@baseplate-dev/plugin-auth 0.6.13 → 0.6.15

package/dist/web/assets/{dist-CtqdAorB.js → dist-DiQ4J8N0.js}

@@ -1,7 +1,7 @@
 import { t as __commonJSMin } from "./rolldown-runtime-FZ4Itg2g.js";
-import { q as stringifyPrettyStable } from "./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-BTSgZGcl.js";
+import { q as stringifyPrettyStable } from "./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-IL2CfUDN.js";
 import { n as __mf_0, t as __mfDefaultExport } from "./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare__zod__loadShare__.js-Do-7VDVw.js";
-import { $ as getTag, A as isPlainObject$1, B as int32ArrayTag, C as createPluginFieldMap, D as validationHintRegistry, E as CASE_VALIDATORS, F as dataViewTag, G as regexpTag, H as mapTag, I as dateTag, J as symbolTag, K as setTag, L as float32ArrayTag, M as arrayBufferTag, N as arrayTag, O as isEqual, P as booleanTag, Q as uint8ClampedArrayTag, R as float64ArrayTag, S as createFieldMapSpec, T as runInPluginContext, U as numberTag, V as int8ArrayTag, W as objectTag, X as uint32ArrayTag, Y as uint16ArrayTag, Z as uint8ArrayTag, _ as createRefContextSlot, a as featureEntityType, b as expressionParserSpec, c as createEntityType, d as definitionSchemaWithSlots, et as getSymbols, f as withPlaceholderSlots, g as withRef, h as withEnt, i as createFeaturesSchema, j as argumentsTag, k as isEqualsSameValueZero, l as createDefinitionSchemaParserContext, m as definitionDefaultRegistry, n as FeatureUtils, nt as createPluginSpec, o as featureNameSchema, p as withDefault, q as stringTag, r as createFeatureSchema, s as DefinitionEntityType, t as ModelUtils, tt as sortBy, u as definitionSchema, v as createRefContextSlotMap, w as getPluginContext, x as definitionRefRegistry, y as RefExpressionParser, z as int16ArrayTag } from "./model-utils-BDM6ILfO.js";
+import { $ as getTag, A as isPlainObject$1, B as int32ArrayTag, C as createPluginFieldMap, D as validationHintRegistry, E as CASE_VALIDATORS, F as dataViewTag, G as regexpTag, H as mapTag, I as dateTag, J as symbolTag, K as setTag, L as float32ArrayTag, M as arrayBufferTag, N as arrayTag, O as isEqual, P as booleanTag, Q as uint8ClampedArrayTag, R as float64ArrayTag, S as createFieldMapSpec, T as runInPluginContext, U as numberTag, V as int8ArrayTag, W as objectTag, X as uint32ArrayTag, Y as uint16ArrayTag, Z as uint8ArrayTag, _ as createRefContextSlot, a as featureEntityType, b as expressionParserSpec, c as createEntityType, d as definitionSchemaWithSlots, et as getSymbols, f as withPlaceholderSlots, g as withRef, h as withEnt, i as createFeaturesSchema, j as argumentsTag, k as isEqualsSameValueZero, l as createDefinitionSchemaParserContext, m as definitionDefaultRegistry, n as FeatureUtils, nt as createPluginSpec, o as featureNameSchema, p as withDefault, q as stringTag, r as createFeatureSchema, s as DefinitionEntityType, t as ModelUtils, tt as sortBy, u as definitionSchema, v as createRefContextSlotMap, w as getPluginContext, x as definitionRefRegistry, y as RefExpressionParser, z as int16ArrayTag } from "./model-utils-BoeoBppL.js";
 //#region ../../packages/utils/dist/arrays/assert-no-duplicates.js
 /**
 * Asserts that an array has no duplicate values based on an optional key function.
@@ -488,6 +488,17 @@ var ToposortUnknownNodeError = class extends Error {
 	}
 };
 //#endregion
+//#region ../../packages/utils/dist/toposort/node-index.js
+/**
+* Reads a node index that is in-bounds by construction, throwing if the graph
+* bookkeeping is corrupt rather than silently producing a wrong ordering.
