@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/resources/utils/resources-config-operations.dtos-builder.utils.js

@@ -1,12 +1,15 @@
 import { z } from 'zod';
 import { CoreResourceOperation } from '../resources.shared.core.definitions.js';
-import { Resources_BulkOperationBaseSchema, DataMode, OPERATION_VARIANT_KEY, createPaginationResponseMetadataSchema, getChildDirectionRelationships, getParentDirectionRelationships, ResourceGeneratedOperationKind } from '../resources-config.shared.schemas.js';
+import { wrapRequestDtoAsBulk, resolveBulkOperationMaxSelection, DataMode, OPERATION_VARIANT_KEY, createPaginationResponseMetadataSchema, DEFAULT_LIST_PAGE_CEILING, DEFAULT_SEARCH_PAGE_CEILING, getChildDirectionRelationships, getParentDirectionRelationships, ResourceGeneratedOperationKind } from '../resources-config.shared.schemas.js';
 import { ResourceRelationshipCardinality, isOneToOneCardinality, isArrayCardinality, getDefaultResponseSchemaForOperation, isOutputEnvelopeOperation, operationShouldHaveRequestDto, DefaultBulkDeleteResponseSchema, CONTEXT_AUTO_POPULATED_FIELD_IDENTIFIERS, createOrUpdateMandatoryDiscardFields } from '../resources.shared.schemas.js';
 import { Resources_SharedUtils } from '../resources.shared.utils.js';
-import { addDiscriminator, getCustomFieldMetadata, ZodDecorator, getZodType, hasZodType, isZodObject, isZodArray, isZodOptional, isZodNullable, isZodDefault, toPatchOptionalField, getZodObjectShape, getZodDefSchemaProperty, getZodDefArrayProperty, getZodDefStringProperty, getZodDefProperty, isZodTypeAny, getEnumValues, isExcludedFromCreate, isExcludedFromUpdate, isVirtualField, isTemplatableFileField, isPrimaryKey, isBackendOnlyField, getBackendOnlyParams, isWriteOnlySecretField, isDiscriminatorField, unwrapSchema, getMergedObjectOrUnionShape, withArrayElement, SCHEMA_METADATA } from '@wildo-ai/zod-decorators';
+import { addDiscriminator, getCustomFieldMetadata, ZodDecorator, getZodType, hasZodType, isZodObject, isZodArray, isZodOptional, isZodNullable, isZodDefault, toPatchOptionalField, getZodObjectShape, getZodDefSchemaProperty, getZodDefArrayProperty, getZodDefStringProperty, getZodDefProperty, isZodTypeAny, getEnumValues, isExcludedFromCreate, isExcludedFromUpdate, isVirtualField, isTemplatableFileField, isPrimaryKey, isBackendOnlyField, getBackendOnlyParams, isWriteOnlySecretField, isDiscriminatorField, unwrapSchema, getMergedObjectOrUnionShape, withArrayElement, markPatchRequestDtoObject, SCHEMA_METADATA } from '@wildo-ai/zod-decorators';
+import { ContextPolicy_ObjectMode, DEFAULT_RELATIONSHIP_CONTEXT_POLICY, } from '../context-policy.shared.schemas.js';
 import { ResourcesSummaryUtils } from './resources-summary.utils.js';
 import { RepositoryDtoBuilderUtils } from './repository-dto-builder.utils.js';
 import { stripTemplatableFileFieldsRecursively as stripTemplatableFileFieldsSchema, } from './templatable-file-fields.shared.utils.js';
+import { widenFileFieldsForPopulatedReads } from './populated-file-fields.shared.utils.js';
+import { describeCaughtError } from '../../errors/errors.shared.utils.js';
 /**
  * Canonical placeholder shown to clients in place of a `.isWriteOnlySecret()`
  * field's real value. It doubles as the write-back sentinel: when a client
@@ -137,7 +140,13 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
     }
     static stripTemplatableFileFieldsRecursively(schema) {
         return stripTemplatableFileFieldsSchema(schema, {
-            rebuildObjectSchema: (objectSchema, strippedShape) => this.rebuildObjectSchema(objectSchema, strippedShape, { preserveChecks: false }),
+            rebuildObjectSchema: (objectSchema, strippedShape) => {
+                // Checks and decorator metadata survive when the FIELD SET is unchanged — only a nested field
+                // was replaced, so the object is still what they describe. This passed `preserveChecks: false`
+                // unconditionally, which dropped both on every object above a rewritten field (#989).
