@opensaas/stack-core 0.37.0 → 0.39.0

package/dist/access/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpE;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAE1D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,cAAc,GAErB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe1D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,aAAa,CAAA;CACvB,GACA,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAUpC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,YAAY,EAAE,OAAO,GAAG,YAAY,GACnC,YAAY,GAAG,IAAI,CAoBrB"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpE;;;;;;;;;;;;;GAaG;AAEH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAE1D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,cAAc,GAErB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe1D;AAED,wBAAsB,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,EAC3C,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,aAAa,CAAA;CACvB,GACA,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CASpC;AAED,wBAAgB,YAAY,CAC1B,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,YAAY,EAAE,OAAO,GAAG,YAAY,GACnC,YAAY,GAAG,IAAI,CAgBrB"}

package/dist/access/engine.js

@@ -12,26 +12,12 @@
  * (`checkFieldAccess`). See `docs/adr/0001-access-control-is-a-two-phase-read.md`
  * and the access-control glossary in `CONTEXT.md`.
  */
-/**
- * Check if access control result is a boolean
- */
 export function isBoolean(value) {
     return typeof value === 'boolean';
 }
-/**
- * Check if access control result is a Prisma filter
- */
 export function isPrismaFilter(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-/**
- * Parse a relationship ref and get the related list configuration
- * Relationship refs are in the format "ListName.fieldName"
- *
- * @param relationshipRef - The ref string (e.g., "Post.author")
- * @param config - The OpenSaas configuration
- * @returns The related list name and config, or null if not found
- */
 export function getRelatedListConfig(relationshipRef, config) {
     // Parse ref format: "ListName.fieldName" or "ListName"
     const parts = relationshipRef.split('.');
@@ -45,35 +31,24 @@ export function getRelatedListConfig(relationshipRef, config) {
     }
     return { listName, listConfig };
 }
-/**
- * Execute an access control function
- */
 export async function checkAccess(accessControl, args) {
     // No access control means deny by default
     if (!accessControl) {
         return false;
     }
-    // Execute the access control function
     const result = await accessControl(args);
     return result;
 }
-/**
- * Merge user filter with access control filter
- */
 export function mergeFilters(userFilter, accessFilter) {
-    // If access is denied, return null
     if (accessFilter === false) {
         return null;
     }
-    // If access is fully granted, use user filter
     if (accessFilter === true) {
         return userFilter || {};
     }
-    // Merge access filter with user filter
     if (!userFilter) {
         return accessFilter;
     }
-    // Combine filters with AND
     return {
         AND: [accessFilter, userFilter],
     };

package/dist/access/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAA;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAAuB,EACvB,MAAsB;IAGtB,uDAAuD;IACvD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAA2C,EAC3C,IAIC;IAED,0CAA0C;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAExC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAoC,EACpC,YAAoC;IAEpC,mCAAmC;IACnC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8CAA8C;IAC9C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,UAAU,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,2BAA2B;IAC3B,OAAO;QACL,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;KAChC,CAAA;AACH,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,eAAuB,EACvB,MAAsB;IAGtB,uDAAuD;IACvD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAA2C,EAC3C,IAIC;IAED,0CAA0C;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAExC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,UAAoC,EACpC,YAAoC;IAEpC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,UAAU,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;KAChC,CAAA;AACH,CAAC"}

package/dist/access/errors.d.ts

@@ -1,14 +1,18 @@
 /**
  * Thrown when a caller-supplied `include` names a relation nested deeper than
- * the Access Filter can scope (see `READ_INCLUDE_MAX_DEPTH`). Deliberately
- * distinct from `ValidationError`: this is not bad user input, it is the
- * engine refusing to return data it cannot prove is row/field scoped. Code
- * that catches `ValidationError` to report form errors must not silently
- * swallow this.
+ * `READ_INCLUDE_MAX_DEPTH`. Deliberately distinct from `ValidationError`: this
+ * is not bad user input, it is the engine declining to serve a tree this
+ * expensive. Code that catches `ValidationError` to report form errors must
+ * not silently swallow this.
  *
- * Only an explicit caller selection past the depth cap triggers this — the
- * auto-include silently stopping at the cap (no caller `include` involved)
- * never throws. See ADR-0022 and issue #830.
