@opensaas/stack-core 0.38.0 → 0.39.0

package/dist/access/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAaA,mEAAmE;AACnE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAA;AACpB,4EAA4E;AAC5E,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAC1E,4DAA4D;AAC5D,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAA;AAC5F,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,2EAA2E;AAC3E,yBAAyB;AACzB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAaA,mEAAmE;AACnE,OAAO,EACL,WAAW,EACX,YAAY,EACZ,SAAS,EACT,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAA;AACpB,4EAA4E;AAC5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAA;AAC1B,6EAA6E;AAC7E,qCAAqC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,uEAAuE;AACvE,oEAAoE;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAA;AACpE,4DAA4D;AAC5D,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAC3B,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,2EAA2E;AAC3E,yBAAyB;AACzB,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,kFAAkF;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,oFAAoF;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAA"}

package/dist/access/query-validation.d.ts

@@ -0,0 +1,121 @@
+import type { ListConfig, OpenSaasConfig } from '../config/types.js';
+import type { Session, AccessContext } from './types.js';
+/**
+ * #912 — read-path key validation.
+ *
+ * The write path settled #564: an undeclared key in `data` throws, because the
+ * generated Prisma model has strictly more fields than the config declares (most
+ * notably back-relations — Prisma emits one for every inbound foreign key, whether
+ * or not the list config declares the reverse relationship). Reads had no
+ * equivalent — a caller's `where`/`orderBy` reached Prisma unchanged, so an
+ * anonymous caller could filter or order by a relation the config never exposed.
+ *
+ * This module is the read-path counterpart: every key named in a caller's `where`
+ * or `orderBy` is resolved against the list config before the query runs. A key
+ * with no entry in the config throws, naming the list and the key. `sudo` is the
+ * single trusted bypass, mirroring the write path.
+ *
+ * Deliberately NOT walked: the access filter produced by the list's own `query`
+ * access control. That filter is trusted config authored by the same person who
+ * declares the fields — walking it would make this an access-control decision
+ * (that's #915/#916), not the key-existence seam this ticket establishes.
+ *
+ * `validateQueryFieldReadAccess` below is that access-control decision for
+ * #915: it re-walks `where`/`orderBy` (reusing `resolveQueryField`) and checks
+ * each resolved field's `read` access via the canonical evaluator, so a field
+ * the session cannot read cannot be named in a predicate either. It runs
+ * strictly after this module's key-existence check — an undeclared key is
+ * #912's rejection, not a field-access decision — and stays scoped to the
+ * CURRENT list, deliberately not recursing into a related list's fields
+ * nested inside a relation filter itself (that recursion is #916's job, not
+ * this module's — see below).
+ *
+ * #916 — the relation-filter counterpart — scopes a relation filter itself
+ * (`some`/`every`/`none`/`is`/`isNot`) by the RELATED list's own `query`
+ * access, folding it into the nested clause exactly like
+ * `buildAccessScopedInclude` folds it into `include` (`access-filter.ts`).
+ * It reuses this module's shape-recognition (`resolveQueryField`,
+ * `LOGICAL_OPERATORS`, `RELATION_QUANTIFIERS`, exported below) and calls
+ * `walkWhereReadAccess` once per hop — against the RELATED list's own
+ * config — for the field-read half of the same job this module's
+ * `validateQueryFieldReadAccess` already does for the CURRENT list. There is
+ * deliberately no second copy of either the shape-recognition or the
+ * field-read check: `access-filter.ts` supplies the RELATED list at each
+ * hop and calls back into the same primitives this module already owns.
+ */
+export declare const LOGICAL_OPERATORS: Set<string>;
+export declare const RELATION_QUANTIFIERS: Set<string>;
+type FieldConfigMap = Record<string, any>;
+export interface ResolvedQueryField {
+    fieldConfig: any;
+    isRelationship: boolean;
+}
+/**
+ * Resolve a `where`/`orderBy` key against a list's declared fields.
+ *
+ * A key is valid when it is:
+ * - a system field (`id`, `createdAt`, `updatedAt`) — always present, and never
+ *   declared in `fields` (the write path excludes them from `fieldConfigs` the
+ *   same way), or
+ * - a field declared directly in the list config, or
+ * - the foreign-key scalar a to-one `relationship` field implies (e.g. `authorId`
+ *   for `author: relationship(...)`) — the config never names this column
+ *   directly, but Prisma always generates it, and the write path
+ *   (`filterWritableFields`) grants it the same pass, or
+ * - a raw per-part column a multi-column field's `splitColumns` contributes (e.g.
+ *   storage `image()`/`file()` in Keystone-parity mode) — undeclared by design,
+ *   mirroring the write path's `splitColumnOwners` allowance (#568/#789).
