@opensaas/stack-core 0.38.0 → 0.39.0

package/dist/utils/password.js

@@ -1,44 +1,12 @@
 import bcrypt from 'bcryptjs';
-/**
- * Default bcrypt cost factor (rounds)
- * Higher values = more secure but slower
- * 10 is a good balance for production use
- */
+// Bcrypt cost factor: higher is slower but more resistant to brute force.
 const DEFAULT_COST_FACTOR = 10;
-/**
- * Hash a plain text password using bcrypt
- *
- * @param plainPassword - The plain text password to hash
- * @param costFactor - The bcrypt cost factor (default: 10)
- * @returns Promise resolving to the hashed password
- *
- * @example
- * ```typescript
- * const hashed = await hashPassword('mypassword')
- * // Returns: $2a$10$...
- * ```
- */
 export async function hashPassword(plainPassword, costFactor = DEFAULT_COST_FACTOR) {
     if (typeof plainPassword !== 'string' || plainPassword.length === 0) {
         throw new Error('Password must be a non-empty string');
     }
     return bcrypt.hash(plainPassword, costFactor);
 }
-/**
- * Compare a plain text password with a hashed password
- *
- * @param plainPassword - The plain text password to compare
- * @param hashedPassword - The hashed password to compare against
- * @returns Promise resolving to true if passwords match, false otherwise
- *
- * @example
- * ```typescript
- * const isValid = await comparePassword('mypassword', hashedPassword)
- * if (isValid) {
- *   // Password is correct
- * }
- * ```
- */
 export async function comparePassword(plainPassword, hashedPassword) {
     if (typeof plainPassword !== 'string' || typeof hashedPassword !== 'string') {
         return false;
@@ -50,36 +18,19 @@ export async function comparePassword(plainPassword, hashedPassword) {
         return await bcrypt.compare(plainPassword, hashedPassword);
     }
     catch (error) {
-        // Invalid hash format or other bcrypt error
+        // Fail closed on a malformed hash or other bcrypt error, rather than
+        // letting it propagate as an authentication-bypassing exception.
         console.error('Password comparison failed:', error);
         return false;
     }
 }
-/**
- * Check if a string appears to be a bcrypt hash
- * Bcrypt hashes follow the format: $2a$10$...
- *
- * @param value - The string to check
- * @returns True if the string looks like a bcrypt hash
- */
 export function isHashedPassword(value) {
     if (typeof value !== 'string')
         return false;
-    // Bcrypt hashes start with $2a$, $2b$, or $2y$ followed by cost factor
-    // and are typically 60 characters long
     return /^\$2[aby]\$\d{2}\$.{53}$/.test(value);
 }
-/**
- * HashedPassword class wraps a bcrypt hash and provides a compare method
- * This allows password field values to be used as strings while also
- * providing a convenient compare() method for authentication
- *
- * @example
- * ```typescript
- * const user = await context.db.user.findUnique({ where: { id: '1' } })
- * const isValid = await user.password.compare('plaintextPassword')
- * ```
- */
+// Wraps a bcrypt hash so a password field's value can still be used as a
+// plain string while also exposing compare() for authentication.
 export class HashedPassword {
     hash;
     constructor(hash) {
@@ -88,43 +39,23 @@ export class HashedPassword {
             throw new Error('HashedPassword requires a non-empty hash string');
         }
     }
-    /**
-     * Compare a plain text password with this hashed password
-     *
-     * @param plainPassword - The plain text password to compare
-     * @returns Promise resolving to true if passwords match
-     */
     async compare(plainPassword) {
         return comparePassword(plainPassword, this.hash);
     }
-    /**
-     * Get the underlying hash string
-     * This allows the HashedPassword to be used anywhere a string is expected
-     */
     toString() {
         return this.hash;
     }
-    /**
-     * Get the underlying hash when used in string contexts
-     * This allows the HashedPassword to be coerced to a string automatically
-     */
+    // Implicit coercion (template literals, string concatenation) resolves here.
     [Symbol.toPrimitive](hint) {
         if (hint === 'string' || hint === 'default') {
             return this.hash;
         }
         return this.hash;
     }
-    /**
-     * Return the hash for JSON serialization
-     * This ensures the hash is properly serialized when converting to JSON
-     */
+    // JSON.stringify calls this when present, so the hash serializes as a plain string.
     toJSON() {
         return this.hash;
     }
-    /**
-     * Get the underlying hash value
-     * This allows accessing the raw hash string
-     */
     valueOf() {
         return this.hash;
     }