+ * Only an explicit request naming something at or past the cap triggers this
+ * — a read that simply doesn't reach this deep never throws. Before
+ * ADR-0026 made the read pipeline caller-directed, this cap was the engine's
+ * last line of defense against returning a relation it could not prove was
+ * row/field scoped (ADR-0022, issue #830); a request naming anything at this
+ * depth is now scoped exactly like every other named relation; the cap
+ * exists solely to bound how deep a request may cost the engine to serve. See
+ * ADR-0026 and `docs/adr/0022-access-control-fails-closed-when-it-cannot-scope.md`.
  */
 export declare class AccessScopeDepthExceededError extends Error {
     listKey: string;
@@ -40,4 +44,53 @@ export declare class ResolveOutputCycleError extends Error {
         fieldKey: string;
     }[]);
 }
+/**
+ * Thrown when a relation filter in a caller's `where` (`some`/`every`/`none`/
+ * `is`/`isNot`) names a relationship whose related list denies operation-level
+ * `query` access outright (`=== false`). Deliberately a loud failure, not a
+ * silently narrowed `{ id: { in: [] } }` or a pass-through: ADR-0022 requires
+ * an engine that cannot compute a scope to deny, never pass through, and here
+ * the engine CAN compute the scope (denied) — passing that through as a
+ * silently-empty match would itself be a distinguishable signal for a caller
+ * probing which relations they may filter on. `include`'s equivalent case
+ * (`buildAccessScopedInclude`) drops the relation silently instead, because a
+ * `null`/missing key in a response is indistinguishable from "not requested";
+ * a `where` predicate has no such neutral outcome, so a relation filter on a
+ * fully denied relation is refused instead. `sudo` bypasses this check
+ * entirely, matching every other access-control escape hatch. See #916 and
+ * `docs/adr/0022-access-control-fails-closed-when-it-cannot-scope.md`.
+ */
+export declare class RelationFilterAccessDeniedError extends Error {
+    listKey: string;
+    fieldKey: string;
+    relatedListKey: string;
+    constructor(listKey: string, fieldKey: string, relatedListKey: string);
+}
+/**
+ * Thrown when a field-level access control function returns anything other
+ * than a strict `boolean`. `FieldAccessControl` is typed to return `boolean`
+ * only: field access is a single per-field visibility decision, not a row
+ * filter, and a denied field is removed rather than used to scope rows (see
+ * the "Field-level access" glossary entry in `CONTEXT.md`, ADR-0001, and
+ * ADR-0030).
+ *
+ * A rule that type-checks can never reach this — the only way here is a
+ * caller that bypasses the type (an untyped JS config, or a value forced past
+ * the checker), most notably a Prisma filter, which is the shape
+ * operation-level `AccessControl` accepts but `FieldAccessControl` does not.
+ * Before #913 this fell through to an unconditional `return true`, silently
+ * granting the field blanket access; it now fails loudly and closed instead,
+ * for `read`, `create`, and `update` alike.
+ *
+ * Deliberately does not expose the offending result as a public field: unlike
+ * `AccessScopeDepthExceededError`/`ResolveOutputCycleError`'s fields, there is
+ * no concretely-typed shape to give it (the whole problem is that it isn't
+ * the `boolean` the caller's rule promised), and the root CLAUDE.md forbids
+ * exposing `unknown`/`any` as part of a package's external API. A description
+ * of what was returned instead is folded into the message text.
+ */
+export declare class InvalidFieldAccessResultError extends Error {
+    operation: 'read' | 'create' | 'update';
+    constructor(operation: 'read' | 'create' | 'update', result: unknown);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/access/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IAEpB,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAW3D;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACzC,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAE9D,YAAY,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAUlE;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IAEpB,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAW3D;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACzC,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAE9D,YAAY,KAAK,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAUlE;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACjD,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IAE7B,YAAY,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAUpE;CACF;AASD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IAC/C,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;IAE9C,YAAY,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAWnE;CACF"}

package/dist/access/errors.js

@@ -1,25 +1,29 @@
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
 /**
  * Thrown when a caller-supplied `include` names a relation nested deeper than
- * the Access Filter can scope (see `READ_INCLUDE_MAX_DEPTH`). Deliberately
- * distinct from `ValidationError`: this is not bad user input, it is the
- * engine refusing to return data it cannot prove is row/field scoped. Code
- * that catches `ValidationError` to report form errors must not silently
- * swallow this.
+ * `READ_INCLUDE_MAX_DEPTH`. Deliberately distinct from `ValidationError`: this
+ * is not bad user input, it is the engine declining to serve a tree this
+ * expensive. Code that catches `ValidationError` to report form errors must
+ * not silently swallow this.