+ *
+ * Anything else — most importantly a Prisma-generated back-relation the config
+ * never declares — resolves to `undefined` and is rejected by the caller.
+ */
+export declare function resolveQueryField(key: string, fields: FieldConfigMap): ResolvedQueryField | undefined;
+/**
+ * Validate a caller-supplied `where`/`orderBy` against the list config,
+ * recursing into logical operators (`AND`/`OR`/`NOT`) and relation filters.
+ * Throws a `ValidationError` naming the list and the offending key on the
+ * first undeclared key found. `isSudo` bypasses the check entirely, matching
+ * the write path's `sudo` escape hatch.
+ */
+export declare function validateQueryKeys(args: {
+    where?: unknown;
+    orderBy?: unknown;
+    listConfig: ListConfig<any>;
+    listName: string;
+    config: OpenSaasConfig;
+    isSudo: boolean;
+}): void;
+/**
+ * Check field-level `read` access for every key at ONE level of a `where`
+ * clause, recursing only into logical operators (`AND`/`OR`/`NOT`) — never
+ * into a relationship field's own nested value. Exported for `access-filter.ts`'s
+ * #916 reuse (see module doc comment above) — called once per hop against the
+ * RELATED list's own config.
+ */
+export declare function walkWhereReadAccess(where: unknown, listConfig: ListConfig<any>, listName: string, args: {
+    session: Session | null;
+    context: AccessContext & {
+        _isSudo?: boolean;
+    };
+}): Promise<void>;
+/**
+ * Validate a caller-supplied `where`/`orderBy` against field-level `read`
+ * access, recursing into logical operators (`AND`/`OR`/`NOT`) the same way
+ * `validateQueryKeys` does. Throws a `ValidationError` naming the list and
+ * the offending key on the first read-denied field found. `isSudo` bypasses
+ * the check entirely, matching `validateQueryKeys` and the write path's
+ * `sudo` escape hatch.
+ */
+export declare function validateQueryFieldReadAccess(args: {
+    where?: unknown;
+    orderBy?: unknown;
+    listConfig: ListConfig<any>;
+    listName: string;
+    session: Session | null;
+    context: AccessContext & {
+        _isSudo?: boolean;
+    };
+    isSudo: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=query-validation.d.ts.map

package/dist/access/query-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-validation.d.ts","sourceRoot":"","sources":["../../src/access/query-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAKxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,eAAO,MAAM,iBAAiB,aAAgC,CAAA;AAI9D,eAAO,MAAM,oBAAoB,aAAoD,CAAA;AAOrF,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAEzC,MAAM,WAAW,kBAAkB;IAEjC,WAAW,EAAE,GAAG,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,GACrB,kBAAkB,GAAG,SAAS,CA2BhC;AA4GD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAIP;AAmCD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,OAAO,EAEd,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAChF,OAAO,CAAC,IAAI,CAAC,CAoBf;AAqBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9C,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB"}

package/dist/access/query-validation.js

@@ -0,0 +1,292 @@
+import { getRelatedListConfig } from './engine.js';
+import { isFieldReadableForPredicate } from './field-access.js';
+import { ValidationError } from '../hooks/index.js';
+/**
+ * #912 — read-path key validation.
+ *
+ * The write path settled #564: an undeclared key in `data` throws, because the
+ * generated Prisma model has strictly more fields than the config declares (most
+ * notably back-relations — Prisma emits one for every inbound foreign key, whether
+ * or not the list config declares the reverse relationship). Reads had no
+ * equivalent — a caller's `where`/`orderBy` reached Prisma unchanged, so an
+ * anonymous caller could filter or order by a relation the config never exposed.
+ *
+ * This module is the read-path counterpart: every key named in a caller's `where`
+ * or `orderBy` is resolved against the list config before the query runs. A key
+ * with no entry in the config throws, naming the list and the key. `sudo` is the
+ * single trusted bypass, mirroring the write path.
+ *
+ * Deliberately NOT walked: the access filter produced by the list's own `query`
+ * access control. That filter is trusted config authored by the same person who
+ * declares the fields — walking it would make this an access-control decision
+ * (that's #915/#916), not the key-existence seam this ticket establishes.
+ *
+ * `validateQueryFieldReadAccess` below is that access-control decision for
+ * #915: it re-walks `where`/`orderBy` (reusing `resolveQueryField`) and checks
+ * each resolved field's `read` access via the canonical evaluator, so a field
+ * the session cannot read cannot be named in a predicate either. It runs
+ * strictly after this module's key-existence check — an undeclared key is
+ * #912's rejection, not a field-access decision — and stays scoped to the
+ * CURRENT list, deliberately not recursing into a related list's fields
+ * nested inside a relation filter itself (that recursion is #916's job, not
+ * this module's — see below).
