@web-ts-toolkit/access-router 0.55.0 → 0.57.0

package/advanced.js

@@ -260,7 +260,7 @@ function normalizeHydrationUpdate(current, key, value) {
 
 // src/runtime.ts
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-var import_utils12 = require("@web-ts-toolkit/utils");
+var import_utils13 = require("@web-ts-toolkit/utils");
 
 // src/helpers/query.ts
 var import_utils2 = require("@web-ts-toolkit/utils");
@@ -1237,7 +1237,7 @@ function resolveSnapshotDescriptor(scopeVirtuals, virtualName, access) {
 }
 
 // src/acl/virtual-populate-dependencies.ts
-var import_utils11 = require("@web-ts-toolkit/utils");
+var import_utils12 = require("@web-ts-toolkit/utils");
 
 // src/acl/authorization-snapshot.ts
 var import_node_util3 = require("util");
@@ -1445,6 +1445,25 @@ function captureAuthorizationFieldCatalog(schema, virtuals, documentPermissionFi
   });
 }
 
+// src/acl/populate-target-configuration.ts
+var import_utils11 = require("@web-ts-toolkit/utils");
+function capturePopulateTargetConfiguration(runtime, modelName, source, proposedOptions) {
+  const label = `Populate target "${modelName}" for ${source}`;
+  if (!proposedOptions && !runtime.hasModel(modelName))
+    authorizationError(
+      `${label} must be configured first in this runtime; register its Mongoose model and setModelOptions with an object permissionSchema`
+    );
+  const model = runtime.getModelInstance(modelName);
+  if (!model) authorizationError(`${label} requires an actual registered Mongoose model in this runtime`);
+  const options = proposedOptions ?? runtime.getModelOptions(modelName);
+  const permissionSchema = options.permissionSchema === void 0 ? runtime.getDefaultModelOption("permissionSchema") : options.permissionSchema;
+  if (!(0, import_utils11.isPlainObject)(permissionSchema))
+    authorizationError(
+      `${label} requires an effective object permissionSchema; configure the model or runtime model defaults ({} explicitly closes business fields)`
+    );
+  return { model, options: { ...options, permissionSchema } };
+}
+
 // src/acl/virtual-populate-dependencies.ts
 var elementType = (type) => type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster;
 var join = (prefix, path) => prefix ? `${prefix}.${path}` : path;
@@ -1456,7 +1475,7 @@ var fail = (label, message) => {
 var varyingSchema = (schema) => Object.keys(schema.discriminators ?? {}).length > 0 || schema.discriminatorMapping?.isRoot === false;
 var varyingModel = (model) => !!model.baseModelName || Object.keys(model.discriminators ?? {}).length > 0 || varyingSchema(model.schema);
 function record(value, label) {
-  if (!(0, import_utils11.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
+  if (!(0, import_utils12.isPlainObject)(value)) return fail(label, "entries must be plain { path, select? } objects");
   for (const key of Reflect.ownKeys(value)) {
     const property = Object.getOwnPropertyDescriptor(value, key);
     if (typeof key !== "string" || !property.enumerable || !("value" in property))
@@ -1544,7 +1563,9 @@ function normalizeSelection(select, catalog, label) {
     includeId: selection.includes("_id")
   };
 }
-function captureVirtualPopulateDependencies(runtime, modelName, options) {
+function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const requireOperationAccessForPopulateDependencies = globalOptions.requireOperationAccessForPopulateDependencies !== false;
+  const requireOperationAccessForPopulateQueries = globalOptions.requireOperationAccessForPopulateQueries !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -1584,15 +1605,23 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
                 label,
                 `target "${ref}" requires a registered same-connection non-discriminator ObjectId model bound to the source ref`
               );
-            const targetOptions = ref === modelName ? options : runtime.getModelOptions(ref);
+            const { options: targetOptions } = capturePopulateTargetConfiguration(
+              runtime,
+              ref,
+              `dependsOnPopulate virtual "${label}"`,
+              ref === modelName ? options : void 0
+            );
             const defaults = runtime.getDefaultModelOptions();
-            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils11.get)(targetOptions, path2, fallback), key, (0, import_utils11.get)(defaults, key));
+            const readOption = (key) => resolveNestedOption((path2, fallback) => (0, import_utils12.get)(targetOptions, path2, fallback), key, (0, import_utils12.get)(defaults, key));
             const documentPermissionField = targetOptions.documentPermissionField ?? defaults.documentPermissionField;
             const catalog = captureAuthorizationFieldCatalog(targetModel.schema, void 0, documentPermissionField);
             const configuration = copyAuthorizationValue(
               {
                 catalog,
                 documentPermissionField,
+                requireOperationAccessForPopulateDependencies,
+                requireOperationAccessForPopulateQueries,
+                permissionSchema: targetOptions.permissionSchema,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -1641,13 +1670,13 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
         );
         continue;
       }
-      if (!(0, import_utils11.isPlainObject)(raw)) continue;
+      if (!(0, import_utils12.isPlainObject)(raw)) continue;
       const entry = raw;
       const label = join(sourcePrefix, name);
       captureList(entry.dependsOnPopulate, label);
       if (!("get" in entry))
         for (const access of accesses) {
-          if ((0, import_utils11.isPlainObject)(entry[access]))
+          if ((0, import_utils12.isPlainObject)(entry[access]))
             captureList(entry[access].dependsOnPopulate, `${label}.${access}`);
         }
       const byAccess = {};
