@opensaas/stack-core 0.40.0 → 0.42.0

package/dist/access/access-filter.js

@@ -1,7 +1,8 @@
-import { checkAccess, getRelatedListConfig } from './engine.js';
+import { checkAccess, getRelatedListConfig, resolveSyntheticReverseRelation, listSyntheticReverseRelationNames, } from './engine.js';
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
-import { AccessScopeDepthExceededError, RelationFilterAccessDeniedError } from './errors.js';
-import { LOGICAL_OPERATORS, RELATION_QUANTIFIERS, resolveQueryField, walkWhereReadAccess, } from './query-validation.js';
+import { AccessScopeDepthExceededError, RelationFilterAccessDeniedError, UndeclaredCountKeyError, UndeclaredIncludeKeyError, } from './errors.js';
+import { LOGICAL_OPERATORS, RELATION_QUANTIFIERS, resolveQueryField, validateQueryFieldReadAccess, validateQueryKeys, walkWhereReadAccess, } from './query-validation.js';
+import { isToManyRelationshipField, resolveCountAccessEntryForList } from './relationship-count.js';
 import { getDbKey } from '../lib/case-utils.js';
 /** A plain object — excludes `null` and arrays, which `typeof x === 'object'` alone would admit. */
 function isPlainObject(value) {
@@ -56,25 +57,212 @@ export function emptyToOneAccessFilterTree() {
 function isToOneAccessFilterTreeEmpty(tree) {
     return Object.keys(tree.filters).length === 0 && Object.keys(tree.nested).length === 0;
 }
-/** Whether a relationship field is to-one (at most one related row) rather than to-many. */
-function isToOneRelationship(fieldConfig) {
+/**
+ * Whether a relationship field is to-one (at most one related row) rather
+ * than to-many. Exported so `field-visibility.ts` can pick the same `null`
+ * (to-one) vs `[]` (to-many) shape for a denied relation's forced value
+ * (issue #1103) that this module used to decide whether to record the
+ * denial in the first place — one source of truth for arity, not two.
+ */
+export function isToOneRelationship(fieldConfig) {
     return !('many' in fieldConfig && fieldConfig.many === true);
 }
+export function emptyCountAccessDenialTree() {
+    return { keys: new Set(), nested: {} };
+}
+function isCountAccessDenialTreeEmpty(tree) {
+    return tree.keys.size === 0 && Object.keys(tree.nested).length === 0;
+}
+/**
+ * Normalize a caller's `_count` include value to the `_count.select` map it
+ * names. `true` (Prisma's "count every relation" shorthand) expands to every
+ * countable relation Prisma itself carries on this model — every DECLARED
+ * to-many relationship, plus every synthetic back-relation a list-only `ref`
+ * elsewhere in the config synthesizes onto it (issue #1082): Prisma's own
+ * `_count: true` has always counted both, and dropping the synthetic ones
+ * here would silently stop counting a relation the caller used to get a
+ * (previously unscoped) count for. Returns `null` for a shape that requests
+ * nothing countable (`false`, or an object with no usable `select`).
+ */
+function normalizeCountSelect(requestedValue, fieldConfigs, listKey, config) {
+    if (requestedValue === true) {
+        const expanded = {};
+        for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
+            if (isToManyRelationshipField(fieldConfig))
+                expanded[fieldName] = true;
+        }
+        for (const syntheticName of listSyntheticReverseRelationNames(listKey, config)) {
+            expanded[syntheticName] = true;
+        }
+        return expanded;
+    }
+    if (isPlainObject(requestedValue) && isPlainObject(requestedValue.select)) {
+        return requestedValue.select;
+    }
+    return null;
+}
+/**
+ * Scope a caller-supplied `_count` include value by each named relation's own
+ * `query` access — the `_count` counterpart to the rest of this module's
+ * relation scoping (issue #1087, closing the one key `buildAccessScopedInclude`
+ * used to allowlist through unscoped, #1082's "Out of scope").
+ *
+ * For each key in the caller's `_count.select` (or, for bare `_count: true`,
+ * every declared to-many relation — see `normalizeCountSelect`):
+ * - Not a declared to-many relationship and not a synthetic back-relation
+ *   (#1082 — always genuinely countable) → THROWN as
+ *   `UndeclaredCountKeyError`, matching `buildAccessScopedInclude`'s own
+ *   rejection for the ordinary walk. A declared to-many relationship whose
+ *   `ref` cannot be resolved is skipped instead, matching that same walk's
+ *   handling of a config-level dangling ref (not a caller error).
+ * - The counting list's OWN field-level `read` access on the relationship
+ *   field being counted denies it, or the related list's `query` access
+ *   denies it (`=== false`) → omitted from the select sent to Prisma and
+ *   added to the returned `deniedKeys`, so `filterReadableFields` can inject
+ *   `0` post-query (a count is session-relative; denial doesn't mean "no such
+ *   relation"). The field-level check has nothing to evaluate for a synthetic
+ *   back-relation (no field of its own on this list) and is skipped for it —
+ *   `resolveCountAccessEntryForList` (issue #1111). Both checks run BEFORE
+ *   any caller-supplied nested `where` is validated — validating first would
+ *   let a caller who cannot read a single row of the related list learn its
+ *   field names and field-level read rules from a thrown `ValidationError`
+ *   alone, reopening the exact oracle #915/ADR-0031 closed for a top-level
+ *   predicate.
