@web-ts-toolkit/access-router 0.48.0 → 0.49.0

package/advanced.js

@@ -913,6 +913,286 @@ var refreshPermissionMetadata = (target) => {
   target._globalPermissionKeys = globalPermissionKeys;
   target._modelPermissionKeys = modelPermissionKeys;
 };
+var VIRTUAL_SUPPORTED_ACCESSES = ["default", "list", "create", "read", "update"];
+var VIRTUAL_UNSUPPORTED_ACCESSES = ["delete", "distinct", "count"];
+var VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
+var VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+var isVirtualContainerValue = (value) => (0, import_utils8.isPlainObject)(value) && "sub" in value;
+var virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
+var virtualPathsOverlap = (virtualPath, permissionField) => {
+  if (!virtualPath || !permissionField) return false;
+  try {
+    if ((0, import_utils8.get)((0, import_utils8.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+    if ((0, import_utils8.get)((0, import_utils8.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+  } catch {
+    return false;
+  }
+  return false;
+};
+var collectStoredTopLevel = (schema) => {
+  const fields = /* @__PURE__ */ new Set();
+  if (!schema) return fields;
+  const paths = schema.paths;
+  if (paths) {
+    for (const p of Object.keys(paths)) {
+      const top = p.split(".")[0];
+      if (top) fields.add(top);
+    }
+  }
+  const obj = schema.obj;
+  if (obj) {
+    for (const k of Object.keys(obj)) fields.add(k);
+  }
+  return fields;
+};
+var getChildSchemaForField = (parentSchema, fieldName) => {
+  if (!parentSchema) return null;
+  try {
+    const pathType = parentSchema.path?.(fieldName);
+    if (pathType && typeof pathType === "object") {
+      if (pathType.schema) return pathType.schema;
+      if (pathType.caster?.schema) return pathType.caster.schema;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+};
+var getNestedChildFields = (parentSchema, fieldName) => {
+  const fields = /* @__PURE__ */ new Set();
+  if (!parentSchema) return fields;
+  const paths = parentSchema.paths;
+  if (paths) {
+    const prefix = `${fieldName}.`;
+    for (const p of Object.keys(paths)) {
+      if (p.startsWith(prefix)) {
+        const rest = p.slice(prefix.length);
+        const top = rest.split(".")[0];
+        if (top) fields.add(top);
+      }
+    }
+  }
+  return fields;
+};
+var cloneVirtualsForValidation = (value) => {
+  if (Array.isArray(value)) return value.map((item) => cloneVirtualsForValidation(item));
+  if (!value || typeof value !== "object") return value;
+  if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([k, v]) => [k, cloneVirtualsForValidation(v)])
+  );
+};
+var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
+  if (dependsOn === void 0) return [];
+  if (!(0, import_utils8.isArray)(dependsOn)) {
+    throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
+  }
+  const list = dependsOn;
+  for (const dep of list) {
+    if (!(0, import_utils8.isString)(dep) || dep.length === 0) {
+      throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
+    }
+    if (dep.includes(".")) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" must be a top-level persisted name relative to its scope (dotted paths rejected)`
+      );
+    }
+    if (siblingVirtualNames.has(dep)) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" must not reference another virtual (virtual-to-virtual rejected)`
+      );
+    }
+    if (!storedFields.has(dep)) {
+      throw new Error(
+        `Virtual ${entryLabel}: dependsOn "${dep}" is not a persisted field in its scope (validated against the receiving Mongoose schema/child scope)`
+      );
+    }
+  }
+  return list;
+};
+var validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
+  if ((0, import_utils8.isFunction)(value)) return;
+  if (!(0, import_utils8.isPlainObject)(value)) {
+    throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
