@opensaas/stack-core 0.37.0 → 0.39.0

package/dist/access/field-access.test.js

@@ -1,5 +1,6 @@
-import { describe, it, expect } from 'vitest';
-import { filterWritableFields } from './field-access.js';
+import { describe, it, expect, expectTypeOf } from 'vitest';
+import { checkFieldAccess, filterWritableFields, isFieldReadableForPredicate, } from './field-access.js';
+import { InvalidFieldAccessResultError } from './errors.js';
 import { ValidationError } from '../hooks/index.js';
 // A non-sudo access context. The cast is localized to test setup (mirrors the
 // existing sudo-context casts in this file): the runtime AccessContext carries
@@ -18,6 +19,210 @@ function sudoContext() {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
     };
 }
+// ── #914: `FieldAccess['read']`'s `item` must type as present, matching what
+// Field Visibility (field-visibility.ts) actually passes ──
+describe("FieldAccess['read'] item typing (issue #914)", () => {
+    it('types item as present for a read rule that reads a property off it — no cast, no `any`', () => {
+        const fieldAccess = {
+            read: ({ session, item }) => item.ownerId === session?.userId,
+        };
+        expect(typeof fieldAccess.read).toBe('function');
+    });
+    it('still compiles a read rule that ignores item entirely', () => {
+        const fieldAccess = {
+            read: () => true,
+        };
+        expect(typeof fieldAccess.read).toBe('function');
+    });
+    it('leaves the create branch unchanged — item is still absent, there genuinely is no row yet', () => {
+        expectTypeOf().toEqualTypeOf();
+    });
+    // Type-level pin: `resolveReadableFieldValue` (field-visibility.ts) is the
+    // sole caller of `checkFieldAccess` for `operation: 'read'`, and always
+    // supplies `item: accessItem` — a full row, never `undefined`. This
+    // assertion has no runtime effect (`expectTypeOf` is a no-op outside
+    // `vitest --typecheck`); its value is that `pnpm build`/`tsc` fails on this
+    // file the moment `FieldAccess['read']`'s `item` type drifts back to
+    // optional/absent, so the declared type and the call site cannot silently
+    // diverge again.
+    it("pins FieldAccess['read']'s item type against the field-visibility.ts call site", () => {
+        expectTypeOf().toEqualTypeOf();
+        expectTypeOf().toEqualTypeOf();
+    });
+});
+// ── #913: a field rule returning a filter must not be granted blanket access ──
+describe('checkFieldAccess', () => {
+    it('allows when the rule returns true', async () => {
+        const allowed = await checkFieldAccess({ read: () => true }, 'read', {
+            session: null,
+            item: { ownerId: 'someone-else' },
+            context: nonSudoContext(),
+        });
+        expect(allowed).toBe(true);
+    });
+    it('denies when the rule returns false', async () => {
+        const allowed = await checkFieldAccess({ read: () => false }, 'read', {
+            session: null,
+            item: { ownerId: 'someone-else' },
+            context: nonSudoContext(),
+        });
+        expect(allowed).toBe(false);
+    });
+    it('allows when no field access is configured', async () => {
+        const allowed = await checkFieldAccess(undefined, 'read', {
+            session: null,
+            context: nonSudoContext(),
+        });
+        expect(allowed).toBe(true);
+    });
+    it('allows when no rule is configured for the operation', async () => {
+        const allowed = await checkFieldAccess({ update: () => false }, 'read', {
+            session: null,
+            context: nonSudoContext(),
+        });
+        expect(allowed).toBe(true);
+    });
+    it('throws InvalidFieldAccessResultError, not allow, when a read rule returns a filter', async () => {
+        // The exact reproduction from the issue: a rule written to scope a field
+        // by row, which the previous fail-open default granted full access to.