@@ -1693,44 +1722,44 @@ var defaultDataOptions = {
   listHardLimit: DEFAULT_LIST_HARD_LIMIT
 };
 var normalizeBasePath = (name, value) => {
-  if ((0, import_utils12.isNil)(value)) {
+  if ((0, import_utils13.isNil)(value)) {
     return `/${pluralize(name)}`;
   }
-  return (0, import_utils12.isString)(value) ? (0, import_utils12.addLeadingSlash)(value) : "";
+  return (0, import_utils13.isString)(value) ? (0, import_utils13.addLeadingSlash)(value) : "";
 };
 var hasModelPermission = (value, modelPermissionPrefix) => {
   if (!modelPermissionPrefix) {
     return true;
   }
-  if ((0, import_utils12.isString)(value)) {
+  if ((0, import_utils13.isString)(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if ((0, import_utils12.isArray)(value)) {
+  if ((0, import_utils13.isArray)(value)) {
     return value.some((item) => {
-      if ((0, import_utils12.isString)(item) || (0, import_utils12.isArray)(item)) {
+      if ((0, import_utils13.isString)(item) || (0, import_utils13.isArray)(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
     });
   }
-  return (0, import_utils12.isFunction)(value);
+  return (0, import_utils13.isFunction)(value);
 };
 var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const schemaKeys = Object.keys(permissionSchema);
   const globalPermissionKeys = {};
   const modelPermissionKeys = {};
-  (0, import_utils12.forEach)(schemaKeys, (schemaKey) => {
+  (0, import_utils13.forEach)(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = (0, import_utils12.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = (0, import_utils13.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!(0, import_utils12.isArray)(globalPermissionKeys[accessKey])) {
+      if (!(0, import_utils13.isArray)(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!(0, import_utils12.isArray)(modelPermissionKeys[accessKey])) {
+      if (!(0, import_utils13.isArray)(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
-      if ((0, import_utils12.isBoolean)(value)) {
+      if ((0, import_utils13.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
         continue;
       }
@@ -1762,13 +1791,13 @@ var VIRTUAL_UNSUPPORTED_ACCESSES = ["delete", "distinct", "count"];
 var VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
 var VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-var isVirtualContainerValue2 = (value) => (0, import_utils12.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValue2 = (value) => (0, import_utils13.isPlainObject)(value) && "sub" in value;
 var virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
 var virtualPathsOverlap = (virtualPath, permissionField) => {
   if (!virtualPath || !permissionField) return false;
   try {
-    if ((0, import_utils12.get)((0, import_utils12.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-    if ((0, import_utils12.get)((0, import_utils12.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+    if ((0, import_utils13.get)((0, import_utils13.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+    if ((0, import_utils13.get)((0, import_utils13.set)({}, permissionField, true), virtualPath) !== void 0) return true;
   } catch {
     return false;
   }
@@ -1829,12 +1858,12 @@ var cloneVirtualsForValidation = (value) => {
 };
 var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
   if (dependsOn === void 0) return [];
-  if (!(0, import_utils12.isArray)(dependsOn)) {
+  if (!(0, import_utils13.isArray)(dependsOn)) {
     throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
   }
   const list = dependsOn;
   for (const dep of list) {
-    if (!(0, import_utils12.isString)(dep) || dep.length === 0) {
+    if (!(0, import_utils13.isString)(dep) || dep.length === 0) {
       throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
     }
     if (dep.includes(".")) {
@@ -1856,12 +1885,12 @@ var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirt
   return list;
 };
 var validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-  if ((0, import_utils12.isFunction)(value)) return;
-  if (!(0, import_utils12.isPlainObject)(value)) {
+  if ((0, import_utils13.isFunction)(value)) return;
+  if (!(0, import_utils13.isPlainObject)(value)) {
     throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
   }
   const record2 = value;
-  if (!(0, import_utils12.isFunction)(record2.get)) {
+  if (!(0, import_utils13.isFunction)(record2.get)) {
     throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
   }
   validateVirtualDependsOn(record2.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -1903,7 +1932,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
           `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
         );
       }
-      if (!(0, import_utils12.isPlainObject)(record3.sub)) {
+      if (!(0, import_utils13.isPlainObject)(record3.sub)) {
         throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
       }
       continue;
@@ -1913,8 +1942,8 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
         `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
       );
     }
-    if ((0, import_utils12.isFunction)(raw)) continue;
-    if (!(0, import_utils12.isPlainObject)(raw)) {
+    if ((0, import_utils13.isFunction)(raw)) continue;
+    if (!(0, import_utils13.isPlainObject)(raw)) {
       throw new Error(
         `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
       );
@@ -1968,7 +1997,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
 };
 var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
   if (virtuals === void 0 || virtuals === null) return;
-  if (!(0, import_utils12.isPlainObject)(virtuals)) {
+  if (!(0, import_utils13.isPlainObject)(virtuals)) {
     throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
   }
   const rootSchema = model?.schema ?? null;
@@ -2020,7 +2049,8 @@ var AccessRuntime = class {
       {
