@opensaas/stack-core 0.32.0 → 0.34.0

package/dist/access/access-filter.test.js

@@ -1,5 +1,7 @@
 import { describe, it, expect } from 'vitest';
-import { buildIncludeWithAccessControl, mergeIncludeWithAccessControl } from './access-filter.js';
+import { buildIncludeWithAccessControl, mergeIncludeWithAccessControl, toPrismaInclude, } from './access-filter.js';
+import { AccessScopeDepthExceededError } from './errors.js';
+import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
 /**
  * Regression coverage for the cyclic readable-relationship auto-include.
  *
@@ -37,11 +39,15 @@ function cyclicConfig() {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     };
 }
-function makeContext() {
+function makeContext(resolveOutputDepth = 0) {
+    const chain = Array.from({ length: resolveOutputDepth }, (_, i) => ({
+        listKey: 'TestHook',
+        fieldKey: `hook${i}`,
+    }));
     return {
         session: null,
         _isSudo: false,
-        _resolveOutputCounter: { depth: 0 },
+        _resolveOutputChain: chain,
         // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
     };
 }
@@ -64,10 +70,60 @@ function includeDepth(include) {
     }
     return max;
 }
+// A straight-line chain of `count` lists, each with a scalar field and a
+// single relationship to the next list: L0 → L1 → … → L(count-1). Every list
+// past the root is query-scoped with a filter unique to it, so a test can
+// assert the merged tree actually carries the right `where` at a given hop
+// (not just that it happens not to throw).
+function chainConfig(count) {
+    const lists = {};
+    for (let i = 0; i < count; i++) {
+        const listName = `L${i}`;
+        const fields = { name: { type: 'text' } };
+        if (i < count - 1) {
+            fields.next = rel(`L${i + 1}.prev`);
+        }
+        if (i > 0) {
+            fields.prev = rel(`L${i - 1}.next`);
+        }
+        const filter = { ownerId: { equals: listName } };
+        lists[listName] = {
+            fields,
+            access: { operation: { query: i === 0 ? () => true : () => filter } },
+        };
+    }
+    return {
+        db: { provider: 'sqlite', url: 'file:./dev.db' },
+        lists,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    };
+}
+// A caller `include` value selecting `next` `hops` more times beyond the
+// point at which this value is attached, ending in a bare `true` leaf. E.g.
+// `nestedInclude(0) === true` (stop here); `{ next: nestedInclude(2) }` at the
+// top level names 3 hops total (the outer `next` plus 2 more).
+function nestedInclude(hops) {
+    if (hops <= 0)
+        return true;
+    return { include: { next: nestedInclude(hops - 1) } };
+}
+// Read the `where` at the end of a chain of nested `next` includes (used to
+// assert row-scoping survived down to a specific hop).
+function whereAtHop(merged, hops) {
+    let current = merged;
+    for (let i = 0; i < hops; i++) {
+        const entry = current?.next;
+        if (i === hops - 1)
+            return entry?.where;
+        current = entry?.include;
+    }
+    return undefined;
+}
 describe('buildIncludeWithAccessControl — cyclic graph', () => {
     it('stops re-descending a relationship cycle instead of walking to MAX_DEPTH', async () => {
         const config = cyclicConfig();
-        const include = await buildIncludeWithAccessControl(config.lists.A.fields, { session: null, context: makeContext() }, config, 0, ['A']);
+        const result = await buildIncludeWithAccessControl(config.lists.A.fields, { session: null, context: makeContext() }, config, 0, ['A']);
+        const include = toPrismaInclude(result);
         // A → B → C, then C.a closes the cycle back to A → flat (no further nesting).
         expect(include).toEqual({
             b: { include: { c: { include: { a: true } } } },
@@ -79,7 +135,7 @@ describe('buildIncludeWithAccessControl — cyclic graph', () => {
     it('flattens a self-referential relationship to a single level', async () => {
         const allowQuery = () => true;
         const config = {
-            db: { provider: 'sqlite', url: 'file:./dev.db' },
+            db: { provider: 'sqlite' },
             lists: {
                 Category: {
                     fields: {
@@ -92,7 +148,8 @@ describe('buildIncludeWithAccessControl — cyclic graph', () => {
             },
             // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
         };
-        const include = await buildIncludeWithAccessControl(config.lists.Category.fields, { session: null, context: makeContext() }, config, 0, ['Category']);
+        const result = await buildIncludeWithAccessControl(config.lists.Category.fields, { session: null, context: makeContext() }, config, 0, ['Category']);
+        const include = toPrismaInclude(result);
         // Both self-references come back flat — no infinite parent/children descent.
         expect(include).toEqual({ parent: true, children: true });
         expect(includeDepth(include)).toBe(1);
@@ -105,7 +162,7 @@ describe('mergeIncludeWithAccessControl — bare-true leaf on a cyclic graph', (
         // Caller asks for A → b with a bare-`true` leaf. The merge must keep the
         // access-controlled (cycle-bounded) nested include rather than re-expanding
         // the leaf into an unbounded auto-include.
