@opensaas/stack-core 0.29.0 → 0.31.0

package/src/access/relationship-count.ts

@@ -0,0 +1,311 @@
+import type { Session, AccessContext, PrismaFilter } from './types.js'
+import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js'
+import type { FilterOperator, RelationshipCountFilterMarker } from '../filter/types.js'
+import { RELATIONSHIP_COUNT_FILTER_KEY } from '../filter/types.js'
+import { checkAccess, getRelatedListConfig } from './engine.js'
+import { getDbKey } from '../lib/case-utils.js'
+
+/**
+ * Access-scoped to-many relationship counts for the admin list view (issue
+ * #732).
+ *
+ * A to-many relationship column shows the count of the related rows the session
+ * may see — fetched in the SAME query as the row via Prisma's filtered
+ * `_count` (`_count: { select: { orders: { where: <access filter> } } }`), so no
+ * per-row query is issued and the count can never include rows the session
+ * cannot read. This module is the single place the related list's
+ * operation-level `query` access is folded into that `_count`, mirroring how
+ * `buildIncludeWithAccessControl` folds it into relation includes.
+ *
+ * It also resolves the count Filter spec's markers: Prisma cannot compare a
+ * relation count in a `where`, so a to-many relationship's Filter spec emits a
+ * {@link RELATIONSHIP_COUNT_FILTER_KEY} marker that
+ * {@link resolveRelationshipCountFilters} turns into an access-scoped
+ * `{ id: { in } }` before the query runs — never leaking counts of related rows
+ * the session cannot see.
+ */
+
+type CountArgs = {
+  session: Session | null
+  context: AccessContext
+}
+
+/**
+ * Whether a field is a to-many relationship — the only field kind that carries a
+ * relationship count (a to-one relationship has at most one related row).
+ */
+export function isToManyRelationshipField(field: FieldConfig | undefined): boolean {
+  return (
+    field?.type === 'relationship' &&
+    'many' in field &&
+    field.many === true &&
+    'ref' in field &&
+    typeof field.ref === 'string' &&
+    field.ref.length > 0
+  )
+}
+
+/** The per-relation entry the count `_count.select` uses for one relationship. */
+type CountAccessEntry =
+  | { kind: 'all' } // related list fully readable → count every related row
+  | { kind: 'scoped'; where: PrismaFilter } // count only rows matching the access filter
+  | { kind: 'denied' } // related list not readable at all → count is always 0
+
+/**
+ * Resolve the related list's operation-level `query` access for one to-many
+ * relationship into the entry its `_count` select needs. Returns `null` when the
+ * field is not a resolvable to-many relationship.
+ */
+async function relationshipCountAccessEntry(
+  field: FieldConfig | undefined,
+  args: CountArgs,
+  config: OpenSaasConfig,
+): Promise<CountAccessEntry | null> {
+  if (!field || !isToManyRelationshipField(field) || !('ref' in field)) {
+    return null
+  }
+  const ref = field.ref
+  if (typeof ref !== 'string') return null
+  const related = getRelatedListConfig(ref, config)
+  if (!related) return null
+
+  const queryAccess = related.listConfig.access?.operation?.query
+  const result = await checkAccess(queryAccess, { session: args.session, context: args.context })
+
+  if (result === false) return { kind: 'denied' }
+  if (typeof result === 'object') return { kind: 'scoped', where: result }
+  return { kind: 'all' }
+}
+
+/**
+ * Build the object to place at `include._count.select` for a list's to-many
+ * relationships, with each related list's `query` access folded into the
+ * per-relation `where` so the returned counts are access-scoped. A relationship
+ * whose related list is fully denied is omitted (its count renders as 0). Returns
+ * `undefined` when the list has no countable to-many relationships.
