@opensaas/stack-core 0.31.1 → 0.33.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @opensaas/stack-core@0.31.1 build /home/runner/work/stack/stack/packages/core
+> @opensaas/stack-core@0.33.0 build /home/runner/work/stack/stack/packages/core
 > tsc
 

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @opensaas/stack-core
 
+## 0.33.0
+
+### Minor Changes
+
+- [#838](https://github.com/OpenSaasAU/stack/pull/838) [`0caf680`](https://github.com/OpenSaasAU/stack/commit/0caf68007e41b69f1a5d5f74fb15df2548a559dc) Thanks [@borisno2](https://github.com/borisno2)! - **Behavior change:** reads that previously returned deeply-nested relation data unscoped now throw instead. A caller-supplied `include` nested past the Access Filter's read-include depth cap (`READ_INCLUDE_MAX_DEPTH`, 5) used to fail OPEN — the relation was fetched with no row filter and its fields were never access-checked or `resolveOutput`-processed. It now fails CLOSED: the read throws a new `AccessScopeDepthExceededError` (exported from `@opensaas/stack-core`) naming the list, relation field, and depth reached, instead of returning unscoped data.
+
+  ```typescript
+  import { AccessScopeDepthExceededError } from '@opensaas/stack-core'
+
+  try {
+    await context.db.post.findMany({
+      include: { author: { include: {/* … nested past the depth cap */} } },
+    })
+  } catch (err) {
+    if (err instanceof AccessScopeDepthExceededError) {
+      // err.listKey / err.fieldKey / err.depth — restructure into shallower reads.
+    }
+  }
+  ```
+
+  An ordinary read with no caller `include`, or one within the depth limit, is unaffected — the auto-include still stops silently at the cap, matching prior behavior. A read issued from inside a `resolveOutput`/virtual-field hook now also row-scopes its immediate relations (previously it skipped scoping entirely at that point). Field-level read access and `resolveOutput` hooks are now applied at every nesting depth on the returned rows, with no independent cap of their own. See ADR-0022 and issue [#830](https://github.com/OpenSaasAU/stack/issues/830).
+
+### Patch Changes
+
+- [#839](https://github.com/OpenSaasAU/stack/pull/839) [`1a3f51d`](https://github.com/OpenSaasAU/stack/commit/1a3f51d5837d6e5244ccf04c3d14c41c264701c3) Thanks [@borisno2](https://github.com/borisno2)! - Fix `beforeTransaction`/`afterTransaction` hooks not firing for lists reachable only past the involved-list enumeration's old fixed depth cap. These hooks now fire for every list a write touches regardless of nesting depth, so compensation logic that previously never ran will start running — that was a bug, not a contract.
+
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

package/dist/access/access-filter.d.ts

@@ -15,17 +15,69 @@ import type { OpenSaasConfig, FieldConfig } from '../config/types.js';
  * `docs/adr/0001-access-control-is-a-two-phase-read.md` and the access-control
  * glossary in `CONTEXT.md`.
  */
+/** A single relation entry in a Prisma `include` object (see below). */
+type IncludeEntry = boolean | {
+    where?: PrismaFilter;
+    include?: IncludeObject;
+    take?: number;
+};
+type IncludeObject = Record<string, IncludeEntry>;
+/**
+ * The result of trying to compute an access-controlled include for a list's
+ * fields. `buildIncludeWithAccessControl` used to collapse three unrelated
+ * outcomes into a single overloaded `undefined`: "inside a resolveOutput
+ * context", "hit the depth cap", and "no relationships to scope" all looked
+ * identical to callers, which is what let a depth-capped relation pass
+ * through unscoped (issue #830). This discriminated result keeps them
+ * distinguishable all the way to `mergeIncludeWithAccessControl`, which is the
+ * only place that knows whether a caller actually asked for the part that
+ * couldn't be scoped.
+ *
+ * - `scoped`: relationships were found and (to the extent depth allows)
+ *   access-controlled; `include` is the resulting tree.
+ * - `nothing-to-scope`: the list genuinely has no relationships to scope, OR
+ *   we are inside a resolveOutput/virtual-field context and deliberately did
+ *   not descend into a relation's own nested relations. Passing the caller's
+ *   include through unchanged here is correct, not a leak.