-        const merged = mergeIncludeWithAccessControl({ b: true }, accessControlledInclude, config.lists.A.fields, config);
+        const merged = mergeIncludeWithAccessControl({ b: true }, accessControlledInclude, config.lists.A.fields, config, 'A');
         expect(merged).toEqual({
             b: { include: { c: { include: { a: true } } } },
         });
@@ -124,7 +181,7 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
     // A one-list config whose `posts` to-many is query-scoped by an access filter.
     function scopedConfig() {
         return {
-            db: { provider: 'sqlite', url: 'file:./dev.db' },
+            db: { provider: 'sqlite' },
             lists: {
                 User: {
                     fields: { name: { type: 'text' }, posts: rel('Post.author', true) },
@@ -142,7 +199,7 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
     it('preserves the take and AND-combines it with the access where', async () => {
         const config = scopedConfig();
         const accessControlledInclude = await buildIncludeWithAccessControl(config.lists.User.fields, { session: null, context: makeContext() }, config, 0, ['User']);
-        const merged = mergeIncludeWithAccessControl({ posts: { take: 10 } }, accessControlledInclude, config.lists.User.fields, config);
+        const merged = mergeIncludeWithAccessControl({ posts: { take: 10 } }, accessControlledInclude, config.lists.User.fields, config, 'User');
         // The bound rides on top of the access filter — neither is dropped. The
         // access-controlled include also auto-nests Post's `author` back-relation.
         expect(merged).toEqual({
@@ -158,9 +215,117 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
         // Deny Post reads entirely.
         config.lists.Post.access = { operation: { query: () => false } };
         const accessControlledInclude = await buildIncludeWithAccessControl(config.lists.User.fields, { session: null, context: makeContext() }, config, 0, ['User']);
-        const merged = mergeIncludeWithAccessControl({ posts: { take: 10 } }, accessControlledInclude, config.lists.User.fields, config);
+        const merged = mergeIncludeWithAccessControl({ posts: { take: 10 } }, accessControlledInclude, config.lists.User.fields, config, 'User');
         // A denied relation is dropped wholesale — the take cannot resurrect it.
         expect(merged).toEqual({});
     });
 });
+/**
+ * Regression coverage for issue #830: the read pipeline used to FAIL OPEN past
+ * `READ_INCLUDE_MAX_DEPTH` — a caller-supplied `include` nested deeper than the
+ * engine could scope was passed through unscoped rather than denied. These
+ * tests pin the exact boundary the fix introduces (ADR-0022): a caller include
+ * one level past the cap throws, the same include one level shallower still
+ * works, and an unrequested auto-include past the cap stays silent.
+ */
+describe('mergeIncludeWithAccessControl — fail-closed at the read-include depth cap (#830)', () => {
+    // A relation `hops` hops from the root sits AT the cap boundary (correctly
+    // where-scoped, matching the triage report's "F" list); one hop further is
+    // the first one the engine cannot scope ("G"). With
+    // READ_INCLUDE_MAX_DEPTH = 5 that boundary is hop 5 / hop 6.
+    const HOPS_AT_CAP = READ_INCLUDE_MAX_DEPTH;
+    it('throws AccessScopeDepthExceededError when the caller include reaches past the cap', async () => {
+        // L0 → L1 → … → L6 (one more list than HOPS_AT_CAP + 1) so a caller
+        // include can walk `next` one hop past the boundary.
+        const chainLength = HOPS_AT_CAP + 2;
+        const config = chainConfig(chainLength);
+        const accessControlledInclude = await buildIncludeWithAccessControl(config.lists.L0.fields, { session: null, context: makeContext() }, config, 0, ['L0']);
+        // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP) (HOPS_AT_CAP more) = HOPS_AT_CAP + 1 hops.
+        const callerInclude = { next: nestedInclude(HOPS_AT_CAP) };
+        expect(() => mergeIncludeWithAccessControl(callerInclude, accessControlledInclude, config.lists.L0.fields, config, 'L0')).toThrow(AccessScopeDepthExceededError);
+    });
+    it('still row-scopes a caller include one level shallower than the cap', async () => {
+        const chainLength = HOPS_AT_CAP + 1;
+        const config = chainConfig(chainLength);
+        const accessControlledInclude = await buildIncludeWithAccessControl(config.lists.L0.fields, { session: null, context: makeContext() }, config, 0, ['L0']);
+        // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP - 1) = HOPS_AT_CAP hops total — right at the boundary.