+*/
+function atNodeIndex(items, index) {
+	const item = items[index];
+	if (item === void 0) throw new Error(`Toposort encountered an unknown node index: ${index}`);
+	return item;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/tinyqueue@3.0.0/node_modules/tinyqueue/index.js
 var TinyQueue = class {
 	constructor(data = [], compare = (a, b) => a < b ? -1 : a > b ? 1 : 0) {
@@ -564,7 +575,7 @@ function makeOutgoingEdges(nodes, edgeArr) {
 */
 function makeNodeInDegrees(outgoingEdgesMap, nodeLength) {
 	const nodeInDegrees = Array.from({ length: nodeLength }, () => 0);
-	for (const [, targets] of outgoingEdgesMap.entries()) for (const target of targets) nodeInDegrees[target]++;
+	for (const [, targets] of outgoingEdgesMap.entries()) for (const target of targets) nodeInDegrees[target] = atNodeIndex(nodeInDegrees, target) + 1;
 	return nodeInDegrees;
 }
 /**
@@ -591,7 +602,7 @@ function detectCycle(nodes, visited, edges) {
 	for (let i = 0; i < nodes.length; i++) if (!visited.has(i)) {
 		path.length = 0;
 		visitSet.clear();
-		if (dfs(i)) return path.map((idx) => nodes[idx]);
+		if (dfs(i)) return path.map((idx) => atNodeIndex(nodes, idx));
 	}
 	return [];
 }
@@ -607,7 +618,7 @@ function toposort(nodes, edges, options = {}) {
 	const { compareFunc } = options;
 	const outgoingEdgesMap = makeOutgoingEdges(new Map(nodes.map((node, index) => [node, index])), edges);
 	const nodeInDegrees = makeNodeInDegrees(outgoingEdgesMap, nodes.length);
-	const zeroInDegreeQueue = compareFunc ? new TinyQueue([], (a, b) => compareFunc(nodes[a], nodes[b])) : [];
+	const zeroInDegreeQueue = compareFunc ? new TinyQueue([], (a, b) => compareFunc(atNodeIndex(nodes, a), atNodeIndex(nodes, b))) : [];
 	for (const [i, nodeInDegree] of nodeInDegrees.entries()) if (nodeInDegree === 0) zeroInDegreeQueue.push(i);
 	const result = [];
 	const visited = /* @__PURE__ */ new Set();
@@ -615,11 +626,12 @@ function toposort(nodes, edges, options = {}) {
 		const current = zeroInDegreeQueue.pop();
 		if (current === void 0) break;
 		visited.add(current);
-		result.push(nodes[current]);
+		result.push(atNodeIndex(nodes, current));
 		const outgoingEdges = outgoingEdgesMap.get(current);
 		if (outgoingEdges) for (const target of outgoingEdges) {
-			nodeInDegrees[target]--;
-			if (nodeInDegrees[target] === 0) zeroInDegreeQueue.push(target);
+			const remainingInDegree = atNodeIndex(nodeInDegrees, target) - 1;
+			nodeInDegrees[target] = remainingInDegree;
+			if (remainingInDegree === 0) zeroInDegreeQueue.push(target);
 		}
 	}
 	if (result.length !== nodes.length) throw new ToposortCyclicalDependencyError(detectCycle(nodes, visited, outgoingEdgesMap));
@@ -1237,8 +1249,9 @@ function byId$2(projectDefinition, id) {
 }
 function getBackendApp(projectDefinition) {
 	const backendApps = projectDefinition.apps.filter((a) => a.type === "backend");
-	if (backendApps.length > 1 || backendApps.length === 0) throw new Error(`Only one backend app is supported and must exist`);
-	return backendApps[0];
+	const backendApp = backendApps[0];
+	if (backendApps.length > 1 || !backendApp) throw new Error(`Only one backend app is supported and must exist`);
+	return backendApp;
 }
 /**
 * Given an app config, get the relative directory of the app
@@ -1908,7 +1921,7 @@ function walkNode$1(schema, data, path, visitors, entityCtx) {
 			walkNode$1(children.right, data, path, visitors, entityCtx);
 			break;
 	}
-	for (let i = cleanups.length - 1; i >= 0; i--) cleanups[i]();
+	for (const cleanup of cleanups.toReversed()) cleanup();
 	if (entityRestore) entityRestore();
 }
 //#endregion
@@ -2182,7 +2195,9 @@ function resolveZodRefPayloadNames(payload, { skipReferenceNameResolution = fals
 		return entity.name;
 	}
 	for (const id of orderedEntities) {
-		const { nameResolver, ...rest } = entitiesById[id];
+		const entity = entitiesById[id];
+		if (!entity) throw new Error(`Could not find entity for id: ${id}`);
+		const { nameResolver, ...rest } = entity;
 		if (typeof nameResolver === "string") resolvedEntitiesById.set(rest.id, {
 			...rest,
 			name: nameResolver
@@ -2250,7 +2265,7 @@ function resolveReferencesToIds(payload) {
 	if (typeof data !== "object" || data === null) throw new TypeError("Data is not an object");
 	const entitiesById = groupBy$1(entities, (entity) => entity.id);
 	const duplicateEntityIds = Object.values(entitiesById).filter((e) => e.length > 1);
-	if (duplicateEntityIds.length > 0) throw new Error(`Found multiple duplicate entity IDs: ${duplicateEntityIds.map((ents) => `${ents[0].id} (${ents.map((e) => e.path.join(".")).join(",")})`).join(", ")}`);
+	if (duplicateEntityIds.length > 0) throw new Error(`Found multiple duplicate entity IDs: ${duplicateEntityIds.map((ents) => `${ents[0]?.id} (${ents.map((e) => e.path.join(".")).join(",")})`).join(", ")}`);
 	if (uniq(entities.map((e) => e.id)).length !== entities.length) throw new Error(`Found duplicate entity IDs`);
 	const entityTypes = uniq(entities.map((e) => e.type));
 	const entityTypeNames = uniq(entityTypes.map((t) => t.name));
@@ -3267,16 +3282,20 @@ var createAuthorizerRoleSchema = definitionSchemaWithSlots({ modelSlot: modelEnt
 	*/
 	name: VALIDATORS.CAMEL_CASE_STRING,
 	/**
-	* TypeScript expression that evaluates to a boolean.
+	* Authorization expression — a JS-like boolean DSL, not arbitrary
+	* TypeScript. See `.agents/authorization.md` for the full grammar.