package/dist/utils/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAAU,GAAW,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4CAA4C;QAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,uEAAuE;IACvE,uCAAuC;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACI,IAAI;IAAjC,YAA6B,IAAY;oBAAZ,IAAI;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAAU,GAAW,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,OAAO,cAAc;IACI,IAAI;IAAjC,YAA6B,IAAY;oBAAZ,IAAI;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,6EAA6E;IAC7E,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,oFAAoF;IACpF,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}

package/dist/validation/field-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field-config.d.ts","sourceRoot":"","sources":["../../src/validation/field-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,aAAa,EAAE,eAAe,GAAG,mBAAmB,GAAG,cAAc,GAAG,mBAAmB,CAAA;IAC3F,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;CAChB;AAwCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,0BAA0B,EAAE,CAmC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,0BAA0B,EAAE,CAWzF"}
+{"version":3,"file":"field-config.d.ts","sourceRoot":"","sources":["../../src/validation/field-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,aAAa,EAAE,eAAe,GAAG,mBAAmB,GAAG,cAAc,GAAG,mBAAmB,CAAA;IAC3F,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;CAChB;AAqCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,0BAA0B,EAAE,CAgC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,0BAA0B,EAAE,CAWzF"}

package/dist/validation/field-config.js

@@ -17,9 +17,6 @@ function hasFieldMethod(field, method) {
     const value = Reflect.get(field, method);
     return typeof value === 'function';
 }
-/**
- * Build the canonical error message for a missing contract method.
- */
 function buildMessage(fieldType, method, fieldKey, listKey) {
     const location = listKey ? `Field "${listKey}.${fieldKey}"` : `Field "${fieldKey}"`;
     return (`${location} (type "${fieldType}") is not self-contained: it does not implement ` +
@@ -61,17 +58,14 @@ export function validateFieldConfig(field, fieldKey, listKey) {
         }
     };
     if (field.type === 'relationship') {
-        // Relationships render through the relationship path only.
         requireMethod('getPrismaRelation');
         return errors;
     }
     if (field.virtual === true || field.type === 'virtual') {
-        // Virtual fields are not persisted, so getPrismaType is intentionally absent.
         requireMethod('getTypeScriptType');
         requireMethod('getZodSchema');
         return errors;
     }
-    // Stored scalar fields must implement the full generation contract.
     requireMethod('getPrismaType');
     requireMethod('getTypeScriptType');
     requireMethod('getZodSchema');