+  }
+  const record = value;
+  if (!(0, import_utils8.isFunction)(record.get)) {
+    throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
+  }
+  validateVirtualDependsOn(record.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
+  for (const k of Object.keys(record)) {
+    if (k !== "get" && k !== "dependsOn") {
+      throw new Error(`Virtual ${entryLabel}: unsupported descriptor key "${k}" (expected only get/dependsOn)`);
+    }
+  }
+};
+var validateVirtualsScope = (scope, documentPermissionField) => {
+  const { scopeVirtuals, storedFields, scopePrefix, scopeLabel } = scope;
+  const leafNames = /* @__PURE__ */ new Set();
+  for (const [name, raw] of Object.entries(scopeVirtuals)) {
+    if (raw === void 0) continue;
+    if (isVirtualContainerValue(raw)) continue;
+    leafNames.add(name);
+  }
+  for (const [name, raw] of Object.entries(scopeVirtuals)) {
+    if (raw === void 0) continue;
+    if (name.includes(".")) {
+      throw new Error(`Virtual ${scopeLabel}${name}: dotted definition names are rejected (use sub scopes)`);
+    }
+    if (VIRTUAL_DANGEROUS_SEGMENTS.has(name) || VIRTUAL_RESERVED_NAMES.has(name) || name.startsWith("$") || !VIRTUAL_NAME_PATTERN.test(name)) {
+      throw new Error(`Virtual ${scopeLabel}${name}: "_id"/reserved internal paths are rejected`);
+    }
+    const fullPath = virtualFullPath(scopePrefix, name);
+    if (virtualPathsOverlap(fullPath, documentPermissionField)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: overlaps document permission field "${documentPermissionField}" (equal/ancestor/descendant rejected)`
+      );
+    }
+    if (isVirtualContainerValue(raw)) {
+      const record2 = raw;
+      const extra = Object.keys(record2).filter((k) => k !== "sub");
+      if (extra.length > 0) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
+        );
+      }
+      if (!(0, import_utils8.isPlainObject)(record2.sub)) {
+        throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
+      }
+      continue;
+    }
+    if (storedFields.has(name)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
+      );
+    }
+    if ((0, import_utils8.isFunction)(raw)) continue;
+    if (!(0, import_utils8.isPlainObject)(raw)) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
+      );
+    }
+    const record = raw;
+    const hasGet = "get" in record;
+    const accessKeys = Object.keys(record).filter((k) => VIRTUAL_SUPPORTED_ACCESSES.includes(k));
+    const unsupported = Object.keys(record).filter(
+      (k) => k !== "get" && k !== "dependsOn" && k !== "sub" && !VIRTUAL_SUPPORTED_ACCESSES.includes(k)
+    );
+    for (const key of Object.keys(record)) {
+      if (VIRTUAL_UNSUPPORTED_ACCESSES.includes(key)) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: unsupported access "${key}" (supported: default + list/create/read/update; NOT delete/distinct/count)`
+        );
+      }
+    }
+    if (unsupported.length > 0) {
+      throw new Error(
+        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported[0]}" (supported: default + list/create/read/update)`
+      );
+    }
+    if (hasGet) {
+      if (accessKeys.length > 0) {
+        throw new Error(
+          `Virtual ${scopeLabel}${name}: cannot mix "get" with per-access keys (use either bare { get, dependsOn } or a per-access record)`
+        );
+      }
+      if ("sub" in record) {
+        throw new Error(`Virtual ${scopeLabel}${name}: cannot mix "get" with "sub" (leaf vs embedded container)`);
+      }
+      validateVirtualLeafValue(raw, `${scopeLabel}${name}`, storedFields, leafNames, void 0);
+      continue;
+    }
+    if (accessKeys.length > 0) {
+      if ("sub" in record) {
+        throw new Error(`Virtual ${scopeLabel}${name}: cannot mix per-access keys with "sub"`);
+      }
+      validateVirtualDependsOn(record.dependsOn, `${scopeLabel}${name}`, storedFields, leafNames);