 	*
-	* Available context variables:
-	* - `model` - The model instance being authorized
-	* - `userId` - The authenticated user's ID (implicit auth context)
-	* - `hasRole()` / `hasSomeRole()` - Role checking functions
+	* Available context:
+	* - `model.<field>` — the row being authorized (scalars and relations)
+	* - `userId` / `isAuthenticated` — the principal
+	* - `hasRole()` / `hasSomeRole()` — global roles, or role delegation
+	*   across a relation in the two-argument form
+	* - `exists()` / `all()` — quantify over a has-many relation
 	*
-	* @example 'model.id === userId'
-	* @example 'hasRole("admin")'
-	* @example 'model.authorId === userId || hasRole("admin")'
+	* @example 'model.userId === userId'
+	* @example "hasRole('admin')"
+	* @example "hasRole(model.blog, 'owner')"
+	* @example 'exists(model.members, { userId: userId })'
 	*/
 	expression: ctx.withExpression(authorizerExpressionRef, { model: modelSlot })
 }), {
@@ -8450,7 +8469,7 @@ function parseAuthorizerExpression(input) {
 	}
 	if (program.body.length !== 1) throw new AuthorizerExpressionParseError("Expression must be a single expression statement, e.g. model.id === auth.userId", 0, input.length);
 	const expressionStatement = program.body[0];
-	if (expressionStatement.type !== "ExpressionStatement") throw new AuthorizerExpressionParseError("Line must be an expression statement, e.g. model.id === auth.userId", expressionStatement);
+	if (expressionStatement?.type !== "ExpressionStatement") throw new AuthorizerExpressionParseError("Line must be an expression statement, e.g. model.id === auth.userId", expressionStatement);
 	const ast = convertNode(expressionStatement.expression);
 	return {
 		ast,
@@ -8560,7 +8579,7 @@ function parseModelRelationArg(arg, funcName) {
 function parseHasRoleArgs(node, funcName) {
 	if (node.arguments.length === 1) {
 		const arg = node.arguments[0];
-		if (arg.type !== "Literal" || typeof arg.value !== "string") throw new AuthorizerExpressionParseError(`${funcName} argument must be a string literal`, arg);
+		if (arg?.type !== "Literal" || typeof arg.value !== "string") throw new AuthorizerExpressionParseError(`${funcName} argument must be a string literal`, arg ?? node);
 		return {
 			type: "hasRole",
 			role: arg.value,
@@ -8572,7 +8591,7 @@ function parseHasRoleArgs(node, funcName) {
 		const relationArg = node.arguments[0];
 		const roleArg = node.arguments[1];
 		const relation = parseModelRelationArg(relationArg, funcName);
-		if (roleArg.type !== "Literal" || typeof roleArg.value !== "string") throw new AuthorizerExpressionParseError(`${funcName} second argument must be a string literal (role name)`, roleArg);
+		if (roleArg?.type !== "Literal" || typeof roleArg.value !== "string") throw new AuthorizerExpressionParseError(`${funcName} second argument must be a string literal (role name)`, roleArg ?? node);
 		return {
 			type: "nestedHasRole",
 			relationName: relation.relationName,
@@ -8646,7 +8665,7 @@ function parseRelationFilterArgs(node, operator, funcName) {
 	const relationArg = node.arguments[0];
 	const conditionsArg = node.arguments[1];
 	const relation = parseModelRelationArg(relationArg, funcName);
-	if (conditionsArg.type !== "ObjectExpression") throw new AuthorizerExpressionParseError(`${funcName} second argument must be an object literal (e.g., { userId: userId })`, conditionsArg);
+	if (conditionsArg?.type !== "ObjectExpression") throw new AuthorizerExpressionParseError(`${funcName} second argument must be an object literal (e.g., { userId: userId })`, conditionsArg ?? node);
 	if (conditionsArg.properties.length === 0) throw new AuthorizerExpressionParseError(`${funcName} conditions object must have at least one property`, conditionsArg);
 	const conditions = [];
 	for (const prop of conditionsArg.properties) {
@@ -8865,10 +8884,10 @@ function validateAuthorizerExpression(ast, modelContext, pluginStore, definition
 			});
 		},
 		hasSomeRole(node) {
-			for (let i = 0; i < node.roles.length; i++) {
-				const role = node.roles[i];
+			for (const [i, role] of node.roles.entries()) {
 				const start = node.rolesStart[i];
 				const end = node.rolesEnd[i];
+				if (start === void 0 || end === void 0) continue;
 				if (allRoleNames.has(role)) warnIfAutoAssignedRole(role, start, end);
 				else warnings.push({
 					message: `Role '${role}' is not defined in the project configuration. Available roles: ${[...allRoleNames].join(", ")}.`,
@@ -9085,6 +9104,7 @@ function buildModelExpressionContext(model, allModels) {
 */
 var AuthorizerExpressionParser = class extends RefExpressionParser {
 	name = "authorizer-expression";
+	description = "JS-like boolean DSL over `model.<field>`, `userId`, and `isAuthenticated` — e.g. `model.userId === userId`, `hasRole(model.blog, 'owner')`, `exists(model.members, { userId: userId })`. See .agents/authorization.md for the full grammar.";
 	/**
 	* Creates a Zod schema for validating expression strings.
 	* Requires a non-empty string value.
@@ -9199,13 +9219,15 @@ var AuthorizerExpressionParser = class extends RefExpressionParser {
 					const foreignModel = modelById.get(relation.modelRef);
 					if (foreignModel) {
 						const foreignRoleByName = new Map(foreignModel.authorizer.roles.map((r) => [r.name, r]));
-						for (let i = 0; i < node.roles.length; i++) {
-							const foreignRole = foreignRoleByName.get(node.roles[i]);
-							if (foreignRole) deps.push({
+						for (const [i, roleName] of node.roles.entries()) {
+							const foreignRole = foreignRoleByName.get(roleName);
+							const roleStart = node.rolesStart[i];
+							const roleEnd = node.rolesEnd[i];
+							if (foreignRole && roleStart !== void 0 && roleEnd !== void 0) deps.push({
 								entityType: modelAuthorizerRoleEntityType,
 								entityId: foreignRole.id,
-								start: node.rolesStart[i] + 1,
-								end: node.rolesEnd[i] - 1
+								start: roleStart + 1,
+								end: roleEnd - 1
 							});
 						}
 					}
@@ -9261,9 +9283,9 @@ var AuthorizerExpressionParser = class extends RefExpressionParser {
 		const modelPath = resolvedSlots.model;
 		for (let len = modelPath.length; len > 0; len--) {
 			let current = definition;
-			for (let i = 0; i < len; i++) {
+			for (const part of modelPath.slice(0, len)) {
 				if (current === null || current === void 0) break;
-				current = current[modelPath[i]];
+				current = current[part];
 			}
 			if (current !== null && current !== void 0 && typeof current === "object" && "name" in current && typeof current.name === "string") return current;
 		}
@@ -9551,21 +9573,7 @@ var createModelGraphqlSchema = definitionSchemaWithSlots({ modelSlot: modelEntit
 				type: modelAuthorizerRoleEntityType,
 				onDelete: "DELETE",
 				parentSlot: modelSlot
-			})), []),
-			/**
-			* Whether this field is exposed as a `where` filter operand
-			* when the model's list query has where filtering enabled.