+ */
+export async function buildRelationshipCountSelect(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  args: CountArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown> | undefined> {
+  const select: Record<string, unknown> = {}
+  for (const [fieldName, field] of Object.entries(listConfig.fields)) {
+    const entry = await relationshipCountAccessEntry(field, args, config)
+    if (entry === null || entry.kind === 'denied') continue
+    select[fieldName] = entry.kind === 'scoped' ? { where: entry.where } : true
+  }
+  return Object.keys(select).length > 0 ? select : undefined
+}
+
+/** Read a to-many relationship's count off a fetched row's `_count` payload. */
+function readRelationshipCount(row: Record<string, unknown>, fieldName: string): number {
+  const counts = row._count
+  if (counts && typeof counts === 'object') {
+    const value = (counts as Record<string, unknown>)[fieldName]
+    if (typeof value === 'number') return value
+  }
+  return 0
+}
+
+/** Whether a count satisfies a Filter operator/value comparison. */
+function matchesCount(count: number, operator: FilterOperator, value: number): boolean {
+  switch (operator) {
+    case 'eq':
+      return count === value
+    case 'gt':
+      return count > value
+    case 'gte':
+      return count >= value
+    case 'lt':
+      return count < value
+    case 'lte':
+      return count <= value
+  }
+}
+
+/** Minimal shape the resolver needs off the secured `context.db` delegate. */
+interface CountFindManyDelegate {
+  findMany: (args: { include: { _count: { select: Record<string, unknown> } } }) => Promise<unknown>
+}
+
+function asCountDelegate(value: unknown): CountFindManyDelegate | null {
+  if (value && typeof value === 'object' && 'findMany' in value) {
+    const candidate = value as { findMany?: unknown }
+    if (typeof candidate.findMany === 'function') {
+      return value as CountFindManyDelegate
+    }
+  }
+  return null
+}
+
+/** Extract the `RelationshipCountFilterMarker` from a condition value, if present. */
+function readCountMarker(value: unknown): RelationshipCountFilterMarker | null {
+  if (!value || typeof value !== 'object') return null
+  const marker = (value as Record<string, unknown>)[RELATIONSHIP_COUNT_FILTER_KEY]
+  if (!marker || typeof marker !== 'object') return null
+  const { operator, value: n } = marker as { operator?: unknown; value?: unknown }
+  if (
+    (operator === 'eq' ||
+      operator === 'gt' ||
+      operator === 'gte' ||
+      operator === 'lt' ||
+      operator === 'lte') &&
+    typeof n === 'number'
+  ) {
+    return { operator, value: n }
+  }
+  return null
+}
+
+/**
+ * Resolve one to-many relationship count-filter marker into a Prisma `where`
+ * fragment constraining the parent by id. Runs a single access-scoped read
+ * through the SECURED context — never a raw/unscoped query and never a per-row
+ * query — computing the access-visible count per parent and keeping the ids
+ * whose count satisfies the comparison. A fully-denied related list makes every
+ * count 0, resolved without any query.
+ */
+async function resolveOneCountFilter(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listKey: string,
+  fieldName: string,
+  marker: RelationshipCountFilterMarker,
+  args: CountArgs,
+  config: OpenSaasConfig,
+): Promise<PrismaFilter> {
+  const field = listConfig.fields[fieldName]
+  const entry = await relationshipCountAccessEntry(field, args, config)
+
+  // Not resolvable (shouldn't happen for a marker the spec emitted) → no-op.
+  if (entry === null) return {}
+
+  // Related list fully denied → every parent's access-visible count is 0.
+  if (entry.kind === 'denied') {
+    return matchesCount(0, marker.operator, marker.value) ? {} : { id: { in: [] } }
+  }
+
+  const delegate = asCountDelegate(args.context.db[getDbKey(listKey)])
+  if (!delegate) return {}
+
+  const countSelect = entry.kind === 'scoped' ? { where: entry.where } : true
+  // This over-fetches the parent's scalar columns — it reads only `id` + `_count`
+  // per row yet materialises every scalar. It is left un-narrowed on purpose: the
+  // secured `context.db` `findMany` does NOT honour Prisma `select` (it
+  // warns-and-ignores it and returns the full access-filtered record — see
+  // `warnIfSelectIgnored` in context/index.ts and the "Narrowing Reads" note in
+  // packages/core/CLAUDE.md). The only supported narrowing is `include`/fragment
+  // `query`, neither of which can drop scalar columns. So adding
+  // `select: { id: true, _count: {...} }` here would be a silent no-op that also
+  // trips the ignore-warning, not a real projection. The count stays access-scoped
+  // via the filtered `_count` include below regardless; trimming the projection
+  // would first require the read pipeline to honour `select`.