+      for (const access of accessKeys) {
+        const leaf = record[access];
+        if (leaf === void 0) continue;
+        validateVirtualLeafValue(leaf, `${scopeLabel}${name}.${access}`, storedFields, leafNames, record.dependsOn);
+      }
+      continue;
+    }
+    throw new Error(
+      `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record with default/list/create/read/update)`
+    );
+  }
+};
+var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
+  if (virtuals === void 0 || virtuals === null) return;
+  if (!(0, import_utils8.isPlainObject)(virtuals)) {
+    throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
+  }
+  const rootSchema = model?.schema ?? null;
+  const rootStored = collectStoredTopLevel(rootSchema);
+  const rootVirtuals = virtuals;
+  validateVirtualsScope(
+    { scopeVirtuals: rootVirtuals, storedFields: rootStored, scopePrefix: "", scopeLabel: "" },
+    documentPermissionField
+  );
+  const visitContainers = (currentVirtuals, currentSchema, currentPrefix) => {
+    for (const [containerName, raw] of Object.entries(currentVirtuals)) {
+      if (raw === void 0 || !isVirtualContainerValue(raw)) continue;
+      const record = raw;
+      const childSchema = getChildSchemaForField(currentSchema, containerName);
+      const nestedFields = getNestedChildFields(currentSchema, containerName);
+      const currentStored = collectStoredTopLevel(currentSchema);
+      if (!currentStored.has(containerName)) {
+        throw new Error(
+          `Virtual ${containerName}: scope-container "${containerName}" is not a persisted field in its scope`
+        );
+      }
+      const isEmbedded = childSchema !== null || nestedFields.size > 0;
+      if (!isEmbedded) {
+        throw new Error(
+          `Virtual ${containerName}: scope-container "${containerName}" must be an embedded field with a child scope`
+        );
+      }
+      const subStored = childSchema ? collectStoredTopLevel(childSchema) : nestedFields;
+      const subPrefix = currentPrefix ? `${currentPrefix}.${containerName}` : containerName;
+      const subVirtuals = record.sub ?? {};
+      validateVirtualsScope(
+        {
+          scopeVirtuals: subVirtuals,
+          storedFields: subStored,
+          scopePrefix: subPrefix,
+          scopeLabel: `${subPrefix}.sub.`
+        },
+        documentPermissionField
+      );
+      const nextSchema = childSchema;
+      visitContainers(subVirtuals, nextSchema, subPrefix);
+    }
+  };
+  visitContainers(rootVirtuals, rootSchema, "");
+};
+var getScopeVirtualsObject = (rootVirtuals, scopePath) => {
+  if (!rootVirtuals || !(0, import_utils8.isPlainObject)(rootVirtuals)) return null;
+  if (!scopePath || scopePath.length === 0) return rootVirtuals;
+  let current = rootVirtuals;
+  for (let i = 0; i < scopePath.length; i += 2) {
+    const field = scopePath[i];
+    const subMarker = scopePath[i + 1];
+    if (!field || subMarker !== "sub") return null;
+    if (!(0, import_utils8.isPlainObject)(current)) return null;
+    const container = current[field];
+    if (!isVirtualContainerValue(container)) return null;
+    current = container.sub;
+    if (!(0, import_utils8.isPlainObject)(current)) return null;
+  }
+  return current;
+};
+var toVirtualDescriptor = (leaf, sharedDependsOn) => {
+  if ((0, import_utils8.isFunction)(leaf))
+    return { get: leaf, dependsOn: sharedDependsOn ?? [] };
+  if (!(0, import_utils8.isPlainObject)(leaf)) return null;
+  const record = leaf;
+  if (!(0, import_utils8.isFunction)(record.get)) return null;
+  const dependsOn = record.dependsOn ?? sharedDependsOn ?? [];
+  return { get: record.get, dependsOn };
+};
 var AccessRuntime = class {
   constructor(options = {}) {
     this.globalOptions = new OptionsManager(
@@ -1150,10 +1430,46 @@ var AccessRuntime = class {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