  *
- * Only an explicit caller selection past the depth cap triggers this — the
- * auto-include silently stopping at the cap (no caller `include` involved)
- * never throws. See ADR-0022 and issue #830.
+ * Only an explicit request naming something at or past the cap triggers this
+ * — a read that simply doesn't reach this deep never throws. Before
+ * ADR-0026 made the read pipeline caller-directed, this cap was the engine's
+ * last line of defense against returning a relation it could not prove was
+ * row/field scoped (ADR-0022, issue #830); a request naming anything at this
+ * depth is now scoped exactly like every other named relation; the cap
+ * exists solely to bound how deep a request may cost the engine to serve. See
+ * ADR-0026 and `docs/adr/0022-access-control-fails-closed-when-it-cannot-scope.md`.
  */
 export class AccessScopeDepthExceededError extends Error {
     listKey;
     fieldKey;
     depth;
     constructor(listKey, fieldKey, depth) {
-        super(`Cannot compute an access scope for "${listKey}.${fieldKey}" at include depth ${depth}: ` +
-            `this exceeds the Access Filter's maximum read-include depth (${READ_INCLUDE_MAX_DEPTH}). ` +
-            `A caller-supplied include this deep cannot be row- and field-scoped, so the read is denied ` +
-            `rather than returned unscoped. Restructure the query to fetch this relation separately.`);
+        super(`Cannot include "${listKey}.${fieldKey}" at include depth ${depth}: this exceeds the read ` +
+            `pipeline's maximum include depth (${READ_INCLUDE_MAX_DEPTH}). This is a cost limit, not an ` +
+            `inability to scope — the engine declines to serve a tree this deep rather than returning ` +
+            `it. Restructure the query to fetch this relation separately.`);
         this.name = 'AccessScopeDepthExceededError';
         this.listKey = listKey;
         this.fieldKey = fieldKey;
@@ -52,4 +56,79 @@ export class ResolveOutputCycleError extends Error {
         this.chain = chain;
     }
 }
+/**
+ * Thrown when a relation filter in a caller's `where` (`some`/`every`/`none`/
+ * `is`/`isNot`) names a relationship whose related list denies operation-level
+ * `query` access outright (`=== false`). Deliberately a loud failure, not a
+ * silently narrowed `{ id: { in: [] } }` or a pass-through: ADR-0022 requires
+ * an engine that cannot compute a scope to deny, never pass through, and here
+ * the engine CAN compute the scope (denied) — passing that through as a
+ * silently-empty match would itself be a distinguishable signal for a caller
+ * probing which relations they may filter on. `include`'s equivalent case
+ * (`buildAccessScopedInclude`) drops the relation silently instead, because a
+ * `null`/missing key in a response is indistinguishable from "not requested";
+ * a `where` predicate has no such neutral outcome, so a relation filter on a
+ * fully denied relation is refused instead. `sudo` bypasses this check
+ * entirely, matching every other access-control escape hatch. See #916 and
+ * `docs/adr/0022-access-control-fails-closed-when-it-cannot-scope.md`.
+ */
+export class RelationFilterAccessDeniedError extends Error {
+    listKey;
+    fieldKey;
+    relatedListKey;
+    constructor(listKey, fieldKey, relatedListKey) {
+        super(`Cannot filter "${listKey}.${fieldKey}" — the related list "${relatedListKey}" denies ` +
+            `query access to this session, so this relation filter cannot be scoped. Denial is loud ` +
+            `rather than silently narrowed to match nothing (ADR-0022). Use sudo to bypass.`);
+        this.name = 'RelationFilterAccessDeniedError';
+        this.listKey = listKey;
+        this.fieldKey = fieldKey;
+        this.relatedListKey = relatedListKey;
+    }
+}
+function describeFieldAccessResult(result) {
+    if (result === null)
+        return 'null';
+    if (result === undefined)
+        return 'undefined';
+    if (typeof result === 'object')
+        return 'an object (e.g. a Prisma filter)';
+    return `a ${typeof result}`;
+}
+/**
+ * Thrown when a field-level access control function returns anything other
+ * than a strict `boolean`. `FieldAccessControl` is typed to return `boolean`
+ * only: field access is a single per-field visibility decision, not a row
+ * filter, and a denied field is removed rather than used to scope rows (see
+ * the "Field-level access" glossary entry in `CONTEXT.md`, ADR-0001, and
+ * ADR-0030).