-			* Opt-in: an author must explicitly choose which exposed
-			* fields are filterable.
-			*/
-			filterable: ctx.withDefault(__mf_0.boolean(), false),
-			/**
-			* Whether this field is exposed as an `orderBy` sort key
-			* when the model's list query has sorting enabled. Opt-in:
-			* an author must explicitly choose which exposed fields are
-			* sortable.
-			*/
-			sortable: ctx.withDefault(__mf_0.boolean(), false)
+			})), [])
 		})).apply(withByKeyMergeRule({ getKey: (item) => item.ref })).apply(withDefault([])),
 		localRelations: __mf_0.array(__mf_0.object({
 			ref: ctx.withRef({
@@ -9592,9 +9600,67 @@ var createModelGraphqlSchema = definitionSchemaWithSlots({ modelSlot: modelEntit
 				onDelete: "DELETE",
 				parentSlot: modelSlot
 			})), []),
-			paginated: ctx.withDefault(__mf_0.boolean(), false)
+			paginated: ctx.withDefault(__mf_0.boolean(), false),
+			orderable: ctx.withDefault(__mf_0.boolean(), false)
 		})).apply(withByKeyMergeRule({ getKey: (item) => item.ref })).apply(withDefault([]))
 	}), {}),
+	/**
+	* Sorting configuration shared by every surface that exposes an
+	* `orderBy` argument — the list and connection queries, and `orderable`
+	* list relations. Each surface opts in separately (`queries.orderBy.enabled`,
+	* `objectType.foreignRelations[].orderable`) but they all sort by the
+	* same fields.
+	*/
+	orderBy: ctx.withDefault(__mf_0.object({
+		/** Fields exposed as `orderBy` sort keys. */
+		fields: __mf_0.array(ctx.withRef({
+			type: modelScalarFieldEntityType,
+			onDelete: "DELETE_PARENT",
+			parentSlot: modelSlot
+		})).apply(withDefault([])),
+		/**
+		* Applied when a caller supplies no `orderBy`. Ordered, so multi-key
+		* defaults sort by the first entry first. Not restricted to
+		* `fields` — a model can default to a sort key it does not expose.
+		*/
+		defaultSort: __mf_0.array(__mf_0.object({
+			ref: ctx.withRef({
+				type: modelScalarFieldEntityType,
+				onDelete: "DELETE_PARENT",
+				parentSlot: modelSlot
+			}),
+			direction: ctx.withDefault(__mf_0.enum(["asc", "desc"]), "asc")
+		})).apply(withByKeyMergeRule({ getKey: (item) => item.ref })).apply(withDefault([]))
+	}), {}),
+	/**
+	* Filtering configuration for surfaces that expose a `where` argument —
+	* the list and connection queries (`queries.where.enabled`). Shaped like
+	* `orderBy` so relation-level filtering can reuse it.
+	*/
+	where: ctx.withDefault(__mf_0.object({ 
+	/** Fields exposed as `where` filter operands. */
+fields: __mf_0.array(ctx.withRef({
+		type: modelScalarFieldEntityType,
+		onDelete: "DELETE_PARENT",
+		parentSlot: modelSlot
+	})).apply(withDefault([])) }), {}),
+	/**
+	* Page-size limits shared by every paginated surface — the list query,
+	* the connection query, and paginated list relations. Both are optional;
+	* leaving them unset keeps the offset surfaces unbounded and lets the
+	* connection fall back to Pothos' own defaults (20 / 100). Setting only a
+	* max also applies it as the default, since the cap on an offset surface
+	* would otherwise be bypassed by omitting the argument.
+	*/
+	pagination: ctx.withDefault(__mf_0.object({
+		/** Page size applied when the caller requests no explicit size. */
+		defaultPageSize: __mf_0.number().int().positive().optional(),
+		/** Largest page a caller may request. */
+		maxPageSize: __mf_0.number().int().positive().optional()
+	}).refine(({ defaultPageSize, maxPageSize }) => defaultPageSize === void 0 || maxPageSize === void 0 || defaultPageSize <= maxPageSize, {
+		message: "Default page size cannot exceed max page size",
+		path: ["defaultPageSize"]
+	}), {}),
 	queries: ctx.withDefault(__mf_0.object({
 		globalRoles: createRoleArray(ctx),
 		instanceRoles: ctx.withDefault(__mf_0.array(ctx.withRef({
@@ -9603,13 +9669,23 @@ var createModelGraphqlSchema = definitionSchemaWithSlots({ modelSlot: modelEntit
 			parentSlot: modelSlot
 		})), []),
 		get: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
+		/** Offset pagination (`skip`/`take`). */
 		list: ctx.withDefault(__mf_0.object({
 			enabled: ctx.withDefault(__mf_0.boolean(), false),
-			count: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
-			connection: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
-			where: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
-			orderBy: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {})
-		}), {})
+			count: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {})
+		}), {}),
+		/**
+		* Cursor pagination (Relay connection). Independent of `list` — a
+		* model may expose either, both, or neither.