+ * - Otherwise → the caller-supplied nested `where` at that key (if any) is
+ *   key- and read-access-validated against the RELATED list via the same
+ *   `validateQueryKeys`/`validateQueryFieldReadAccess` primitives
+ *   `createFindMany` already runs on a top-level `where` (#912/#915), then
+ *   run through `buildAccessScopedWhere` — the same fold `createFindMany`
+ *   applies to a top-level `where` (#916) — so a relation filter nested
+ *   inside IT (e.g. `_count.select.posts.where.comments.some`) is scoped by
+ *   THAT further list's own `query` access too, not just the counted
+ *   relation's. The result is AND-combined with the counted relation's own
+ *   access filter (if any) — reusing `andWhere`, never replacing the
+ *   caller's condition, mirroring `buildAccessScopedInclude` itself.
+ */
+async function buildAccessScopedCountSelect(requestedValue, fieldConfigs, args, config, listKey) {
+    const requestedSelect = normalizeCountSelect(requestedValue, fieldConfigs, listKey, config);
+    const deniedKeys = new Set();
+    if (!requestedSelect)
+        return { select: undefined, deniedKeys };
+    const select = {};
+    for (const [key, entryValue] of Object.entries(requestedSelect)) {
+        // A caller can explicitly exclude a key from the `true`-expanded set the
+        // same way Prisma's own `select` excludes a field.
+        if (entryValue === false)
+            continue;
+        const fieldConfig = fieldConfigs[key];
+        const isDeclaredToMany = isToManyRelationshipField(fieldConfig);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+        let relatedConfig = null;
+        if (isDeclaredToMany && fieldConfig && 'ref' in fieldConfig) {
+            relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
+        }
+        if (!relatedConfig && !isDeclaredToMany) {
+            const synthetic = resolveSyntheticReverseRelation(key, listKey, config);
+            if (synthetic) {
+                relatedConfig = {
+                    listName: synthetic.sourceListName,
+                    listConfig: synthetic.sourceListConfig,
+                };
+            }
+        }
+        if (!relatedConfig) {
+            // A declared to-many field whose `ref` didn't resolve is a config
+            // issue, not a caller error — skip it exactly like the ordinary
+            // include walk does for the same case.
+            if (isDeclaredToMany)
+                continue;
+            throw new UndeclaredCountKeyError(listKey, key);
+        }
+        // `fieldConfig` is undefined for a synthetic back-relation (#1082) — it has
+        // no field of its own on THIS list, so there is no field-level `read`
+        // access to fold in; `resolveCountAccessEntryForList` treats a missing
+        // `fieldAccess` as exempt, matching the ordinary include path's own lack
+        // of a field-level gate for a synthetic key (issue #1111).
+        const accessEntry = await resolveCountAccessEntryForList(relatedConfig.listConfig, args, fieldConfig?.access);
+        // Denial is checked BEFORE the caller's nested `where` is validated —
+        // mirroring `buildAccessScopedWhere`'s own ordering below. A fully denied
+        // relation counts `0` no matter what `where` the caller supplied, so
+        // validating it first would let a caller who cannot read a single row of
+        // the related list learn its field names and field-level read rules from
+        // a `ValidationError`'s message alone — the exact oracle #915/ADR-0031
+        // closed for a top-level predicate, reopened here if this ran first.
+        if (accessEntry.kind === 'denied') {
+            deniedKeys.add(key);
+            continue;
+        }
+        const requestedWhere = isPlainObject(entryValue) && isPlainObject(entryValue.where)
+            ? entryValue.where
+            : undefined;
+        let scopedRequestedWhere;
+        if (requestedWhere) {
+            // Mirrors `buildAccessScopedInclude`'s own `resolveSyntheticRelation`
+            // closure (#1092/#916) — a synthetic back-relation (#1082) named inside
+            // this count entry's own `where` resolves against its source list
+            // rather than being rejected as undeclared, at every hop.