+        const fieldAccess = {
+            read: () => ({ ownerId: { equals: 'someone-else' } }),
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        await expect(checkFieldAccess(fieldAccess, 'read', {
+            session: null,
+            item: { ownerId: 'the-owner' },
+            context: nonSudoContext(),
+        })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
+    it('throws for a filter-returning rule on create, where there is no item to test it against', async () => {
+        const fieldAccess = {
+            create: () => ({ ownerId: { equals: 'someone-else' } }),
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        await expect(checkFieldAccess(fieldAccess, 'create', {
+            session: null,
+            context: nonSudoContext(),
+            inputData: { ownerId: 'the-owner' },
+        })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
+    it('throws for a filter-returning rule on update', async () => {
+        const fieldAccess = {
+            update: () => ({ ownerId: { equals: 'someone-else' } }),
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        await expect(checkFieldAccess(fieldAccess, 'update', {
+            session: null,
+            item: { ownerId: 'the-owner' },
+            context: nonSudoContext(),
+            inputData: { ownerId: 'someone-else' },
+        })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
+    it('throws for a non-boolean, non-filter result too (e.g. undefined)', async () => {
+        const fieldAccess = {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            read: () => undefined,
+        };
+        await expect(checkFieldAccess(fieldAccess, 'read', {
+            session: null,
+            item: {},
+            context: nonSudoContext(),
+        })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
+    it('throws with a descriptive message for null, and for other primitive results', async () => {
+        const nullAccess = {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            read: () => null,
+        };
+        await expect(checkFieldAccess(nullAccess, 'read', {
+            session: null,
+            item: {},
+            context: nonSudoContext(),
+        })).rejects.toThrow(/returned null, not a boolean/);
+        const numberAccess = {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            read: () => 42,
+        };
+        await expect(checkFieldAccess(numberAccess, 'read', {
+            session: null,
+            item: {},
+            context: nonSudoContext(),
+        })).rejects.toThrow(/returned a number, not a boolean/);
+    });
+    it('sudo bypasses the rule entirely, so a filter-returning rule never reaches the throw', async () => {
+        const fieldAccess = {
+            read: () => ({ ownerId: { equals: 'someone-else' } }),
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        const allowed = await checkFieldAccess(fieldAccess, 'read', {
+            session: null,
+            item: { ownerId: 'the-owner' },
+            context: sudoContext(),
+        });
+        expect(allowed).toBe(true);
+    });
+});
+describe('isFieldReadableForPredicate (#915)', () => {
+    it('allows when there is no field access configured', async () => {
+        const readable = await isFieldReadableForPredicate(undefined, {
+            session: null,
+            context: nonSudoContext(),
+        });
+        expect(readable).toBe(true);
+    });
+    it('allows when the rule only inspects session (never touches item)', async () => {
+        const readable = await isFieldReadableForPredicate({ read: ({ session }) => session?.userId === 'admin' }, { session: { userId: 'admin' }, context: nonSudoContext() });
+        expect(readable).toBe(true);
+    });
+    it('denies when the rule returns false', async () => {
+        const readable = await isFieldReadableForPredicate({ read: () => false }, { session: null, context: nonSudoContext() });
+        expect(readable).toBe(false);
+    });
+    it('denies a row-dependent rule that dereferences `item` directly', async () => {
+        const readable = await isFieldReadableForPredicate({ read: ({ item, session }) => item.ownerId === session?.userId }, { session: { userId: 'user-1' }, context: nonSudoContext() });
+        expect(readable).toBe(false);
+    });
+    it('denies a row-dependent rule even when it reads `item` via optional chaining', async () => {
+        // This is the exact idiom `InvalidFieldAccessResultError`'s own message
+        // recommends (`item?.ownerId === session?.userId`) — it must still deny,
+        // not silently misevaluate `undefined === session?.userId` against a
+        // poisoned `item`.
+        const readable = await isFieldReadableForPredicate({ read: ({ item, session }) => item?.ownerId === session?.userId }, { session: null, context: nonSudoContext() });
+        expect(readable).toBe(false);
+    });
+    it('denies a row-dependent rule that only enumerates `item`s keys', async () => {
+        const readable = await isFieldReadableForPredicate(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        { read: ({ item }) => Object.keys(item).length > 0 }, { session: null, context: nonSudoContext() });
+        expect(readable).toBe(false);
+    });
+    it('propagates InvalidFieldAccessResultError instead of folding it into a denial', async () => {
+        const fieldAccess = {
+            read: () => ({ ownerId: { equals: 'someone-else' } }),
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        await expect(isFieldReadableForPredicate(fieldAccess, { session: null, context: nonSudoContext() })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
+    it('propagates a genuine error the rule throws for its own reasons, not just non-boolean results', async () => {
+        // The rule never touches `item` — it throws for a reason of its own.
+        // This must NOT be folded into an ordinary `false` denial (that would
+        // mask a real bug in the rule as "field not readable"), matching how the
+        // post-query path (`filterReadableFields`) already lets such a throw
+        // propagate unchanged.