+        const callerInclude = { next: nestedInclude(HOPS_AT_CAP - 1) };
+        // Must NOT throw — this depth is within what the engine can scope.
+        const merged = mergeIncludeWithAccessControl(callerInclude, accessControlledInclude, config.lists.L0.fields, config, 'L0');
+        expect(includeDepth(merged)).toBe(HOPS_AT_CAP);
+        // The last list in the chain (at the boundary) is genuinely row-scoped —
+        // not just present without a throw.
+        expect(whereAtHop(merged, HOPS_AT_CAP)).toEqual({ ownerId: { equals: `L${HOPS_AT_CAP}` } });
+    });
+    it('does not throw for an ordinary read with no caller include, even on a deep schema', async () => {
+        // No caller include at all — the auto-include just stops at the cap
+        // silently. This must never throw; only an EXPLICIT caller selection past
+        // the cap is a denial.
+        const chainLength = HOPS_AT_CAP + 3;
+        const config = chainConfig(chainLength);
+        const result = await buildIncludeWithAccessControl(config.lists.L0.fields, { session: null, context: makeContext() }, config, 0, ['L0']);
+        expect(() => toPrismaInclude(result)).not.toThrow();
+        const include = toPrismaInclude(result);
+        expect(includeDepth(include)).toBeLessThanOrEqual(HOPS_AT_CAP);
+    });
+    it('a list with no relationships still passes the caller include through unchanged', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Leaf: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const accessControlledInclude = await buildIncludeWithAccessControl(config.lists.Leaf.fields, { session: null, context: makeContext() }, config, 0, ['Leaf']);
+        expect(accessControlledInclude).toEqual({ kind: 'nothing-to-scope' });
+        // An arbitrary (non-declared-relationship) key passed through unchanged —
+        // access control does not govern keys it doesn't recognize as relationships.
+        const merged = mergeIncludeWithAccessControl({ someUnrelatedKey: true }, accessControlledInclude, config.lists.Leaf.fields, config, 'Leaf');
+        expect(merged).toEqual({ someUnrelatedKey: true });
+    });
+});
+/**
+ * Regression coverage for the resolveOutput/virtual-field trigger of #830: a
+ * read issued from inside a resolveOutput hook used to lose relation row
+ * scoping ENTIRELY (whole-object passthrough) rather than scoping the
+ * immediate relation and simply not auto-expanding further. The loop guard
+ * that motivated the original passthrough (hooks making DB queries that
+ * include relationships back to the same entity) must still hold.
+ */
+describe('buildIncludeWithAccessControl — inside a resolveOutput context', () => {
+    it('scopes the immediate relation with its access where but does not auto-expand nested relations', async () => {
+        const config = chainConfig(4); // L0 → L1 → L2 → L3
+        config.lists.L1.access = { operation: { query: () => ({ tenantId: { equals: 'mine' } }) } };
+        const result = await buildIncludeWithAccessControl(config.lists.L0.fields, { session: null, context: makeContext(1) }, // depth > 0 → inside resolveOutput
+        config, 0, ['L0']);
+        expect(result.kind).toBe('scoped');
+        const include = toPrismaInclude(result);
+        // L1's own access `where` is applied...
+        expect(include).toEqual({ next: { where: { tenantId: { equals: 'mine' } } } });
+        // ...but L1's own nested relations (`next` → L2) are NOT auto-included.