+  const rows = await delegate.findMany({
+    include: { _count: { select: { [fieldName]: countSelect } } },
+  })
+
+  const matchingIds: string[] = []
+  if (Array.isArray(rows)) {
+    for (const row of rows) {
+      if (!row || typeof row !== 'object') continue
+      const record = row as Record<string, unknown>
+      if (matchesCount(readRelationshipCount(record, fieldName), marker.operator, marker.value)) {
+        matchingIds.push(String(record.id))
+      }
+    }
+  }
+  return { id: { in: matchingIds } }
+}
+
+/**
+ * Merge a filter-member's non-resolved sibling conditions with a resolved
+ * access-scoped fragment (e.g. a count marker's `{ id: { in } }`, or a to-one
+ * label filter's access-scoped `is`). With no siblings (the guaranteed case
+ * today) this is just the resolved fragment. When a sibling shares a key with
+ * the resolved fragment — a contrived case that cannot arise under the current
+ * one-condition-per-member invariant — both are ANDed so neither condition is
+ * silently lost. Shared by both relationship resolvers in this module and in
+ * `relationship-label-filter.ts`.
+ */
+export function mergeResolvedMember(
+  siblings: Record<string, unknown>,
+  resolved: Record<string, unknown>,
+): Record<string, unknown> {
+  if (Object.keys(siblings).length === 0) return resolved
+  const collides = Object.keys(resolved).some((key) => key in siblings)
+  return collides ? { AND: [siblings, resolved] } : { ...siblings, ...resolved }
+}
+
+/**
+ * Replace any to-many relationship count-filter markers in a filter `where` with
+ * access-scoped `{ id: { in } }` fragments. Markers only ever appear as
+ * top-level AND members (the pure filter engine pushes each field condition into
+ * the top-level AND, and never nests a marker inside the free-text OR), so this
+ * walks only the top level. Returns the `where` unchanged when it contains no
+ * markers, so lists without count filters pay nothing.
+ */
+export async function resolveRelationshipCountFilters(
+  where: Record<string, unknown> | undefined,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listKey: string,
+  args: CountArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown> | undefined> {
+  if (!where) return where
+
+  const andValue = where.AND
+  const members: Array<Record<string, unknown>> = Array.isArray(andValue)
+    ? (andValue as Array<Record<string, unknown>>)
+    : [where]
+
+  const findMarker = (
+    member: Record<string, unknown>,
+  ): { field: string; marker: RelationshipCountFilterMarker } | null => {
+    for (const key of Object.keys(member)) {
+      if (!isToManyRelationshipField(listConfig.fields[key])) continue
+      const marker = readCountMarker(member[key])
+      if (marker) return { field: key, marker }
+    }
+    return null
+  }
+
+  if (!members.some((member) => findMarker(member) !== null)) {
+    return where
+  }
+
+  const resolvedMembers: Array<Record<string, unknown>> = []
+  for (const member of members) {
+    const found = findMarker(member)
+    if (!found) {
+      resolvedMembers.push(member)
+      continue
+    }
+    const resolved = await resolveOneCountFilter(
+      listConfig,
+      listKey,
+      found.field,
+      found.marker,
+      args,
+      config,
+    )
+    // Preserve any sibling conditions co-present on this member rather than
+    // replacing it wholesale with the resolved `{ id: { in } }`. The filter engine
+    // currently guarantees each AND-member (and the no-AND single object) carries
+    // exactly one field condition, so `siblings` is empty today and this equals the
+    // previous wholesale replacement — but if a future engine change ever merged
+    // multiple conditions into one member, spreading keeps the marker's siblings
+    // from being silently dropped.
+    const siblings: Record<string, unknown> = { ...member }
+    delete siblings[found.field]
+    resolvedMembers.push(mergeResolvedMember(siblings, resolved))
+  }
+
+  // Drop no-op members (a fully-denied related list where 0 satisfies the
+  // comparison resolves to `{}` — matches everything, so it need not be ANDed).
+  const effective = resolvedMembers.filter((member) => Object.keys(member).length > 0)
+  if (effective.length === 0) return undefined
+  return effective.length === 1 ? effective[0] : { AND: effective }
+}

package/src/access/relationship-label-filter.test.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect } from 'vitest'
+import { list } from '../config/index.js'
+import { text, relationship, integer } from '../fields/index.js'
+import type { OpenSaasConfig } from '../config/types.js'
+import type { AccessContext } from './types.js'
+import {
+  resolveRelationshipLabelFilters,
+  isToOneRelationshipField,
+} from './relationship-label-filter.js'
+
+/**
+ * Access-scoped to-one relationship label filters (issue #749). Verifies that
+ * `author:Ada` → `{ author: { is: { name: { contains: 'Ada' } } } }` gets the
+ * related list's `query` access folded into the nested `is` clause, so a
+ * session can never distinguish parent rows by a related field it cannot
+ * itself read.
+ */
+
+// Post is fully open; User (the `author` relation target) is scoped so only
+// active users are queryable; Widget ships fully closed (no access block).