+        const fieldAccess = {
+            read: ({ session }) => {
+                if (session === null)
+                    throw new Error('unexpected anonymous access');
+                return true;
+            },
+        };
+        await expect(isFieldReadableForPredicate(fieldAccess, { session: null, context: nonSudoContext() })).rejects.toThrow('unexpected anonymous access');
+    });
+    it('sudo bypasses the rule entirely, so a row-dependent rule never denies', async () => {
+        const readable = await isFieldReadableForPredicate({ read: ({ item, session }) => item.ownerId === session?.userId }, { session: null, context: sudoContext() });
+        expect(readable).toBe(true);
+    });
+});
 describe('filterWritableFields', () => {
     it('should filter out foreign key fields when their corresponding relationship field exists', async () => {
         // Setup: Define field configs with a relationship field
@@ -303,6 +508,28 @@ describe('filterWritableFields', () => {
             inputData: data,
         })).rejects.toThrow(/status/);
     });
+    // ── #913: a field rule returning a filter must not grant blanket write access ──
+    it('throws InvalidFieldAccessResultError, not a blanket write, when field access returns a filter (non-sudo)', async () => {
+        const fieldConfigs = {
+            title: { type: 'text' },
+            status: {
+                type: 'text',
+                access: {
+                    // Written as a row-scoping rule; field access does not honour filters.
+                    update: () => ({ status: { equals: 'draft' } }),
+                    create: () => ({ status: { equals: 'draft' } }),
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        };
+        const data = { title: 'Test', status: 'published' };
+        await expect(filterWritableFields(data, fieldConfigs, 'update', {
+            session: null,
+            item: { id: 'post-1', status: 'draft' },
+            context: nonSudoContext(),
+            inputData: data,
+        })).rejects.toThrow(InvalidFieldAccessResultError);
+    });
     it('does NOT throw on a would-be-denied field under sudo', async () => {
         const fieldConfigs = {
             title: { type: 'text' },

package/dist/access/field-access.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"field-access.test.js","sourceRoot":"","sources":["../../src/access/field-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,SAAS,cAAc;IACrB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,8DAA8D;KACxD,CAAA;AACV,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,8DAA8D;KACxD,CAAA;AACV,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,wDAAwD;QACxD,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;aACb;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,IAAI,EAAE,qDAAqD;aAClE;SACF,CAAA;QAED,sEAAsE;QACtE,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,UAAU,EAAE,8BAA8B;YACpD,MAAM,EAAE,SAAS,EAAE,kDAAkD;YACrE,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;aAC5B;SACF,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI,EAAE,2CAA2C;gBAC1D,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,kCAAkC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAE/C,sBAAsB;QACtB,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAErD,oCAAoC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACxB,CAAA;QAED,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,uCAAuC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAEhD,+BAA+B;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;SACF,CAAA;QAED,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,UAAU,EAAE,yBAAyB;YAC/C,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;aAC5B;SACF,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;QACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,YAAY,GAAG;YACnB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,8CAA8C;YAC5E,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;SACF,CAAA;QAED,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,WAAW,EAAE,gDAAgD;YACzE,QAAQ,EAAE,UAAU,EAAE,0CAA0C;SACjE,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,qDAAqD;QACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAE1D,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAEhF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,sEAAsE;YACtE,4EAA4E;YAC5E,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;SACvD,CAAA;QAED,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAClC,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO;SAClB,CAAA;QAED,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;SACvD,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;SAC9C,CAAA;QACD,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,QAAQ,EAAE,2BAA2B;SAChD,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,0EAA0E;QAC1E,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,iBAAiB;YAC5B,UAAU,EAAE,EAAE;SACf,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;gBACpD,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,CAAC;SACd,CAAA;QAED,kEAAkE;QAClE,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAClC,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;gBACpD,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,iBAAiB;YAC5B,UAAU,EAAE,EAAE;SACf,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAEhF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;aACrD;SACF,CAAA;QACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAEnD,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;aACrD;SACF,CAAA;QACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAEnD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;SAC9C,CAAA;QACD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;SACtC,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"field-access.test.js","sourceRoot":"","sources":["../../src/access/field-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,SAAS,cAAc;IACrB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,8DAA8D;KACxD,CAAA;AACV,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,8DAA8D;KACxD,CAAA;AACV,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAE5D,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAG5D,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,WAAW,GAAsB;YACrC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,MAAM;SAC9D,CAAA;QACD,MAAM,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,WAAW,GAAsB;YACrC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;SACjB,CAAA;QACD,MAAM,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAMlG,YAAY,EAAsB,CAAC,aAAa,EAAa,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,iBAAiB;IACjB,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAExF,YAAY,EAAoB,CAAC,aAAa,EAAQ,CAAA;QACtD,YAAY,EAAyB,CAAC,aAAa,EAAU,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,iFAAiF;AAEjF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE;YACnE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACjC,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE;YACpE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACjC,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE;YACxD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE;YACtE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,WAAW,GAAG;YAClB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;YACrD,8DAA8D;SACxD,CAAA;QAER,MAAM,MAAM,CACV,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YACpC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;YAC9B,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,WAAW,GAAG;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;YACvD,8DAA8D;SACxD,CAAA;QAER,MAAM,MAAM,CACV,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE;YACtC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;SACpC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,WAAW,GAAG;YAClB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;YACvD,8DAA8D;SACxD,CAAA;QAER,MAAM,MAAM,CACV,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE;YACtC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;YAC9B,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;SACvC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,WAAW,GAAG;YAClB,8DAA8D;YAC9D,IAAI,EAAE,GAAG,EAAE,CAAC,SAAgB;SAC7B,CAAA;QAED,MAAM,MAAM,CACV,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YACpC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,UAAU,GAAG;YACjB,8DAA8D;YAC9D,IAAI,EAAE,GAAG,EAAE,CAAC,IAAW;SACxB,CAAA;QACD,MAAM,MAAM,CACV,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;QAEjD,MAAM,YAAY,GAAG;YACnB,8DAA8D;YAC9D,IAAI,EAAE,GAAG,EAAE,CAAC,EAAS;SACtB,CAAA;QACD,MAAM,MAAM,CACV,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE;YACrC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,WAAW,GAAG;YAClB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;YACrD,8DAA8D;SACxD,CAAA;QAER,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YAC1D,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;YAC9B,OAAO,EAAE,WAAW,EAAE;SACvB,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,SAAS,EAAE;YAC5D,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,EAAE,EACtD,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAC5D,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EACrB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAC7C,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,MAAM,EAAE,EACjE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAC7D,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,EAAE,MAAM,EAAE,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAC7C,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,QAAQ,GAAG,MAAM,2BAA2B;QAChD,8DAA8D;QAC9D,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAC3D,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAC7C,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,WAAW,GAAG;YAClB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;YACrD,8DAA8D;SACxD,CAAA;QAER,MAAM,MAAM,CACV,2BAA2B,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,uBAAuB;QACvB,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;gBACpE,OAAO,IAAI,CAAA;YACb,CAAC;SACF,CAAA;QAED,MAAM,MAAM,CACV,2BAA2B,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,MAAM,EAAE,EACjE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAC1C,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,wDAAwD;QACxD,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;aACb;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,IAAI,EAAE,qDAAqD;aAClE;SACF,CAAA;QAED,sEAAsE;QACtE,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,UAAU,EAAE,8BAA8B;YACpD,MAAM,EAAE,SAAS,EAAE,kDAAkD;YACrE,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;aAC5B;SACF,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI,EAAE,2CAA2C;gBAC1D,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,kCAAkC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAE/C,sBAAsB;QACtB,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAErD,oCAAoC;QACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACxB,CAAA;QAED,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,uCAAuC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAEhD,+BAA+B;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;SACF,CAAA;QAED,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,UAAU,EAAE,yBAAyB;YAC/C,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;aAC5B;SACF,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;QACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,YAAY,GAAG;YACnB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,8CAA8C;YAC5E,MAAM,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,KAAK;aACZ;SACF,CAAA;QAED,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,WAAW,EAAE,gDAAgD;YACzE,QAAQ,EAAE,UAAU,EAAE,0CAA0C;SACjE,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,8DAA8D;aACxD;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,qDAAqD;QACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QAE1D,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAEhF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,sEAAsE;YACtE,4EAA4E;YAC5E,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;SACvD,CAAA;QAED,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAClC,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,OAAO;SAClB,CAAA;QAED,