package/dist/validation/field-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"field-config.js","sourceRoot":"","sources":["../../src/validation/field-config.ts"],"names":[],"mappings":"AAyBA;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkB,EAAE,MAAc;IACxD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,SAAiB,EACjB,MAAmD,EACnD,QAAgB,EAChB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,UAAU,QAAQ,GAAG,CAAA;IACnF,OAAO,CACL,GAAG,QAAQ,WAAW,SAAS,kDAAkD;QACjF,GAAG,MAAM,mEAAmE;QAC5E,8DAA8D,CAC/D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,QAAgB,EAChB,OAAgB;IAEhB,MAAM,MAAM,GAAiC,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAE1C,MAAM,aAAa,GAAG,CAAC,MAAmD,EAAQ,EAAE;QAClF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC5D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,2DAA2D;QAC3D,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAClC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,8EAA8E;QAC9E,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAClC,aAAa,CAAC,cAAc,CAAC,CAAA;QAC7B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oEAAoE;IACpE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC9B,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAClC,aAAa,CAAC,cAAc,CAAC,CAAA;IAE7B,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,MAAM,MAAM,GAAiC,EAAE,CAAA;IAE/C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU,EAAE,MAAM;YAAE,SAAQ;QACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"field-config.js","sourceRoot":"","sources":["../../src/validation/field-config.ts"],"names":[],"mappings":"AAyBA;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkB,EAAE,MAAc;IACxD,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAA;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,SAAiB,EACjB,MAAmD,EACnD,QAAgB,EAChB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,UAAU,QAAQ,GAAG,CAAA;IACnF,OAAO,CACL,GAAG,QAAQ,WAAW,SAAS,kDAAkD;QACjF,GAAG,MAAM,mEAAmE;QAC5E,8DAA8D,CAC/D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,QAAgB,EAChB,OAAgB;IAEhB,MAAM,MAAM,GAAiC,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAE1C,MAAM,aAAa,GAAG,CAAC,MAAmD,EAAQ,EAAE;QAClF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;aAC5D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAClC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,aAAa,CAAC,mBAAmB,CAAC,CAAA;QAClC,aAAa,CAAC,cAAc,CAAC,CAAA;QAC7B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,aAAa,CAAC,eAAe,CAAC,CAAA;IAC9B,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAClC,aAAa,CAAC,cAAc,CAAC,CAAA;IAE7B,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,MAAM,MAAM,GAAiC,EAAE,CAAA;IAE/C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU,EAAE,MAAM;YAAE,SAAQ;QACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/validation/schema.d.ts

@@ -1,13 +1,6 @@
 import { z } from 'zod';
 import type { FieldConfig } from '../config/types.js';
-/**
- * Generate Zod schema from field configurations
- */
 export declare function generateZodSchema(fieldConfigs: Record<string, FieldConfig>, operation?: 'create' | 'update'): z.ZodObject;
-/**
- * Validate data against field configurations using Zod
- * Returns structured errors by field
- */
 export declare function validateWithZod(data: Record<string, unknown>, fieldConfigs: Record<string, FieldConfig>, operation?: 'create' | 'update'): {
     success: true;
 } | {

package/dist/validation/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,CAAC,CAAC,SAAS,CAwBb;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAiBxE"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,CAAC,CAAC,SAAS,CAsBb;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAgBxE"}

package/dist/validation/schema.js

@@ -1,18 +1,13 @@
 import { z } from 'zod';
-/**
- * Generate Zod schema from field configurations
- */
 export function generateZodSchema(fieldConfigs, operation = 'create') {
     const shape = {};
     for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
-        // Skip system fields, relationships, and virtual fields
         // Virtual fields don't accept input - they only compute output
         if (['id', 'createdAt', 'updatedAt'].includes(fieldName) ||
             fieldConfig.type === 'relationship' ||
             fieldConfig.virtual) {
             continue;
         }
-        // Use the field's schema generator
         if (fieldConfig.getZodSchema) {
             shape[fieldName] = fieldConfig.getZodSchema(fieldName, operation);
         }
@@ -23,17 +18,12 @@ export function generateZodSchema(fieldConfigs, operation = 'create') {
     }
     return z.object(shape);
 }
-/**
- * Validate data against field configurations using Zod
- * Returns structured errors by field
- */
 export function validateWithZod(data, fieldConfigs, operation = 'create') {
     const schema = generateZodSchema(fieldConfigs, operation);
     const result = schema.safeParse(data);
     if (result.success) {
         return { success: true };
     }
-    // Convert Zod errors to field-specific error messages
     const errors = {};
     for (const issue of result.error.issues) {
         const fieldPath = issue.path.join('.');

package/dist/validation/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,KAAK,GAAiC,EAAE,CAAA;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,wDAAwD;QACxD,+DAA+D;QAC/D,IACE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,WAAW,CAAC,IAAI,KAAK,cAAc;YACnC,WAAW,CAAC,OAAO,EACnB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,mCAAmC;QACnC,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAErC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,UAAU,iBAAiB,CAC/B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,KAAK,GAAiC,EAAE,CAAA;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,+DAA+D;QAC/D,IACE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,WAAW,CAAC,IAAI,KAAK,cAAc;YACnC,WAAW,CAAC,OAAO,EACnB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAErC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "main": "./dist/index.js",