+ *
+ * A rule that type-checks can never reach this — the only way here is a
+ * caller that bypasses the type (an untyped JS config, or a value forced past
+ * the checker), most notably a Prisma filter, which is the shape
+ * operation-level `AccessControl` accepts but `FieldAccessControl` does not.
+ * Before #913 this fell through to an unconditional `return true`, silently
+ * granting the field blanket access; it now fails loudly and closed instead,
+ * for `read`, `create`, and `update` alike.
+ *
+ * Deliberately does not expose the offending result as a public field: unlike
+ * `AccessScopeDepthExceededError`/`ResolveOutputCycleError`'s fields, there is
+ * no concretely-typed shape to give it (the whole problem is that it isn't
+ * the `boolean` the caller's rule promised), and the root CLAUDE.md forbids
+ * exposing `unknown`/`any` as part of a package's external API. A description
+ * of what was returned instead is folded into the message text.
+ */
+export class InvalidFieldAccessResultError extends Error {
+    operation;
+    constructor(operation, result) {
+        super(`Field-level access control for operation "${operation}" returned ` +
+            `${describeFieldAccessResult(result)}, not a boolean. Field access is a per-field ` +
+            `visibility decision — it must return true or false, and (unlike operation-level access) ` +
+            `cannot scope which rows are affected. If you meant to restrict access based on the row or ` +
+            `the write payload, evaluate the condition yourself and return a boolean, e.g. ` +
+            `\`({ item, session }) => item?.ownerId === session?.userId\`.`);
+        this.name = 'InvalidFieldAccessResultError';
+        this.operation = operation;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/access/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IAEpB,YAAY,OAAe,EAAE,QAAgB,EAAE,KAAa;QAC1D,KAAK,CACH,uCAAuC,OAAO,IAAI,QAAQ,sBAAsB,KAAK,IAAI;YACvF,gEAAgE,sBAAsB,KAAK;YAC3F,6FAA6F;YAC7F,yFAAyF,CAC5F,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACzC,KAAK,CAAkD;IAE9D,YAAY,KAAuD;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChF,KAAK,CACH,iCAAiC,IAAI,+CAA+C;YAClF,wFAAwF;YACxF,0FAA0F;YAC1F,iCAAiC,CACpC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/access/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC/C,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IAEpB,YAAY,OAAe,EAAE,QAAgB,EAAE,KAAa;QAC1D,KAAK,CACH,mBAAmB,OAAO,IAAI,QAAQ,sBAAsB,KAAK,0BAA0B;YACzF,qCAAqC,sBAAsB,kCAAkC;YAC7F,2FAA2F;YAC3F,8DAA8D,CACjE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACzC,KAAK,CAAkD;IAE9D,YAAY,KAAuD;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChF,KAAK,CACH,iCAAiC,IAAI,+CAA+C;YAClF,wFAAwF;YACxF,0FAA0F;YAC1F,iCAAiC,CACpC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACjD,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,cAAc,CAAQ;IAE7B,YAAY,OAAe,EAAE,QAAgB,EAAE,cAAsB;QACnE,KAAK,CACH,kBAAkB,OAAO,IAAI,QAAQ,yBAAyB,cAAc,WAAW;YACrF,yFAAyF;YACzF,gFAAgF,CACnF,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;IACtC,CAAC;CACF;AAED,SAAS,yBAAyB,CAAC,MAAe;IAChD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,kCAAkC,CAAA;IACzE,OAAO,KAAK,OAAO,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC/C,SAAS,CAA8B;IAE9C,YAAY,SAAuC,EAAE,MAAe;QAClE,KAAK,CACH,6CAA6C,SAAS,aAAa;YACjE,GAAG,yBAAyB,CAAC,MAAM,CAAC,+CAA+C;YACnF,0FAA0F;YAC1F,4FAA4F;YAC5F,gFAAgF;YAChF,+DAA+D,CAClE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}

package/dist/access/field-access.d.ts

@@ -18,6 +18,10 @@ import type { FieldAccess } from './types.js';
  * (read/update/delete), and on the `inputData` being written (create/update),
  * so all of those are accepted. Do not introduce a parallel evaluator with a
  * narrower signature.
+ *
+ * Returns a strict boolean, never a filter: a rule that returns anything else
+ * throws `InvalidFieldAccessResultError` rather than defaulting to allow (see
+ * that error's doc, ADR-0001, and ADR-0030).