+ * - `depth-exceeded`: we could not evaluate this level at all because it sits
+ *   at or past `READ_INCLUDE_MAX_DEPTH`. This is a denial: a caller `include`
+ *   that reaches here must be rejected, not passed through.
+ */
+export type AccessIncludeResult = {
+    kind: 'scoped';
+    include: RichIncludeObject;
+} | {
+    kind: 'nothing-to-scope';
+} | {
+    kind: 'depth-exceeded';
+};
+/** A relation entry in the rich, provenance-carrying tree `buildIncludeWithAccessControl` builds internally. */
+type RichIncludeEntry = {
+    where?: PrismaFilter;
+    nested: AccessIncludeResult;
+};
+type RichIncludeObject = Record<string, RichIncludeEntry>;
 /**
- * Build Prisma include object with access control filters
- * This allows us to filter relationships at the database level instead of in memory
+ * Collapse an `AccessIncludeResult` to the plain Prisma `include` shape used
+ * when there is no caller-supplied include to merge against (the direct
+ * auto-include path). `nothing-to-scope` and `depth-exceeded` both become
+ * `undefined` here — at this call site nothing was explicitly requested past
+ * either boundary, so there is nothing to deny.
+ */
+export declare function toPrismaInclude(result: AccessIncludeResult): IncludeObject | undefined;
+/**
+ * Build the access-controlled include for a list's fields.
+ *
+ * This allows us to filter relationships at the database level instead of in
+ * memory. Returns an {@link AccessIncludeResult} rather than a plain include
+ * object so that `mergeIncludeWithAccessControl` can tell a genuine "nothing
+ * to scope" apart from "the engine hit its depth cap" (see that type's doc
+ * comment and ADR-0022).
  */
 export declare function buildIncludeWithAccessControl(fieldConfigs: Record<string, FieldConfig>, args: {
     session: Session | null;
     context: AccessContext;
-}, config: OpenSaasConfig, depth?: number, visitedLists?: readonly string[]): Promise<Record<string, boolean | {
-    where?: PrismaFilter;
-    include?: Record<string, boolean | /*elided*/ any>;
-}> | undefined>;
+}, config: OpenSaasConfig, depth?: number, visitedLists?: readonly string[]): Promise<AccessIncludeResult>;
 /**
  * Merge a caller-supplied `include` with the access-controlled include — phase-1
  * row/relation scoping for explicit caller selections.
@@ -49,22 +101,25 @@ export declare function buildIncludeWithAccessControl(fieldConfigs: Record<strin
  * - If the caller names a key that is NOT a config-declared relationship, it is
  *   passed through unchanged (access control does not govern it).
  *
- * The access-controlled include is recursive to `MAX_DEPTH` (see
- * `buildIncludeWithAccessControl`); beyond that depth no auto-include exists, so
- * deeper caller selections pass through unscoped — consistent with the existing
- * auto-include behaviour.
+ * `accessControlledInclude` is the {@link AccessIncludeResult} for THIS level:
+ * - `nothing-to-scope` → nothing to merge against (the list has no
+ *   relationships, or we're inside a resolveOutput context where the caller
+ *   include is irrelevant to begin with). Pass the caller's include through
+ *   unchanged — this is a non-denial outcome, not "every relation denied".
+ * - `depth-exceeded` → the engine could not compute a scope for THIS level at
+ *   all because it sits at or past `READ_INCLUDE_MAX_DEPTH`. If the caller
+ *   named anything here, that is exactly the case that used to pass through
+ *   unscoped (issue #830): throw `AccessScopeDepthExceededError` instead. An
+ *   empty caller include at this level (nothing further requested) is not an
+ *   error — there's simply nothing to do.
+ * - `scoped` → the normal per-relation merge below: a declared relationship
+ *   ABSENT from the access include was denied (drop it); one PRESENT is used
+ *   as the base, AND-combining `where`s and recursing into nested includes.
  *
- * `accessControlledInclude` being `undefined` is NOT "every relation denied". It
- * means no access-controlled include was computed at all — a non-denial outcome
- * that `buildIncludeWithAccessControl` returns when inside a `resolveOutput`/
- * virtual-field context, at `MAX_DEPTH`, or when the list has no relationships.