+function makeConfig(): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+    lists: {
+      User: list({
+        fields: { name: text(), active: integer() },
+        access: { operation: { query: () => ({ active: { equals: 1 } }) } },
+      }),
+      Post: list({
+        fields: {
+          title: text(),
+          views: integer(),
+          author: relationship({ ref: 'User.posts' }),
+          widget: relationship({ ref: 'Widget' }),
+        },
+        access: { operation: { query: () => true } },
+      }),
+      // Widget ships closed (no access block) → query denied by default.
+      Widget: list({ fields: { name: text() } }),
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+  } as any
+}
+
+function makeContext(): AccessContext {
+  return {
+    session: null,
+    _isSudo: false,
+    _resolveOutputCounter: { depth: 0 },
+    db: {},
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+  } as any
+}
+
+describe('isToOneRelationshipField', () => {
+  const config = makeConfig()
+  const postFields = config.lists.Post.fields
+
+  it('is true only for a to-one relationship', () => {
+    expect(isToOneRelationshipField(postFields.author)).toBe(true)
+    expect(isToOneRelationshipField(postFields.widget)).toBe(true)
+    expect(isToOneRelationshipField(postFields.title)).toBe(false)
+  })
+})
+
+describe('resolveRelationshipLabelFilters', () => {
+  it('returns the where unchanged when there are no label-filter members', async () => {
+    const config = makeConfig()
+    const where = { title: { contains: 'hello' } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toBe(where)
+  })
+
+  it("ANDs the related list's access filter into the nested `is` clause", async () => {
+    const config = makeConfig()
+    const where = { author: { is: { name: { contains: 'Ada' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } },
+    })
+  })
+
+  it('leaves the member unchanged when the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        Tag: list({ fields: { name: text() }, access: { operation: { query: () => true } } }),
+        Post: list({ fields: { title: text(), tag: relationship({ ref: 'Tag' }) } }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const where = { tag: { is: { name: { contains: 'news' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual(where)
+  })
+
+  it('resolves a fully denied related list to a never-matching member (no leak)', async () => {
+    const config = makeConfig()
+    const where = { widget: { is: { name: { contains: 'Gadget' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({ id: { in: [] } })
+  })
+
+  it('preserves sibling conditions, ANDing the resolved id constraint for a denied member', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ title: { contains: 'hello' } }, { widget: { is: { name: { contains: 'Gadget' } } } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [{ title: { contains: 'hello' } }, { id: { in: [] } }],
+    })
+  })
+
+  it('preserves sibling conditions alongside the access-scoped nested `is` clause', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ title: { contains: 'hello' } }, { author: { is: { name: { contains: 'Ada' } } } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [
+        { title: { contains: 'hello' } },
+        { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+      ],
+    })
+  })
+
+  it('composes with a to-many count marker member left untouched by this resolver', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ author: { is: { name: { contains: 'Ada' } } } }, { views: { gt: 10 } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [
+        { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+        { views: { gt: 10 } },
+      ],
+    })
+  })
+})

package/src/access/relationship-label-filter.ts

@@ -0,0 +1,140 @@
+import type { Session, AccessContext } from './types.js'
+import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js'
+import { checkAccess, getRelatedListConfig } from './engine.js'
+import { mergeResolvedMember } from './relationship-count.js'
+
+/**
+ * Access-scoped to-one relationship label filters for the admin list view
+ * (issue #749).
+ *
+ * A to-one relationship's Filter spec (`author:Ada` → `{ author: { is: { name:
+ * { contains: 'Ada' } } } }`) is a pure mapper (see `relationship()` in
+ * `fields/index.ts`) — it has no way to consult the related list's access
+ * control, so the nested `is` clause it emits runs as an unscoped Prisma
+ * sub-filter against the related table. The parent list's own access filter
+ * still scopes which parent rows are visible, but the nested condition itself
+ * is evaluated with no reference to the related list's `query` access — a
+ * session could distinguish parent rows by a related field it is not itself
+ * allowed to read (e.g. binary-searching `author:A`, `author:Ad`, `author:Ada`
+ * against a `User` list it cannot query).
+ *
+ * This module is the single place the related list's operation-level `query`
+ * access is folded into that nested `is` clause, mirroring how
+ * `relationship-count.ts` folds it into `_count` selects and count-filter
+ * markers. A fully denied related list makes the member never match — the
+ * token cannot be used to confirm or rule out a value on a field the session
+ * cannot read (narrowing-only, matching the count resolver's denied path).
