAA0B,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAA8B,CAAC;QAE5E,sFAAsF;QACtF,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnE,CAAC;QAED,6DAA6D;QAC7D,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/C,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAA4B,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACrG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,yBAAyB,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5E,QAAQ,CAAC,iEAAiE,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,EAAsB,EACtB,OAAe,EACf,QAAgB;QAEhB,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACtB,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAI,OAAO,CAAC;gBACrC,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC7B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACrF,CAAC,CAAC;aACL,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,IAAI,KAAK,EAAE,CAAC;gBACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QACzC,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,YAAY;SAC7B,CAAC;IACN,CAAC;CACJ,CAAA;AA3MS;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAE3B,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;qCADsC,eAAe;;2DAsH9D;AAzHQ,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CA6M9B"}
+{"version":3,"file":"AdhocQueryResolver.js","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAG3E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;GAGG;AAEH,IAAM,eAAe,GAArB,MAAM,eAAe;CAYpB,CAAA;AAVG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,CAAC;;4CAC5F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACvE;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;gDACvH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;;iDACvK;AAXhB,eAAe;IADpB,SAAS,EAAE;GACN,eAAe,CAYpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;IAE1C,AAAN,KAAK,CAAC,iBAAiB,CACkB,KAAsB,EACpD,OAAmB;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,sFAAsF;QACtF,2FAA2F;QAC3F,wFAAwF;QACxF,2EAA2E;QAC3E,IAAI,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,mEAAmE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClH,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACnC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,cAAc,EAAE,cAAc;aACjC,EAAE,WAAW,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,YAAY,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,OAAe,EAAE,QAA8B,EAAE,WAAiC;QAC1G,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvI,IAAI,CAAC,sCAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;YAChH,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,YAAY,CAChB,MAAsB,EACtB,QAAgB,EAChB,OAA2B,EAC3B,cAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;YAC7D,OAAO,IAAI,CAAC,gBAAgB,CACxB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,cAAc,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAChG,eAAe,CAClB,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC1E,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACrC,aAAa,EAAE,eAAe;YAC9B,YAAY,EAAE,EAAE;SACnB,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,YAAoB,EAAE,eAAe,GAAG,CAAC;QAC9D,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,eAAe;YAC9B,YAAY,EAAE,YAAY;SAC7B,CAAC;IACN,CAAC;CACJ,CAAA;AA1GS;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAE3B,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;qCADsC,eAAe;;2DAoC9D;AAvCQ,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CA4G9B;;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,gBAAwB;IAC7D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC1C,OAAO;QACH,SAAS,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC;QACpG,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;KAC1G,CAAC;AACN,CAAC"}

package/dist/resolvers/DatasetResolver.d.ts

@@ -1,4 +1,5 @@
-import { AppContext } from '../types.js';
+import { AppContext, UserPayload } from '../types.js';
+import { DatabaseProviderBase, DatasetItemFilterType, DatasetItemResultType, UserInfo } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 export declare class DatasetResultType {
     DatasetID: string;
@@ -12,7 +13,27 @@ export declare class DatasetItemFilterTypeGQL {
     ItemCode: string;
     Filter: string;
 }
-export declare class DatasetResolverExtended extends ResolverBase {
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export declare abstract class DatasetResolverBase extends ResolverBase {
+    /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+    protected RequireDatasetUser(userPayload: UserPayload): UserInfo;
+    /**
+     * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+     * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+     */
+    protected ScreenItemFilters(itemFilters: DatasetItemFilterTypeGQL[] | undefined, provider: DatabaseProviderBase, user: UserInfo): DatasetItemFilterType[] | undefined;
+    /**
+     * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+     * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+     * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+     */