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;QAChD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,sBAAsB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;SACvD,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;SAC9C,CAAA;QACD,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,QAAQ,EAAE,2BAA2B;SAChD,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,0EAA0E;QAC1E,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,iBAAiB;YAC5B,UAAU,EAAE,EAAE;SACf,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;gBACpD,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,CAAC;SACd,CAAA;QAED,kEAAkE;QAClE,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAClC,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;gBACpD,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC;aACjF;SACF,CAAA;QACD,MAAM,IAAI,GAAG;YACX,SAAS,EAAE,iBAAiB;YAC5B,UAAU,EAAE,EAAE;SACf,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,gFAAgF;IAEhF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;aACrD;SACF,CAAA;QACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAEnD,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAElF,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACxH,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,uEAAuE;oBACvE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;oBAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;iBAChD;aACF;YACD,8DAA8D;SACxD,CAAA;QACR,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAEnD,MAAM,MAAM,CACV,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACjD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;YACvC,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE;aACrD;SACF,CAAA;QACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAEnD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACtB,OAAO,EAAE,WAAW,EAAE;YACtB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE;SAC9C,CAAA;QACD,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;SACtC,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/access/field-transforms.d.ts

@@ -1,46 +1,19 @@
 import type { OpenSaasConfig, FieldConfig } from '../config/types.js';
 import type { HashedPassword } from '../utils/password.js';
-/**
- * Extract the return type of a field's afterOperation hook
- * If the field has an afterOperation hook, infer its return type
- * Otherwise, use the original type
- */
 export type InferFieldReadType<TField extends FieldConfig, TOriginal> = TField extends {
     hooks?: {
         afterOperation?: (...args: any[]) => infer R;
     };
 } ? R extends never ? TOriginal : R : TOriginal;
-/**
- * Transform a Prisma model's field types based on OpenSaas field configs
- * This applies afterOperation hook transformations to field types
- */
 export type TransformModelFields<TModel extends Record<string, any>, TFields extends Record<string, FieldConfig>> = {
     [K in keyof TModel]: K extends keyof TFields ? InferFieldReadType<TFields[K], TModel[K]> : TModel[K];
 };
-/**
- * Get the field configs for a specific list from the OpenSaas config
- */
 export type GetListFields<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists']> = TConfig['lists'][TListKey]['fields'];
-/**
- * Transform a Prisma model result based on OpenSaas config
- * Applies field hooks transformations
- */
 export type TransformResult<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists'], TResult> = TResult extends Record<string, any> ? TransformModelFields<TResult, GetListFields<TConfig, TListKey>> : TResult;
-/**
- * Transform a Prisma operation's return type
- * Handles single results, arrays, and null cases
- */
 export type TransformOperationResult<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists'], TResult> = TResult extends Promise<infer R> ? Promise<R extends Array<infer Item> ? Array<TransformResult<TConfig, TListKey, Item>> : R extends null ? null : TransformResult<TConfig, TListKey, R>> : never;
-/**
- * Known field type mappings for afterOperation hooks
- * These provide concrete type hints for common field transformations
- */
 export interface FieldTypeTransforms {
     password: HashedPassword;
 }
-/**
- * Helper to infer field type based on field config type
- */
 export type InferFieldTypeTransform<TField extends FieldConfig> = TField extends {
     type: infer TType;
 } ? TType extends keyof FieldTypeTransforms ? FieldTypeTransforms[TType] : never : never;

package/dist/access/field-transforms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-transforms.d.ts","sourceRoot":"","sources":["../../src/access/field-transforms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,WAAW,EAAE,SAAS,IAAI,MAAM,SAAS;IAIrF,KAAK,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,CAAA;KAAE,CAAA;CACzD,GACG,CAAC,SAAS,KAAK,GACb,SAAS,GACT,CAAC,GACH,SAAS,CAAA;AAEb;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAI9B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IACzC;KACD,CAAC,IAAI,MAAM,MAAM,GAAG,CAAC,SAAS,MAAM,OAAO,GACxC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GACzC,MAAM,CAAC,CAAC,CAAC;CACd,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,CACvB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,IACrC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;AAExC;;;GAGG;AACH,MAAM,MAAM,eAAe,CACzB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAKP,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAC/D,OAAO,CAAA;AAEb;;;GAGG;AACH,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAEP,OAAO,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAC5B,OAAO,CACL,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,CAAC,GACvB,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,GAC/C,CAAC,SAAS,IAAI,GACZ,IAAI,GACJ,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC5C,GACD,KAAK,CAAA;AAEX;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAA;CAIzB;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS;IAC/E,IAAI,EAAE,MAAM,KAAK,CAAA;CAClB,GACG,KAAK,SAAS,MAAM,mBAAmB,GACrC,mBAAmB,CAAC,KAAK,CAAC,GAC1B,KAAK,GACP,KAAK,CAAA"}