+        expect(includeDepth(include)).toBe(1);
+    });
+    it('terminates on a self-referential relationship instead of looping', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Category: {
+                    fields: {
+                        name: { type: 'text' },
+                        parent: rel('Category.children'),
+                        children: rel('Category.parent', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const result = await buildIncludeWithAccessControl(config.lists.Category.fields, { session: null, context: makeContext(1) }, config, 0, ['Category']);
+        const include = toPrismaInclude(result);
+        expect(include).toEqual({ parent: true, children: true });
+    });
+});
 //# sourceMappingURL=access-filter.test.js.map

package/dist/access/access-filter.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-filter.test.js","sourceRoot":"","sources":["../../src/access/access-filter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAA;AAIjG;;;;;;;;;;GAUG;AAEH,iDAAiD;AACjD,SAAS,GAAG,CAAC,GAAW,EAAE,IAAI,GAAG,KAAK;IACpC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAA4B,CAAA;AACtE,CAAC;AAED,+DAA+D;AAC/D,SAAS,YAAY;IACnB,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAA;IAC7B,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE;QAChD,KAAK,EAAE;YACL,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;YACD,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;YACD,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;SACF;QACD,8FAA8F;KACxF,CAAA;AACV,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACnC,+FAA+F;KACzF,CAAA;AACV,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAA;IACrD,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAkC,CAAC,EAAE,CAAC;QACtE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAI,KAA+B,CAAC,OAAO,CAAA;YACvD,IAAI,MAAM;gBAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;;gBACpD,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,GAAG,CAAC,CACN,CAAA;QAED,8EAA8E;QAC9E,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;SAChD,CAAC,CAAA;QACF,4EAA4E;QAC5E,4BAA4B;QAC5B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAA;QAC7B,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE;YAChD,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB;wBACrC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC;wBAChC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC;qBACvC;oBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;iBAC7C;aACF;YACD,8FAA8F;SACtE,CAAA;QAE1B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CACjD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC5B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,UAAU,CAAC,CACb,CAAA;QAED,6EAA6E;QAC7E,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,GAAG,CAAC,CACN,CAAA;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,CAAC,EAAE,IAAI,EAAE,EACX,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,MAAM,CACP,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;SAChD,CAAC,CAAA;QACF,4CAA4C;QAC5C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,+EAA+E;IAC/E,SAAS,YAAY;QACnB,OAAO;YACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE;YAChD,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE;oBAClF,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;iBAC7C;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE;oBAC7E,2EAA2E;oBAC3E,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;iBAC1E;aACF;YACD,8FAA8F;SACxF,CAAA;IACV,CAAC;IAED,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EACvB,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,MAAM,CACP,CAAA;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,KAAK,EAAE;gBACL,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACtC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACzB,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,4BAA4B;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAA;QAChE,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EACvB,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,MAAM,CACP,CAAA;QAED,yEAAyE;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"access-filter.test.js","sourceRoot":"","sources":["../../src/access/access-filter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAI1D;;;;;;;;;;GAUG;AAEH,iDAAiD;AACjD,SAAS,GAAG,CAAC,GAAW,EAAE,IAAI,GAAG,KAAK;IACpC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAA4B,CAAA;AACtE,CAAC;AAED,+DAA+D;AAC/D,SAAS,YAAY;IACnB,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAA;IAC7B,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE;QAChD,KAAK,EAAE;YACL,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;YACD,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;YACD,CAAC,EAAE;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;aAC7C;SACF;QACD,8FAA8F;KACxF,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAAC,kBAAkB,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,OAAO,CAAC,EAAE;KACrB,CAAC,CAAC,CAAA;IACH,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,mBAAmB,EAAE,KAAK;QAC1B,+FAA+F;KACzF,CAAA;AACV,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAA;IACrD,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAkC,CAAC,EAAE,CAAC;QACtE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAI,KAA+B,CAAC,OAAO,CAAA;YACvD,IAAI,MAAM;gBAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;;gBACpD,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,2CAA2C;AAC3C,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAA6E,EAAE,CAAA;IAC1F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAA;QACxB,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,CAAA;QACrF,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAA;QAChD,KAAK,CAAC,QAAQ,CAAC,GAAG;YAChB,MAAM;YACN,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;SACtE,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE;QAChD,KAAK;QACL,8FAA8F;KACxF,CAAA;AACV,CAAC;AAED,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAA0C,CAAA;IAChE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,CAAA;AACvD,CAAC;AAED,4EAA4E;AAC5E,uDAAuD;AACvD,SAAS,UAAU,CAAC,MAA+B,EAAE,IAAY;IAC/D,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAI,OAA8B,EAAE,IAAI,CAAA;QACnD,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;YAAE,OAAQ,KAA6B,EAAE,KAAK,CAAA;QAChE,OAAO,GAAI,KAA+B,EAAE,OAAO,CAAA;IACrD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,GAAG,CAAC,CACN,CAAA;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAEvC,8EAA8E;QAC9E,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;SAChD,CAAC,CAAA;QACF,4EAA4E;QAC5E,4BAA4B;QAC5B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAA;QAC7B,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB;wBACrC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC;wBAChC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC;qBACvC;oBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;iBAC7C;aACF;YACD,8FAA8F;SACtE,CAAA;QAE1B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC5B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,UAAU,CAAC,CACb,CAAA;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAEvC,6EAA6E;QAC7E,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,GAAG,CAAC,CACN,CAAA;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,CAAC,EAAE,IAAI,EAAE,EACX,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACrB,MAAM,EACN,GAAG,CACJ,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;SAChD,CAAC,CAAA;QACF,4CAA4C;QAC5C,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,+EAA+E;IAC/E,SAAS,YAAY;QACnB,OAAO;YACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE;oBAClF,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;iBAC7C;gBACD,IAAI,EAAE;oBACJ,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE;oBAC7E,2EAA2E;oBAC3E,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;iBAC1E;aACF;YACD,8FAA8F;SACxF,CAAA;IACV,CAAC;IAED,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EACvB,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,MAAM,EACN,MAAM,CACP,CAAA;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,KAAK,EAAE;gBACL,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBACtC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACzB,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,4BAA4B;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAA;QAChE,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EACvB,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,MAAM,EACN,MAAM,CACP,CAAA;QAED,yEAAyE;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,QAAQ,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAChG,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,6DAA6D;IAC7D,MAAM,WAAW,GAAG,sBAAsB,CAAA;IAE1C,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;QAEvC,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAA;QAED,+FAA+F;QAC/F,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAA;QAE1D,MAAM,CAAC,GAAG,EAAE,CACV,6BAA6B,CAC3B,aAAa,EACb,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,MAAM,EACN,IAAI,CACL,CACF,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;QAEvC,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAA;QAED,0GAA0G;QAC1G,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAA;QAE9D,mEAAmE;QACnE,MAAM,MAAM,GAAG,6BAA6B,CAC1C,aAAa,EACb,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,MAAM,EACN,IAAI,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC9C,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,oEAAoE;QACpE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;QAEvC,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAA;QAED,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QACnD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB,EAAE;oBACjD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;iBAC7C;aACF;YACD,8FAA8F;SACtE,CAAA;QAE1B,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,EACN,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAErE,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,6BAA6B,CAC1C,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAC1B,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EACxB,MAAM,EACN,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,QAAQ,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC9E,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA,CAAC,oBAAoB;QAClD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAA;QAE3F,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EACtB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,mCAAmC;QAC/E,MAAM,EACN,CAAC,EACD,CAAC,IAAI,CAAC,CACP,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACvC,wCAAwC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9E,wEAAwE;QACxE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAiB;wBACrC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC;wBAChC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC;qBACvC;oBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;iBAC7C;aACF;YACD,8FAA8F;SACtE,CAAA;QAE1B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAC5B,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,EAC1C,MAAM,EACN,CAAC,EACD,CAAC,UAAU,CAAC,CACb,CAAA;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/access/depth-limits.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Maximum nesting depth of relation `include`s that the Access Filter
+ * (`buildIncludeWithAccessControl`) will auto-scope on a read.
+ *
+ * Security implication: this is an access-control boundary, not just a cost
+ * bound. Past this depth the engine cannot compute a row/field scope for a
+ * relation, so a caller-supplied `include` naming a relation at or beyond it
+ * must be treated as a denial (see `AccessScopeDepthExceededError`) rather
+ * than passed through unscoped — see ADR-0022 and issue #830.
+ */
+export declare const READ_INCLUDE_MAX_DEPTH = 5;
+/**
+ * Maximum length of the resolve chain — the ordered sequence of `resolveOutput`
+ * hooks a read has entered, each entry extended by a hook that issues its own
+ * read (see `_resolveOutputChain` on `AccessContext`).
+ *
+ * This is a COST limit, not an access-control boundary: an acyclic chain
+ * genuinely can exceed it and still be correct (e.g. a virtual `Order.total`
+ * reading a virtual `LineItem.subtotal` reading further virtuals), so
+ * exceeding it omits the field and emits a single `console.warn` rather than
+ * throwing. Termination itself is guaranteed by the separate cycle guard,
+ * which refuses to re-enter a `(list, field)` pair already on the chain
+ * regardless of this cap. See ADR-0023.
+ */
+export declare const RESOLVE_CHAIN_MAX_LENGTH = 5;
+//# sourceMappingURL=depth-limits.d.ts.map

package/dist/access/depth-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"depth-limits.d.ts","sourceRoot":"","sources":["../../src/access/depth-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA"}

package/dist/access/depth-limits.js

@@ -0,0 +1,26 @@
+/**
+ * Maximum nesting depth of relation `include`s that the Access Filter
+ * (`buildIncludeWithAccessControl`) will auto-scope on a read.
+ *
+ * Security implication: this is an access-control boundary, not just a cost
+ * bound. Past this depth the engine cannot compute a row/field scope for a
+ * relation, so a caller-supplied `include` naming a relation at or beyond it
+ * must be treated as a denial (see `AccessScopeDepthExceededError`) rather
+ * than passed through unscoped — see ADR-0022 and issue #830.
+ */
+export const READ_INCLUDE_MAX_DEPTH = 5;
+/**
+ * Maximum length of the resolve chain — the ordered sequence of `resolveOutput`
+ * hooks a read has entered, each entry extended by a hook that issues its own
+ * read (see `_resolveOutputChain` on `AccessContext`).
+ *
+ * This is a COST limit, not an access-control boundary: an acyclic chain
+ * genuinely can exceed it and still be correct (e.g. a virtual `Order.total`
+ * reading a virtual `LineItem.subtotal` reading further virtuals), so
+ * exceeding it omits the field and emits a single `console.warn` rather than
+ * throwing. Termination itself is guaranteed by the separate cycle guard,
+ * which refuses to re-enter a `(list, field)` pair already on the chain
+ * regardless of this cap. See ADR-0023.