+                const fieldSetUnchanged = Object.keys(getZodObjectShape(objectSchema)).every((fieldName) => fieldName in strippedShape);
+                return this.rebuildObjectSchema(objectSchema, strippedShape, { preserveChecks: fieldSetUnchanged });
+            },
         });
     }
     /**
@@ -410,7 +419,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         const contextBaseDto = isListOrSearch
             ? this.extractPaginatedCollectionItemDto(responseDto, effectiveOperation)
             : responseDto;
-        const contextDto = this.addRelationshipPlaceholders(contextBaseDto, operation.resourceRelationships, registry);
+        const contextDto = this.addRelationshipPlaceholders(contextBaseDto, operation.resourceRelationships, effectiveOperation, registry);
         // 7. Build internalDto base (before variant overrides):
         //    - Start with mainSchema (with inheritance)
         //    - Include backend-only fields (DO NOT strip)
@@ -519,7 +528,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             else if (operation.variantKey === OPERATION_VARIANT_KEY.CONTEXT) {
                 // For CONTEXT variants, build from contextDto versions
                 // contextDto is built from responseDto which already has backend-only stripped, so we need internal version
-                const contextDtoInternal = this.addRelationshipPlaceholders(this.excludeVirtualFieldsFromSchema(enhancedMainSchema), operation.resourceRelationships, registry);
+                const contextDtoInternal = this.addRelationshipPlaceholders(this.excludeVirtualFieldsFromSchema(enhancedMainSchema), operation.resourceRelationships, effectiveOperation, registry);
                 repositoryDto = RepositoryDtoBuilderUtils.deriveRepositoryDto(contextDtoInternal, enhancedMainSchema);
                 if (isListOrSearch) {
                     // Build internalDto for service-layer validation (pagination wrapper with backend-only items)
@@ -557,14 +566,26 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         }
         requestDto = this.stripTemplatableFileFieldsRecursively(requestDto);
         // 11. Finalize internalDto with network-boundary coercion (dates + money bigints):
-        const internalDtoFinal = this.applyNetworkBoundaryCoercion(internalDtoProcessed);
+        let internalDtoFinal = this.applyNetworkBoundaryCoercion(internalDtoProcessed);
+        // 11b. A SUMMARY or CONTEXT read runs file population, which lays each file's metadata BESIDE the
+        //      stored reference (`file` / `files`, issue #1059). The DTOs that describe those reads — what
+        //      `transformOutput` validates and what the wire carries — declare that optional companion;
+        //      RAW reads never populate and keep the bare reference. Applied AFTER coercion, so the
+        //      companion's own dates are coerced by its own schema rather than by a walker that leaves a
+        //      plain union untouched. The widened field keeps its file metadata, so it is still a FILE field.
+        const isPopulatedReadVariant = operation.variantKey === OPERATION_VARIANT_KEY.SUMMARY
+            || operation.variantKey === OPERATION_VARIANT_KEY.CONTEXT;
+        if (isPopulatedReadVariant) {
+            internalDtoFinal = widenFileFieldsForPopulatedReads(internalDtoFinal);
+            responseDto = widenFileFieldsForPopulatedReads(responseDto);
+        }
         // 12. Return operation with all DTOs stored
         return {
             ...operation,
             requestDto,
             responseDto,
-            summaryDto,
-            contextDto,
+            summaryDto: widenFileFieldsForPopulatedReads(summaryDto),
+            contextDto: widenFileFieldsForPopulatedReads(contextDto),
             internalDto: internalDtoFinal,
             repositoryDto
         };
@@ -605,30 +626,38 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 isBulkOperation: false,
                 requestDto: undefined // Clear to force rebuild
             };
-            const underlyingRequestDto = this.buildEnhancedRequestDto(underlyingOperation, effectiveOperation);
-            // Wrap with bulk operation base schema
-            if (underlyingRequestDto && !isZodAny(underlyingRequestDto)) {
-                const underlyingInfo = this.analyzeDtoSchema(underlyingRequestDto);
-                if (underlyingInfo !== '📄 {} (empty object)') {
-                    if (effectiveOperation === CoreResourceOperation.CREATE_MANY) {
-                        return z.object({
-                            data: z.array(underlyingRequestDto),
-                        });
-                    }
-                    if (isZodObject(underlyingRequestDto)) {
-                        return Resources_BulkOperationBaseSchema.extend(getZodObjectShape(underlyingRequestDto));
-                    }
-                    return Resources_BulkOperationBaseSchema.and(underlyingRequestDto);
-                }
-            }
-            return effectiveOperation === CoreResourceOperation.CREATE_MANY
-                ? z.object({
-                    data: z.array(z.object({})),
-                })
-                : Resources_BulkOperationBaseSchema;
+            // The ROW of a batch create is a CREATE row. Rebuilding it as CREATE_MANY would return the
+            // `{ data: row[] }` envelope (see the CREATE_MANY branch below) and this wrap would nest it twice.