+		*/
+		connection: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
+		/**
+		* `where`/`orderBy` arguments, shared by the list and connection
+		* queries. The fields each may operate on live in the model-level
+		* `where.fields` / `orderBy.fields` lists.
+		*/
+		where: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
+		orderBy: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {})
 	}), {}),
 	mutations: ctx.withDefault(__mf_0.object({
 		create: ctx.withDefault(__mf_0.object({ enabled: ctx.withDefault(__mf_0.boolean(), false) }), {}),
@@ -10703,7 +10779,7 @@ var pluginMetadataSchema = __mf_0.object({
 function sortAndValidateMigrations(migrations, pluginKey) {
 	const sortedMigrations = [...migrations].toSorted((a, b) => a.version - b.version);
 	if (sortedMigrations.some((m) => m.version <= 0)) throw new Error(`All migrations for plugin ${pluginKey} must have a positive version`);
-	for (let i = 0; i < sortedMigrations.length - 1; i++) if (sortedMigrations[i].version === sortedMigrations[i + 1].version) throw new Error(`All migrations for plugin ${pluginKey} must have a unique version`);
+	for (const [i, migration] of sortedMigrations.slice(0, -1).entries()) if (migration.version === sortedMigrations[i + 1]?.version) throw new Error(`All migrations for plugin ${pluginKey} must have a unique version`);
 	return sortedMigrations;
 }
 /**
@@ -11150,7 +11226,7 @@ var EnumUtils = {
 function isScalarUnique(model, fieldId) {
 	const { primaryKeyFieldRefs } = model.model;
 	const { uniqueConstraints } = model.model;
-	return primaryKeyFieldRefs.length === 1 && primaryKeyFieldRefs.includes(fieldId) || uniqueConstraints.some((c) => c.fields.length === 1 && c.fields[0].fieldRef === fieldId);
+	return primaryKeyFieldRefs.length === 1 && primaryKeyFieldRefs.includes(fieldId) || uniqueConstraints.some((c) => c.fields.length === 1 && c.fields[0]?.fieldRef === fieldId);
 }
 function areScalarsUnique(model, fieldIds) {
 	const sortedFieldIds = [...fieldIds].toSorted();
@@ -11224,9 +11300,10 @@ function byId(projectDefinition, id) {
 }
 function byUniqueTypeOrThrow(projectDefinition, type) {
 	const config = projectDefinition.libraries.filter((lib) => lib.type === type);
-	if (config.length === 0) throw new Error(`Unable to find library with type ${type}`);
+	const library = config[0];
+	if (!library) throw new Error(`Unable to find library with type ${type}`);
 	if (config.length > 1) throw new Error(`Multiple libraries with type ${type} found and only one is expected (${config.map((lib) => lib.name).join(", ")})`);
-	return config[0];
+	return library;
 }
 /**
 * Given a library config, get the relative directory of the library
@@ -11482,7 +11559,7 @@ function walkNode(schema, path, visitors, visited) {
 			walkNode(children.right, path, visitors, visited);
 			break;
 	}
-	for (let i = cleanups.length - 1; i >= 0; i--) cleanups[i]();
+	for (const cleanup of cleanups.toReversed()) cleanup();
 	visited.delete(schema);
 }
 /**
@@ -11929,6 +12006,7 @@ function transformJsonPath(data, path, transformFn) {
 	const navigateAndTransform = (current, parts) => {
 		if (parts.length === 0) return transformFn(structuredClone(current));
 		const [currentPart, ...remainingParts] = parts;
+		if (currentPart === void 0) return transformFn(structuredClone(current));
 		if (currentPart === "*") {
 			if (!Array.isArray(current)) throw new TypeError(`Expected an array at ${pathParts.join(".")}`);
 			return current.map((item) => navigateAndTransform(item, remainingParts));
@@ -11949,7 +12027,7 @@ function renameObjectKeysTransform(renames) {
 	return (data) => {
 		if (data === null) return null;
 		if (typeof data !== "object") throw new TypeError(`Expected an object, got ${typeof data}`);
-		return Object.fromEntries(Object.entries(data).map(([key, value]) => [renames[key] || key, value]));
+		return Object.fromEntries(Object.entries(data).map(([key, value]) => [renames[key] ?? key, value]));
 	};
 }
 //#endregion
@@ -15188,10 +15266,13 @@ var migration012MigrateAuthConfig = createSchemaMigration({
 			version: "0.1.0",
 			config: auth0Config
 		});
-		else plugins[pluginIndex] = {
-			...plugins[pluginIndex],
-			config: auth0Config
-		};
+		else {
+			const existingPlugin = plugins[pluginIndex];
+			if (existingPlugin) plugins[pluginIndex] = {
+				...existingPlugin,
+				config: auth0Config
+			};
+		}
 		return {
 			...config,
 			auth: void 0,
@@ -15370,7 +15451,7 @@ var migration018CrudNameFieldRef = createSchemaMigration({
 				selectedField ??= model.model.fields[0];
 				return {
 					...section,
-					nameFieldRef: selectedField.name
+					nameFieldRef: selectedField?.name ?? ""
 				};
 			});
 			return {
@@ -15518,13 +15599,16 @@ var migration021MigrateBullmqToPlugin = createSchemaMigration({
 				version: "1.0.0",
 				config: { implementationPluginKey: "baseplate-dev_plugin-queue_bullmq" }
 			});
-			else plugins[queuePluginIndex] = {
-				...plugins[queuePluginIndex],
-				config: {
-					...plugins[queuePluginIndex].config,
-					implementationPluginKey: "baseplate-dev_plugin-queue_bullmq"
-				}
-			};
+			else {
+				const existingQueuePlugin = plugins[queuePluginIndex];
+				if (existingQueuePlugin) plugins[queuePluginIndex] = {
+					...existingQueuePlugin,
+					config: {
+						...existingQueuePlugin.config,
+						implementationPluginKey: "baseplate-dev_plugin-queue_bullmq"
+					}
+				};
+			}
 			if (plugins.findIndex((p) => p.id === bullmqPluginId) === -1) plugins.push({
 				id: bullmqPluginId,
 				name: "bullmq",
@@ -15959,6 +16043,101 @@ var migration031UuidDefaultGeneration = createSchemaMigration({
 //#region ../../packages/project-builder-lib/dist/migrations/migration-032-web-app-plugin-data.js
 var STORAGE_PLUGIN_KEY = "baseplate-dev_plugin-storage_storage";
 var NOTIFICATIONS_PLUGIN_KEY = "baseplate-dev_plugin-notifications_notifications";
+/**
+* Moves hardcoded per-app opt-in flags off the core web app config and into the
+* generic `pluginData[pluginKey]` bag introduced by the web app schema extension
+* point.