+ */
+export const RESOLVE_CHAIN_MAX_LENGTH = 5;
+//# sourceMappingURL=depth-limits.js.map

package/dist/access/depth-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"depth-limits.js","sourceRoot":"","sources":["../../src/access/depth-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA"}

package/dist/access/errors.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Thrown when a caller-supplied `include` names a relation nested deeper than
+ * the Access Filter can scope (see `READ_INCLUDE_MAX_DEPTH`). Deliberately
+ * distinct from `ValidationError`: this is not bad user input, it is the
+ * engine refusing to return data it cannot prove is row/field scoped. Code
+ * that catches `ValidationError` to report form errors must not silently
+ * swallow this.
+ *
+ * Only an explicit caller selection past the depth cap triggers this — the
+ * auto-include silently stopping at the cap (no caller `include` involved)
+ * never throws. See ADR-0022 and issue #830.
+ */
+export declare class AccessScopeDepthExceededError extends Error {
+    listKey: string;
+    fieldKey: string;
+    depth: number;
+    constructor(listKey: string, fieldKey: string, depth: number);
+}
+/**
+ * Thrown when a `resolveOutput` hook re-enters a `(list, field)` pair already
+ * on its own resolve chain — a hook whose own read (directly or transitively)
+ * comes back around to itself. Deliberately distinct from `ValidationError`
+ * (same reasoning as `AccessScopeDepthExceededError`): this is not bad user
+ * input, it is the engine refusing to run a hook chain that cannot terminate.
+ *
+ * This is a loud failure, not a Silent one, on purpose: a repeated pair never
+ * terminated before this guard existed, so no working application can depend
+ * on the old (hanging) behaviour, and staying silent here would return
+ * `undefined` for a field with nothing in the logs to explain why. Contrast
+ * with exceeding `RESOLVE_CHAIN_MAX_LENGTH`, which can happen on a chain that
+ * would otherwise terminate correctly and therefore only warns. See ADR-0023.
+ */
+export declare class ResolveOutputCycleError extends Error {
+    chain: readonly {
+        listKey: string;
+        fieldKey: string;
+    }[];
+    constructor(chain: readonly {
+        listKey: string;
+        fieldKey: string;
+    }[]);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/access/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IAEpB,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAW3D;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACzC,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAE9D,YAAY,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAUlE;CACF"}

package/dist/access/errors.js

@@ -0,0 +1,55 @@
+import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
+/**
+ * Thrown when a caller-supplied `include` names a relation nested deeper than
+ * the Access Filter can scope (see `READ_INCLUDE_MAX_DEPTH`). Deliberately
+ * distinct from `ValidationError`: this is not bad user input, it is the
+ * engine refusing to return data it cannot prove is row/field scoped. Code
+ * that catches `ValidationError` to report form errors must not silently
+ * swallow this.
+ *
+ * Only an explicit caller selection past the depth cap triggers this — the
+ * auto-include silently stopping at the cap (no caller `include` involved)
+ * never throws. See ADR-0022 and issue #830.
+ */
+export class AccessScopeDepthExceededError extends Error {
+    listKey;
+    fieldKey;
+    depth;
+    constructor(listKey, fieldKey, depth) {
+        super(`Cannot compute an access scope for "${listKey}.${fieldKey}" at include depth ${depth}: ` +
+            `this exceeds the Access Filter's maximum read-include depth (${READ_INCLUDE_MAX_DEPTH}). ` +
+            `A caller-supplied include this deep cannot be row- and field-scoped, so the read is denied ` +
+            `rather than returned unscoped. Restructure the query to fetch this relation separately.`);
+        this.name = 'AccessScopeDepthExceededError';
+        this.listKey = listKey;
+        this.fieldKey = fieldKey;
+        this.depth = depth;
+    }
+}
+/**
+ * Thrown when a `resolveOutput` hook re-enters a `(list, field)` pair already
+ * on its own resolve chain — a hook whose own read (directly or transitively)
+ * comes back around to itself. Deliberately distinct from `ValidationError`
+ * (same reasoning as `AccessScopeDepthExceededError`): this is not bad user
+ * input, it is the engine refusing to run a hook chain that cannot terminate.
+ *
+ * This is a loud failure, not a Silent one, on purpose: a repeated pair never
+ * terminated before this guard existed, so no working application can depend
+ * on the old (hanging) behaviour, and staying silent here would return
+ * `undefined` for a field with nothing in the logs to explain why. Contrast
+ * with exceeding `RESOLVE_CHAIN_MAX_LENGTH`, which can happen on a chain that
+ * would otherwise terminate correctly and therefore only warns. See ADR-0023.