+            const resolveSyntheticRelation = (syntheticKey, fromListName) => {
+                const synthetic = resolveSyntheticReverseRelation(syntheticKey, fromListName, config);
+                return synthetic
+                    ? { listConfig: synthetic.sourceListConfig, listName: synthetic.sourceListName }
+                    : null;
+            };
+            validateQueryKeys({
+                where: requestedWhere,
+                listConfig: relatedConfig.listConfig,
+                listName: relatedConfig.listName,
+                config,
+                isSudo: false,
+                resolveSyntheticRelation,
+            });
+            await validateQueryFieldReadAccess({
+                where: requestedWhere,
+                listConfig: relatedConfig.listConfig,
+                listName: relatedConfig.listName,
+                session: args.session,
+                context: args.context,
+                isSudo: false,
+            });
+            // A relation filter (`some`/`every`/`none`/`is`/`isNot`) nested inside
+            // the caller's own `where` names a THIRD list one hop further out —
+            // e.g. `_count.select.posts.where.comments.some`. Validation above only
+            // checked keys against the counted relation's OWN fields; without this,
+            // that nested relation would reach Prisma unscoped by ITS list's
+            // `query` access, letting the resulting count reveal whether
+            // inaccessible rows over there exist. `buildAccessScopedWhere` is the
+            // same fold `createFindMany` runs on an ordinary top-level `where`
+            // (#916) — reused here rather than re-derived.
+            scopedRequestedWhere = (await buildAccessScopedWhere(requestedWhere, relatedConfig.listConfig, relatedConfig.listName, config, args, resolveSyntheticRelation));
+        }
+        const scopedWhere = andWhere(accessEntry.kind === 'scoped' ? accessEntry.where : undefined, scopedRequestedWhere);
+        select[key] = scopedWhere ? { where: scopedWhere } : true;
+    }
+    return { select: Object.keys(select).length > 0 ? select : undefined, deniedKeys };
+}
 /**
  * Build the access-scoped `include` for exactly the relations a read
  * requested, recursing only into branches `requestedInclude` itself names.
  *
  * For each key in `requestedInclude`:
- * - Not a config-declared relationship → access control does not govern it;
- *   passed through unchanged (e.g. a fragment/caller key that isn't a
- *   relationship at all).
+ * - A declared field that isn't a relationship (scalar, virtual, …) → access
+ *   control does not govern it; passed through unchanged (a virtual key is
+ *   stripped later by `stripVirtualFieldsFromInclude`, #628).
+ * - Not declared at all → resolved via `resolveSyntheticReverseRelation`
+ *   (the synthetic-back-relation case above); `_count` is scoped by
+ *   `buildAccessScopedCountSelect` (issue #1087 — each named relation's own
+ *   `query` access, exactly like any other relation this walk scopes; a
+ *   denied one is recorded for `filterReadableFields` to inject `0` for,
+ *   post-query, since Prisma cannot be asked for a guaranteed `0`); anything
+ *   else throws `UndeclaredIncludeKeyError` rather than reaching the
+ *   database unscoped.
  * - A declared relationship whose related list's `query` access denies it
  *   (`=== false`) → dropped entirely, no matter what the request asked for
  *   nested beneath it (#566): the caller chooses *which* relations, access
- *   control chooses *whether* and *with what filter*. For a to-one relation
- *   this denial is also recorded in `toOneAccessFilters` (`kind: 'denied'`),
- *   so `filterReadableFields` can still surface an explicit `null` for it
- *   (issue #974) rather than an absent key.
+ *   control chooses *whether* and *with what filter*. This denial is also
+ *   recorded in `toOneAccessFilters` (`kind: 'denied'`), for either arity, so
+ *   `filterReadableFields` can still surface an explicit `null` (to-one,
+ *   issue #974) or `[]` (to-many, issue #1103) for it rather than an absent
+ *   key.
  * - Otherwise, for a to-**many** relation → the access `where` is
  *   AND-combined with any caller-supplied nested `where` (never replaced —
  *   the other half of #566), and a caller-supplied `take` rides through
@@ -103,36 +291,119 @@ export async function buildAccessScopedInclude(requestedInclude, fieldConfigs, a
     }
     const result = {};
     const toOneAccessFilters = emptyToOneAccessFilterTree();
+    const countDenials = emptyCountAccessDenialTree();
     for (const [relationName, requestedValue] of Object.entries(requestedInclude)) {
+        // A caller can explicitly opt a relation OUT of a Prisma include with
+        // `false` (its `Include` type allows a bare `boolean`), or end up with an
+        // `undefined` value from a conditionally-built object
+        // (`{ posts: cond ? true : undefined }`) — Prisma treats both the same as
+        // the key being absent. Treat them identically here too, before this key
+        // ever reaches access evaluation: an explicitly-disabled relation was
+        // never actually requested, so it must not be evaluated, dropped as
+        // "denied", or recorded as needing a post-query fixup (issue #1103 code
+        // review) — any of those would surface a value (`[]`/`null`) for a key
+        // the caller deliberately excluded.