- * In every one of those cases there is nothing to merge against, so the caller's
- * `include` is passed through unchanged (matching the prior `args.include || …`
- * fallback). This is distinct from an `undefined` ENTRY inside a defined access
- * include, which DOES mean the relation was denied and must be dropped (see the
- * per-relation loop below). Only the whole-object `undefined` is a passthrough.
+ * `listKey` and `depth` are carried only to build a useful
+ * `AccessScopeDepthExceededError` message; they do not affect merge behaviour.
  */
-export declare function mergeIncludeWithAccessControl(callerInclude: Record<string, unknown>, accessControlledInclude: Record<string, unknown> | undefined, fieldConfigs: Record<string, FieldConfig>, config: OpenSaasConfig): Record<string, unknown>;
+export declare function mergeIncludeWithAccessControl(callerInclude: Record<string, unknown>, accessControlledInclude: AccessIncludeResult, fieldConfigs: Record<string, FieldConfig>, config: OpenSaasConfig, listKey: string, depth?: number): Record<string, unknown>;
 /**
  * Remove keys that correspond to `virtual` fields from a Prisma `include`
  * object, recursing into nested relationship includes using the related
@@ -82,4 +137,5 @@ export declare function mergeIncludeWithAccessControl(callerInclude: Record<stri
  * no effect on whether the value appears in the result (#628).
  */
 export declare function stripVirtualFieldsFromInclude(include: Record<string, unknown> | undefined, fieldConfigs: Record<string, FieldConfig>, config: OpenSaasConfig): Record<string, unknown> | undefined;
+export {};
 //# sourceMappingURL=access-filter.d.ts.map

package/dist/access/access-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-filter.d.ts","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGrE;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,EACD,MAAM,EAAE,cAAc,EACtB,KAAK,GAAE,MAAU,EAIjB,YAAY,GAAE,SAAS,MAAM,EAAO;YAeI,YAAY;cAAY,MAAM,CAAC,MAAM,2BAAe;gBAiE7F;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,MAAM,EAAE,cAAc,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmEzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,MAAM,EAAE,cAAc,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAgCrC"}
+{"version":3,"file":"access-filter.d.ts","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAKrE;;;;;;;;;;;;;;GAcG;AAEH,wEAAwE;AACxE,KAAK,YAAY,GAAG,OAAO,GAAG;IAAE,KAAK,CAAC,EAAE,YAAY,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAC9F,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE9B,gHAAgH;AAChH,KAAK,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAC7E,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAqBzD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,GAAG,SAAS,CAOtF;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,EACD,MAAM,EAAE,cAAc,EACtB,KAAK,GAAE,MAAU,EAIjB,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAmE9B;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,uBAAuB,EAAE,mBAAmB,EAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,MAAU,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2EzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,MAAM,EAAE,cAAc,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAgCrC"}

package/dist/access/access-filter.js

@@ -1,39 +1,67 @@
 import { checkAccess, getRelatedListConfig } from './engine.js';
+import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
+import { AccessScopeDepthExceededError } from './errors.js';
 /**
- * Access Filter — phase 1 of the two-phase read (pre-query).
- *
- * This module scopes which rows and relationships the database is allowed to
- * return, before the query runs. It evaluates *operation-level* `query` access
- * on related lists and turns the results into a Prisma `include`/`where` clause,
- * so denied rows and relations never leave the database.
- *
- * Phase 2 (post-query field stripping + `resolveOutput` + virtual computation)
- * lives in `field-visibility.ts`. The two phases cannot be merged: virtual
- * fields are computed in JavaScript and post-query field access can depend on
- * the fetched row, neither of which is expressible in SQL. See
- * `docs/adr/0001-access-control-is-a-two-phase-read.md` and the access-control
- * glossary in `CONTEXT.md`.
+ * Collapse a rich, provenance-carrying include entry down to the plain
+ * Prisma-shaped form. A `nested` result that is `depth-exceeded` or
+ * `nothing-to-scope` contributes no `include` key — this is the AUTO-include
+ * silently stopping, which is correct when no caller asked for anything past
+ * this point (see `AccessIncludeResult` doc comment).
