@web-ts-toolkit/access-router 0.47.1 → 0.49.0

package/advanced.mjs

@@ -57,7 +57,8 @@ import {
   isPlainObject as isPlainObject9,
   isString as isString3,
   keys,
-  normalizeUrlPath
+  normalizeUrlPath,
+  set as set2
 } from "@web-ts-toolkit/utils";
 
 // src/helpers/query.ts
@@ -818,11 +819,11 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       }
       if (isBoolean(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       if (hasModelPermission(value, modelPermissionPrefix)) {
         modelPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       globalPermissionKeys[accessKey].push(schemaKey);
     }
@@ -843,6 +844,286 @@ var refreshPermissionMetadata = (target) => {
   target._globalPermissionKeys = globalPermissionKeys;
   target._modelPermissionKeys = modelPermissionKeys;
 };
+var VIRTUAL_SUPPORTED_ACCESSES = ["default", "list", "create", "read", "update"];
+var VIRTUAL_UNSUPPORTED_ACCESSES = ["delete", "distinct", "count"];
+var VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
+var VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+var isVirtualContainerValue = (value) => isPlainObject9(value) && "sub" in value;
+var virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
+var virtualPathsOverlap = (virtualPath, permissionField) => {
+  if (!virtualPath || !permissionField) return false;
+  try {
+    if (get2(set2({}, virtualPath, true), permissionField) !== void 0) return true;
+    if (get2(set2({}, permissionField, true), virtualPath) !== void 0) return true;
+  } catch {
+    return false;
+  }
+  return false;
+};
+var collectStoredTopLevel = (schema) => {
+  const fields = /* @__PURE__ */ new Set();
+  if (!schema) return fields;
+  const paths = schema.paths;
+  if (paths) {
+    for (const p of Object.keys(paths)) {
+      const top = p.split(".")[0];
+      if (top) fields.add(top);
+    }
+  }
+  const obj = schema.obj;
+  if (obj) {
+    for (const k of Object.keys(obj)) fields.add(k);
+  }
+  return fields;
+};
+var getChildSchemaForField = (parentSchema, fieldName) => {
+  if (!parentSchema) return null;
+  try {
+    const pathType = parentSchema.path?.(fieldName);
+    if (pathType && typeof pathType === "object") {
+      if (pathType.schema) return pathType.schema;
+      if (pathType.caster?.schema) return pathType.caster.schema;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+};
+var getNestedChildFields = (parentSchema, fieldName) => {
+  const fields = /* @__PURE__ */ new Set();
+  if (!parentSchema) return fields;
+  const paths = parentSchema.paths;
+  if (paths) {
+    const prefix = `${fieldName}.`;
+    for (const p of Object.keys(paths)) {
+      if (p.startsWith(prefix)) {
+        const rest = p.slice(prefix.length);
+        const top = rest.split(".")[0];
+        if (top) fields.add(top);
+      }
+    }
+  }
+  return fields;
+};
+var cloneVirtualsForValidation = (value) => {
+  if (Array.isArray(value)) return value.map((item) => cloneVirtualsForValidation(item));
+  if (!value || typeof value !== "object") return value;
+  if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([k, v]) => [k, cloneVirtualsForValidation(v)])
+  );
+};
+var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
+  if (dependsOn === void 0) return [];
+  if (!isArray4(dependsOn)) {
+    throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
+  }
+  const list = dependsOn;
+  for (const dep of list) {
+    if (!isString3(dep) || dep.length === 0) {
+      throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
+    }
+    if (dep.includes(".")) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" must be a top-level persisted name relative to its scope (dotted paths rejected)`
+      );
+    }
+    if (siblingVirtualNames.has(dep)) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" must not reference another virtual (virtual-to-virtual rejected)`
+      );
+    }
+    if (!storedFields.has(dep)) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" is not a persisted field in its scope (validated against the receiving Mongoose schema/child scope)`
+      );
+    }
+  }
+  return list;
+};
+var validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
+  if (isFunction(value)) return;
+  if (!isPlainObject9(value)) {
+    throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
+  }
+  const record = value;
+  if (!isFunction(record.get)) {