+*
+* - `includeUploadComponents` -> `pluginData['<storage>'].includeUploadComponents`
+* - `includeNotifications`    -> `pluginData['<notifications>'].includeNotifications`
+* - `includeAuth`             -> dropped (it was never read by any generator)
+*
+* Only `true` values are relocated so existing opt-ins are preserved; the flags
+* are always stripped from the core config.
+*/
+var migration032WebAppPluginData = createSchemaMigration({
+	version: 32,
+	name: "webAppPluginData",
+	description: "Move includeUploadComponents/includeNotifications into web app pluginData and drop includeAuth",
+	migrate: (config) => {
+		const apps = config.apps?.map((app) => {
+			if (app.type !== "web") return app;
+			const { includeAuth: _includeAuth, includeUploadComponents, includeNotifications, pluginData: existingPluginData, ...rest } = app;
+			const pluginData = { ...existingPluginData };
+			if (includeUploadComponents) pluginData[STORAGE_PLUGIN_KEY] = {
+				...pluginData[STORAGE_PLUGIN_KEY],
+				includeUploadComponents: true
+			};
+			if (includeNotifications) pluginData[NOTIFICATIONS_PLUGIN_KEY] = {
+				...pluginData[NOTIFICATIONS_PLUGIN_KEY],
+				includeNotifications: true
+			};
+			return Object.keys(pluginData).length > 0 ? {
+				...rest,
+				pluginData
+			} : rest;
+		});
+		return {
+			...config,
+			apps: apps ?? []
+		};
+	}
+});
+//#endregion
+//#region ../../packages/project-builder-lib/dist/migrations/migration-033-hoist-sort-filter-config.js
+/**
+* Hoists the per-field `sortable`/`filterable` flags off
+* `graphql.objectType.fields[]` into the shared `graphql.orderBy.fields` and
+* `graphql.where.fields` lists.
+*
+* Both flags gate vocabulary used by more than one surface — the list query and
+* `orderable` list relations — so they belong beside the other shared sort and
+* filter configuration rather than under the object type. The per-surface
+* enable switches (`queries.list.orderBy.enabled`, `queries.list.where.enabled`)
+* are unaffected.
+*/
+var migration033HoistSortFilterConfig = createSchemaMigration({
+	version: 33,
+	name: "hoistSortFilterConfig",
+	description: "Hoist sortable/filterable field flags into shared graphql.orderBy and graphql.where config",
+	migrate: (config) => {
+		if (!config.models) return config;
+		const refsWhere = (fields, key) => fields.filter((field) => field[key] === true).map((field) => field.ref).filter((ref) => ref !== void 0);
+		return {
+			...config,
+			models: config.models.map((model) => {
+				const { graphql } = model;
+				if (!graphql?.objectType?.fields) return model;
+				const { fields } = graphql.objectType;
+				return {
+					...model,
+					graphql: {
+						...graphql,
+						objectType: {
+							...graphql.objectType,
+							fields: fields.map((field) => omit(field, ["sortable", "filterable"]))
+						},
+						orderBy: {
+							...graphql.orderBy,
+							fields: refsWhere(fields, "sortable")
+						},
+						where: {
+							...graphql.where,
+							fields: refsWhere(fields, "filterable")
+						}
+					}
+				};
+			})
+		};
+	}
+});
+//#endregion
+//#region ../../packages/project-builder-lib/dist/migrations/migration-034-hoist-connection-config.js
+var HOISTED_KEYS = [
+	"connection",
+	"where",
+	"orderBy"
+];
 //#endregion
 //#region ../../packages/project-builder-lib/dist/migrations/index.js
 var SCHEMA_MIGRATIONS = [
@@ -15989,31 +16168,36 @@ var SCHEMA_MIGRATIONS = [
 	migration029AdminRoleAndAutoAssigned,
 	migration030RemoveThemeHoverColors,
 	migration031UuidDefaultGeneration,
+	migration032WebAppPluginData,
+	migration033HoistSortFilterConfig,
 	createSchemaMigration({
-		version: 32,
-		name: "webAppPluginData",
-		description: "Move includeUploadComponents/includeNotifications into web app pluginData and drop includeAuth",
+		version: 34,
+		name: "hoistConnectionConfig",
+		description: "Hoist connection, where, and orderBy toggles out of graphql.queries.list into graphql.queries",
 		migrate: (config) => {
-			const apps = config.apps?.map((app) => {
-				if (app.type !== "web") return app;
-				const { includeAuth: _includeAuth, includeUploadComponents, includeNotifications, pluginData: existingPluginData, ...rest } = app;
-				const pluginData = { ...existingPluginData };
-				if (includeUploadComponents) pluginData[STORAGE_PLUGIN_KEY] = {
-					...pluginData[STORAGE_PLUGIN_KEY],
-					includeUploadComponents: true
-				};
-				if (includeNotifications) pluginData[NOTIFICATIONS_PLUGIN_KEY] = {
-					...pluginData[NOTIFICATIONS_PLUGIN_KEY],
-					includeNotifications: true
-				};
-				return Object.keys(pluginData).length > 0 ? {