  */
+function toPrismaEntry(entry) {
+    const result = {};
+    if (entry.where)
+        result.where = entry.where;
+    if (entry.nested.kind === 'scoped') {
+        const nestedInclude = toPrismaInclude(entry.nested);
+        if (nestedInclude && Object.keys(nestedInclude).length > 0) {
+            result.include = nestedInclude;
+        }
+    }
+    return Object.keys(result).length > 0 ? result : true;
+}
+/**
+ * Collapse an `AccessIncludeResult` to the plain Prisma `include` shape used
+ * when there is no caller-supplied include to merge against (the direct
+ * auto-include path). `nothing-to-scope` and `depth-exceeded` both become
+ * `undefined` here — at this call site nothing was explicitly requested past
+ * either boundary, so there is nothing to deny.
+ */
+export function toPrismaInclude(result) {
+    if (result.kind !== 'scoped')
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(result.include)) {
+        out[key] = toPrismaEntry(entry);
+    }
+    return out;
+}
 /**
- * Build Prisma include object with access control filters
- * This allows us to filter relationships at the database level instead of in memory
+ * Build the access-controlled include for a list's fields.
+ *
+ * This allows us to filter relationships at the database level instead of in
+ * memory. Returns an {@link AccessIncludeResult} rather than a plain include
+ * object so that `mergeIncludeWithAccessControl` can tell a genuine "nothing
+ * to scope" apart from "the engine hit its depth cap" (see that type's doc
+ * comment and ADR-0022).
  */
 export async function buildIncludeWithAccessControl(fieldConfigs, args, config, depth = 0, 
 // List names already on the path from the root to here. Used to detect
 // relationship cycles (A → B → … → A) and stop the auto-include from
 // re-descending them. Seed it with the root list name at the call site.
 visitedLists = []) {
-    const MAX_DEPTH = 5;
-    if (depth >= MAX_DEPTH) {
-        return undefined;
-    }
-    // Skip auto-including relationships when inside a resolveOutput hook
-    // This prevents infinite loops when hooks make DB queries that include
-    // relationships back to the same entity (e.g., User virtual field queries Posts
-    // which includes author back to User, triggering the virtual field again)
-    if (args.context._resolveOutputCounter.depth > 0) {
-        return undefined;
+    if (depth >= READ_INCLUDE_MAX_DEPTH) {
+        return { kind: 'depth-exceeded' };
     }
+    // Inside a resolveOutput/virtual-field context we still scope each immediate
+    // relation (its own access `where`), but do not auto-expand INTO its nested
+    // relations — no recursive call is made, so a self-referential relation
+    // terminates after one level regardless of cycles. This prevents the
+    // infinite loops the original passthrough guarded against (hooks making DB
+    // queries that include relationships back to the same entity), while still
+    // row-scoping the relation itself rather than skipping scoping altogether
+    // (issue #830's second trigger).
+    const insideResolveOutput = args.context._resolveOutputCounter.depth > 0;
     const include = {};
     let hasRelationships = false;
     for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
@@ -51,12 +79,7 @@ visitedLists = []) {
                 if (accessResult === false) {
                     continue;
                 }
-                // Build the include entry
-                const includeEntry = {};
-                // If access returns a filter, add it to the where clause
-                if (typeof accessResult === 'object') {
-                    includeEntry.where = accessResult;
-                }
+                const where = typeof accessResult === 'object' ? accessResult : undefined;
                 // Cycle guard: if the related list already appears on the path from the
                 // root, DO NOT auto-include its relationships again. On a cyclic
                 // readable-relationship graph (A → B → … → A) the depth-first walk would
@@ -68,20 +91,16 @@ visitedLists = []) {
                 // genuine single-level fetch, not a re-expansion of the full auto-include.
                 // The relation itself is still included (as a FLAT fetch of its own
                 // columns); only its onward relationships are pruned at the back-edge.