+    const merged = { ...defaultOptions, ...currentModelOptions, ...options };
+    const model = this.getModelInstance(modelName);
+    const permissionField = merged.documentPermissionField ?? currentModelOptions.documentPermissionField ?? this.getDefaultModelOption("documentPermissionField") ?? "_permissions";
+    validateVirtualsTree(model, merged.virtuals, permissionField, modelName);
     manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
   }
   setModelOption(modelName, key, value) {
     const manager = this.getOrCreateModelOptions(modelName);
+    const keyStr = String(key);
+    if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
+      const model = this.getModelInstance(modelName);
+      const currentVirtuals = manager.get("virtuals");
+      const currentPermissionField = manager.get("documentPermissionField") ?? this.getDefaultModelOption("documentPermissionField") ?? "_permissions";
+      let proposedVirtuals = currentVirtuals;
+      let proposedPermissionField = currentPermissionField;
+      if (keyStr === "documentPermissionField") {
+        proposedPermissionField = value;
+      } else if (keyStr === "virtuals") {
+        proposedVirtuals = value;
+      } else {
+        const cloned = cloneVirtualsForValidation(currentVirtuals ?? {});
+        const nestedPath = keyStr.slice("virtuals.".length);
+        if (value === void 0) {
+          const segments = nestedPath.split(".");
+          let cursor = cloned;
+          for (let i = 0; i < segments.length - 1; i++) {
+            if (!(0, import_utils8.isPlainObject)(cursor)) break;
+            cursor = cursor[segments[i]];
+          }
+          if ((0, import_utils8.isPlainObject)(cursor)) {
+            delete cursor[segments[segments.length - 1]];
+          }
+          proposedVirtuals = cloned;
+        } else {
+          (0, import_utils8.set)(cloned, nestedPath, value);
+          proposedVirtuals = cloned;
+        }
+      }
+      validateVirtualsTree(model, proposedVirtuals, proposedPermissionField, modelName);
+    }
     manager.set(key, value);
   }
   getModelOptions(modelName) {
@@ -1173,6 +1489,71 @@ var AccessRuntime = class {
     const defaultModelValue = this.getDefaultModelOption(key);
     return manager.get(key, defaultModelValue);
   }
+  /**
+   * List registered virtual leaf names for a scope (VIRT-01).
+   * Scope containers (`{ sub }`) are not leaves. Inapplicable names are
+   * still listed here; applicability is decided per-access by
+   * {@link resolveVirtualDescriptor}. Request-controlled include collisions
+   * are validated by VIRT-05, not guessed here.
+   */
+  getVirtualNames(modelName, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals) return [];
+    return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue(v)).map(([k]) => k);
+  }
+  /**
+   * Whether a field is a registered virtual leaf in a scope (VIRT-01).
+   * Inapplicable registered names stay virtual (never persisted), even when
+   * no getter applies for the current access. Containers and persisted
+   * fields return false.
+   */
+  isVirtualField(modelName, fieldName, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals || !(fieldName in scopeVirtuals)) return false;
+    const entry = scopeVirtuals[fieldName];
+    if (entry === void 0 || isVirtualContainerValue(entry)) return false;
+    return true;
+  }
+  /**
+   * Resolve an applicable virtual descriptor with exact → `.default` → bare
+   * semantics (VIRT-01, VIRT-00A D1/D5). Returns `undefined` when no getter
+   * applies for `access`. Crucially, an access-record object is NEVER
+   * interpreted as a getter descriptor when the access is absent: an
+   * inapplicable registered name stays virtual (excluded from persisted
+   * projections, write admission, and DB sort/filter/distinct).
+   * Shared record-level `dependsOn` is inherited when a leaf lacks its own.