+    protected ProtectEncryptedFields(items: DatasetItemResultType[], provider: DatabaseProviderBase, user: UserInfo): Promise<DatasetItemResultType[]>;
+}
+export declare class DatasetResolverExtended extends DatasetResolverBase {
     GetDatasetByName(DatasetName: string, { providers, userPayload }: AppContext, ItemFilters?: DatasetItemFilterTypeGQL[]): Promise<{
         DatasetID: string;
         DatasetName: string;
@@ -30,7 +51,7 @@ export declare class DatasetStatusResultType {
     LatestUpdateDate: Date;
     EntityUpdateDates: string;
 }
-export declare class DatasetStatusResolver extends ResolverBase {
+export declare class DatasetStatusResolver extends DatasetResolverBase {
     GetDatasetStatusByName(DatasetName: string, { providers, userPayload }: AppContext, ItemFilters?: DatasetItemFilterTypeGQL[]): Promise<{
         DatasetID: string;
         DatasetName: string;

package/dist/resolvers/DatasetResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatasetResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/DatasetResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,qBACa,iBAAiB;IAE5B,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,OAAO,EAAE,OAAO,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;IAGf,gBAAgB,EAAE,IAAI,CAAC;IAGvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBACa,wBAAwB;IAEnC,QAAQ,EAAE,MAAM,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAGD,qBACa,uBAAwB,SAAQ,YAAY;IAEjD,gBAAgB,CACc,WAAW,EAAE,MAAM,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACuC,WAAW,CAAC,EAAE,wBAAwB,EAAE;;;;;;;;CAyB/H;AAED,qBACa,uBAAuB;IAElC,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,OAAO,EAAE,OAAO,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;IAGf,gBAAgB,EAAE,IAAI,CAAC;IAGvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,qBAAsB,SAAQ,YAAY;IAE/C,sBAAsB,CACQ,WAAW,EAAE,MAAM,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACuC,WAAW,CAAC,EAAE,wBAAwB,EAAE;;;;;;;;IA0B9H;;;OAGG;IAEG,8BAA8B,CACG,YAAY,EAAE,MAAM,EAAE,EACpD,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,GAC5C,OAAO,CAAC,uBAAuB,EAAE,CAAC;CA2BtC"}
+{"version":3,"file":"DatasetResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/DatasetResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAsB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAExI,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,qBACa,iBAAiB;IAE5B,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,OAAO,EAAE,OAAO,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;IAGf,gBAAgB,EAAE,IAAI,CAAC;IAGvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBACa,wBAAwB;IAEnC,QAAQ,EAAE,MAAM,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,8BAAsB,mBAAoB,SAAQ,YAAY;IAC5D,2GAA2G;IAC3G,SAAS,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,QAAQ;IAQhE;;;OAGG;IACH,SAAS,CAAC,iBAAiB,CACzB,WAAW,EAAE,wBAAwB,EAAE,GAAG,SAAS,EACnD,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,QAAQ,GACb,qBAAqB,EAAE,GAAG,SAAS;IAUtC;;;;OAIG;cACa,sBAAsB,CACpC,KAAK,EAAE,qBAAqB,EAAE,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,qBAAqB,EAAE,CAAC;CAYpC;AAED,qBACa,uBAAwB,SAAQ,mBAAmB;IAExD,gBAAgB,CACc,WAAW,EAAE,MAAM,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACuC,WAAW,CAAC,EAAE,wBAAwB,EAAE;;;;;;;;CA2B/H;AAED,qBACa,uBAAuB;IAElC,SAAS,EAAE,MAAM,CAAC;IAGlB,WAAW,EAAE,MAAM,CAAC;IAGpB,OAAO,EAAE,OAAO,CAAC;IAGjB,MAAM,EAAE,MAAM,CAAC;IAGf,gBAAgB,EAAE,IAAI,CAAC;IAGvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,qBAAsB,SAAQ,mBAAmB;IAEtD,sBAAsB,CACQ,WAAW,EAAE,MAAM,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,EACuC,WAAW,CAAC,EAAE,wBAAwB,EAAE;;;;;;;;IA4B9H;;;OAGG;IAEG,8BAA8B,CACG,YAAY,EAAE,MAAM,EAAE,EACpD,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,UAAU,GAC5C,OAAO,CAAC,uBAAuB,EAAE,CAAC;CA4BtC"}

package/dist/resolvers/DatasetResolver.js

@@ -58,13 +58,59 @@ DatasetItemFilterTypeGQL = __decorate([
     InputType()
 ], DatasetItemFilterTypeGQL);
 export { DatasetItemFilterTypeGQL };
-let DatasetResolverExtended = class DatasetResolverExtended extends ResolverBase {
+/**
+ * Request handling shared by the dataset queries. Every read runs as the session's user, so the
+ * provider applies that user's entity read permission and row-level security per item, and every
+ * client ItemFilter passes the same AST screen as a RunView ExtraFilter before a provider sees it.
+ */
+export class DatasetResolverBase extends ResolverBase {
+    /** The session's user. A dataset read never runs without one: the provider applies no read checks then. */
+    RequireDatasetUser(userPayload) {
+        const user = this.GetUserFromPayload(userPayload);
+        if (!user) {
+            throw new Error('Dataset request refused: the session resolves to no user');
+        }
+        return user;
+    }
+    /**
+     * Screens every client ItemFilter: one statement, read-only, and subqueries only over entity base
+     * views the user can read. Throws on the first refusal. Returns the filters without null entries.