+        if (requestedValue === false || requestedValue === undefined)
+            continue;
         const fieldConfig = fieldConfigs[relationName];
         const isDeclaredRelationship = fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && !!fieldConfig.ref;
-        if (!isDeclaredRelationship) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+        let relatedConfig;
+        let isToOne;
+        if (isDeclaredRelationship) {
+            relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
+            if (!relatedConfig)
+                continue;
+            isToOne = isToOneRelationship(fieldConfig);
+        }
+        else if (fieldConfig) {
+            // A declared field that is not a relationship — access control does
+            // not govern it here; passed through unchanged.
             result[relationName] = requestedValue;
             continue;
         }
-        const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
-        if (!relatedConfig)
+        else if (relationName === '_count') {
+            const { select, deniedKeys } = await buildAccessScopedCountSelect(requestedValue, fieldConfigs, args, config, listKey);
+            if (select)
+                result[relationName] = { select };
+            if (deniedKeys.size > 0)
+                countDenials.keys = deniedKeys;
             continue;
-        const isToOne = isToOneRelationship(fieldConfig);
+        }
+        else {
+            const synthetic = resolveSyntheticReverseRelation(relationName, listKey, config);
+            if (!synthetic) {
+                throw new UndeclaredIncludeKeyError(listKey, relationName);
+            }
+            relatedConfig = { listName: synthetic.sourceListName, listConfig: synthetic.sourceListConfig };
+            // Always to-many — a list-only ref has one construction site and no
+            // arity branch, and one-to-one is structurally impossible for it.
+            isToOne = false;
+        }
         const queryAccess = relatedConfig.listConfig.access?.operation?.query;
         const accessResult = await checkAccess(queryAccess, {
             session: args.session,
             context: args.context,
         });
         if (accessResult === false) {
-            if (isToOne) {
-                toOneAccessFilters.filters[relationName] = { kind: 'denied' };
-            }
+            // Recorded for either arity (issue #1103) — a to-many relation is
+            // dropped from `include` here exactly like a to-one one, and needs the
+            // same post-query fixup so its key comes back `[]`, not silently
+            // absent from the row.
+            toOneAccessFilters.filters[relationName] = { kind: 'denied' };
             continue;
         }
         const accessWhere = typeof accessResult === 'object' ? accessResult : undefined;
         const requestedEntry = asEntryObject(requestedValue);
+        // #1092 — a nested `where`/`orderBy` gets the same #912/#915 checks the
+        // top-level `where`/`orderBy` already gets, resolved against the RELATED
+        // list (`relatedConfig`) rather than the current one, and run only once
+        // the relation is known to be accessible at all (same ordering reason as
+        // the top-level checks: don't leak a field's name/read-gating status to a
+        // caller who has zero access to the relation to begin with).
+        const resolveSyntheticRelation = (key, fromListName) => {
+            const synthetic = resolveSyntheticReverseRelation(key, fromListName, config);
+            return synthetic
+                ? { listConfig: synthetic.sourceListConfig, listName: synthetic.sourceListName }
+                : null;
+        };
+        validateQueryKeys({
+            where: requestedEntry?.where,
+            orderBy: requestedEntry?.orderBy,
+            listConfig: relatedConfig.listConfig,
+            listName: relatedConfig.listName,
+            config,
+            isSudo: false,
+            resolveSyntheticRelation,
+        });
+        await validateQueryFieldReadAccess({
+            where: requestedEntry?.where,
+            orderBy: requestedEntry?.orderBy,
+            listConfig: relatedConfig.listConfig,
+            listName: relatedConfig.listName,
+            session: args.session,
+            context: args.context,
+            isSudo: false,
+        });
+        // The two checks above only reach the entry's own top-level keys — a
+        // relation quantifier (`some`/`every`/`none`/`is`/`isNot`) nested inside
+        // this `where` names a DEEPER related list, which needs the same
+        // treatment the top-level `where` already gets from `buildAccessScopedWhere`
+        // (#916): scope it by that deeper list's own `query` access and check ITS
+        // fields' read access, recursing through every further hop. Only for
+        // to-many — a to-one entry never carries `requestedEntry.where` through to
+        // Prisma at all (see below), so there is nothing here to scope.
+        const scopedRequestedWhere = !isToOne && requestedEntry?.where !== undefined
+            ? (await buildAccessScopedWhere(requestedEntry.where, relatedConfig.listConfig, relatedConfig.listName, config, args, resolveSyntheticRelation))
+            : requestedEntry?.where;
         let nestedInclude;
         let nestedToOneFilters;
+        let nestedCountDenials;
         if (requestedEntry?.include) {
             const nested = await buildAccessScopedInclude(requestedEntry.include, relatedConfig.listConfig.fields, args, config, relatedConfig.listName, depth + 1);
             nestedInclude = nested.include;
             nestedToOneFilters = nested.toOneAccessFilters;
+            nestedCountDenials = nested.countDenials;
         }
         const entry = {};
         if (isToOne) {
@@ -145,7 +416,7 @@ export async function buildAccessScopedInclude(requestedInclude, fieldConfigs, a
             }
         }
         else {
-            const mergedWhere = andWhere(accessWhere, requestedEntry?.where);
+            const mergedWhere = andWhere(accessWhere, scopedRequestedWhere);
             if (mergedWhere)
                 entry.where = mergedWhere;
             if (requestedEntry?.take !== undefined)
@@ -160,9 +431,12 @@ export async function buildAccessScopedInclude(requestedInclude, fieldConfigs, a
         if (nestedToOneFilters && !isToOneAccessFilterTreeEmpty(nestedToOneFilters)) {
             toOneAccessFilters.nested[relationName] = nestedToOneFilters;
         }
+        if (nestedCountDenials && !isCountAccessDenialTreeEmpty(nestedCountDenials)) {
+            countDenials.nested[relationName] = nestedCountDenials;
+        }
         result[relationName] = Object.keys(entry).length > 0 ? entry : true;
     }
-    return { include: result, toOneAccessFilters };
+    return { include: result, toOneAccessFilters, countDenials };
 }
 export function emptyToOneAccessVisibilityTree() {
     return { filters: {}, nested: {} };
@@ -274,32 +548,55 @@ export async function resolveToOneAccessVisibility(items, tree, args) {
  * caller can observe that an inaccessible related row exists (an `every`
  * that "should" pass instead fails), but never that row's field values,
  * which is the property this ticket exists to close.