+    throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
+  }
+  validateVirtualDependsOn(record.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
+  for (const k of Object.keys(record)) {
+    if (k !== "get" && k !== "dependsOn") {
+      throw new Error(`Virtual ${entryLabel}: unsupported descriptor key "${k}" (expected only get/dependsOn)`);
+    }
+  }
+};
+var validateVirtualsScope = (scope, documentPermissionField) => {
+  const { scopeVirtuals, storedFields, scopePrefix, scopeLabel } = scope;
+  const leafNames = /* @__PURE__ */ new Set();
+  for (const [name, raw] of Object.entries(scopeVirtuals)) {
+    if (raw === void 0) continue;
+    if (isVirtualContainerValue(raw)) continue;
+    leafNames.add(name);
+  }
+  for (const [name, raw] of Object.entries(scopeVirtuals)) {
+    if (raw === void 0) continue;
+    if (name.includes(".")) {
+      throw new Error(`Virtual ${scopeLabel}${name}: dotted definition names are rejected (use sub scopes)`);
+    }
+    if (VIRTUAL_DANGEROUS_SEGMENTS.has(name) || VIRTUAL_RESERVED_NAMES.has(name) || name.startsWith("$") || !VIRTUAL_NAME_PATTERN.test(name)) {
+      throw new Error(`Virtual ${scopeLabel}${name}: "_id"/reserved internal paths are rejected`);
+    }
+    const fullPath = virtualFullPath(scopePrefix, name);
+    if (virtualPathsOverlap(fullPath, documentPermissionField)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: overlaps document permission field "${documentPermissionField}" (equal/ancestor/descendant rejected)`
+      );
+    }
+    if (isVirtualContainerValue(raw)) {
+      const record2 = raw;
+      const extra = Object.keys(record2).filter((k) => k !== "sub");
+      if (extra.length > 0) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
+        );
+      }
+      if (!isPlainObject9(record2.sub)) {
+        throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
+      }
+      continue;
+    }
+    if (storedFields.has(name)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
+      );
+    }
+    if (isFunction(raw)) continue;
+    if (!isPlainObject9(raw)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
+      );
+    }
+    const record = raw;
+    const hasGet = "get" in record;
+    const accessKeys = Object.keys(record).filter((k) => VIRTUAL_SUPPORTED_ACCESSES.includes(k));
+    const unsupported = Object.keys(record).filter(
+      (k) => k !== "get" && k !== "dependsOn" && k !== "sub" && !VIRTUAL_SUPPORTED_ACCESSES.includes(k)
+    );
+    for (const key of Object.keys(record)) {
+      if (VIRTUAL_UNSUPPORTED_ACCESSES.includes(key)) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: unsupported access "${key}" (supported: default + list/create/read/update; NOT delete/distinct/count)`
+        );
+      }
+    }
+    if (unsupported.length > 0) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported[0]}" (supported: default + list/create/read/update)`
+      );
+    }
+    if (hasGet) {
+      if (accessKeys.length > 0) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: cannot mix "get" with per-access keys (use either bare { get, dependsOn } or a per-access record)`
+        );
+      }
+      if ("sub" in record) {
+        throw new Error(`Virtual ${scopeLabel}${name}: cannot mix "get" with "sub" (leaf vs embedded container)`);
+      }
+      validateVirtualLeafValue(raw, `${scopeLabel}${name}`, storedFields, leafNames, void 0);
+      continue;
+    }
+    if (accessKeys.length > 0) {
+      if ("sub" in record) {
+        throw new Error(`Virtual ${scopeLabel}${name}: cannot mix per-access keys with "sub"`);
+      }
+      validateVirtualDependsOn(record.dependsOn, `${scopeLabel}${name}`, storedFields, leafNames);
+      for (const access of accessKeys) {
+        const leaf = record[access];
+        if (leaf === void 0) continue;
+        validateVirtualLeafValue(leaf, `${scopeLabel}${name}.${access}`, storedFields, leafNames, record.dependsOn);
+      }
+      continue;
+    }
+    throw new Error(
+      `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record with default/list/create/read/update)`
+    );
+  }
+};
+var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
+  if (virtuals === void 0 || virtuals === null) return;
+  if (!isPlainObject9(virtuals)) {
+    throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
+  }
+  const rootSchema = model?.schema ?? null;
+  const rootStored = collectStoredTopLevel(rootSchema);