+{"version":3,"file":"field-transforms.d.ts","sourceRoot":"","sources":["../../src/access/field-transforms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,WAAW,EAAE,SAAS,IAAI,MAAM,SAAS;IAIrF,KAAK,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,CAAA;KAAE,CAAA;CACzD,GACG,CAAC,SAAS,KAAK,GACb,SAAS,GACT,CAAC,GACH,SAAS,CAAA;AAEb,MAAM,MAAM,oBAAoB,CAI9B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IACzC;KACD,CAAC,IAAI,MAAM,MAAM,GAAG,CAAC,SAAS,MAAM,OAAO,GACxC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GACzC,MAAM,CAAC,CAAC,CAAC;CACd,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,IACrC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;AAExC,MAAM,MAAM,eAAe,CACzB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAIP,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAC/D,OAAO,CAAA;AAEb,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAEP,OAAO,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAC5B,OAAO,CACL,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,CAAC,GACvB,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,GAC/C,CAAC,SAAS,IAAI,GACZ,IAAI,GACJ,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC5C,GACD,KAAK,CAAA;AAEX,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS;IAC/E,IAAI,EAAE,MAAM,KAAK,CAAA;CAClB,GACG,KAAK,SAAS,MAAM,mBAAmB,GACrC,mBAAmB,CAAC,KAAK,CAAC,GAC1B,KAAK,GACP,KAAK,CAAA"}

package/dist/access/field-visibility.d.ts

@@ -1,14 +1,11 @@
 import type { Session, AccessContext } from './types.js';
 import type { OpenSaasConfig, FieldConfig } from '../config/types.js';
 import type { DeclaredOnlyTree } from './declared-dependencies.js';
-/**
- * Filter fields from an object based on read access
- * Recursively applies access control to nested relationships
- */
+import type { FieldSelectionScope } from '../query/index.js';
 export declare function filterReadableFields<T extends Record<string, unknown>>(item: T, fieldConfigs: Record<string, FieldConfig>, args: {
     session: Session | null;
     context: AccessContext & {
         _isSudo?: boolean;
     };
-}, config?: OpenSaasConfig, depth?: number, listKey?: string, declaredOnly?: DeclaredOnlyTree): Promise<Partial<T>>;
+}, config?: OpenSaasConfig, depth?: number, listKey?: string, declaredOnly?: DeclaredOnlyTree, selection?: FieldSelectionScope): Promise<Partial<T>>;
 //# sourceMappingURL=field-visibility.d.ts.map

package/dist/access/field-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-visibility.d.ts","sourceRoot":"","sources":["../../src/access/field-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAKrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAqKlE;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC/C,EACD,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,GAAE,MAAU,EACjB,OAAO,CAAC,EAAE,MAAM,EAMhB,YAAY,GAAE,gBAA0C,GACvD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAiLrB"}
+{"version":3,"file":"field-visibility.d.ts","sourceRoot":"","sources":["../../src/access/field-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAKrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAElE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAwK5D,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,IAAI,EAAE,CAAC,EACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC/C,EACD,MAAM,CAAC,EAAE,cAAc,EACvB,KAAK,GAAE,MAAU,EACjB,OAAO,CAAC,EAAE,MAAM,EAMhB,YAAY,GAAE,gBAA0C,EAGxD,SAAS,CAAC,EAAE,mBAAmB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAmOrB"}

package/dist/access/field-visibility.js

@@ -54,12 +54,14 @@ function deriveResolveOutputContext(context, link, config) {
  * from the result.
  *
  * `accessItem` is the row used to evaluate field access; `hookItem` is the
- * object passed to the hook as `item` (these differ for virtual fields, which
- * see the already-filtered output so they can read sibling fields).
+ * object passed to the hook as `item`. For a stored field, both are
+ * `workingItem` (the row's own stored/fetched columns). For a virtual field,
+ * `hookItem` is `computedFieldItem` instead — the same stored columns with
+ * every skipped-or-denied key removed — so it never sees another computed
+ * field's resolved value (ADR-0027).
  */
 async function resolveReadableFieldValue(params) {
     const { fieldConfig, fieldName, value, accessItem, hookItem, listKey, args, config } = params;
-    // Check field access (checkFieldAccess already handles sudo mode)
     const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
         ...args,
         item: accessItem,
@@ -67,10 +69,9 @@ async function resolveReadableFieldValue(params) {
     if (!canRead) {
         return { readable: false };
     }
-    // Apply resolveOutput hook if present
     if (fieldConfig?.hooks?.resolveOutput && listKey) {
-        // Cast to runtime type for generic execution
-        // At runtime, the hook will receive the correct value type for the field
+        // The hook is erased to this runtime shape here; at the actual call it
+        // receives the value typed for its own field.
         const hook = fieldConfig.hooks.resolveOutput;
         const link = { listKey, fieldKey: fieldName };
         const chain = args.context._resolveOutputChain;
@@ -91,7 +92,6 @@ async function resolveReadableFieldValue(params) {
                 `not an access denial.`);
             return { readable: false };
         }
-        // Use Promise.resolve() to handle both sync and async hooks
         const resolved = await Promise.resolve(hook({
             value,
             operation: 'query',
@@ -104,17 +104,16 @@ async function resolveReadableFieldValue(params) {
     }
     return { readable: true, value };
 }
-/**
- * Filter fields from an object based on read access
- * Recursively applies access control to nested relationships
- */
 export async function filterReadableFields(item, fieldConfigs, args, config, depth = 0, listKey, 
 // Relation keys added purely to satisfy a field's `needs` (ADR-0025) at
 // THIS level, and the same tree for each nested relation reached via a
 // caller-named branch. Stripped from `filtered` right before it is
 // returned — after resolveOutput has had a chance to read them — so a
 // declared dependency never widens what the caller receives.