+ *
+ * A quantifier's value of literal `null` (`is: null`/`isNot: null`, a to-one
+ * relation's existence check) is passed through untouched rather than folded:
+ * it names no fields to read-check or scope, and AND-folding an access filter
+ * into it would silently invert the caller's own predicate (see the inline
+ * comment at that branch).
+ *
+ * `resolveSyntheticRelation` (#1092/#1108) extends this to a key that
+ * resolves to a synthetic back-relation (#1082) rather than a declared
+ * field, recursing against its SOURCE list. Only `buildAccessScopedInclude`
+ * passes it, for the include-nested `where` position; the top-level `where`
+ * this function was originally built for (`context/index.ts`) omits it, so
+ * a synthetic key there is unaffected — matching #1092's own scope, which
+ * deliberately left the top-level checks unchanged.
  */
 export async function buildAccessScopedWhere(where, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-listConfig, listName, config, args) {
+listConfig, listName, config, args, 
+// #1092/#1108 — the include-nested position's own addition, exactly
+// mirroring `validateQueryKeys`'s `resolveSyntheticRelation` (see that
+// module's doc comment): every top-level `where` caller omits this, so
+// top-level behavior is unchanged.
+resolveSyntheticRelation) {
     if (where === null || typeof where !== 'object')
         return where;
     if (Array.isArray(where)) {
-        return Promise.all(where.map((entry) => buildAccessScopedWhere(entry, listConfig, listName, config, args)));
+        return Promise.all(where.map((entry) => buildAccessScopedWhere(entry, listConfig, listName, config, args, resolveSyntheticRelation)));
     }
     const result = {};
     for (const [key, value] of Object.entries(where)) {
         if (LOGICAL_OPERATORS.has(key)) {
-            result[key] = await buildAccessScopedWhere(value, listConfig, listName, config, args);
+            result[key] = await buildAccessScopedWhere(value, listConfig, listName, config, args, resolveSyntheticRelation);
             continue;
         }
         const resolved = resolveQueryField(key, listConfig.fields);
-        if (!resolved ||
-            !resolved.isRelationship ||
-            value === null ||
-            typeof value !== 'object' ||
-            Array.isArray(value)) {
-            result[key] = value;
-            continue;
-        }
-        const related = getRelatedListConfig(resolved.fieldConfig.ref, config);
-        if (!related) {
+        // A synthetic back-relation (#1082) carries no `ref` of its own to
+        // follow — its "related" list for recursion is the SOURCE list it
+        // stands for, given directly by the resolver, not `getRelatedListConfig`.
+        const related = resolved?.isRelationship
+            ? getRelatedListConfig(resolved.fieldConfig.ref, config)
+            : !resolved
+                ? (() => {
+                    const synthetic = resolveSyntheticRelation?.(key, listName);
+                    return synthetic
+                        ? { listConfig: synthetic.listConfig, listName: synthetic.listName }
+                        : null;
+                })()
+                : null;
+        if (!related || value === null || typeof value !== 'object' || Array.isArray(value)) {
             result[key] = value;
             continue;
         }
@@ -321,8 +618,18 @@ listConfig, listName, config, args) {
                     nestedEntry[quantifier] = quantifierValue;
                     continue;
                 }
+                if (quantifierValue === null) {
+                    // `is: null` / `isNot: null` tests EXISTENCE of a to-one relation,
+                    // not its fields — there is nothing to read-check or scope, and
+                    // AND-folding the access filter in here would silently invert the
+                    // caller's predicate: `is: null` ("has no related row") would
+                    // become `is: <accessWhere>` ("has a related row matching the
+                    // filter"), the opposite of what was asked. Passed through as-is.