+  const rootVirtuals = virtuals;
+  validateVirtualsScope(
+    { scopeVirtuals: rootVirtuals, storedFields: rootStored, scopePrefix: "", scopeLabel: "" },
+    documentPermissionField
+  );
+  const visitContainers = (currentVirtuals, currentSchema, currentPrefix) => {
+    for (const [containerName, raw] of Object.entries(currentVirtuals)) {
+      if (raw === void 0 || !isVirtualContainerValue(raw)) continue;
+      const record = raw;
+      const childSchema = getChildSchemaForField(currentSchema, containerName);
+      const nestedFields = getNestedChildFields(currentSchema, containerName);
+      const currentStored = collectStoredTopLevel(currentSchema);
+      if (!currentStored.has(containerName)) {
+        throw new Error(
+          `Virtual ${containerName}: scope-container "${containerName}" is not a persisted field in its scope`
+        );
+      }
+      const isEmbedded = childSchema !== null || nestedFields.size > 0;
+      if (!isEmbedded) {
+        throw new Error(
+          `Virtual ${containerName}: scope-container "${containerName}" must be an embedded field with a child scope`
+        );
+      }
+      const subStored = childSchema ? collectStoredTopLevel(childSchema) : nestedFields;
+      const subPrefix = currentPrefix ? `${currentPrefix}.${containerName}` : containerName;
+      const subVirtuals = record.sub ?? {};
+      validateVirtualsScope(
+        {
+          scopeVirtuals: subVirtuals,
+          storedFields: subStored,
+          scopePrefix: subPrefix,
+          scopeLabel: `${subPrefix}.sub.`
+        },
+        documentPermissionField
+      );
+      const nextSchema = childSchema;
+      visitContainers(subVirtuals, nextSchema, subPrefix);
+    }
+  };
+  visitContainers(rootVirtuals, rootSchema, "");
+};
+var getScopeVirtualsObject = (rootVirtuals, scopePath) => {
+  if (!rootVirtuals || !isPlainObject9(rootVirtuals)) return null;
+  if (!scopePath || scopePath.length === 0) return rootVirtuals;
+  let current = rootVirtuals;
+  for (let i = 0; i < scopePath.length; i += 2) {
+    const field = scopePath[i];
+    const subMarker = scopePath[i + 1];
+    if (!field || subMarker !== "sub") return null;
+    if (!isPlainObject9(current)) return null;
+    const container = current[field];
+    if (!isVirtualContainerValue(container)) return null;
+    current = container.sub;
+    if (!isPlainObject9(current)) return null;
+  }
+  return current;
+};
+var toVirtualDescriptor = (leaf, sharedDependsOn) => {
+  if (isFunction(leaf))
+    return { get: leaf, dependsOn: sharedDependsOn ?? [] };
+  if (!isPlainObject9(leaf)) return null;
+  const record = leaf;
+  if (!isFunction(record.get)) return null;
+  const dependsOn = record.dependsOn ?? sharedDependsOn ?? [];
+  return { get: record.get, dependsOn };
+};
 var AccessRuntime = class {
   constructor(options = {}) {
     this.globalOptions = new OptionsManager(
@@ -1080,10 +1361,46 @@ var AccessRuntime = class {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
+    const merged = { ...defaultOptions, ...currentModelOptions, ...options };
+    const model = this.getModelInstance(modelName);
+    const permissionField = merged.documentPermissionField ?? currentModelOptions.documentPermissionField ?? this.getDefaultModelOption("documentPermissionField") ?? "_permissions";
+    validateVirtualsTree(model, merged.virtuals, permissionField, modelName);
     manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
   }
   setModelOption(modelName, key, value) {
     const manager = this.getOrCreateModelOptions(modelName);
+    const keyStr = String(key);
+    if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
+      const model = this.getModelInstance(modelName);
+      const currentVirtuals = manager.get("virtuals");
+      const currentPermissionField = manager.get("documentPermissionField") ?? this.getDefaultModelOption("documentPermissionField") ?? "_permissions";
+      let proposedVirtuals = currentVirtuals;
+      let proposedPermissionField = currentPermissionField;
+      if (keyStr === "documentPermissionField") {
+        proposedPermissionField = value;
+      } else if (keyStr === "virtuals") {
+        proposedVirtuals = value;
+      } else {
+        const cloned = cloneVirtualsForValidation(currentVirtuals ?? {});
+        const nestedPath = keyStr.slice("virtuals.".length);
+        if (value === void 0) {