+   */
+  resolveVirtualDescriptor(modelName, virtualName, access, scopePath) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const rootVirtuals = manager.get("virtuals");
+    const scopeVirtuals = getScopeVirtualsObject(rootVirtuals, scopePath);
+    if (!scopeVirtuals || !(virtualName in scopeVirtuals)) return void 0;
+    const entry = scopeVirtuals[virtualName];
+    if (entry === void 0 || isVirtualContainerValue(entry)) return void 0;
+    if ((0, import_utils8.isFunction)(entry)) return { get: entry, dependsOn: [] };
+    if (!(0, import_utils8.isPlainObject)(entry)) return void 0;
+    const record = entry;
+    if ("get" in record) {
+      const descriptor = toVirtualDescriptor(entry, void 0);
+      return descriptor ?? void 0;
+    }
+    const sharedDependsOn = record.dependsOn;
+    const exact = record[access];
+    if (exact !== void 0) {
+      const descriptor = toVirtualDescriptor(exact, sharedDependsOn);
+      if (descriptor) return descriptor;
+    }
+    const fallback = record.default;
+    if (fallback !== void 0) {
+      const descriptor = toVirtualDescriptor(fallback, sharedDependsOn);
+      if (descriptor) return descriptor;
+    }
+    return void 0;
+  }
   getModelNames() {
     return Object.keys(this.modelOptions);
   }
@@ -1471,6 +1852,7 @@ var sortSchema = import_zod2.z.union([
   import_zod2.z.array(import_zod2.z.tuple([import_zod2.z.string(), sortOrderSchema])),
   import_zod2.z.null()
 ]);
+var populateAccessSchema = import_zod2.z.enum(["list", "read"]);
 var populateSchema = import_zod2.z.union([
   import_zod2.z.string(),
   import_zod2.z.array(
@@ -1480,7 +1862,7 @@ var populateSchema = import_zod2.z.union([
         path: import_zod2.z.string().min(1),
         select: projectionSchema.optional(),
         match: import_zod2.z.unknown().optional(),
-        access: import_zod2.z.enum(["list", "read"]).optional()
+        access: populateAccessSchema.optional()
       }).passthrough()
     ])
   ),
@@ -1488,7 +1870,7 @@ var populateSchema = import_zod2.z.union([
     path: import_zod2.z.string().min(1),
     select: projectionSchema.optional(),
     match: import_zod2.z.unknown().optional(),
-    access: import_zod2.z.enum(["list", "read"]).optional()
+    access: populateAccessSchema.optional()
   }).passthrough()
 ]);
 var subPopulateSchema = import_zod2.z.union([
@@ -2196,7 +2578,7 @@ var listBodySchema = import_zod3.z.object({
     includeFieldPermissions: import_zod3.z.boolean().optional(),
     includeCount: import_zod3.z.boolean().optional(),
     includeExtraHeaders: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
 var countBodySchema = import_zod3.z.object({
@@ -2214,7 +2596,7 @@ var readFilterBodySchema = import_zod3.z.object({
     includePermissions: import_zod3.z.boolean().optional(),
     includeFieldPermissions: import_zod3.z.boolean().optional(),
     tryList: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var readByIdBodySchema = import_zod3.z.object({
@@ -2227,7 +2609,7 @@ var readByIdBodySchema = import_zod3.z.object({
     includePermissions: import_zod3.z.boolean().optional(),
     includeFieldPermissions: import_zod3.z.boolean().optional(),
     tryList: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var advancedCreateBodySchema = import_zod3.z.object({
@@ -2238,7 +2620,7 @@ var advancedCreateBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     includePermissions: import_zod3.z.boolean().optional(),
     includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var createBodySchema = import_zod3.z.union([
@@ -2255,7 +2637,7 @@ var advancedUpdateBodySchema = import_zod3.z.object({
     returningAll: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
     includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var upsertBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
@@ -2268,7 +2650,7 @@ var advancedUpsertBodySchema = import_zod3.z.object({
     returningAll: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
     includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: import_zod3.z.unknown().optional()
+    populateAccess: populateAccessSchema.optional()
   }).passthrough().optional()
 }).passthrough();
 var distinctBodySchema = import_zod3.z.object({
@@ -2340,7 +2722,7 @@ var rootModelListOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   includeCount: import_zod5.z.boolean().optional(),
-  populateAccess: import_zod5.z.unknown().optional(),
+  populateAccess: populateAccessSchema.optional(),
   lean: import_zod5.z.boolean().optional()
 }).passthrough();
 var rootModelReadArgsSchema = import_zod5.z.object({
@@ -2357,7 +2739,7 @@ var rootModelReadOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   tryList: import_zod5.z.boolean().optional(),
-  populateAccess: import_zod5.z.unknown().optional(),
+  populateAccess: populateAccessSchema.optional(),
   lean: import_zod5.z.boolean().optional()
 }).passthrough();
 var rootModelCreateArgsSchema = import_zod5.z.object({
@@ -2369,7 +2751,7 @@ var rootModelCreateOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
-  populateAccess: import_zod5.z.unknown().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelUpdateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
@@ -2381,7 +2763,7 @@ var rootModelUpdateOptionsSchema = import_zod5.z.object({
   returningAll: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
-  populateAccess: import_zod5.z.unknown().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;