-declaredOnly = emptyDeclaredOnlyTree()) {
+declaredOnly = emptyDeclaredOnlyTree(), 
+// The fragment scope this level was reached under (ADR-0027, see module doc
+// above), and the same tree one level down for each nested relation.
+selection) {
     const filtered = {};
     // Multi-column fields (e.g. storage image()/file() in Keystone-parity mode)
     // back several physical columns rather than one. Before the per-field pass,
@@ -139,17 +138,31 @@ declaredOnly = emptyDeclaredOnlyTree()) {
         }
         workingItem[fieldName] = assembled;
     }
+    // Keys denied by field-level read access during the pass below — as opposed
+    // to a key merely skipped by `selection` or held back only for
+    // `declaredOnly` stripping. Tracked separately because a denied key must
+    // stay invisible to a computed field's hook (below), while a declared-only
+    // key must stay VISIBLE to one — that is the entire point of declaring it
+    // (ADR-0025) — even though `selection` above skipped adding it to
+    // `filtered` because the caller's fragment never asked for it.
+    const accessDeniedKeys = new Set();
     // Process existing fields from the database result
     for (const [fieldName, value] of Object.entries(workingItem)) {
         const fieldConfig = fieldConfigs[fieldName];
-        // Always include id, createdAt, updatedAt
         if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
             filtered[fieldName] = value;
             continue;
         }
-        // Handle relationship fields - recursively filter fields within related items
-        // Note: Access control filtering is now done at database level via buildIncludeWithAccessControl
-        // This only handles field-level access (hiding sensitive fields)
+        // Projection-aware skip (ADR-0027, see module doc above): a field this
+        // level's fragment did not select gets no read-access check, no
+        // resolveOutput, and no recursion into a relation — none of that work
+        // happens for a value the read isn't going to return.
+        if (selection?.fields && !selection.fields.has(fieldName)) {
+            continue;
+        }
+        // Row/relation-level access is already scoped at the DB level via
+        // buildAccessScopedInclude; this only handles field-level access (hiding
+        // sensitive fields).
         //
         // Deliberately uncapped: the row/relation scoping in access-filter.ts bounds
         // what gets FETCHED (a caller include past its depth cap is now a denial,
@@ -165,12 +178,12 @@ declaredOnly = emptyDeclaredOnlyTree()) {
             fieldConfig.ref &&
             value !== null &&
             value !== undefined) {
-            // Gate the relationship on read access before recursing.
             const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
                 ...args,
                 item: workingItem,
             });
             if (!canRead) {
+                accessDeniedKeys.add(fieldName);
                 continue;
             }
             const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
@@ -179,26 +192,27 @@ declaredOnly = emptyDeclaredOnlyTree()) {
             // back to an empty tree when this relation isn't declaration-related at
             // all — the common case.
             const nestedDeclaredOnly = declaredOnly.nested[fieldName] ?? emptyDeclaredOnlyTree();
+            // This relation's own fragment scope, if the caller's fragment named it
+            // with a nested Fragment/RelationSelector. `undefined` (a bare `true`
+            // selector, or no `selection` at all) means the nested list computes
+            // unrestricted — matching what naming a relation without narrowing it
+            // further has always meant.
+            const nestedSelection = selection?.nested[fieldName];
             if (relatedConfig) {
-                // For many relationships (arrays) - recursively filter fields in each item
-                // The recursive call already handles applying resolveOutput hooks
                 if (Array.isArray(value)) {
-                    filtered[fieldName] = await Promise.all(value.map((relatedItem) => filterReadableFields(relatedItem, relatedConfig.listConfig.fields, args, config, depth + 1, relatedConfig.listName, nestedDeclaredOnly)));
+                    filtered[fieldName] = await Promise.all(value.map((relatedItem) => filterReadableFields(relatedItem, relatedConfig.listConfig.fields, args, config, depth + 1, relatedConfig.listName, nestedDeclaredOnly, nestedSelection)));
                 }
-                // For single relationships (objects) - recursively filter fields
-                // The recursive call already handles applying resolveOutput hooks
                 else if (typeof value === 'object') {
-                    filtered[fieldName] = await filterReadableFields(value, relatedConfig.listConfig.fields, args, config, depth + 1, relatedConfig.listName, nestedDeclaredOnly);
+                    filtered[fieldName] = await filterReadableFields(value, relatedConfig.listConfig.fields, args, config, depth + 1, relatedConfig.listName, nestedDeclaredOnly, nestedSelection);
                 }
             }
             else {
-                // Related config not found, include the value as-is
                 filtered[fieldName] = value;
             }
             continue;
         }
-        // Non-relationship field (or relationship without an includable value):
-        // check read access and apply resolveOutput via the shared helper.