+          const segments = nestedPath.split(".");
+          let cursor = cloned;
+          for (let i = 0; i < segments.length - 1; i++) {
+            if (!isPlainObject9(cursor)) break;
+            cursor = cursor[segments[i]];
+          }
+          if (isPlainObject9(cursor)) {
+            delete cursor[segments[segments.length - 1]];
+          }
+          proposedVirtuals = cloned;
+        } else {
+          set2(cloned, nestedPath, value);
+          proposedVirtuals = cloned;
+        }
+      }
+      validateVirtualsTree(model, proposedVirtuals, proposedPermissionField, modelName);
+    }
     manager.set(key, value);
   }
   getModelOptions(modelName) {
@@ -1103,6 +1420,71 @@ var AccessRuntime = class {
     const defaultModelValue = this.getDefaultModelOption(key);
     return manager.get(key, defaultModelValue);
   }
+  /**
+   * List registered virtual leaf names for a scope (VIRT-01).
+   * Scope containers (`{ sub }`) are not leaves. Inapplicable names are
+   * still listed here; applicability is decided per-access by
+   * {@link resolveVirtualDescriptor}. Request-controlled include collisions
+   * are validated by VIRT-05, not guessed here.
+   */
+  getVirtualNames(modelName, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals) return [];
+    return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue(v)).map(([k]) => k);
+  }
+  /**
+   * Whether a field is a registered virtual leaf in a scope (VIRT-01).
+   * Inapplicable registered names stay virtual (never persisted), even when
+   * no getter applies for the current access. Containers and persisted
+   * fields return false.
+   */
+  isVirtualField(modelName, fieldName, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals || !(fieldName in scopeVirtuals)) return false;
+    const entry = scopeVirtuals[fieldName];
+    if (entry === void 0 || isVirtualContainerValue(entry)) return false;
+    return true;
+  }
+  /**
+   * Resolve an applicable virtual descriptor with exact → `.default` → bare
+   * semantics (VIRT-01, VIRT-00A D1/D5). Returns `undefined` when no getter
+   * applies for `access`. Crucially, an access-record object is NEVER
+   * interpreted as a getter descriptor when the access is absent: an
+   * inapplicable registered name stays virtual (excluded from persisted
+   * projections, write admission, and DB sort/filter/distinct).
+   * Shared record-level `dependsOn` is inherited when a leaf lacks its own.
+   */
+  resolveVirtualDescriptor(modelName, virtualName, access, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals || !(virtualName in scopeVirtuals)) return void 0;
+    const entry = scopeVirtuals[virtualName];
+    if (entry === void 0 || isVirtualContainerValue(entry)) return void 0;
+    if (isFunction(entry)) return { get: entry, dependsOn: [] };
+    if (!isPlainObject9(entry)) return void 0;
+    const record = entry;
+    if ("get" in record) {
+      const descriptor = toVirtualDescriptor(entry, void 0);
+      return descriptor ?? void 0;
+    }
+    const sharedDependsOn = record.dependsOn;
+    const exact = record[access];
+    if (exact !== void 0) {
+      const descriptor = toVirtualDescriptor(exact, sharedDependsOn);
+      if (descriptor) return descriptor;
+    }
+    const fallback = record.default;
+    if (fallback !== void 0) {
+      const descriptor = toVirtualDescriptor(fallback, sharedDependsOn);
+      if (descriptor) return descriptor;
+    }
+    return void 0;
+  }
   getModelNames() {
     return Object.keys(this.modelOptions);
   }
@@ -1401,6 +1783,7 @@ var sortSchema = z2.union([
   z2.array(z2.tuple([z2.string(), sortOrderSchema])),
   z2.null()
 ]);
+var populateAccessSchema = z2.enum(["list", "read"]);
 var populateSchema = z2.union([
   z2.string(),
   z2.array(
@@ -1410,7 +1793,7 @@ var populateSchema = z2.union([
         path: z2.string().min(1),
         select: projectionSchema.optional(),
         match: z2.unknown().optional(),
-        access: z2.enum(["list", "read"]).optional()
+        access: populateAccessSchema.optional()
       }).passthrough()
     ])
   ),
@@ -1418,7 +1801,7 @@ var populateSchema = z2.union([
     path: z2.string().min(1),
     select: projectionSchema.optional(),
     match: z2.unknown().optional(),
-    access: z2.enum(["list", "read"]).optional()
+    access: populateAccessSchema.optional()
   }).passthrough()
 ]);