+ */
+
+type LabelFilterArgs = {
+  session: Session | null
+  context: AccessContext
+}
+
+/**
+ * Whether a field is a to-one relationship — the only field kind whose Filter
+ * spec emits a nested `{ is: {...} } }` condition against the related list's
+ * label field.
+ */
+export function isToOneRelationshipField(field: FieldConfig | undefined): boolean {
+  return (
+    field?.type === 'relationship' &&
+    !('many' in field && field.many === true) &&
+    'ref' in field &&
+    typeof field.ref === 'string' &&
+    field.ref.length > 0
+  )
+}
+
+/** Narrow a filter member's field value to a `{ is: {...} } }` clause, if it is one. */
+function readIsClause(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object') return null
+  const isValue = (value as Record<string, unknown>).is
+  if (!isValue || typeof isValue !== 'object') return null
+  return isValue as Record<string, unknown>
+}
+
+/**
+ * Resolve one to-one relationship label-filter member into an access-scoped
+ * condition by ANDing the related list's `query` access filter into the nested
+ * `is` clause. Returns `{ id: { in: [] } }` (never matches) when the related
+ * list is fully denied, the original member unchanged when it is fully
+ * readable, and the `is` clause ANDed with the access filter otherwise.
+ */
+async function resolveOneLabelFilter(
+  field: FieldConfig,
+  fieldName: string,
+  isClause: Record<string, unknown>,
+  args: LabelFilterArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown>> {
+  if (!('ref' in field) || typeof field.ref !== 'string') {
+    return { [fieldName]: { is: isClause } }
+  }
+  const related = getRelatedListConfig(field.ref, config)
+  if (!related) return { [fieldName]: { is: isClause } }
+
+  const queryAccess = related.listConfig.access?.operation?.query
+  const result = await checkAccess(queryAccess, { session: args.session, context: args.context })
+
+  if (result === false) return { id: { in: [] } }
+  if (result === true) return { [fieldName]: { is: isClause } }
+  return { [fieldName]: { is: { AND: [result, isClause] } } }
+}
+
+/**
+ * Replace any to-one relationship label-filter members in a filter `where`
+ * with access-scoped equivalents. Label-filter members only ever appear as
+ * top-level AND members (the relationship Filter spec does not declare
+ * `freeText`, so it never participates in the free-text OR), so this walks
+ * only the top level. Returns the `where` unchanged when it contains no such
+ * members, so lists without to-one relationship filters pay nothing.
+ */
+export async function resolveRelationshipLabelFilters(
+  where: Record<string, unknown> | undefined,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  args: LabelFilterArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown> | undefined> {
+  if (!where) return where
+
+  const andValue = where.AND
+  const members: Array<Record<string, unknown>> = Array.isArray(andValue)
+    ? (andValue as Array<Record<string, unknown>>)
+    : [where]
+
+  const findLabelFilter = (
+    member: Record<string, unknown>,
+  ): { field: string; isClause: Record<string, unknown> } | null => {
+    for (const key of Object.keys(member)) {
+      const field = listConfig.fields[key]
+      if (!isToOneRelationshipField(field)) continue
+      const isClause = readIsClause(member[key])
+      if (!isClause) continue
+      return { field: key, isClause }
+    }
+    return null
+  }
+
+  if (!members.some((member) => findLabelFilter(member) !== null)) {
+    return where
+  }
+
+  const resolvedMembers: Array<Record<string, unknown>> = []
+  for (const member of members) {
+    const found = findLabelFilter(member)
+    if (!found) {
+      resolvedMembers.push(member)
+      continue
+    }
+    const field = listConfig.fields[found.field]
+    const resolved = await resolveOneLabelFilter(field, found.field, found.isClause, args, config)
+
+    const siblings: Record<string, unknown> = { ...member }
+    delete siblings[found.field]
+    resolvedMembers.push(mergeResolvedMember(siblings, resolved))
+  }
+
+  return resolvedMembers.length === 1 ? resolvedMembers[0] : { AND: resolvedMembers }
+}

package/src/config/index.ts

@@ -150,6 +150,12 @@ export type {
   UIConfig,
   ListUIConfig,
   ListViewUIConfig,
+  BulkAction,
+  BulkActionContext,
+  BulkActionResult,
+  BulkActionVariant,
+  ItemViewUIConfig,
+  RelationshipItemViewConfig,
   ThemeConfig,
   ThemePreset,
   ThemeColors,