+                let nested = { kind: 'nothing-to-scope' };
                 const relatedListName = relatedConfig.listName;
-                if (!visitedLists.includes(relatedListName)) {
-                    // Recursively build nested includes
-                    const nestedInclude = await buildIncludeWithAccessControl(relatedConfig.listConfig.fields, args, config, depth + 1, [...visitedLists, relatedListName]);
-                    if (nestedInclude && Object.keys(nestedInclude).length > 0) {
-                        includeEntry.include = nestedInclude;
-                    }
+                if (!insideResolveOutput && !visitedLists.includes(relatedListName)) {
+                    nested = await buildIncludeWithAccessControl(relatedConfig.listConfig.fields, args, config, depth + 1, [...visitedLists, relatedListName]);
                 }
-                // Add to include object
-                include[fieldName] = Object.keys(includeEntry).length > 0 ? includeEntry : true;
+                include[fieldName] = { where, nested };
             }
         }
     }
-    return hasRelationships ? include : undefined;
+    return hasRelationships ? { kind: 'scoped', include } : { kind: 'nothing-to-scope' };
 }
 /**
  * Narrow an unknown include value to the structured object form (vs bare `true`
@@ -148,32 +167,37 @@ function andWhere(accessWhere, callerWhere) {
  * - If the caller names a key that is NOT a config-declared relationship, it is
  *   passed through unchanged (access control does not govern it).
  *
- * The access-controlled include is recursive to `MAX_DEPTH` (see
- * `buildIncludeWithAccessControl`); beyond that depth no auto-include exists, so
- * deeper caller selections pass through unscoped — consistent with the existing
- * auto-include behaviour.
+ * `accessControlledInclude` is the {@link AccessIncludeResult} for THIS level:
+ * - `nothing-to-scope` → nothing to merge against (the list has no
+ *   relationships, or we're inside a resolveOutput context where the caller
+ *   include is irrelevant to begin with). Pass the caller's include through
+ *   unchanged — this is a non-denial outcome, not "every relation denied".
+ * - `depth-exceeded` → the engine could not compute a scope for THIS level at
+ *   all because it sits at or past `READ_INCLUDE_MAX_DEPTH`. If the caller
+ *   named anything here, that is exactly the case that used to pass through
+ *   unscoped (issue #830): throw `AccessScopeDepthExceededError` instead. An
+ *   empty caller include at this level (nothing further requested) is not an
+ *   error — there's simply nothing to do.
+ * - `scoped` → the normal per-relation merge below: a declared relationship
+ *   ABSENT from the access include was denied (drop it); one PRESENT is used
+ *   as the base, AND-combining `where`s and recursing into nested includes.
  *
- * `accessControlledInclude` being `undefined` is NOT "every relation denied". It
- * means no access-controlled include was computed at all — a non-denial outcome
- * that `buildIncludeWithAccessControl` returns when inside a `resolveOutput`/
- * virtual-field context, at `MAX_DEPTH`, or when the list has no relationships.
- * In every one of those cases there is nothing to merge against, so the caller's
- * `include` is passed through unchanged (matching the prior `args.include || …`
- * fallback). This is distinct from an `undefined` ENTRY inside a defined access
- * include, which DOES mean the relation was denied and must be dropped (see the
- * per-relation loop below). Only the whole-object `undefined` is a passthrough.
+ * `listKey` and `depth` are carried only to build a useful
+ * `AccessScopeDepthExceededError` message; they do not affect merge behaviour.
  */
-export function mergeIncludeWithAccessControl(callerInclude, accessControlledInclude, fieldConfigs, config) {
-    // No access-controlled include was computed (resolveOutput/virtual context,
-    // MAX_DEPTH, or a list with no relationships) → nothing to scope against, so
-    // pass the caller's include through unchanged. Dropping relations here would be
-    // fail-closed data loss, not a denial. Denied relations are dropped only when a
-    // defined access include OMITS them (handled per-relation below).
-    if (accessControlledInclude === undefined) {
+export function mergeIncludeWithAccessControl(callerInclude, accessControlledInclude, fieldConfigs, config, listKey, depth = 0) {
+    if (accessControlledInclude.kind === 'nothing-to-scope') {
         return callerInclude;
     }
+    if (accessControlledInclude.kind === 'depth-exceeded') {
+        const [firstRelationName] = Object.keys(callerInclude);
+        if (firstRelationName !== undefined) {
+            throw new AccessScopeDepthExceededError(listKey, firstRelationName, depth);
+        }
+        return {};
+    }
     const merged = {};
-    const accessInclude = accessControlledInclude;
+    const accessInclude = accessControlledInclude.include;
     for (const [relationName, callerValue] of Object.entries(callerInclude)) {
         const fieldConfig = fieldConfigs[relationName];
         const isDeclaredRelationship = fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && !!fieldConfig.ref;
@@ -182,27 +206,30 @@ export function mergeIncludeWithAccessControl(callerInclude, accessControlledInc
             merged[relationName] = callerValue;
             continue;
         }
-        const accessValue = accessInclude[relationName];
+        const accessEntry = accessInclude[relationName];
         // Declared relationship absent from the access include → query access denied → drop it.