+ *
+ * #916 — the relation-filter counterpart — scopes a relation filter itself
+ * (`some`/`every`/`none`/`is`/`isNot`) by the RELATED list's own `query`
+ * access, folding it into the nested clause exactly like
+ * `buildAccessScopedInclude` folds it into `include` (`access-filter.ts`).
+ * It reuses this module's shape-recognition (`resolveQueryField`,
+ * `LOGICAL_OPERATORS`, `RELATION_QUANTIFIERS`, exported below) and calls
+ * `walkWhereReadAccess` once per hop — against the RELATED list's own
+ * config — for the field-read half of the same job this module's
+ * `validateQueryFieldReadAccess` already does for the CURRENT list. There is
+ * deliberately no second copy of either the shape-recognition or the
+ * field-read check: `access-filter.ts` supplies the RELATED list at each
+ * hop and calls back into the same primitives this module already owns.
+ */
+// Prisma's logical combinators for a WHERE clause — never field names.
+export const LOGICAL_OPERATORS = new Set(['AND', 'OR', 'NOT']);
+// Prisma's relation quantifiers. The value nested under one of these is itself a
+// WHERE clause for the RELATED list, and is walked against that list's fields.
+export const RELATION_QUANTIFIERS = new Set(['some', 'every', 'none', 'is', 'isNot']);
+// Always present, never declared in a list's `fields` — the write path
+// (`filterWritableFields`) excludes the same three names from `fieldConfigs`.
+const SYSTEM_FIELDS = new Set(['id', 'createdAt', 'updatedAt']);
+/**
+ * Resolve a `where`/`orderBy` key against a list's declared fields.
+ *
+ * A key is valid when it is:
+ * - a system field (`id`, `createdAt`, `updatedAt`) — always present, and never
+ *   declared in `fields` (the write path excludes them from `fieldConfigs` the
+ *   same way), or
+ * - a field declared directly in the list config, or
+ * - the foreign-key scalar a to-one `relationship` field implies (e.g. `authorId`
+ *   for `author: relationship(...)`) — the config never names this column
+ *   directly, but Prisma always generates it, and the write path
+ *   (`filterWritableFields`) grants it the same pass, or
+ * - a raw per-part column a multi-column field's `splitColumns` contributes (e.g.
+ *   storage `image()`/`file()` in Keystone-parity mode) — undeclared by design,
+ *   mirroring the write path's `splitColumnOwners` allowance (#568/#789).
+ *
+ * Anything else — most importantly a Prisma-generated back-relation the config
+ * never declares — resolves to `undefined` and is rejected by the caller.
+ */
+export function resolveQueryField(key, fields) {
+    if (SYSTEM_FIELDS.has(key)) {
+        return { fieldConfig: undefined, isRelationship: false };
+    }
+    const fieldConfig = fields[key];
+    if (fieldConfig) {
+        return { fieldConfig, isRelationship: fieldConfig.type === 'relationship' };
+    }
+    if (key.endsWith('Id')) {
+        const baseField = fields[key.slice(0, -2)];
+        if (baseField && baseField.type === 'relationship' && !baseField.many) {
+            return { fieldConfig: baseField, isRelationship: false };
+        }
+    }
+    for (const [ownerName, owner] of Object.entries(fields)) {
+        if (owner && typeof owner.getColumnNames === 'function') {
+            const columns = owner.getColumnNames(ownerName);
+            if (columns.includes(key)) {
+                return { fieldConfig: owner, isRelationship: false };
+            }
+        }
+    }
+    return undefined;
+}
+function rejectUndeclaredKey(listName, key, kind) {
+    throw new ValidationError([
+        `Cannot query "${listName}" — "${key}" is not a field of this list. ` +
+            `Undeclared ${kind} keys are rejected (use sudo to bypass).`,
+    ]);
+}
+function walkWhere(where, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, listName, config, isSudo) {
+    if (where === null || typeof where !== 'object')
+        return;
+    if (Array.isArray(where)) {
+        for (const entry of where)
+            walkWhere(entry, listConfig, listName, config, isSudo);
+        return;
+    }
+    for (const [key, value] of Object.entries(where)) {
+        if (LOGICAL_OPERATORS.has(key)) {
+            walkWhere(value, listConfig, listName, config, isSudo);
+            continue;
+        }
+        const resolved = resolveQueryField(key, listConfig.fields);
+        if (!resolved) {
+            if (isSudo)
+                continue;
+            rejectUndeclaredKey(listName, key, 'where');
+        }
+        // Scalar field filters use Prisma's own operator vocabulary (`equals`,
+        // `contains`, `in`, …) and never nest another field name — trusted as-is,
+        // no further walk needed. Only a relationship field's filter nests a
+        // WHERE clause for another list.