         requestPermissionField: "_permissions",
         globalPermissions: () => ({}),
-        requireRegisteredPopulateModels: true,
+        requireOperationAccessForPopulateQueries: true,
+        requireOperationAccessForPopulateDependencies: true,
         logger: defaultLogger,
         requestComplexity: defaultRequestComplexity
       },
@@ -2075,7 +2105,7 @@ var AccessRuntime = class {
   }
   registerOpenApiRoute(route) {
     this.openApiRegistry.register(
-      this.openApiPathPrefix ? { ...route, path: (0, import_utils12.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+      this.openApiPathPrefix ? { ...route, path: (0, import_utils13.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
     );
   }
   /**
@@ -2086,7 +2116,7 @@ var AccessRuntime = class {
    */
   withOpenApiPathPrefix(prefix, build) {
     const previous = this.openApiPathPrefix;
-    this.openApiPathPrefix = (0, import_utils12.normalizeUrlPath)(`${previous}/${prefix}`);
+    this.openApiPathPrefix = (0, import_utils13.normalizeUrlPath)(`${previous}/${prefix}`);
     try {
       return build();
     } finally {
@@ -2193,9 +2223,18 @@ var AccessRuntime = class {
   }
   /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
   setGlobalOptions(options) {
-    this.globalOptions.assign(options);
+    const next = { ...options };
+    if ("requireOperationAccessForPopulateQueries" in next)
+      next.requireOperationAccessForPopulateQueries = next.requireOperationAccessForPopulateQueries !== false;
+    if ("requireOperationAccessForPopulateDependencies" in next)
+      next.requireOperationAccessForPopulateDependencies = next.requireOperationAccessForPopulateDependencies !== false;
+    this.globalOptions.assign(next);
   }
   setGlobalOption(key, value) {
+    if (key === "requireOperationAccessForPopulateQueries" || key === "requireOperationAccessForPopulateDependencies") {
+      this.globalOptions.set(key, value !== false);
+      return;
+    }
     this.globalOptions.set(key, value);
   }
   getGlobalOptions() {
@@ -2222,7 +2261,7 @@ var AccessRuntime = class {
     if (keyStr === "defaults") assertPublicDefaults(value);
     else if (keyStr.startsWith("defaults.")) {
       const proposed = {};
-      (0, import_utils12.set)(proposed, keyStr.slice("defaults.".length), value);
+      (0, import_utils13.set)(proposed, keyStr.slice("defaults.".length), value);
       assertPublicDefaults(proposed);
     }
     this.defaultModelOptions.set(key, value);
@@ -2251,7 +2290,7 @@ var AccessRuntime = class {
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
-        (0, import_utils12.isString)(newval) || (0, import_utils12.isNil)(newval) ? newval : void 0
+        (0, import_utils13.isString)(newval) || (0, import_utils13.isNil)(newval) ? newval : void 0
       );
     }).build();
     this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -2295,7 +2334,7 @@ var AccessRuntime = class {
     if (keyStr === "defaults") assertPublicDefaults(value);
     else if (keyStr.startsWith("defaults.")) {
       const proposed = {};
-      (0, import_utils12.set)(proposed, keyStr.slice("defaults.".length), value);
+      (0, import_utils13.set)(proposed, keyStr.slice("defaults.".length), value);
       assertPublicDefaults(proposed);
     }
     const manager = this.modelOptions[modelName];
@@ -2316,15 +2355,15 @@ var AccessRuntime = class {
           const segments = nestedPath.split(".");
           let cursor = cloned;
           for (let i = 0; i < segments.length - 1; i++) {
-            if (!(0, import_utils12.isPlainObject)(cursor)) break;
+            if (!(0, import_utils13.isPlainObject)(cursor)) break;
             cursor = cursor[segments[i]];
           }
-          if ((0, import_utils12.isPlainObject)(cursor)) {
+          if ((0, import_utils13.isPlainObject)(cursor)) {
             delete cursor[segments[segments.length - 1]];
           }
           proposedVirtuals = cloned;
         } else {
-          (0, import_utils12.set)(cloned, nestedPath, value);
+          (0, import_utils13.set)(cloned, nestedPath, value);
           proposedVirtuals = cloned;
         }
       }
@@ -2425,7 +2464,7 @@ var AccessRuntime = class {
     manager.onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         dataName,
-        (0, import_utils12.isString)(newval) || (0, import_utils12.isNil)(newval) ? newval : void 0
+        (0, import_utils13.isString)(newval) || (0, import_utils13.isNil)(newval) ? newval : void 0
       );
     }).build();
     return manager;
@@ -2485,20 +2524,20 @@ var AccessRuntime = class {
     const schema = model.schema;
     this.modelRefs[modelName] = buildRefs(schema.tree);
     this.modelSubs[modelName] = buildSubPaths(schema.tree);
-    this.modelAtts[modelName] = (0, import_utils12.keys)(schema.obj);
+    this.modelAtts[modelName] = (0, import_utils13.keys)(schema.obj);
   }
   getModelRef(modelName, refPath) {
     this.ensureModelMeta(modelName);
-    const value = (0, import_utils12.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-    return (0, import_utils12.isString)(value) ? value : null;
+    const value = (0, import_utils13.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils13.isString)(value) ? value : null;
   }
   getModelSub(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils12.get)(this.modelSubs, modelName, []);
+    return (0, import_utils13.get)(this.modelSubs, modelName, []);
   }
   getModelAtt(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils12.get)(this.modelAtts, modelName, []);
+    return (0, import_utils13.get)(this.modelAtts, modelName, []);
   }
 };
 var defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -2518,7 +2557,7 @@ var getGlobalOption = (key, defaultValue) => {
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils14 = require("@web-ts-toolkit/utils");
+var import_utils15 = require("@web-ts-toolkit/utils");
 