-        if (accessValue === undefined) {
+        if (accessEntry === undefined) {
             continue;
         }
-        const accessEntry = asEntryObject(accessValue);
         const callerEntry = asEntryObject(callerValue);
         // Resolve the related list's field configs so nested includes merge recursively.
         const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
         const relatedFields = relatedConfig?.listConfig.fields;
-        const mergedWhere = andWhere(accessEntry?.where, callerEntry?.where);
+        const mergedWhere = andWhere(accessEntry.where, callerEntry?.where);
         let mergedNested;
-        if (callerEntry?.include && relatedFields) {
-            // Recurse: scope the caller's nested selection against the nested access include.
-            mergedNested = mergeIncludeWithAccessControl(callerEntry.include, accessEntry?.include, relatedFields, config);
+        if (callerEntry?.include && relatedFields && relatedConfig) {
+            // Recurse: scope the caller's nested selection against the nested access
+            // result. If that result is 'depth-exceeded', the recursive call itself
+            // throws — the caller named something the engine cannot scope.
+            mergedNested = mergeIncludeWithAccessControl(callerEntry.include, accessEntry.nested, relatedFields, config, relatedConfig.listName, depth + 1);
         }
-        else if (accessEntry?.include) {
+        else if (accessEntry.nested.kind === 'scoped') {
             // Caller selected the relation bare (no nested include); keep the
             // access-controlled nested include so deeper relations stay filtered.
-            mergedNested = accessEntry.include;
+            mergedNested = toPrismaInclude(accessEntry.nested);
         }
+        // If the caller's entry has no nested include, a 'depth-exceeded' nested
+        // result is silent here too — nothing was asked for past this point.
         const entry = {};
         if (mergedWhere)
             entry.where = mergedWhere;

package/dist/access/access-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,KAAK,GAAW,CAAC;AACjB,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,YAAY,GAAsB,EAAE;IAEpC,MAAM,SAAS,GAAG,CAAC,CAAA;IACnB,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IAID,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpF,gBAAgB,GAAG,IAAI,CAAA;YACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAE7E,IAAI,aAAa,EAAE,CAAC;gBAClB,0CAA0C;gBAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;gBACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;oBAClD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAA;gBAEF,4DAA4D;gBAC5D,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAC3B,SAAQ;gBACV,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,YAAY,GAA4B,EAAE,CAAA;gBAEhD,yDAAyD;gBACzD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACrC,YAAY,CAAC,KAAK,GAAG,YAAY,CAAA;gBACnC,CAAC;gBAED,wEAAwE;gBACxE,iEAAiE;gBACjE,yEAAyE;gBACzE,0EAA0E;gBAC1E,2EAA2E;gBAC3E,kEAAkE;gBAClE,yEAAyE;gBACzE,qEAAqE;gBACrE,2EAA2E;gBAC3E,oEAAoE;gBACpE,uEAAuE;gBACvE,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAA;gBAC9C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC5C,oCAAoC;oBACpC,MAAM,aAAa,GAAG,MAAM,6BAA6B,CACvD,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,EACT,CAAC,GAAG,YAAY,EAAE,eAAe,CAAC,CACnC,CAAA;oBAED,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC3D,YAAY,CAAC,OAAO,GAAG,aAAa,CAAA;oBACtC,CAAC;gBACH,CAAC;gBAED,wBAAwB;gBACxB,OAAO,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/C,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAA;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,MAAM,KAAK,GAAuB,EAAE,CAAA;QACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,GAAG,KAAqB,CAAA;QAC3E,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,OAAO,GAAG,OAAwB,CAAA;QACpF,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAsC,EACtC,uBAA4D,EAC5D,YAAyC,EACzC,MAAsB;IAEtB,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,kEAAkE;IAClE,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,aAAa,GAAG,uBAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,kGAAkG;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAA;YAClC,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;QAE/C,wFAAwF;QACxF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;QAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