+ */
+export class ResolveOutputCycleError extends Error {
+    chain;
+    constructor(chain) {
+        const path = chain.map((link) => `${link.listKey}.${link.fieldKey}`).join(' → ');
+        super(`resolveOutput cycle detected: ${path}. A hook that re-enters a (list, field) pair ` +
+            `already on its own resolve chain cannot terminate, so the read is refused rather than ` +
+            `left to recurse until the process runs out of memory. Restructure the hooks so the read ` +
+            `does not loop back into itself.`);
+        this.name = 'ResolveOutputCycleError';
+        this.chain = chain;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/access/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IAEpB,YAAY,OAAe,EAAE,QAAgB,EAAE,KAAa;QAC1D,KAAK,CACH,uCAAuC,OAAO,IAAI,QAAQ,sBAAsB,KAAK,IAAI;YACvF,gEAAgE,sBAAsB,KAAK;YAC3F,6FAA6F;YAC7F,yFAAyF,CAC5F,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACzC,KAAK,CAAkD;IAE9D,YAAY,KAAuD;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChF,KAAK,CACH,iCAAiC,IAAI,+CAA+C;YAClF,wFAAwF;YACxF,0FAA0F;YAC1F,iCAAiC,CACpC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF"}

package/dist/access/field-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-visibility.d.ts","sourceRoot":"","sources":["../../src/access/field-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAqGrE;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC/C,EACD,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,GAAE,MAAU,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAwJrB"}
+{"version":3,"file":"field-visibility.d.ts","sourceRoot":"","sources":["../../src/access/field-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAwKrE;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC/C,EACD,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,GAAE,MAAU,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAiKrB"}

package/dist/access/field-visibility.js

@@ -1,5 +1,47 @@
 import { getRelatedListConfig } from './engine.js';
 import { checkFieldAccess } from './field-access.js';
+import { RESOLVE_CHAIN_MAX_LENGTH } from './depth-limits.js';
+import { ResolveOutputCycleError } from './errors.js';
+// NOTE: `context/index.ts` imports `filterReadableFields` from this module
+// (via the `access/index.ts` barrel) — this is an intentional cyclic
+// dependency, the same shape and for the same reason as the one documented in
+// `context/write-pipeline.ts`. `buildDbDelegate` is only INVOKED when a
+// `resolveOutput` hook actually runs (never during module evaluation), so by
+// the time it runs the export is fully initialised.
+import { buildDbDelegate } from '../context/index.js';
+/**
+ * Derive the context passed to a single `resolveOutput` hook invocation: a
+ * NEW context object whose `_resolveOutputChain` extends the caller's chain
+ * with this hook's own `(list, field)` link. The chain is never mutated in
+ * place — this is what lets concurrent hook invocations (e.g. sibling rows in
+ * a to-many relation, filtered via `Promise.all`) each see their own chain
+ * rather than racing on one shared value (ADR-0023).
+ *
+ * A plain `{ ...context, _resolveOutputChain }` spread is not enough on its
+ * own: `context.db`'s operations capture their `context` at construction
+ * (see `populateDbDelegate`), so a hook that calls `context.db.x.findMany(…)`
+ * would otherwise reach the ORIGINAL closures — bound to the ORIGINAL
+ * context — and its read would silently fall back to the un-extended chain,
+ * defeating the cycle guard entirely. Rebuilding `db` via `buildDbDelegate`
+ * against the derived context is what makes a hook-issued read's own nested
+ * hooks actually observe the extended chain.
+ *
+ * `config` is required to rebuild `db`; callers that cannot supply one (e.g. a
+ * narrow unit test exercising field access in isolation) still get a correct
+ * chain for THIS hook's own cycle/cap check, but a read that hook issues
+ * would not carry the chain any further — those callers are not exercising
+ * the read pipeline, so there is nothing for it to reach.
+ */
+function deriveResolveOutputContext(context, link, config) {
+    const derived = {
+        ...context,
+        _resolveOutputChain: [...context._resolveOutputChain, link],
+    };
+    if (config) {
+        derived.db = buildDbDelegate(config, context.prisma, derived);
+    }
+    return derived;
+}
 /**
  * The core Field Visibility step for a single field: check read access and, if
  * granted, produce the output value by running any `resolveOutput` hook.
@@ -15,7 +57,7 @@ import { checkFieldAccess } from './field-access.js';
  * see the already-filtered output so they can read sibling fields).