+     */
+    ScreenItemFilters(itemFilters, provider, user) {
+        if (!itemFilters)
+            return undefined;
+        itemFilters.forEach((itemFilter, index) => {
+            if (itemFilter) {
+                this.assertClientClauseUsesEntityBaseViews(itemFilter.Filter, `ItemFilters[${index}].Filter`, provider, user);
+            }
+        });
+        return itemFilters.filter((itemFilter) => itemFilter != null);
+    }
+    /**
+     * Applies the API encryption policy to each item's rows, as every other GraphQL read path does:
+     * an encrypted field the entity does not allow decrypted over the API leaves as ciphertext or the
+     * sentinel. Works on copies, because the rows can be the server cache's own frozen objects.
+     */
+    async ProtectEncryptedFields(items, provider, user) {
+        return Promise.all(items.map(async (item) => {
+            const entity = provider.EntityByName(item.EntityName);
+            if (!item.Results?.length || !entity?.EncryptedFields.some((field) => !field.AllowDecryptInAPI)) {
+                return item;
+            }
+            const rows = item.Results.map((row) => ({ ...row }));
+            return { ...item, Results: await this.ArrayFilterEncryptedFieldsForAPI(item.EntityName, rows, user, provider, 'Name') };
+        }));
+    }
+}
+let DatasetResolverExtended = class DatasetResolverExtended extends DatasetResolverBase {
     async GetDatasetByName(DatasetName, { providers, userPayload }, ItemFilters) {
         // Check API key scope authorization for dataset read
         await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+        const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+        const user = this.RequireDatasetUser(userPayload);
+        const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
         try {
-            const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
-            const result = await md.GetDatasetByName(DatasetName, ItemFilters);
+            const result = await md.GetDatasetByName(DatasetName, itemFilters, user);
             if (result) {
                 return {
                     DatasetID: result.DatasetID,
@@ -72,7 +118,7 @@ let DatasetResolverExtended = class DatasetResolverExtended extends ResolverBase
                     Success: result.Success,
                     Status: result.Status,
                     LatestUpdateDate: result.LatestUpdateDate,
-                    Results: JSON.stringify(result.Results),
+                    Results: JSON.stringify(await this.ProtectEncryptedFields(result.Results, md, user)),
                 };
             }
             else {
@@ -128,13 +174,15 @@ DatasetStatusResultType = __decorate([
     ObjectType()
 ], DatasetStatusResultType);
 export { DatasetStatusResultType };
-let DatasetStatusResolver = class DatasetStatusResolver extends ResolverBase {
+let DatasetStatusResolver = class DatasetStatusResolver extends DatasetResolverBase {
     async GetDatasetStatusByName(DatasetName, { providers, userPayload }, ItemFilters) {
         // Check API key scope authorization for dataset read
         await this.CheckAPIKeyScopeAuthorization('dataset:read', DatasetName, userPayload);
+        const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+        const user = this.RequireDatasetUser(userPayload);
+        const itemFilters = this.ScreenItemFilters(ItemFilters, md, user);
         try {
-            const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
-            const result = await md.GetDatasetStatusByName(DatasetName, ItemFilters);
+            const result = await md.GetDatasetStatusByName(DatasetName, itemFilters, user);
             if (result) {
                 return {
                     DatasetID: result.DatasetID,
@@ -160,11 +208,12 @@ let DatasetStatusResolver = class DatasetStatusResolver extends ResolverBase {
      */
     async GetMultipleDatasetStatusByName(DatasetNames, { providers, userPayload }) {
         const md = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+        const user = this.RequireDatasetUser(userPayload);
         const results = [];
         // Execute all status checks in parallel
         const statusPromises = DatasetNames.map(async (name) => {
             await this.CheckAPIKeyScopeAuthorization('dataset:read', name, userPayload);
-            return md.GetDatasetStatusByName(name);
+            return md.GetDatasetStatusByName(name, undefined, user);
         });
         const statuses = await Promise.all(statusPromises);
         for (const result of statuses) {

package/dist/resolvers/DatasetResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatasetResolver.js","sourceRoot":"","sources":["../../src/resolvers/DatasetResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAO,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAkB7B,CAAA;AAhBC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;oDACF;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;sDACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;kDACJ;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iDACL;AAGf;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACA,IAAI;2DAAC;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;kDACJ;AAjBL,iBAAiB;IAD7B,UAAU,EAAE;GACA,iBAAiB,CAkB7B;;AAGM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;CAMpC,CAAA;AAJC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;0DACH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;wDACL;AALJ,wBAAwB;IADpC,SAAS,EAAE;GACC,wBAAwB,CAMpC;;AAIM,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,YAAY;IAEjD,AAAN,KAAK,CAAC,gBAAgB,CACc,WAAmB,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAc,EACuC,WAAwC;QAE5H,qDAAqD;QACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;iBACxC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,WAAW,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF,CAAA;AA5BO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;IAE5B,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAChC,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;;;;+DAwBpF;AA7BU,uBAAuB;IADnC,QAAQ,CAAC,iBAAiB,CAAC;GACf,uBAAuB,CA8BnC;;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;CAkBnC,CAAA;AAhBC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;0DACF;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;4DACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;wDACJ;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;uDACL;AAGf;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACA,IAAI;iEAAC;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;kEACM;AAjBf,uBAAuB;IADnC,UAAU,EAAE;GACA,uBAAuB,CAkBnC;;AAGM,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,YAAY;IAE/C,AAAN,KAAK,CAAC,sBAAsB,CACQ,WAAmB,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAc,EACuC,WAAwC;QAE5H,qDAAqD;QACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACzE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;iBAC5D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,WAAW,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,8BAA8B,CACG,YAAsB,EACpD,EAAE,SAAS,EAAE,WAAW,EAAc;QAE7C,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,wCAAwC;QACxC,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEnD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;iBACjC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAhEO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC;IAElC,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAChC,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;;;;mEAwBpF;AAOK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAEpC,WAAA,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;;;2EA2BP;AAjEU,qBAAqB;IADjC,QAAQ,CAAC,uBAAuB,CAAC;GACrB,qBAAqB,CAkEjC"}
+{"version":3,"file":"DatasetResolver.js","sourceRoot":"","sources":["../../src/resolvers/DatasetResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAO,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,EAAsE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AACxI,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAkB7B,CAAA;AAhBC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;oDACF;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;sDACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;kDACJ;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iDACL;AAGf;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACA,IAAI;2DAAC;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;kDACJ;AAjBL,iBAAiB;IAD7B,UAAU,EAAE;GACA,iBAAiB,CAkB7B;;AAGM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;CAMpC,CAAA;AAJC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;0DACH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;wDACL;AALJ,wBAAwB;IADpC,SAAS,EAAE;GACC,wBAAwB,CAMpC;;AAED;;;;GAIG;AACH,MAAM,OAAgB,mBAAoB,SAAQ,YAAY;IAC5D,2GAA2G;IACjG,kBAAkB,CAAC,WAAwB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACO,iBAAiB,CACzB,WAAmD,EACnD,QAA8B,EAC9B,IAAc;QAEd,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,sBAAsB,CACpC,KAA8B,EAC9B,QAA8B,EAC9B,IAAc;QAEd,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAChG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAA4B,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1H,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,mBAAmB;IAExD,AAAN,KAAK,CAAC,gBAAgB,CACc,WAAmB,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAc,EACuC,WAAwC;QAE5H,qDAAqD;QACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;iBACrF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,WAAW,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF,CAAA;AA9BO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;IAE5B,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAChC,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;;;;+DA0BpF;AA/BU,uBAAuB;IADnC,QAAQ,CAAC,iBAAiB,CAAC;GACf,uBAAuB,CAgCnC;;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;CAkBnC,CAAA;AAhBC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;0DACF;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;4DACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;wDACJ;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;uDACL;AAGf;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACA,IAAI;iEAAC;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;kEACM;AAjBf,uBAAuB;IADnC,UAAU,EAAE;GACA,uBAAuB,CAkBnC;;AAGM,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,mBAAmB;IAEtD,AAAN,KAAK,CAAC,sBAAsB,CACQ,WAAmB,EAC9C,EAAE,SAAS,EAAE,WAAW,EAAc,EACuC,WAAwC;QAE5H,qDAAqD;QACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAC/E,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;iBAC5D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,WAAW,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,8BAA8B,CACG,YAAsB,EACpD,EAAE,SAAS,EAAE,WAAW,EAAc;QAE7C,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,wCAAwC;QACxC,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACrD,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEnD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;iBACjC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAnEO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC;IAElC,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAChC,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;;;;mEA0BpF;AAOK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAEpC,WAAA,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;;;2EA4BP;AApEU,qBAAqB;IADjC,QAAQ,CAAC,uBAAuB,CAAC;GACrB,qBAAqB,CAqEjC"}