+        if (resolved.isRelationship &&
+            value !== null &&
+            typeof value === 'object' &&
+            !Array.isArray(value)) {
+            const related = getRelatedListConfig(resolved.fieldConfig.ref, config);
+            if (!related)
+                continue;
+            const relationEntries = Object.entries(value);
+            const hasQuantifier = relationEntries.some(([k]) => RELATION_QUANTIFIERS.has(k));
+            if (hasQuantifier) {
+                // Wrapped form: `{ author: { is: {...} } }` / `{ posts: { some: {...} } }`.
+                // Only the quantifier's own value is a nested WHERE clause for the
+                // related list.
+                for (const [quantifier, quantifierValue] of relationEntries) {
+                    if (RELATION_QUANTIFIERS.has(quantifier)) {
+                        walkWhere(quantifierValue, related.listConfig, related.listName, config, isSudo);
+                    }
+                }
+            }
+            else {
+                // Direct-nesting form: Prisma's documented default for a to-one
+                // relation filter nests the related list's own fields with no `is`
+                // wrapper at all (`{ author: { email: { contains: '...' } } }`). The
+                // whole value object IS the nested WHERE clause here — walk it
+                // directly, or an undeclared key reached exactly this way (one hop
+                // through a to-one relation) would pass through unchecked.
+                walkWhere(value, related.listConfig, related.listName, config, isSudo);
+            }
+        }
+    }
+}
+function walkOrderBy(orderBy, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, listName, config, isSudo) {
+    if (orderBy === null || typeof orderBy !== 'object')
+        return;
+    if (Array.isArray(orderBy)) {
+        for (const entry of orderBy)
+            walkOrderBy(entry, listConfig, listName, config, isSudo);
+        return;
+    }
+    for (const [key, value] of Object.entries(orderBy)) {
+        const resolved = resolveQueryField(key, listConfig.fields);
+        if (!resolved) {
+            if (isSudo)
+                continue;
+            rejectUndeclaredKey(listName, key, 'orderBy');
+        }
+        if (resolved.isRelationship && value !== null && typeof value === 'object') {
+            // `{ relation: { _count: 'asc' } }` orders by an aggregate — no nested
+            // field name to resolve. `{ relation: { name: 'asc' } }` orders by a
+            // field on a to-one related list — walk it against that list's fields.
+            if ('_count' in value)
+                continue;
+            const related = getRelatedListConfig(resolved.fieldConfig.ref, config);
+            if (related)
+                walkOrderBy(value, related.listConfig, related.listName, config, isSudo);
+        }
+    }
+}
+/**
+ * Validate a caller-supplied `where`/`orderBy` against the list config,
+ * recursing into logical operators (`AND`/`OR`/`NOT`) and relation filters.
+ * Throws a `ValidationError` naming the list and the offending key on the
+ * first undeclared key found. `isSudo` bypasses the check entirely, matching
+ * the write path's `sudo` escape hatch.
+ */
+export function validateQueryKeys(args) {
+    const { where, orderBy, listConfig, listName, config, isSudo } = args;
+    if (where !== undefined)
+        walkWhere(where, listConfig, listName, config, isSudo);
+    if (orderBy !== undefined)
+        walkOrderBy(orderBy, listConfig, listName, config, isSudo);
+}
+/**
+ * #915 — the predicate-time counterpart to `checkFieldAccess`'s post-query
+ * check: reject a `where`/`orderBy` key that names a field the session cannot
+ * read, BEFORE the query runs. See this module's top doc comment for how this
+ * relates to `validateQueryKeys` (#912) and `isFieldReadableForPredicate`'s
+ * doc (in `field-access.ts`) for how a row-dependent `read` rule is handled.
+ *
+ * A key `resolveQueryField` cannot resolve is skipped here — #912 has already
+ * rejected it (or, under `sudo`, deliberately let it through) by the time
+ * this runs. A system field (`id`/`createdAt`/`updatedAt`) resolves with no
+ * `fieldConfig` and carries no field-level access control, so it is always
+ * readable and skipped too.