  */
 export declare function checkFieldAccess(fieldAccess: FieldAccess | undefined, operation: 'read' | 'create' | 'update', args: {
     session: Session | null;
@@ -28,8 +32,42 @@ export declare function checkFieldAccess(fieldAccess: FieldAccess | undefined, o
     inputData?: Record<string, unknown>;
 }): Promise<boolean>;
 /**
- * Filter fields from input data based on write access (create/update)
+ * Whether a field's `read` access allows it to be NAMED in a `where`/`orderBy`
+ * predicate, evaluated BEFORE the query runs (#915).
+ *
+ * Field-level `read` access has always been a post-query check (Field
+ * Visibility, `field-visibility.ts`): it strips a denied key from a row that
+ * has already been fetched. That leaves the predicate itself unconstrained —
+ * a caller can still filter or sort by a field whose value they could never
+ * read, and recover it (or its relative order) by probing. This function is
+ * the pre-query counterpart, called from `query-validation.ts`'s `where`/
+ * `orderBy` walk for every key that resolves to a declared field.
+ *
+ * It delegates to the same evaluator Field Visibility uses (`checkFieldAccess`),
+ * per this module's canonical-evaluator rule above. The one difference is the
+ * `item` it hands the rule: there is no fetched row
+ * yet, so a rule that depends on one (the shape `FieldAccess['read']`
+ * documents as the norm, e.g. `item?.ownerId === session?.userId`) cannot be
+ * answered here. Rather than skip the check for such a rule — which would
+ * reopen exactly the hole this closes for the fields most likely to be
+ * sensitive — it is handed a poisoned `item` that throws on any property
+ * read, and that throw is caught and resolved to `false`: a row-dependent
+ * `read` rule always denies at predicate time, documented and deliberate
+ * (see docs/adr/0031). A rule that never touches `item` (checking only
+ * `session`, the common case for a field meant to be filterable/sortable at
+ * all) evaluates normally and returns its real answer.
+ *
+ * A rule that returns a non-boolean is a distinct, louder failure (#913,
+ * ADR-0030) — `InvalidFieldAccessResultError` — and is deliberately NOT
+ * folded into the `false` here; it propagates so the config bug it signals is
+ * never mistaken for an ordinary field-level denial.
  */
+export declare function isFieldReadableForPredicate(fieldAccess: FieldAccess | undefined, args: {
+    session: Session | null;
+    context: AccessContext & {
+        _isSudo?: boolean;
+    };
+}): Promise<boolean>;
 export declare function filterWritableFields<T extends Record<string, unknown>>(data: T, fieldConfigs: Record<string, {
     access?: FieldAccess;
     type?: string;

package/dist/access/field-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-access.d.ts","sourceRoot":"","sources":["../../src/access/field-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAM7C;;;;;;;;;GASG;AAEH;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EACvC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC,GACA,OAAO,CAAC,OAAO,CAAC,CAmClB;AA8BD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAClB,MAAM,EACN;IACE,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CACjD,CACF,EACD,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CA2HrB"}
+{"version":3,"file":"field-access.d.ts","sourceRoot":"","sources":["../../src/access/field-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,YAAY,CAAA;AA6CjE;;;;;;;;;GASG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EACvC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC,GACA,OAAO,CAAC,OAAO,CAAC,CA+ClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC/C,GACA,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAClB,MAAM,EACN;IACE,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CACjD,CACF,EACD,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAyHrB"}

package/dist/access/field-access.js

@@ -2,6 +2,41 @@
 // at module-evaluation time, so the field-access ⇄ hooks import cycle is safe
 // under ESM live bindings.
 import { ValidationError } from '../hooks/index.js';
+import { InvalidFieldAccessResultError } from './errors.js';
+/**
+ * Marks a throw caused by touching {@link createPoisonedItem}'s `item`, as
+ * opposed to some other error a field rule legitimately raises. Not exported
+ * — callers only ever see its effect (a `false` from
+ * `isFieldReadableForPredicate`), never the class itself.
+ */
+class PredicateTimeItemAccessError extends Error {
+}
+/**
+ * An `item` that throws {@link PredicateTimeItemAccessError} on ANY attempt to
+ * read a property off it — including via optional chaining (`item?.x`),
+ * since the Proxy itself is a truthy object and optional chaining still
+ * performs the property read once its base is non-nullish. Used by
+ * `isFieldReadableForPredicate` to detect a read rule that depends on the
+ * fetched row: there is no row yet at predicate-evaluation time (see that
+ * function's doc), so any rule that reaches into `item` at all cannot be
+ * answered here.