package/src/access/access-filter.ts

@@ -1,8 +1,14 @@
 import type { Session, AccessContext, PrismaFilter } from './types.js'
-import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
+import type { OpenSaasConfig, FieldConfig, ListConfig } from '../config/types.js'
 import { checkAccess, getRelatedListConfig } from './engine.js'
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js'
-import { AccessScopeDepthExceededError } from './errors.js'
+import { AccessScopeDepthExceededError, RelationFilterAccessDeniedError } from './errors.js'
+import {
+  LOGICAL_OPERATORS,
+  RELATION_QUANTIFIERS,
+  resolveQueryField,
+  walkWhereReadAccess,
+} from './query-validation.js'
 
 /**
  * Access Filter — phase 1 of the two-phase read (pre-query).
@@ -63,8 +69,7 @@ function asEntryObject(value: unknown): IncludeEntryObject | null {
  *
  * The access filter is authoritative: the caller's filter may only NARROW the
  * result further, never widen past what access permits. We therefore wrap both
- * in a Prisma `AND` so neither can override the other. If only one side is
- * present, it is returned as-is; if neither is present, the result is undefined.
+ * in a Prisma `AND` so neither can override the other.
  */
 function andWhere(
   accessWhere: PrismaFilter | undefined,
@@ -173,6 +178,149 @@ export async function buildAccessScopedInclude(
   return result
 }
 