;QAE9C,iFAAiF;QACjF,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,aAAa,GAAG,aAAa,EAAE,UAAU,CAAC,MAAM,CAAA;QAEtD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QAEpE,IAAI,YAAiD,CAAA;QACrD,IAAI,WAAW,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC;YAC1C,kFAAkF;YAClF,YAAY,GAAG,6BAA6B,CAC1C,WAAW,CAAC,OAAO,EACnB,WAAW,EAAE,OAAO,EACpB,aAAa,EACb,MAAM,CACP,CAAA;QACH,CAAC;aAAM,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YAChC,kEAAkE;YAClE,sEAAsE;YACtE,YAAY,GAAG,WAAW,CAAC,OAAO,CAAA;QACpC,CAAC;QAED,MAAM,KAAK,GAA+E,EAAE,CAAA;QAC5F,IAAI,WAAW;YAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;QAC1C,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,YAAY,CAAA;QACtF,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,WAAW,EAAE,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAA;QAElE,2FAA2F;QAC3F,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,uEAAuE;QACvE,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAoD3D;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAuB;IAC5C,MAAM,MAAM,GAAsD,EAAE,CAAA;IACpE,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,OAAO,GAAG,aAAa,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,KAAK,GAAW,CAAC;AACjB,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,YAAY,GAAsB,EAAE;IAEpC,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;IACnC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,GAAG,CAAC,CAAA;IAExE,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpF,gBAAgB,GAAG,IAAI,CAAA;YACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAE7E,IAAI,aAAa,EAAE,CAAC;gBAClB,0CAA0C;gBAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;gBACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;oBAClD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAA;gBAEF,4DAA4D;gBAC5D,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAC3B,SAAQ;gBACV,CAAC;gBAED,MAAM,KAAK,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;gBAEzE,wEAAwE;gBACxE,iEAAiE;gBACjE,yEAAyE;gBACzE,0EAA0E;gBAC1E,2EAA2E;gBAC3E,kEAAkE;gBAClE,yEAAyE;gBACzE,qEAAqE;gBACrE,2EAA2E;gBAC3E,oEAAoE;gBACpE,uEAAuE;gBACvE,IAAI,MAAM,GAAwB,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;gBAC9D,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAA;gBAC9C,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpE,MAAM,GAAG,MAAM,6BAA6B,CAC1C,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,EACT,CAAC,GAAG,YAAY,EAAE,eAAe,CAAC,CACnC,CAAA;gBACH,CAAC;gBAED,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;AACtF,CAAC;AAKD;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAA;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,MAAM,KAAK,GAAuB,EAAE,CAAA;QACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,GAAG,KAAqB,CAAA;QAC3E,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,OAAO,GAAG,OAAwB,CAAA;QACpF,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAsC,EACtC,uBAA4C,EAC5C,YAAyC,EACzC,MAAsB,EACtB,OAAe,EACf,KAAK,GAAW,CAAC;IAEjB,IAAI,uBAAuB,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtD,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAA;IAErD,KAAK,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,kGAAkG;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAA;YAClC,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;QAE/C,wFAAwF;QACxF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;QAE9C,iFAAiF;QACjF,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,aAAa,GAAG,aAAa,EAAE,UAAU,CAAC,MAAM,CAAA;QAEtD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QAEnE,IAAI,YAAiD,CAAA;QACrD,IAAI,WAAW,EAAE,OAAO,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;YAC3D,yEAAyE;YACzE,wEAAwE;YACxE,+DAA+D;YAC/D,YAAY,GAAG,6BAA6B,CAC1C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,MAAM,EAClB,aAAa,EACb,MAAM,EACN,aAAa,CAAC,QAAQ,EACtB,KAAK,GAAG,CAAC,CACV,CAAA;QACH,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChD,kEAAkE;YAClE,sEAAsE;YACtE,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QAErE,MAAM,KAAK,GAA+E,EAAE,CAAA;QAC5F,IAAI,WAAW;YAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;QAC1C,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,YAAY,CAAA;QACtF,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,WAAW,EAAE,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAA;QAElE,2FAA2F;QAC3F,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,uEAAuE;QACvE,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}