-					...rest,
-					pluginData
-				} : rest;
-			});
+			if (!config.models) return config;
 			return {
 				...config,
-				apps: apps ?? []
+				models: config.models.map((model) => {
+					const { graphql } = model;
+					const list = graphql?.queries?.list;
+					if (!graphql?.queries || !list) return model;
+					const hoisted = Object.fromEntries(HOISTED_KEYS.filter((key) => list[key] !== void 0).map((key) => [key, key === "connection" && list.enabled !== true ? {
+						...list[key],
+						enabled: false
+					} : list[key]]));
+					return {
+						...model,
+						graphql: {
+							...graphql,
+							queries: {
+								...graphql.queries,
+								...hoisted,
+								list: omit(list, HOISTED_KEYS)
+							}
+						}
+					};
+				})
 			};
 		}
 	})
@@ -17205,12 +17389,10 @@ function convertColorNameToOklch(color) {
 	const fixedColorMapping = FIXED_COLOR_MAPPINGS[color];
 	if (fixedColorMapping) return fixedColorMapping;
 	const colorComponents = color.split("-");
-	if (colorComponents.length === 2) {
-		const paletteName = colorComponents[0];
-		if (Object.prototype.hasOwnProperty.call(COLOR_PALETTES, paletteName)) {
-			const shade = COLOR_PALETTES[colorComponents[0]][colorComponents[1]];
-			if (shade) return shade;
-		}
+	const [paletteName, shadeName] = colorComponents;
+	if (colorComponents.length === 2 && paletteName !== void 0 && shadeName !== void 0 && Object.prototype.hasOwnProperty.call(COLOR_PALETTES, paletteName)) {
+		const shade = COLOR_PALETTES[paletteName][shadeName];
+		if (shade) return shade;
 	}
 	return color;
 }
@@ -17300,10 +17482,12 @@ var DefinitionDiffKeyedArrayField = class extends DefinitionDiffField {
 				case "add":
 					items.push(item);
 					break;
-				case "update":
-					if (index === -1) throw new Error(`Cannot apply patch. Item with key "${key}" not found.`);
-					items[index] = toMerged(items[index], item);
+				case "update": {
+					const existingItem = items[index];
+					if (index === -1 || !existingItem) throw new Error(`Cannot apply patch. Item with key "${key}" not found.`);
+					items[index] = toMerged(existingItem, item);
 					break;
+				}
 				case "remove":
 					if (index !== -1) items.splice(index, 1);
 					break;
@@ -17329,8 +17513,9 @@ var DefinitionDiffReplacementField = class extends DefinitionDiffField {
 		return [];
 	}
 	apply(current, diff) {
-		if (diff.length === 0) return current;
-		return diff[0].item;
+		const firstOperation = diff[0];
+		if (!firstOperation) return current;
+		return firstOperation.item;
 	}
 	getActionVerb(isNew) {
 		return isNew ? "set" : "replaced";
@@ -18265,4 +18450,4 @@ function generateDefaultTheme() {
 //#endregion
 export { AVAILABLE_FLAGS, AppUtils, AuthorizerExpressionParseError, AuthorizerExpressionParser, BUILT_IN_ADMIN_CRUD_ACTIONS, BUILT_IN_ADMIN_CRUD_COLUMNS, BUILT_IN_ADMIN_CRUD_INPUTS, BUILT_IN_TRANSFORMERS, COLOR_PALETTES, DEFAULT_APPS_FOLDER, DEFAULT_LIBRARIES_FOLDER, DefinitionDiffArrayIncludesField, DefinitionDiffKeyedArrayField, DefinitionDiffReplacementField, DefinitionEntityType, EnumUtils, FIXED_COLOR_MAPPINGS, FeatureUtils, LibraryCompiler, LibraryUtils, ModelFieldUtils, ModelTransformerUtils, ModelUtils, PALETTE_SHADES, PackageCompiler, PluginSpecStore, PluginUtils, ProjectDefinitionContainer, REFERENTIAL_ACTIONS, RefExpressionParser, SCALAR_FIELD_TYPES, SCHEMA_MIGRATIONS, SchemaMigrationError, THEME_COLORS, THEME_COLOR_KEYS, VALIDATORS, adminCrudActionCompilerSpec, adminCrudActionEntityType, adminCrudActionSpec, adminCrudColumnCompilerSpec, adminCrudColumnEntityType, adminCrudColumnSpec, adminCrudEmbeddedFormEntityType, adminCrudEmbeddedInputType, adminCrudEmbeddedLocalInputType, adminCrudInputCompilerSpec, adminCrudInputEntityType, adminCrudInputSpec, adminCrudSectionColumnEntityType, adminSectionEntityType, appCompilerSpec, appEntityType, applyDefinitionDiff, applyDefinitionFixes, applyExpressionRenames, applyMergedDefinition, assignEntityIds, authConfigSpec, authModelsSpec, authRoleEntityType, backendAppEntryType, baseAdminCrudActionSchema, baseAdminCrudColumnSchema, baseAdminCrudInputSchema, baseAppSchema, baseAppValidators, baseLibrarySchema, baseLibraryValidators, basePluginDefinitionSchema, baseTransformerFields, baseTransformerSchema, buildEnabledPluginFqnSet, buildModelExpressionContext, buildPackageName, checkUniqueField, checkUniqueFieldValue, cleanDefaultValues, collectDefinitionIssues, collectEntityArrays, collectEntityMetadata, collectExpressionIssues, collectFieldIssues, convertColorNameToOklch, convertHexToOklch, convertOklchToColorName, convertOklchToHex, createAdminAppSchema, createAdminCrudActionSchema, createAdminCrudActionType, createAdminCrudColumnCompiler, createAdminCrudColumnSchema, createAdminCrudColumnType, createAdminCrudDeleteActionSchema, createAdminCrudEditActionSchema, createAdminCrudEmbeddedFormSchema, createAdminCrudEmbeddedInputSchema, createAdminCrudEmbeddedLocalInputSchema, createAdminCrudEnumInputSchema, createAdminCrudForeignColumnSchema, createAdminCrudForeignInputSchema, createAdminCrudInputSchema, createAdminCrudInputType, createAdminCrudPasswordInputSchema, createAdminCrudSectionSchema, createAdminCrudTextColumnSchema, createAdminCrudTextInputSchema, createAppCompiler, createAppEntryType, createAppSchema, createAuthorizerRoleSchema, createBackendAppSchema, createBaseAdminSectionValidators, createDefinitionDiff, createDefinitionDiffConfig, createDefinitionEntityNameResolver, createDefinitionSchemaParserContext, createEmbeddedRelationTransformerSchema, createEntity, createEntityIssue, createEntityType, createEnumBaseSchema, createEnumSchema, createEnumValueSchema, createExpressionParserRef, createFeatureSchema, createFeaturesSchema, createFieldMapSpec, createIssueFixSetter, createLibraryWebConfig, createModelAuthorizerSchema, createModelBaseSchema, createModelGraphqlSchema, createModelIndexSchema, createModelRelationFieldSchema, createModelScalarFieldSchema, createModelSchema, createModelServiceSchema, createModelTransformerType, createModelUniqueConstraintSchema, createPluginFieldMap, createPluginImplementationStoreWithNewPlugins, createPluginModelSyncChecker, createPluginModule, createPluginSpec, createPluginSpecStore, createPluginWithConfigSchema, createPluginsSchema, createProjectDefinitionSchema, createProjectDefinitionSchemaWithContext, createRefContextSlot, createRefContextSlotMap, createRefSchemaCollector, createRefSchemaVisitor, createSettingsSchema, createTemplateExtractorSchema, createThemeSchema, createTransformerSchema, createWebAdminSectionSchema, createWebAppSchema, definitionFieldIssueRegistry, definitionFixRegistry, definitionIssueCheckerSpec, definitionRefRegistry, definitionSchema, definitionSchemaWithSlots, deleteEntity, deserializeSchemaWithTransformedReferences, diffDefinition, diffSerializedDefinitions, expressionParserCoreModule, expressionParserSpec, extractDefinitionRefs, featureEntityType, featureNameSchema, findDiscriminatedUnionMatch, findOrphanedUnionItems, fixDefinitionRefs, fixRefDeletions, formatOklch, generalSettingsSchema, generateCssBlockFromThemeColors, generateCssFromThemeConfig, generateDefaultTheme, generateThemeColorsFromShade, getBackendRelativePath, getDefaultThemeColorFromShade, getEntity, getEntityName, getLatestMigrationVersion, getManagedPluginsForPlugin, getMergeRule, getPackageDirectory, getPluginContext, getPluginDependencies, getPluginMetadataByKey, getPluginMetadataByKeyOrThrow, getUnmetPluginDependencies, getWebAppPluginData, infrastructureSettingsSchema, initializePlugins, isMigrateableProjectDefinition, libraryEntityType, libraryTypeSpec, listEntities, mergeDataWithSchema, mergeDefinition, mergeDefinitionContainer, modelAuthorizerRoleEntityType, modelEntityType, modelEnumEntityType, modelEnumValueEntityType, modelForeignRelationEntityType, modelIndexEntityType, modelLocalRelationEntityType, modelScalarFieldEntityType, modelTransformerCompilerSpec, modelTransformerEntityType, modelTransformerSpec, modelUniqueConstraintEntityType, monorepoSettingsSchema, nodeLibraryDefinitionSchemaEntry, normalizeOklch, oklchColor, paletteSchema, palettesSchema, parseAuthorizerExpression, parseOklch, parseProjectDefinitionWithContext, parseProjectDefinitionWithReferences, partitionIssuesBySeverity, patchEntity, pluginAppCompiler, pluginConfigSpec, pluginDefaultsSpec, pluginDependencySchema, pluginEntityType, pluginMetadataSchema, pluginSpecDependencySchema, pluginSpecSupportSchema, previewIssueFix, resolveIssuePath, rootCompilerSpec, runInPluginContext, runPluginMigrations, runSchemaMigrations, serializeSchema, serializeSchemaFromRefPayload, sortEntityArrays, stripEmptyGeneratorChildren, stripUndefinedValues, themeColorSchema, transformDataWithSchema, undefinedIfEmpty, undefinedIfFalsy, updateEntity, validateAuthorizerExpression, validatePluginDependencyGraph, visitAuthorizerExpression, walkDataWithSchema, walkSchemaStructure, webAppEntryType, webAppSchemaExtensionSpec, webConfigSpec, withByKeyMergeRule, withDefault, withEnt, withFix, withIssueChecker, withMergeRule, withPlaceholderSlots, withRef };
 
-//# sourceMappingURL=dist-CtqdAorB.js.map
+//# sourceMappingURL=dist-DiQ4J8N0.js.map