+/**
+ * Scope every relation filter (`some`/`every`/`none`/`is`/`isNot`) nested in a
+ * caller's `where` by the related list's own `query` access — the `where`
+ * counterpart to `buildAccessScopedInclude` above, closing #916 (the
+ * "unclosed half of ADR-0022"). `include` and `where` are fundamentally
+ * different requests (which relations come back, vs. which parent rows
+ * match), so this is a distinct function, but it shares every primitive that
+ * matters: `checkAccess`/`getRelatedListConfig` (the same access-evaluation
+ * calls `buildAccessScopedInclude` makes), `andWhere` (the same AND-fold), and
+ * `resolveQueryField`/`LOGICAL_OPERATORS`/`RELATION_QUANTIFIERS`/
+ * `walkWhereReadAccess` (the same shape-recognition and field-read check
+ * `query-validation.ts` already uses for #912/#915) — there is no second,
+ * parallel implementation of any of those decisions.
+ *
+ * For each relationship key found (at any depth — the walk recurses through
+ * `AND`/`OR`/`NOT` and through every hop of a chain):
+ * - Not a declared relationship, or the key #912 already rejected (this walk
+ *   runs strictly after that check) → passed through unchanged.
+ * - The related list's `query` access denies it (`=== false`) → THROWS
+ *   `RelationFilterAccessDeniedError`. Unlike `buildAccessScopedInclude`'s
+ *   silent drop, this is a loud failure: a `where` predicate has no neutral
+ *   "not requested" outcome the way a missing `include` key does, so a
+ *   silently-empty match would itself be a distinguishable signal (ADR-0022).
+ * - Otherwise → the access filter (if any) is AND-combined into the relation
+ *   quantifier's nested clause (never replacing the caller's own condition,
+ *   mirroring `andWhere`'s include-side contract), keys inside that nested
+ *   clause are checked against the RELATED list's field-level `read` access
+ *   (`walkWhereReadAccess`, closing #915's stated gap for this path), and the
+ *   walk recurses into the related list's own fields for a further hop.
+ *
+ * One quantifier is deliberately conservative rather than exactly precise:
+ * folding the access filter into `every`'s nested clause with a plain AND
+ * makes `every` require every related row to be BOTH access-visible AND
+ * matching, not "every access-visible row matches" (the latter needs a
+ * `NOT`/`OR` transform this does not attempt). The conservative version can
+ * only reject a query that the precise version would allow — it never
+ * widens what a caller can learn — so it is the safe direction to ship; a
+ * caller can observe that an inaccessible related row exists (an `every`
+ * that "should" pass instead fails), but never that row's field values,
+ * which is the property this ticket exists to close.
+ */
+export async function buildAccessScopedWhere(
+  where: unknown,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  config: OpenSaasConfig,
+  args: {
+    session: Session | null
+    context: AccessContext
+  },
+): Promise<unknown> {
+  if (where === null || typeof where !== 'object') return where
+
+  if (Array.isArray(where)) {
+    return Promise.all(
+      where.map((entry) => buildAccessScopedWhere(entry, listConfig, listName, config, args)),
+    )
+  }
+
+  const result: Record<string, unknown> = {}
+
+  for (const [key, value] of Object.entries(where as Record<string, unknown>)) {
+    if (LOGICAL_OPERATORS.has(key)) {
+      result[key] = await buildAccessScopedWhere(value, listConfig, listName, config, args)
+      continue
+    }
+
+    const resolved = resolveQueryField(key, listConfig.fields)
+    if (
+      !resolved ||
+      !resolved.isRelationship ||
+      value === null ||
+      typeof value !== 'object' ||
+      Array.isArray(value)
+    ) {
+      result[key] = value
+      continue
+    }
+
+    const related = getRelatedListConfig(resolved.fieldConfig.ref, config)
+    if (!related) {
+      result[key] = value
+      continue
+    }
+
+    const queryAccess = related.listConfig.access?.operation?.query
+    const accessResult = await checkAccess(queryAccess, {
+      session: args.session,
+      context: args.context,
+    })
+
+    if (accessResult === false) {
+      throw new RelationFilterAccessDeniedError(listName, key, related.listName)
+    }
+
+    const accessWhere = typeof accessResult === 'object' ? accessResult : undefined
+    const relationEntries = Object.entries(value as Record<string, unknown>)
+    const hasQuantifier = relationEntries.some(([k]) => RELATION_QUANTIFIERS.has(k))
+
+    if (hasQuantifier) {
+      const nestedEntry: Record<string, unknown> = {}
+      for (const [quantifier, quantifierValue] of relationEntries) {
+        if (!RELATION_QUANTIFIERS.has(quantifier)) {
+          nestedEntry[quantifier] = quantifierValue
+          continue
+        }
+        await walkWhereReadAccess(quantifierValue, related.listConfig, related.listName, args)
+        const scopedNested = await buildAccessScopedWhere(
+          quantifierValue,
+          related.listConfig,
+          related.listName,
+          config,
+          args,
+        )
+        nestedEntry[quantifier] = accessWhere
+          ? andWhere(accessWhere, scopedNested as PrismaFilter | undefined)
+          : scopedNested
+      }
+      result[key] = nestedEntry
+    } else {
+      // Prisma's direct-nesting to-one form: the whole value IS the nested
+      // WHERE clause, with no `is` wrapper. Only wrap it in `is` when there is
+      // an access filter to fold in — an unwrapped value that needs no fold
+      // (fully-allowed related list) is returned exactly as the caller wrote
+      // it, so an already-permitted query is not perturbed by this pass.
+      await walkWhereReadAccess(value, related.listConfig, related.listName, args)
+      const scopedNested = await buildAccessScopedWhere(
+        value,
+        related.listConfig,
+        related.listName,
+        config,
+        args,
+      )
+      result[key] = accessWhere
+        ? { is: andWhere(accessWhere, scopedNested as PrismaFilter | undefined) }
+        : scopedNested
+    }
+  }
+
+  return result
+}
+
 /**
  * Remove keys that correspond to `virtual` fields from a Prisma `include`
  * object, recursing into nested relationship includes using the related
@@ -201,7 +349,6 @@ export function stripVirtualFieldsFromInclude(
   for (const [key, value] of Object.entries(include)) {
     const fieldConfig = fieldConfigs[key]
 