+ */
+function createPoisonedItem() {
+    return new Proxy({}, {
+        get(_target, prop) {
+            throw new PredicateTimeItemAccessError(String(prop));
+        },
+        has(_target, prop) {
+            throw new PredicateTimeItemAccessError(String(prop));
+        },
+        ownKeys() {
+            throw new PredicateTimeItemAccessError('ownKeys');
+        },
+        getOwnPropertyDescriptor(_target, prop) {
+            throw new PredicateTimeItemAccessError(String(prop));
+        },
+    });
+}
 /**
  * Shared field-level access evaluation.
  *
@@ -20,18 +55,29 @@ import { ValidationError } from '../hooks/index.js';
  * (read/update/delete), and on the `inputData` being written (create/update),
  * so all of those are accepted. Do not introduce a parallel evaluator with a
  * narrower signature.
+ *
+ * Returns a strict boolean, never a filter: a rule that returns anything else
+ * throws `InvalidFieldAccessResultError` rather than defaulting to allow (see
+ * that error's doc, ADR-0001, and ADR-0030).
  */
 export async function checkFieldAccess(fieldAccess, operation, args) {
-    // Skip access check in sudo mode
     if (args.context._isSudo) {
         return true;
     }
     if (!fieldAccess) {
-        return true; // No field access means allow
+        return true;
     }
+    // `FieldAccess['read']` is narrower than `FieldAccess['create'/'update']` (it
+    // only accepts the single `operation: 'read'` call shape, see `types.ts`),
+    // so indexing by a not-yet-narrowed `operation` union produces a callable
+    // whose effective parameter type collapses to an intersection TypeScript
+    // can't satisfy generically here. Widen back to the general
+    // `FieldAccessControl` — the same shape this function has always built and
+    // passed below — since by construction the args object always matches
+    // whichever operation is actually requested.
     const accessControl = fieldAccess[operation];
     if (!accessControl) {
-        return true; // No specific access control means allow
+        return true;
     }
     const result = await accessControl({
         session: args.session,
@@ -40,53 +86,74 @@ export async function checkFieldAccess(fieldAccess, operation, args) {
         inputData: args.inputData,
         operation,
     });
-    // If result is false, deny access
     if (result === false) {
         return false;
     }
-    // If result is true, allow access
     if (result === true) {
         return true;
     }
-    // Default to allowing access if we can't determine
-    return true;
+    // `FieldAccessControl` is typed to return `boolean` only — field access is a
+    // per-field visibility decision, not a row filter (ADR-0001, ADR-0030). A
+    // well-typed rule can never reach this line; getting here means a caller
+    // bypassed the type (most notably by returning a Prisma filter, the shape
+    // operation-level `AccessControl` accepts but this does not). Fail loudly
+    // and closed — this operation applies identically whether or not `item` is
+    // available, so `create` (which has no `item` to evaluate a filter against)
+    // needs no separate answer: neither operation ever honours a non-boolean.
+    throw new InvalidFieldAccessResultError(operation, result);
 }
 /**
- * Simple filter matching for field-level access
- * Checks if an item matches a Prisma-like filter object
+ * Whether a field's `read` access allows it to be NAMED in a `where`/`orderBy`
+ * predicate, evaluated BEFORE the query runs (#915).
+ *
+ * Field-level `read` access has always been a post-query check (Field
+ * Visibility, `field-visibility.ts`): it strips a denied key from a row that
+ * has already been fetched. That leaves the predicate itself unconstrained —
+ * a caller can still filter or sort by a field whose value they could never
+ * read, and recover it (or its relative order) by probing. This function is
+ * the pre-query counterpart, called from `query-validation.ts`'s `where`/
+ * `orderBy` walk for every key that resolves to a declared field.
+ *
+ * It delegates to the same evaluator Field Visibility uses (`checkFieldAccess`),
+ * per this module's canonical-evaluator rule above. The one difference is the
+ * `item` it hands the rule: there is no fetched row
+ * yet, so a rule that depends on one (the shape `FieldAccess['read']`
+ * documents as the norm, e.g. `item?.ownerId === session?.userId`) cannot be
+ * answered here. Rather than skip the check for such a rule — which would
+ * reopen exactly the hole this closes for the fields most likely to be
+ * sensitive — it is handed a poisoned `item` that throws on any property
+ * read, and that throw is caught and resolved to `false`: a row-dependent
+ * `read` rule always denies at predicate time, documented and deliberate
+ * (see docs/adr/0031). A rule that never touches `item` (checking only
+ * `session`, the common case for a field meant to be filterable/sortable at
+ * all) evaluates normally and returns its real answer.