+        // Non-relationship field, or a relationship field whose value is not
+        // includable (null/undefined) — falls through to the shared helper.
         const result = await resolveReadableFieldValue({
             fieldConfig,
             fieldName,
@@ -212,33 +226,66 @@ declaredOnly = emptyDeclaredOnlyTree()) {
         if (result.readable) {
             filtered[fieldName] = result.value;
         }
+        else {
+            accessDeniedKeys.add(fieldName);
+        }
+    }
+    // The item a virtual field's hook sees: stored columns and fetched
+    // relations (from `workingItem`, never a resolved value — no hook's output
+    // is ever written back into `workingItem`). A key is visible here if it
+    // either survived into `filtered` (selected and allowed) OR exists only to
+    // satisfy a `needs` declaration (`declaredOnly` — that IS the point of
+    // declaring it: fetched for a hook, never for the caller, ADR-0025).
+    // Everything else — field-level denied, or skipped by `selection` and
+    // declared by no one — is deleted. A computed field reaches for exactly its
+    // own declared dependencies and nothing another field's hook produced
+    // (ADR-0027): reaching for a sibling that was denied or skipped-and-
+    // undeclared finds nothing there, the same as reaching for one never
+    // declared at all, and reaching for a sibling that DID survive finds its
+    // raw stored form, never another hook's resolved value — a virtual field
+    // computed earlier in declaration order is exactly as invisible as one
+    // computed later.
+    const computedFieldItem = { ...workingItem };
+    for (const key of Object.keys(workingItem)) {
+        if (['id', 'createdAt', 'updatedAt'].includes(key))
+            continue;
+        if (accessDeniedKeys.has(key)) {
+            delete computedFieldItem[key];
+            continue;
+        }
+        if (key in filtered)
+            continue;
+        if (declaredOnly.keys.has(key))
+            continue;
+        delete computedFieldItem[key];
     }
-    // Process virtual fields - compute values from other fields
-    // Virtual fields don't exist in the database result, so we need to compute them separately
     for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
-        // Skip if already processed (from database result)
         if (fieldName in filtered) {
             continue;
         }
-        // Only process virtual fields
         if (!fieldConfig.virtual) {
             continue;
         }
-        // Virtual fields must have a resolveOutput hook to compute their value;
-        // without one there is nothing to add to the result.
+        // Projection-aware skip (ADR-0027): same rule as the stored-field pass
+        // above — a fragment that does not select this virtual field does no
+        // work for it at all.
+        if (selection?.fields && !selection.fields.has(fieldName)) {
+            continue;
+        }
+        // A virtual field with no resolveOutput hook can never produce a value
+        // on ANY read — there is nothing to compute, so there is nothing to do,
+        // including evaluating its read access (ADR-0027 reconciles the
+        // access-only evaluation this branch used to preserve: a field that
+        // never has output has no side effect worth preserving access for).
         if (!(fieldConfig.hooks?.resolveOutput && listKey)) {
-            // Still evaluate read access to preserve any access-fn side effects.
-            await checkFieldAccess(fieldConfig.access, 'read', { ...args, item: workingItem });
             continue;
         }
-        // Check read access and compute the value via the shared helper. Virtual
-        // fields see the already-filtered item so they can read sibling fields.
         const result = await resolveReadableFieldValue({
             fieldConfig,
             fieldName,
             value: undefined, // Virtual fields don't have a database value
             accessItem: workingItem,
-            hookItem: filtered,
+            hookItem: computedFieldItem,
             listKey,
             args,
             config,
@@ -248,10 +295,11 @@ declaredOnly = emptyDeclaredOnlyTree()) {
         }
     }
     // Strip relations that were fetched ONLY to satisfy a `needs` declaration
-    // (ADR-0025), now that every resolveOutput hook at this level — including
-    // virtual fields, which read the assembled `filtered` object above — has
-    // had the chance to see them. A declared dependency is private plumbing,
-    // not an implicit `include`: it never widens what the caller receives.
+    // (ADR-0025), now that every resolveOutput hook at this level has had the
+    // chance to see them (via `computedFieldItem`, never `filtered` itself — a
+    // declared dependency is read from stored columns, not from another
+    // field's resolved output). A declared dependency is private plumbing, not
+    // an implicit `include`: it never widens what the caller receives.
     for (const key of declaredOnly.keys) {
         delete filtered[key];
     }