+                    nestedEntry[quantifier] = null;
+                    continue;
+                }
                 await walkWhereReadAccess(quantifierValue, related.listConfig, related.listName, args);
-                const scopedNested = await buildAccessScopedWhere(quantifierValue, related.listConfig, related.listName, config, args);
+                const scopedNested = await buildAccessScopedWhere(quantifierValue, related.listConfig, related.listName, config, args, resolveSyntheticRelation);
                 nestedEntry[quantifier] = accessWhere
                     ? andWhere(accessWhere, scopedNested)
                     : scopedNested;
@@ -336,7 +643,7 @@ listConfig, listName, config, args) {
             // (fully-allowed related list) is returned exactly as the caller wrote
             // it, so an already-permitted query is not perturbed by this pass.
             await walkWhereReadAccess(value, related.listConfig, related.listName, args);
-            const scopedNested = await buildAccessScopedWhere(value, related.listConfig, related.listName, config, args);
+            const scopedNested = await buildAccessScopedWhere(value, related.listConfig, related.listName, config, args, resolveSyntheticRelation);
             result[key] = accessWhere
                 ? { is: andWhere(accessWhere, scopedNested) }
                 : scopedNested;

package/dist/access/access-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAyD/C,oGAAoG;AACpG,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACrD,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IAC/C,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,OAAO,GAAG,OAAwC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IAC/C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAqBD,MAAM,UAAU,0BAA0B;IACxC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,IAA2B;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACxF,CAAC;AAED,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,WAAwB;IACnD,OAAO,CAAC,CAAC,MAAM,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,gBAAyC,EACzC,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,OAAe,EACf,KAAK,GAAW,CAAC;IAEjB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACnD,IAAI,KAAK,IAAI,sBAAsB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,kBAAkB,GAAG,0BAA0B,EAAE,CAAA;IAEvD,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAA;YACrC,SAAQ;QACV,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QAC7E,IAAI,CAAC,aAAa;YAAE,SAAQ;QAE5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAEhD,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;QACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,OAAO,EAAE,CAAC;gBACZ,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC/D,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;QAEpD,IAAI,aAAkD,CAAA;QACtD,IAAI,kBAAqD,CAAA;QACzD,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,cAAc,CAAC,OAAO,EACtB,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,QAAQ,EACtB,KAAK,GAAG,CAAC,CACV,CAAA;YACD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAC9B,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAA;QAChD,CAAC;QAED,MAAM,KAAK,GAAuB,EAAE,CAAA;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG;oBACzC,IAAI,EAAE,QAAQ;oBACd,eAAe,EAAE,aAAa,CAAC,QAAQ;oBACvC,WAAW;iBACZ,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;YAChE,IAAI,WAAW;gBAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;YAC1C,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;YACxE,IAAI,cAAc,EAAE,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAA;YACjF,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;QAC1E,CAAC;QACD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,aAAa,CAAA;QACzF,IAAI,kBAAkB,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5E,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAC9D,CAAC;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;AAChD,CAAC;AAWD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAyB,EACzB,IAA2B,EAC3B,IAGC;IAED,MAAM,QAAQ,GAAG,8BAA8B,EAAE,CAAA;IAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC1C,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAC/C,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;gBACxD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAE,KAAiC,CAAC,EAAE,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;YAC3D,SAAQ;QACV,CAAC;QAED,4IAA4I;QAC5I,MAAM,KAAK,GAAI,IAAI,CAAC,OAAO,CAAC,MAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;QAC3E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;YACvC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE;YAC7D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5F,CAAA;QACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;IAC9D,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAc,EAAE,CAAA;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAC/C,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;iBAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAc;AACd,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,MAAsB,EACtB,IAGC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CACxF,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YACrF,SAAQ;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1D,IACE,CAAC,QAAQ;YACT,CAAC,QAAQ,CAAC,cAAc;YACxB,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;QAC/D,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAA;QACxE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAEhF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,WAAW,GAA4B,EAAE,CAAA;YAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,eAAe,EAAE,CAAC;gBAC5D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,UAAU,CAAC,GAAG,eAAe,CAAA;oBACzC,SAAQ;gBACV,CAAC;gBACD,MAAM,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACtF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,eAAe,EACf,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,IAAI,CACL,CAAA;gBACD,WAAW,CAAC,UAAU,CAAC,GAAG,WAAW;oBACnC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAwC,CAAC;oBACjE,CAAC,CAAC,YAAY,CAAA;YAClB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAA;QAC3B,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC5E,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,KAAK,EACL,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,IAAI,CACL,CAAA;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW;gBACvB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAwC,CAAC,EAAE;gBACzE,CAAC,CAAC,YAAY,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAA;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAgH/C,oGAAoG;AACpG,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACrD,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IAC/C,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,OAAO,GAAG,OAAwC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IAC/C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAkCD,MAAM,UAAU,0BAA0B;IACxC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,IAA2B;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,OAAO,CAAC,CAAC,MAAM,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AAC9D,CAAC;AAoBD,MAAM,UAAU,0BAA0B;IACxC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,4BAA4B,CAAC,IAA2B;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,cAAuB,EACvB,YAAyC,EACzC,OAAe,EACf,MAAsB;IAEtB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAA4B,EAAE,CAAA;QAC5C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACpE,IAAI,yBAAyB,CAAC,WAAW,CAAC;gBAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;QACxE,CAAC;QACD,KAAK,MAAM,aAAa,IAAI,iCAAiC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/E,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAA;QAChC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,aAAa,CAAC,cAAc,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,cAAc,CAAC,MAAM,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,KAAK,UAAU,4BAA4B,CACzC,cAAuB,EACvB,YAAyC,EACzC,IAAyD,EACzD,MAAsB,EACtB,OAAe;IAEf,MAAM,eAAe,GAAG,oBAAoB,CAAC,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAE9D,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAChE,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,UAAU,KAAK,KAAK;YAAE,SAAQ;QAElC,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAA;QAE/D,qGAAqG;QACrG,IAAI,aAAa,GAA6D,IAAI,CAAA;QAClF,IAAI,gBAAgB,IAAI,WAAW,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YAC5D,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACvE,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG;oBACd,QAAQ,EAAE,SAAS,CAAC,cAAc;oBAClC,UAAU,EAAE,SAAS,CAAC,gBAAgB;iBACvC,CAAA;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,kEAAkE;YAClE,gEAAgE;YAChE,uCAAuC;YACvC,IAAI,gBAAgB;gBAAE,SAAQ;YAC9B,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACjD,CAAC;QAED,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,WAAW,GAAG,MAAM,8BAA8B,CACtD,aAAa,CAAC,UAAU,EACxB,IAAI,EACJ,WAAW,EAAE,MAAM,CACpB,CAAA;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,cAAc,GAClB,aAAa,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC;YAC1D,CAAC,CAAE,UAAU,CAAC,KAAiC;YAC/C,CAAC,CAAC,SAAS,CAAA;QAEf,IAAI,oBAAyD,CAAA;QAC7D,IAAI,cAAc,EAAE,CAAC;YACnB,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,wBAAwB,GAAG,CAC/B,YAAoB,EACpB,YAAoB,EACY,EAAE;gBAClC,MAAM,SAAS,GAAG,+BAA+B,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;gBACrF,OAAO,SAAS;oBACd,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,gBAAgB,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,EAAE;oBAChF,CAAC,CAAC,IAAI,CAAA;YACV,CAAC,CAAA;YACD,iBAAiB,CAAC;gBAChB,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,aAAa,CAAC,UAAU;gBACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM;gBACN,MAAM,EAAE,KAAK;gBACb,wBAAwB;aACzB,CAAC,CAAA;YACF,MAAM,4BAA4B,CAAC;gBACjC,KAAK,EAAE,cAAc;gBACrB,UAAU,EAAE,aAAa,CAAC,UAAU;gBACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;YACF,uEAAuE;YACvE,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,6DAA6D;YAC7D,sEAAsE;YACtE,mEAAmE;YACnE,+CAA+C;YAC/C,oBAAoB,GAAG,CAAC,MAAM,sBAAsB,CAClD,cAAc,EACd,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,QAAQ,EACtB,MAAM,EACN,IAAI,EACJ,wBAAwB,CACzB,CAAwC,CAAA;QAC3C,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAC1B,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAC7D,oBAAoB,CACrB,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAA;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,gBAAyC,EACzC,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,OAAe,EACf,KAAK,GAAW,CAAC;IAMjB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACnD,IAAI,KAAK,IAAI,sBAAsB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,kBAAkB,GAAG,0BAA0B,EAAE,CAAA;IACvD,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAA;IAEjD,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,sEAAsE;QACtE,0EAA0E;QAC1E,sDAAsD;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,oCAAoC;QACpC,IAAI,cAAc,KAAK,KAAK,IAAI,cAAc,KAAK,SAAS;YAAE,SAAQ;QAEtE,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,qGAAqG;QACrG,IAAI,aAAuE,CAAA;QAC3E,IAAI,OAAgB,CAAA;QAEpB,IAAI,sBAAsB,EAAE,CAAC;YAC3B,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YACvE,IAAI,CAAC,aAAa;gBAAE,SAAQ;YAC5B,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC5C,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAA;YACrC,SAAQ;QACV,CAAC;aAAM,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,CAC/D,cAAc,EACd,YAAY,EACZ,IAAI,EACJ,MAAM,EACN,OAAO,CACR,CAAA;YACD,IAAI,MAAM;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,CAAA;YAC7C,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC;gBAAE,YAAY,CAAC,IAAI,GAAG,UAAU,CAAA;YACvD,SAAQ;QACV,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,+BAA+B,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAChF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YAC5D,CAAC;YACD,aAAa,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAA;YAC9F,oEAAoE;YACpE,kEAAkE;YAClE,OAAO,GAAG,KAAK