+ */
+async function checkKeyReadableOrThrow(key, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, listName, args, kind) {
+    const resolved = resolveQueryField(key, listConfig.fields);
+    if (!resolved || resolved.fieldConfig === undefined)
+        return;
+    const readable = await isFieldReadableForPredicate(resolved.fieldConfig.access, args);
+    if (!readable) {
+        throw new ValidationError([
+            `Cannot query "${listName}" — "${key}" is denied by field-level read access. ` +
+                `A field the session cannot read cannot be named in a ${kind} (use sudo to bypass).`,
+        ]);
+    }
+}
+/**
+ * Check field-level `read` access for every key at ONE level of a `where`
+ * clause, recursing only into logical operators (`AND`/`OR`/`NOT`) — never
+ * into a relationship field's own nested value. Exported for `access-filter.ts`'s
+ * #916 reuse (see module doc comment above) — called once per hop against the
+ * RELATED list's own config.
+ */
+export async function walkWhereReadAccess(where, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, listName, args) {
+    if (where === null || typeof where !== 'object')
+        return;
+    if (Array.isArray(where)) {
+        for (const entry of where)
+            await walkWhereReadAccess(entry, listConfig, listName, args);
+        return;
+    }
+    for (const [key, value] of Object.entries(where)) {
+        if (LOGICAL_OPERATORS.has(key)) {
+            await walkWhereReadAccess(value, listConfig, listName, args);
+            continue;
+        }
+        // Deliberately does not recurse into a relationship field's own nested
+        // value: it checks whether THIS list's relationship field may be named
+        // (its own `read` access) — a field on the RELATED list nested inside it
+        // is checked by the CALLER re-invoking this function against the related
+        // list's config (see #916 in the module doc comment above).
+        await checkKeyReadableOrThrow(key, listConfig, listName, args, 'where');
+    }
+}
+async function walkOrderByReadAccess(orderBy, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, listName, args) {
+    if (orderBy === null || typeof orderBy !== 'object')
+        return;
+    if (Array.isArray(orderBy)) {
+        for (const entry of orderBy)
+            await walkOrderByReadAccess(entry, listConfig, listName, args);
+        return;
+    }
+    for (const key of Object.keys(orderBy)) {
+        await checkKeyReadableOrThrow(key, listConfig, listName, args, 'orderBy');
+    }
+}
+/**
+ * Validate a caller-supplied `where`/`orderBy` against field-level `read`
+ * access, recursing into logical operators (`AND`/`OR`/`NOT`) the same way
+ * `validateQueryKeys` does. Throws a `ValidationError` naming the list and
+ * the offending key on the first read-denied field found. `isSudo` bypasses
+ * the check entirely, matching `validateQueryKeys` and the write path's
+ * `sudo` escape hatch.
+ */
+export async function validateQueryFieldReadAccess(args) {
+    const { where, orderBy, listConfig, listName, session, context, isSudo } = args;
+    if (isSudo)
+        return;
+    const evalArgs = { session, context };
+    if (where !== undefined)
+        await walkWhereReadAccess(where, listConfig, listName, evalArgs);
+    if (orderBy !== undefined)
+        await walkOrderByReadAccess(orderBy, listConfig, listName, evalArgs);
+}
+//# sourceMappingURL=query-validation.js.map

package/dist/access/query-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-validation.js","sourceRoot":"","sources":["../../src/access/query-validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAE9D,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AAErF,uEAAuE;AACvE,8EAA8E;AAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAW/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,MAAsB;IAEtB,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,KAAK,cAAc,EAAE,CAAA;IAC7E,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YACxD,MAAM,OAAO,GAAa,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAyB;IACnF,MAAM,IAAI,eAAe,CAAC;QACxB,iBAAiB,QAAQ,QAAQ,GAAG,iCAAiC;YACnE,cAAc,IAAI,0CAA0C;KAC/D,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,KAAc;AACd,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,MAAsB,EACtB,MAAe;IAEf,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IAEvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACjF,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YACtD,SAAQ;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,MAAM;gBAAE,SAAQ;YACpB,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAC7C,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,iCAAiC;QACjC,IACE,QAAQ,CAAC,cAAc;YACvB,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtE,IAAI,CAAC,OAAO;gBAAE,SAAQ;YAEtB,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAA;YACxE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAEhF,IAAI,aAAa,EAAE,CAAC;gBAClB,4EAA4E;gBAC5E,mEAAmE;gBACnE,gBAAgB;gBAChB,KAAK,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,eAAe,EAAE,CAAC;oBAC5D,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBACzC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;oBAClF,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,+DAA+D;gBAC/D,mEAAmE;gBACnE,2DAA2D;gBAC3D,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YACxE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,OAAgB;AAChB,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,MAAsB,EACtB,MAAe;IAEf,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAM;IAE3D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACrF,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,MAAM;gBAAE,SAAQ;YACpB,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,QAAQ,CAAC,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3E,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,QAAQ,IAAK,KAAiC;gBAAE,SAAQ;YAE5