  */
 async function resolveReadableFieldValue(params) {
-    const { fieldConfig, fieldName, value, accessItem, hookItem, listKey, args } = params;
+    const { fieldConfig, fieldName, value, accessItem, hookItem, listKey, args, config } = params;
     // Check field access (checkFieldAccess already handles sudo mode)
     const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
         ...args,
@@ -29,24 +71,35 @@ async function resolveReadableFieldValue(params) {
         // Cast to runtime type for generic execution
         // At runtime, the hook will receive the correct value type for the field
         const hook = fieldConfig.hooks.resolveOutput;
-        // Increment depth counter to prevent infinite loops from hooks making DB queries
-        // that include relationships back to the same entity
-        args.context._resolveOutputCounter.depth++;
-        try {
-            // Use Promise.resolve() to handle both sync and async hooks
-            const resolved = await Promise.resolve(hook({
-                value,
-                operation: 'query',
-                fieldName,
-                listKey,
-                item: hookItem,
-                context: args.context,
-            }));
-            return { readable: true, value: resolved };
+        const link = { listKey, fieldKey: fieldName };
+        const chain = args.context._resolveOutputChain;
+        // Cycle guard: a hook that would re-enter a (list, field) pair already on
+        // its own chain cannot terminate — refuse loudly rather than recurse
+        // until the process runs out of memory (issue #844, ADR-0023).
+        const alreadyOnChain = chain.some((entry) => entry.listKey === link.listKey && entry.fieldKey === link.fieldKey);
+        if (alreadyOnChain) {
+            throw new ResolveOutputCycleError([...chain, link]);
         }
-        finally {
-            args.context._resolveOutputCounter.depth--;
+        // Cost cap: a chain this long is refused only as a cost limit, never a
+        // correctness one — an acyclic chain that works today can legitimately
+        // reach this. Omit the field and warn instead of throwing.
+        if (chain.length >= RESOLVE_CHAIN_MAX_LENGTH) {
+            const path = [...chain, link].map((entry) => `${entry.listKey}.${entry.fieldKey}`).join(' → ');
+            console.warn(`resolveOutput: omitting "${listKey}.${fieldName}" — its resolve chain exceeded ` +
+                `RESOLVE_CHAIN_MAX_LENGTH (${RESOLVE_CHAIN_MAX_LENGTH}): ${path}. This is a cost limit, ` +
+                `not an access denial.`);
+            return { readable: false };
         }
+        // Use Promise.resolve() to handle both sync and async hooks
+        const resolved = await Promise.resolve(hook({
+            value,
+            operation: 'query',
+            fieldName,
+            listKey,
+            item: hookItem,
+            context: deriveResolveOutputContext(args.context, link, config),
+        }));
+        return { readable: true, value: resolved };
     }
     return { readable: true, value };
 }
@@ -56,7 +109,6 @@ async function resolveReadableFieldValue(params) {
  */
 export async function filterReadableFields(item, fieldConfigs, args, config, depth = 0, listKey) {
     const filtered = {};
-    const MAX_DEPTH = 5; // Prevent infinite recursion
     // Multi-column fields (e.g. storage image()/file() in Keystone-parity mode)
     // back several physical columns rather than one. Before the per-field pass,
     // assemble each such field's logical value from its raw columns and remove the
@@ -91,13 +143,21 @@ export async function filterReadableFields(item, fieldConfigs, args, config, dep
         // Handle relationship fields - recursively filter fields within related items
         // Note: Access control filtering is now done at database level via buildIncludeWithAccessControl
         // This only handles field-level access (hiding sensitive fields)
+        //
+        // Deliberately uncapped: the row/relation scoping in access-filter.ts bounds
+        // what gets FETCHED (a caller include past its depth cap is now a denial,
+        // not a passthrough — see ADR-0022), so by the time a result reaches this
+        // function it is already a finite, acyclic tree whose depth was decided at
+        // the pre-query phase. Capping recursion again here independently of that
+        // cap used to let a relation be scoped correctly at the DB level while
+        // still returning with unfiltered fields past this function's own,
+        // separately-tracked limit (issue #830).
         if (config &&
             fieldConfig?.type === 'relationship' &&
             'ref' in fieldConfig &&
             fieldConfig.ref &&
             value !== null &&
-            value !== undefined &&
-            depth < MAX_DEPTH) {
+            value !== undefined) {
             // Gate the relationship on read access before recursing.
             const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
                 ...args,
@@ -135,6 +195,7 @@ export async function filterReadableFields(item, fieldConfigs, args, config, dep
             hookItem: workingItem,
             listKey,
             args,
+            config,
         });
         if (result.readable) {
             filtered[fieldName] = result.value;
@@ -168,6 +229,7 @@ export async function filterReadableFields(item, fieldConfigs, args, config, dep
             hookItem: filtered,
             listKey,
             args,
+            config,
         });
         if (result.readable) {
             filtered[fieldName] = result.value;