-    // Virtual fields have no database column — drop them from the include.
     if (fieldConfig?.virtual) continue
 
     const isDeclaredRelationship =

package/src/access/declared-dependencies.ts

@@ -180,12 +180,8 @@ export function foldDeclaredDependencies(
     const relatedConfig = getRelatedListConfig(fieldConfig.ref, config)
     if (!relatedConfig) continue
     // Defensive cycle guard (see module doc comment) — a DECLARATION-ADDED
-    // edge into a list already on this path stops here rather than recursing
-    // without bound. The value at `key` is left exactly as-is. The guard is
-    // deliberately not applied to an edge the request itself named: that
-    // recursion is bounded by the request's own finite literal and cannot
-    // loop, so stopping it would silently drop the folds beneath a request
-    // that merely revisits a list (e.g. `Post → author → posts`).
+    // edge into a list already on this path stops here; the value at `key`
+    // is left exactly as-is.
     if (declaredOnly.keys.has(key) && visitedLists.includes(relatedConfig.listName)) continue
 
     // A branch added purely by the fold has no fragment scope of its own —
@@ -213,9 +209,8 @@ export function foldDeclaredDependencies(
       }
     }
 
-    // A whole branch added purely by the fold above is stripped wholesale by
-    // field-visibility regardless of what's nested inside it, so it needs no
-    // individual nested-key tracking of its own.
+    // Declaration-added branches need no nested tracking of their own (see
+    // module doc comment) — only caller/fragment-named branches do.
     if (!declaredOnly.keys.has(key) && !isDeclaredOnlyTreeEmpty(nested.declaredOnly)) {
       declaredOnly.nested[key] = nested.declaredOnly
     }

package/src/access/engine.ts

@@ -16,28 +16,14 @@ import type { OpenSaasConfig, ListConfig } from '../config/types.js'
  * and the access-control glossary in `CONTEXT.md`.
  */
 
-/**
- * Check if access control result is a boolean
- */
 export function isBoolean(value: unknown): value is boolean {
   return typeof value === 'boolean'
 }
 
-/**
- * Check if access control result is a Prisma filter
- */
 export function isPrismaFilter(value: unknown): value is PrismaFilter {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
 
-/**
- * Parse a relationship ref and get the related list configuration
- * Relationship refs are in the format "ListName.fieldName"
- *
- * @param relationshipRef - The ref string (e.g., "Post.author")
- * @param config - The OpenSaas configuration
- * @returns The related list name and config, or null if not found
- */
 export function getRelatedListConfig(
   relationshipRef: string,
   config: OpenSaasConfig,
@@ -59,9 +45,6 @@ export function getRelatedListConfig(
   return { listName, listConfig }
 }
 
-/**
- * Execute an access control function
- */
 export async function checkAccess<T = Record<string, unknown>>(
   accessControl: AccessControl<T> | undefined,
   args: {
@@ -75,35 +58,27 @@ export async function checkAccess<T = Record<string, unknown>>(
     return false
   }
 
-  // Execute the access control function
   const result = await accessControl(args)
 
   return result
 }
 
-/**
- * Merge user filter with access control filter
- */
 export function mergeFilters(
   userFilter: PrismaFilter | undefined,
   accessFilter: boolean | PrismaFilter,
 ): PrismaFilter | null {
-  // If access is denied, return null
   if (accessFilter === false) {
     return null
   }
 
-  // If access is fully granted, use user filter
   if (accessFilter === true) {
     return userFilter || {}
   }
 
-  // Merge access filter with user filter
   if (!userFilter) {
     return accessFilter
   }
 