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtE,IAAI,OAAO;gBAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/E,IAAI,OAAO,KAAK,SAAS;QAAE,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,uBAAuB,CACpC,GAAW;AACX,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,IAAiF,EACjF,IAAyB;IAEzB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAM;IAE3D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC;YACxB,iBAAiB,QAAQ,QAAQ,GAAG,0CAA0C;gBAC5E,wDAAwD,IAAI,wBAAwB;SACvF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAc;AACd,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,IAAiF;IAEjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IAEvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvF,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC5D,SAAQ;QACV,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACzE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAgB;AAChB,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,IAAiF;IAEjF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAM;IAE3D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3F,OAAM;IACR,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC,EAAE,CAAC;QAClE,MAAM,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IASlD;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/E,IAAI,MAAM;QAAE,OAAM;IAClB,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACzF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AACjG,CAAC"}

package/dist/access/relationship-count.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-count.d.ts","sourceRoot":"","sources":["../../src/access/relationship-count.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAMjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH,KAAK,SAAS,GAAG;IACf,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CASjF;AAkCD;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAEhD,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAQ9C;AA0HD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAE1C,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAuD9C"}
+{"version":3,"file":"relationship-count.d.ts","sourceRoot":"","sources":["../../src/access/relationship-count.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAMjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH,KAAK,SAAS,GAAG;IACf,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CASjF;AAkCD;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAEhD,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAQ9C;AAuHD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAE1C,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAkD9C"}

package/dist/access/relationship-count.js

@@ -55,7 +55,6 @@ listConfig, args, config) {
     }
     return Object.keys(select).length > 0 ? select : undefined;
 }
-/** Read a to-many relationship's count off a fetched row's `_count` payload. */
 function readRelationshipCount(row, fieldName) {
     const counts = row._count;
     if (counts && typeof counts === 'object') {
@@ -65,7 +64,6 @@ function readRelationshipCount(row, fieldName) {
     }
     return 0;
 }
-/** Whether a count satisfies a Filter operator/value comparison. */
 function matchesCount(count, operator, value) {
     switch (operator) {
         case 'eq':
@@ -89,7 +87,6 @@ function asCountDelegate(value) {
     }
     return null;
 }
-/** Extract the `RelationshipCountFilterMarker` from a condition value, if present. */
 function readCountMarker(value) {
     if (!value || typeof value !== 'object')
         return null;
@@ -212,13 +209,8 @@ listConfig, listKey, args, config) {
             continue;
         }
         const resolved = await resolveOneCountFilter(listConfig, listKey, found.field, found.marker, args, config);
-        // Preserve any sibling conditions co-present on this member rather than
-        // replacing it wholesale with the resolved `{ id: { in } }`. The filter engine
-        // currently guarantees each AND-member (and the no-AND single object) carries
-        // exactly one field condition, so `siblings` is empty today and this equals the
-        // previous wholesale replacement — but if a future engine change ever merged
-        // multiple conditions into one member, spreading keeps the marker's siblings
-        // from being silently dropped.
+        // Preserve any sibling conditions rather than replacing the member
+        // wholesale — see `mergeResolvedMember` above for why.
         const siblings = { ...member };
         delete siblings[found.field];
         resolvedMembers.push(mergeResolvedMember(siblings, resolved));

package/dist/access/relationship-count.js.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-count.js","sourceRoot":"","sources":["../../src/access/relationship-count.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AA2B/C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,OAAO,CACL,KAAK,EAAE,IAAI,KAAK,cAAc;QAC9B,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,IAAI;QACnB,KAAK,IAAI,KAAK;QACd,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CACrB,CAAA;AACH,CAAC;AAQD;;;;GAIG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAA8B,EAC9B,IAAe,EACf,MAAsB;IAEtB,IAAI,CAAC,KAAK,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IAE/F,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACxE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;AAChD,qGAAqG;AACrG,UAA2B,EAC3B,IAAe,EACf,MAAsB;IAEtB,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAQ;QACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAED,gFAAgF;AAChF,SAAS,qBAAqB,CAAC,GAA4B,EAAE,SAAiB;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,KAAa,EAAE,QAAwB,EAAE,KAAa;IAC1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,KAAK,KAAK,KAAK,CAAA;QACxB,KAAK,IAAI;YACP,OAAO,KAAK,GAAG,KAAK,CAAA;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,IAAI,KAAK,CAAA;QACvB,KAAK,IAAI;YACP,OAAO,KAAK,GAAG,KAAK,CAAA;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,IAAI,KAAK,CAAA;IACzB,CAAC;AACH,CAAC;AAOD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,KAA+B,CAAA;QACjD,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,MAAM,GAAI,KAAiC,CAAC,6BAA6B,CAAC,CAAA;IAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,MAAiD,CAAA;IAChF,IACE,CAAC,QAAQ,KAAK,IAAI;QAChB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,KAAK,CAAC;QACrB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;AAClC,qGAAqG;AACrG,UAA2B,EAC3B,OAAe,EACf,SAAiB,EACjB,MAAqC,EACrC,IAAe,EACf,MAAsB;IAEtB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAErE,2EAA2E;IAC3E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAE7B,wEAAwE;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,gFAAgF;IAChF,gFAAgF;IAChF,sEAAsE;IACtE,yEAAyE;IACzE,8EAA8E;IAC9E,+EAA+E;IAC/E,+DAA+D;IAC/D,+EAA+E;IAC/E,iFAAiF;IACjF,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;KAC9D,CAAC,CAAA;IAEF,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAQ;YAC7C,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,YAAY,CAAC,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAiC,EACjC,QAAiC;IAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAA;IACrE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAA;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA0C;AAC1C,qGAAqG;AACrG,UAA2B,EAC3B,OAAe,EACf,IAAe,EACf,MAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;IAC1B,MAAM,OAAO,GAAmC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrE,CAAC,CAAE,QAA2C;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAEX,MAAM,UAAU,GAAG,CACjB,MAA+B,EACkC,EAAE;QACnE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAQ;YAChE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YAC3C,IAAI,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,eAAe,GAAmC,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,UAAU,EACV,OAAO,EACP,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,EACZ,IAAI,EACJ,MAAM,CACP,CAAA;QACD,wEAAwE;QACxE,+EAA+E;QAC/E,8EAA8E;QAC9E,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,+BAA+B;QAC/B,MAAM,QAAQ,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAA;QACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5C,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AACnE,CAAC"}
+{"version":3,"file":"relationship-count.js","sourceRoot":"","sources":["../../src/access/relationship-count.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AA2B/C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,OAAO,CACL,KAAK,EAAE,IAAI,KAAK,cAAc;QAC9B,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,IAAI;QACnB,KAAK,IAAI,KAAK;QACd,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CACrB,CAAA;AACH,CAAC;AAQD;;;;GAIG;AACH,KAAK,UAAU,4BAA4B,CACzC,KAA8B,EAC9B,IAAe,EACf,MAAsB;IAEtB,IAAI,CAAC,KAAK,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IAE/F,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACxE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;AAChD,qGAAqG;AACrG,UAA2B,EAC3B,IAAe,EACf,MAAsB;IAEtB,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAQ;QACvD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA4B,EAAE,SAAiB;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;IAC7C,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAwB,EAAE,KAAa;IAC1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,KAAK,KAAK,KAAK,CAAA;QACxB,KAAK,IAAI;YACP,OAAO,KAAK,GAAG,KAAK,CAAA;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,IAAI,KAAK,CAAA;QACvB,KAAK,IAAI;YACP,OAAO,KAAK,GAAG,KAAK,CAAA;QACtB,KAAK,KAAK;YACR,OAAO,KAAK,IAAI,KAAK,CAAA;IACzB,CAAC;AACH,CAAC;AAOD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,KAA+B,CAAA;QACjD,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,MAAM,GAAI,KAAiC,CAAC,6BAA6B,CAAC,CAAA;IAChF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,MAAiD,CAAA;IAChF,IACE,CAAC,QAAQ,KAAK,IAAI;QAChB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,KAAK,CAAC;QACrB,OAAO,CAAC,KAAK,QAAQ,EACrB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;AAClC,qGAAqG;AACrG,UAA2B,EAC3B,OAAe,EACf,SAAiB,EACjB,MAAqC,EACrC,IAAe,EACf,MAAsB;IAEtB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAErE,2EAA2E;IAC3E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAE7B,wEAAwE;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,gFAAgF;IAChF,gFAAgF;IAChF,sEAAsE;IACtE,yEAAyE;IACzE,8EAA8E;IAC9E,+EAA+E;IAC/E,+DAA+D;IAC/D,+EAA+E;IAC/E,iFAAiF;IACjF,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;KAC9D,CAAC,CAAA;IAEF,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAQ;YAC7C,MAAM,MAAM,GAAG,GAA8B,CAAA;YAC7C,IAAI,YAAY,CAAC,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAiC,EACjC,QAAiC;IAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAA;IACrE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAA;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA0C;AAC1C,qGAAqG;AACrG,UAA2B,EAC3B,OAAe,EACf,IAAe,EACf,MAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;IAC1B,MAAM,OAAO,GAAmC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrE,CAAC,CAAE,QAA2C;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAEX,MAAM,UAAU,GAAG,CACjB,MAA+B,EACkC,EAAE;QACnE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAQ;YAChE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YAC3C,IAAI,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,eAAe,GAAmC,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,UAAU,EACV,OAAO,EACP,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,EACZ,IAAI,EACJ,MAAM,CACP,CAAA;QACD,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,QAAQ,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAA;QACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5C,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AACnE,CAAC"}

package/dist/access/relationship-label-filter.d.ts

@@ -2,25 +2,29 @@ import type { Session, AccessContext } from './types.js';
 import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js';
 /**
  * Access-scoped to-one relationship label filters for the admin list view
- * (issue #749).