 // src/validation/public-admission-schema.ts
 var admissions = /* @__PURE__ */ new WeakMap();
@@ -2540,7 +2579,7 @@ function assertTransformedPublicAdmission(schema, value) {
 }
 
 // src/correlated-includes.ts
-var import_utils13 = require("@web-ts-toolkit/utils");
+var import_utils14 = require("@web-ts-toolkit/utils");
 var PARENT_MARKER_KEY = "$parent";
 var ESCAPE_WRAPPER_KEY = "$escape";
 var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
@@ -2551,10 +2590,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils13.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils14.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils13.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils14.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -2573,12 +2612,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils13.isArray)(current)) {
+    if ((0, import_utils14.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils13.isPlainObject)(current)) {
+    if ((0, import_utils14.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -2608,7 +2647,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils13.isPlainObject)(value)) {
+  if ((0, import_utils14.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -2619,7 +2658,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils13.isArray)(value)) {
+  if ((0, import_utils14.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -2660,7 +2699,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils13.isArray)(child)) {
+      if (!(0, import_utils14.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -2673,7 +2712,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils13.isPlainObject)(clause)) {
+        if ((0, import_utils14.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -2684,7 +2723,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter) {
   const issues = [];
-  if (!(0, import_utils13.isPlainObject)(filter)) {
+  if (!(0, import_utils14.isPlainObject)(filter)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -2812,7 +2851,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils14.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils15.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -2849,7 +2888,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils14.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils15.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -2902,7 +2941,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils14.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils15.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,