-  // Combine filters with AND
   return {
     AND: [accessFilter, userFilter],
   }

package/src/access/errors.ts

@@ -64,3 +64,84 @@ export class ResolveOutputCycleError extends Error {
     this.chain = chain
   }
 }
+
+/**
+ * Thrown when a relation filter in a caller's `where` (`some`/`every`/`none`/
+ * `is`/`isNot`) names a relationship whose related list denies operation-level
+ * `query` access outright (`=== false`). Deliberately a loud failure, not a
+ * silently narrowed `{ id: { in: [] } }` or a pass-through: ADR-0022 requires
+ * an engine that cannot compute a scope to deny, never pass through, and here
+ * the engine CAN compute the scope (denied) — passing that through as a
+ * silently-empty match would itself be a distinguishable signal for a caller
+ * probing which relations they may filter on. `include`'s equivalent case
+ * (`buildAccessScopedInclude`) drops the relation silently instead, because a
+ * `null`/missing key in a response is indistinguishable from "not requested";
+ * a `where` predicate has no such neutral outcome, so a relation filter on a
+ * fully denied relation is refused instead. `sudo` bypasses this check
+ * entirely, matching every other access-control escape hatch. See #916 and
+ * `docs/adr/0022-access-control-fails-closed-when-it-cannot-scope.md`.
+ */
+export class RelationFilterAccessDeniedError extends Error {
+  public listKey: string
+  public fieldKey: string
+  public relatedListKey: string
+
+  constructor(listKey: string, fieldKey: string, relatedListKey: string) {
+    super(
+      `Cannot filter "${listKey}.${fieldKey}" — the related list "${relatedListKey}" denies ` +
+        `query access to this session, so this relation filter cannot be scoped. Denial is loud ` +
+        `rather than silently narrowed to match nothing (ADR-0022). Use sudo to bypass.`,
+    )
+    this.name = 'RelationFilterAccessDeniedError'
+    this.listKey = listKey
+    this.fieldKey = fieldKey
+    this.relatedListKey = relatedListKey
+  }
+}
+
+function describeFieldAccessResult(result: unknown): string {
+  if (result === null) return 'null'
+  if (result === undefined) return 'undefined'
+  if (typeof result === 'object') return 'an object (e.g. a Prisma filter)'
+  return `a ${typeof result}`
+}
+
+/**
+ * Thrown when a field-level access control function returns anything other
+ * than a strict `boolean`. `FieldAccessControl` is typed to return `boolean`
+ * only: field access is a single per-field visibility decision, not a row
+ * filter, and a denied field is removed rather than used to scope rows (see
+ * the "Field-level access" glossary entry in `CONTEXT.md`, ADR-0001, and
+ * ADR-0030).
+ *
+ * A rule that type-checks can never reach this — the only way here is a
+ * caller that bypasses the type (an untyped JS config, or a value forced past
+ * the checker), most notably a Prisma filter, which is the shape
+ * operation-level `AccessControl` accepts but `FieldAccessControl` does not.
+ * Before #913 this fell through to an unconditional `return true`, silently
+ * granting the field blanket access; it now fails loudly and closed instead,
+ * for `read`, `create`, and `update` alike.
+ *
+ * Deliberately does not expose the offending result as a public field: unlike
+ * `AccessScopeDepthExceededError`/`ResolveOutputCycleError`'s fields, there is
+ * no concretely-typed shape to give it (the whole problem is that it isn't
+ * the `boolean` the caller's rule promised), and the root CLAUDE.md forbids
+ * exposing `unknown`/`any` as part of a package's external API. A description
+ * of what was returned instead is folded into the message text.
+ */
+export class InvalidFieldAccessResultError extends Error {
+  public operation: 'read' | 'create' | 'update'
+
+  constructor(operation: 'read' | 'create' | 'update', result: unknown) {
+    super(
+      `Field-level access control for operation "${operation}" returned ` +
+        `${describeFieldAccessResult(result)}, not a boolean. Field access is a per-field ` +
+        `visibility decision — it must return true or false, and (unlike operation-level access) ` +
+        `cannot scope which rows are affected. If you meant to restrict access based on the row or ` +
+        `the write payload, evaluate the condition yourself and return a boolean, e.g. ` +
+        `\`({ item, session }) => item?.ownerId === session?.userId\`.`,
+    )
+    this.name = 'InvalidFieldAccessResultError'
+    this.operation = operation
+  }
+}