+ * (issue #749) — NOW A PASS-THROUGH.
  *
  * A to-one relationship's Filter spec (`author:Ada` → `{ author: { is: { name:
- * { contains: 'Ada' } } } }`) is a pure mapper (see `relationship()` in
- * `fields/index.ts`) — it has no way to consult the related list's access
- * control, so the nested `is` clause it emits runs as an unscoped Prisma
- * sub-filter against the related table. The parent list's own access filter
- * still scopes which parent rows are visible, but the nested condition itself
- * is evaluated with no reference to the related list's `query` access — a
- * session could distinguish parent rows by a related field it is not itself
- * allowed to read (e.g. binary-searching `author:A`, `author:Ad`, `author:Ada`
- * against a `User` list it cannot query).
+ * { contains: 'Ada' } } } }`) produces exactly the `{ is: {...} }` shape a
+ * relation filter uses. Before #916, the engine did not scope relation
+ * filters in `where` at all, so this module was the only place the related
+ * list's `query` access was folded into that nested `is` clause (mirroring
+ * `relationship-count.ts`'s `_count` folding) — otherwise a session could
+ * distinguish parent rows by a related field it could not itself read (e.g.
+ * binary-searching `author:A`, `author:Ad`, `author:Ada` against a `User`
+ * list it cannot query).
  *
- * This module is the single place the related list's operation-level `query`
- * access is folded into that nested `is` clause, mirroring how
- * `relationship-count.ts` folds it into `_count` selects and count-filter
- * markers. A fully denied related list makes the member never match — the
- * token cannot be used to confirm or rule out a value on a field the session
- * cannot read (narrowing-only, matching the count resolver's denied path).
+ * #916 closed that gap in the engine itself: `context.db.*.findMany`/`count`
+ * now scope every relation filter in `where` — including this exact `is`
+ * shape — via `buildAccessScopedWhere` (`access-filter.ts`), applied
+ * automatically to whatever `where` this module's caller (`ListView.tsx`)
+ * hands to the secured context. Folding the same access filter here as well
+ * would be redundant work producing an identical result (the engine ANDs the
+ * same filter in a second time), so this module's own fold was removed —
+ * `resolveRelationshipLabelFilters` now returns `where` unchanged. The
+ * exported functions are kept, unchanged in shape, only because they remain
+ * part of `@opensaas/stack-core`'s public surface; removing them outright
+ * would be a breaking change this fix does not need to make.
  */
 type LabelFilterArgs = {
     session: Session | null;
@@ -33,13 +37,9 @@ type LabelFilterArgs = {
  */
 export declare function isToOneRelationshipField(field: FieldConfig | undefined): boolean;
 /**
- * Replace any to-one relationship label-filter members in a filter `where`
- * with access-scoped equivalents. Label-filter members only ever appear as
- * top-level AND members (the relationship Filter spec does not declare
- * `freeText`, so it never participates in the free-text OR), so this walks
- * only the top level. Returns the `where` unchanged when it contains no such
- * members, so lists without to-one relationship filters pay nothing.
+ * No longer folds access into label filters — see the module doc above.
+ * Returns `where` unchanged.
  */
-export declare function resolveRelationshipLabelFilters(where: Record<string, unknown> | undefined, listConfig: ListConfig<any>, args: LabelFilterArgs, config: OpenSaasConfig): Promise<Record<string, unknown> | undefined>;
+export declare function resolveRelationshipLabelFilters(where: Record<string, unknown> | undefined, _listConfig: ListConfig<any>, _args: LabelFilterArgs, _config: OpenSaasConfig): Promise<Record<string, unknown> | undefined>;
 export {};
 //# sourceMappingURL=relationship-label-filter.d.ts.map

package/dist/access/relationship-label-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-label-filter.d.ts","sourceRoot":"","sources":["../../src/access/relationship-label-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAQhF;AAsCD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAE1C,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAyC9C"}
+{"version":3,"file":"relationship-label-filter.d.ts","sourceRoot":"","sources":["../../src/access/relationship-label-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAQhF;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAE1C,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,EAC5B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAE9C"}