+ *
+ * A rule that returns a non-boolean is a distinct, louder failure (#913,
+ * ADR-0030) — `InvalidFieldAccessResultError` — and is deliberately NOT
+ * folded into the `false` here; it propagates so the config bug it signals is
+ * never mistaken for an ordinary field-level denial.
  */
-function matchesFilter(item, filter) {
-    for (const [key, condition] of Object.entries(filter)) {
-        if (typeof condition === 'object' && condition !== null) {
-            // Handle nested conditions like { equals: value }
-            if ('equals' in condition) {
-                if (item[key] !== condition.equals) {
-                    return false;
-                }
-            }
-            else if ('not' in condition) {
-                if (item[key] === condition.not) {
-                    return false;
-                }
-            }
-            // Add more condition types as needed
-        }
-        else {
-            // Direct equality check
-            if (item[key] !== condition) {
-                return false;
-            }
-        }
+export async function isFieldReadableForPredicate(fieldAccess, args) {
+    try {
+        return await checkFieldAccess(fieldAccess, 'read', {
+            session: args.session,
+            context: args.context,
+            item: createPoisonedItem(),
+        });
+    }
+    catch (err) {
+        // Only the poisoned-item signal means "row-dependent, deny". Anything
+        // else — including `InvalidFieldAccessResultError` and a genuine bug in
+        // the rule itself — propagates unchanged rather than being silently
+        // folded into an ordinary denial (found in review of #925).
+        if (err instanceof PredicateTimeItemAccessError)
+            return false;
+        throw err;
     }
-    return true;
 }
-/**
- * Filter fields from input data based on write access (create/update)
- */
 export async function filterWritableFields(data, fieldConfigs, operation, args) {
     const filtered = {};
-    // Build a set of foreign key field names to exclude
-    // Foreign keys should not be in the data when using Prisma's relation syntax
+    // Foreign keys must not appear in `data` when using Prisma's relation syntax.
     const foreignKeyFields = new Set();
     // Map each raw per-part column name contributed by a multi-column field
     // (e.g. storage image()/file() in Keystone-parity mode) back to its OWNING
@@ -122,17 +189,16 @@ export async function filterWritableFields(data, fieldConfigs, operation, args)
     const isSudo = args.context._isSudo === true;
     for (const [fieldName, value] of Object.entries(data)) {
         const fieldConfig = fieldConfigs[fieldName];
-        // Skip system fields
         if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
             continue;
         }
-        // Skip virtual fields - they don't store in database
-        // Virtual fields with resolveInput hooks handle side effects separately
+        // Virtual fields don't store in the database — skipped here, but their
+        // resolveInput hooks still run as a separate side-effect step.
         if (fieldConfig && 'virtual' in fieldConfig && fieldConfig.virtual) {
             continue;
         }
-        // Skip foreign key fields (e.g., authorId) when their corresponding relationship field exists
-        // This prevents conflicts when using Prisma's relation syntax (e.g., author: { connect: { id } })
+        // Prevents conflicts with Prisma's relation syntax (e.g.,
+        // `author: { connect: { id } }`).