,CAAA;QACjB,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;QACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,uBAAuB;YACvB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC7D,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;QAEpD,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,wBAAwB,GAAG,CAC/B,GAAW,EACX,YAAoB,EACY,EAAE;YAClC,MAAM,SAAS,GAAG,+BAA+B,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;YAC5E,OAAO,SAAS;gBACd,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,gBAAgB,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,EAAE;gBAChF,CAAC,CAAC,IAAI,CAAA;QACV,CAAC,CAAA;QACD,iBAAiB,CAAC;YAChB,KAAK,EAAE,cAAc,EAAE,KAAK;YAC5B,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM;YACN,MAAM,EAAE,KAAK;YACb,wBAAwB;SACzB,CAAC,CAAA;QACF,MAAM,4BAA4B,CAAC;YACjC,KAAK,EAAE,cAAc,EAAE,KAAK;YAC5B,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QAEF,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,oBAAoB,GACxB,CAAC,OAAO,IAAI,cAAc,EAAE,KAAK,KAAK,SAAS;YAC7C,CAAC,CAAE,CAAC,MAAM,sBAAsB,CAC5B,cAAc,CAAC,KAAK,EACpB,aAAa,CAAC,UAAU,EACxB,aAAa,CAAC,QAAQ,EACtB,MAAM,EACN,IAAI,EACJ,wBAAwB,CACzB,CAAkB;YACrB,CAAC,CAAC,cAAc,EAAE,KAAK,CAAA;QAE3B,IAAI,aAAkD,CAAA;QACtD,IAAI,kBAAqD,CAAA;QACzD,IAAI,kBAAqD,CAAA;QACzD,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,cAAc,CAAC,OAAO,EACtB,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,QAAQ,EACtB,KAAK,GAAG,CAAC,CACV,CAAA;YACD,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAC9B,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAA;YAC9C,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAA;QAC1C,CAAC;QAED,MAAM,KAAK,GAAuB,EAAE,CAAA;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG;oBACzC,IAAI,EAAE,QAAQ;oBACd,eAAe,EAAE,aAAa,CAAC,QAAQ;oBACvC,WAAW;iBACZ,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;YAC/D,IAAI,WAAW;gBAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;YAC1C,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;YACxE,IAAI,cAAc,EAAE,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAA;YACjF,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;QAC1E,CAAC;QACD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,aAAa,CAAA;QACzF,IAAI,kBAAkB,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5E,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAC9D,CAAC;QACD,IAAI,kBAAkB,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QACxD,CAAC;QAED,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAA;AAC9D,CAAC;AAiBD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAyB,EACzB,IAA2B,EAC3B,IAGC;IAED,MAAM,QAAQ,GAAG,8BAA8B,EAAE,CAAA;IAEjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC1C,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAC/C,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;gBACxD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAE,KAAiC,CAAC,EAAE,CAAC,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;YAC3D,SAAQ;QACV,CAAC;QAED,4IAA4I;QAC5I,MAAM,KAAK,GAAI,IAAI,CAAC,OAAO,CAAC,MAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;QAC3E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;YACvC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE;YAC7D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5F,CAAA;QACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;IAC9D,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAc,EAAE,CAAA;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YAC/C,MAAM,KAAK,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;iBAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAc;AACd,qGAAqG;AACrG,UAA2B,EAC3B,QAAgB,EAChB,MAAsB,EACtB,IAGC;AACD,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,mCAAmC;AACnC,wBAAmD;IAEnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClB,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAC5F,CACF,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,CACxC,KAAK,EACL,UAAU,EACV,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,wBAAwB,CACzB,CAAA;YACD,SAAQ;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1D,mEAAmE;QACnE,kEAAkE;QAClE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,QAAQ,EAAE,cAAc;YACtC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;YACxD,CAAC,CAAC,CAAC,QAAQ;gBACT,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;oBAC3D,OAAO,SAAS;wBACd,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;wBACpE,CAAC,CAAC,IAAI,CAAA;gBACV,CAAC,CAAC,EAAE;gBACN,CAAC,CAAC,IAAI,CAAA;QAEV,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;QAC/D,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC5E,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAA;QACxE,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAEhF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,WAAW,GAA4B,EAAE,CAAA;YAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,eAAe,EAAE,CAAC;gBAC5D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,UAAU,CAAC,GAAG,eAAe,CAAA;oBACzC,SAAQ;gBACV,CAAC;gBACD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;oBAC7B,mEAAmE;oBACnE,gEAAgE;oBAChE,kEAAkE;oBAClE,8DAA8D;oBAC9D,8DAA8D;oBAC9D,kEAAkE;oBAClE,WAAW,CAAC,UAAU,CAAC,GAAG,IAAI,CAAA;oBAC9B,SAAQ;gBACV,CAAC;gBACD,MAAM,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBACtF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,eAAe,EACf,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,IAAI,EACJ,wBAAwB,CACzB,CAAA;gBACD,WAAW,CAAC,UAAU,CAAC,GAAG,WAAW;oBACnC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAwC,CAAC;oBACjE,CAAC,CAAC,YAAY,CAAA;YAClB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAA;QAC3B,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC5E,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,KAAK,EACL,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,IAAI,EACJ,wBAAwB,CACzB,CAAA;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW;gBACvB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAwC,CAAC,EAAE;gBACzE,CAAC,CAAC,YAAY,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}