 var subPopulateSchema = z2.union([
@@ -2082,23 +2465,32 @@ var listQuerySchema = z3.object({
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
   include_count: queryBooleanString.optional(),
-  include_extra_headers: queryBooleanString.optional()
+  include_extra_headers: queryBooleanString.optional(),
+  select: stringOrStringArray.optional(),
+  sort: z3.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
 }).passthrough();
 var createQuerySchema = z3.object({
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var readQuerySchema = z3.object({
   include_permissions: queryBooleanString.optional(),
-  try_list: queryBooleanString.optional()
+  include_field_permissions: queryBooleanString.optional(),
+  try_list: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var updateQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var upsertQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var listBodySchema = z3.object({
   filter: objectOrArraySchema.optional(),
@@ -2114,9 +2506,10 @@ var listBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     includeCount: z3.boolean().optional(),
     includeExtraHeaders: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
 var countBodySchema = z3.object({
@@ -2132,8 +2525,9 @@ var readFilterBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     tryList: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var readByIdBodySchema = z3.object({
@@ -2144,8 +2538,9 @@ var readByIdBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     tryList: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var advancedCreateBodySchema = z3.object({
@@ -2155,7 +2550,8 @@ var advancedCreateBodySchema = z3.object({
   tasks: tasksSchema.optional(),
   options: z3.object({
     includePermissions: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    includeFieldPermissions: z3.boolean().optional(),
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var createBodySchema = z3.union([
@@ -2171,7 +2567,8 @@ var advancedUpdateBodySchema = z3.object({
   options: z3.object({
     returningAll: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    includeFieldPermissions: z3.boolean().optional(),
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var upsertBodySchema = z3.record(z3.string(), z3.unknown());
@@ -2183,7 +2580,8 @@ var advancedUpsertBodySchema = z3.object({
   options: z3.object({
     returningAll: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
-    populateAccess: z3.unknown().optional()
+    includeFieldPermissions: z3.boolean().optional(),
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var distinctBodySchema = z3.object({
@@ -2253,8 +2651,9 @@ var rootModelListArgsSchema = z5.object({
 var rootModelListOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   includeCount: z5.boolean().optional(),
-  populateAccess: z5.unknown().optional(),
+  populateAccess: populateAccessSchema.optional(),
   lean: z5.boolean().optional()
 }).passthrough();
 var rootModelReadArgsSchema = z5.object({
@@ -2269,8 +2668,9 @@ var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
 var rootModelReadOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   tryList: z5.boolean().optional(),
-  populateAccess: z5.unknown().optional(),
+  populateAccess: populateAccessSchema.optional(),
   lean: z5.boolean().optional()
 }).passthrough();
 var rootModelCreateArgsSchema = z5.object({
@@ -2281,7 +2681,8 @@ var rootModelCreateArgsSchema = z5.object({
 var rootModelCreateOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
-  populateAccess: z5.unknown().optional()
+  includeFieldPermissions: z5.boolean().optional(),
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelUpdateArgsSchema = z5.object({
   select: projectionSchema.optional(),
@@ -2292,7 +2693,8 @@ var rootModelUpdateOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   returningAll: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
-  populateAccess: z5.unknown().optional()
+  includeFieldPermissions: z5.boolean().optional(),
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;
@@ -2323,7 +2725,8 @@ var rootModelNewArgsSchema = z5.object({
 }).passthrough();
 var rootModelNewOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
-  includePermissions: z5.boolean().optional()
+  includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional()
 }).passthrough();
 var rootModelQueryEntrySchema = z5.union([
   z5.object({