         if (foreignKeyFields.has(fieldName)) {
             continue;
         }

package/dist/access/field-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"field-access.js","sourceRoot":"","sources":["../../src/access/field-access.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD;;;;;;;;;GASG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAuC,EACvC,IAKC;IAED,iCAAiC;IACjC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAA,CAAC,8BAA8B;IAC5C,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA,CAAC,yCAAyC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;KAC6B,CAAC,CAAA;IAEzC,kCAAkC;IAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mDAAmD;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAA6B,EAAE,MAA+B;IACnF,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,kDAAkD;YAClD,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;oBACnC,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;oBAChC,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YACD,qCAAqC;QACvC,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAO,EACP,YAOC,EACD,SAA8B,EAC9B,IAKC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAE5C,oDAAoD;IACpD,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuD,CAAA;IACxF,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxC,wFAAwF;YACxF,MAAM,SAAS,GAAG,WAAiC,CAAA;YACnD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpB,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YACrD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAA;IAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE3C,qBAAqB;QACrB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,SAAQ;QACV,CAAC;QAED,qDAAqD;QACrD,wEAAwE;QACxE,IAAI,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACnE,SAAQ;QACV,CAAC;QAED,8FAA8F;QAC9F,kGAAkG;QAClG,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,SAAQ;QACV,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,8EAA8E;QAC9E,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC1E,GAAG,IAAI;gBACP,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,eAAe,CAAC;oBACxB,UAAU,SAAS,KAAK,gBAAgB,CAAC,SAAS,kBAAkB,SAAS,MAAM;wBACjF,4BAA4B;iBAC/B,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;YAC3B,SAAQ;QACV,CAAC;QAED,gDAAgD;QAChD,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,MAAM,EAAE,CAAC;gBACX,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;gBAC3B,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,eAAe,CAAC;gBACxB,UAAU,SAAS,KAAK,SAAS,qCAAqC;oBACpE,yDAAyD;aAC5D,CAAC,CAAA;QACJ,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,+DAA+D;QAC/D,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE;YACrE,GAAG,IAAI;YACP,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,CAAC,UAAU,SAAS,KAAK,SAAS,+BAA+B,CAAC,CAAC,CAAA;QAC/F,CAAC;QAED,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;IAC7B,CAAC;IAED,OAAO,QAAsB,CAAA;AAC/B,CAAC"}
+{"version":3,"file":"field-access.js","sourceRoot":"","sources":["../../src/access/field-access.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,8EAA8E;AAC9E,2BAA2B;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAE3D;;;;;GAKG;AACH,MAAM,4BAA6B,SAAQ,KAAK;CAAG;AAEnD;;;;;;;;;GASG;AACH,SAAS,kBAAkB;IACzB,OAAO,IAAI,KAAK,CACd,EAAE,EACF;QACE,GAAG,CAAC,OAAO,EAAE,IAAI;YACf,MAAM,IAAI,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,CAAC;QACD,GAAG,CAAC,OAAO,EAAE,IAAI;YACf,MAAM,IAAI,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,CAAC;QACD,OAAO;YACL,MAAM,IAAI,4BAA4B,CAAC,SAAS,CAAC,CAAA;QACnD,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,IAAI;YACpC,MAAM,IAAI,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,CAAC;KACF,CACyB,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAuC,EACvC,IAKC;IAED,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4DAA4D;IAC5D,2EAA2E;IAC3E,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAmC,CAAA;IAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;KAC6B,CAAC,CAAA;IAEzC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,IAAI,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAoC,EACpC,IAGC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,kBAAkB,EAAE;SAC3B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,4DAA4D;QAC5D,IAAI,GAAG,YAAY,4BAA4B;YAAE,OAAO,KAAK,CAAA;QAC7D,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAO,EACP,YAOC,EACD,SAA8B,EAC9B,IAKC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAE5C,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC1C,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuD,CAAA;IACxF,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxC,wFAAwF;YACxF,MAAM,SAAS,GAAG,WAAiC,CAAA;YACnD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpB,gBAAgB,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YACrD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAA;IAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE3C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,SAAQ;QACV,CAAC;QAED,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACnE,SAAQ;QACV,CAAC;QAED,0DAA0D;QAC1D,kCAAkC;QAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,SAAQ;QACV,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,8EAA8E;QAC9E,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzD,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC1E,GAAG,IAAI;gBACP,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,eAAe,CAAC;oBACxB,UAAU,SAAS,KAAK,gBAAgB,CAAC,SAAS,kBAAkB,SAAS,MAAM;wBACjF,4BAA4B;iBAC/B,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;YAC3B,SAAQ;QACV,CAAC;QAED,gDAAgD;QAChD,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,MAAM,EAAE,CAAC;gBACX,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;gBAC3B,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,eAAe,CAAC;gBACxB,UAAU,SAAS,KAAK,SAAS,qCAAqC;oBACpE,yDAAyD;aAC5D,CAAC,CAAA;QACJ,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,+DAA+D;QAC/D,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE;YACrE,GAAG,IAAI;YACP,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,CAAC,UAAU,SAAS,KAAK,SAAS,+BAA+B,CAAC,CAAC,CAAA;QAC/F,CAAC;QAED,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;IAC7B,CAAC;IAED,OAAO,QAAsB,CAAA;AAC/B,CAAC"}