+            const underlyingRequestDto = this.buildEnhancedRequestDto(underlyingOperation, effectiveOperation === CoreResourceOperation.CREATE_MANY ? CoreResourceOperation.CREATE : effectiveOperation);
+            // Wrap as the bulk request, WITH this operation's batch limit (`wrapRequestDtoAsBulk`).
+            const hasRowInput = !!underlyingRequestDto
+                && !isZodAny(underlyingRequestDto)
+                && this.analyzeDtoSchema(underlyingRequestDto) !== '📄 {} (empty object)';
+            return wrapRequestDtoAsBulk({
+                rowRequestDto: hasRowInput ? underlyingRequestDto : undefined,
+                maxSelection: resolveBulkOperationMaxSelection(operation),
+                isCreate: effectiveOperation === CoreResourceOperation.CREATE_MANY,
+            });
+        }
+        /*
+         * CREATE_MANY takes a BATCH: `{ data: row[] }`, at most the batch limit (#1551).
+         *
+         * It shared the single-row branch below, so its request was ONE row while `createMany` validates
+         * the whole `{ data: [...] }` payload against this DTO (`validateAndTransformInput`, loose parse)
+         * and then reads `.data` as the rows (`normalizeCreateManyInput`). A resource with any required
+         * field could therefore not be batch-created at all. The envelope is built by the same
+         * `wrapRequestDtoAsBulk` every other batch request uses, so the row shape and the limit have one
+         * construction.
+         */
+        if (effectiveOperation === CoreResourceOperation.CREATE_MANY) {
+            return wrapRequestDtoAsBulk({
+                rowRequestDto: this.createRequestDtoForCreate(operation.mainSchema),
+                maxSelection: resolveBulkOperationMaxSelection(operation),
+                isCreate: true,
+            });
         }
         // For create operations, use decorator-aware DTO building
-        if (effectiveOperation === CoreResourceOperation.CREATE || effectiveOperation === CoreResourceOperation.CREATE_MANY) {
+        if (effectiveOperation === CoreResourceOperation.CREATE) {
             return this.createRequestDtoForCreate(operation.mainSchema);
         }
         // For update operations, use decorator-aware DTO building
@@ -682,7 +711,8 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
         // an operation that declares nothing, which is the 500 this whole change exists to remove, in a
         // new place. SEARCH's repository default stays 50, so its pages sit comfortably inside this.
         if (effectiveOperation === CoreResourceOperation.LIST || effectiveOperation === CoreResourceOperation.SEARCH) {
-            return this.createPaginatedResponseSchema(operation.mainSchema, operation.maxPaginatedResultPerPageLimit ?? 100);
+            return this.createPaginatedResponseSchema(operation.mainSchema, operation.maxPaginatedResultPerPageLimit
+                ?? (effectiveOperation === CoreResourceOperation.SEARCH ? DEFAULT_SEARCH_PAGE_CEILING : DEFAULT_LIST_PAGE_CEILING));
         }
         // Apply operation-specific default patterns
         const defaultResponse = getDefaultResponseSchemaForOperation(effectiveOperation, operation.mainSchema);
@@ -817,7 +847,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
         }
         catch (error) {
-            throw new Error(`Failed to create request DTO for CREATE: ${error instanceof Error ? error.message : String(error)}`);
+            throw new Error(`Failed to create request DTO for CREATE: ${describeCaughtError(error)}`);
         }
         return this.stripTemplatableFileFieldsRecursively(schema);
     }
@@ -933,7 +963,8 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 .enum(Array.from(discriminatorValues))
                 .optional();
         }
-        return z.object(mergedShape);
+        // The merged inheritance UPDATE root is written PATCH style like any other UPDATE root (#989).
+        return markPatchRequestDtoObject(z.object(mergedShape));
     }
     /**
      * Extract the concrete discriminator value(s) a union-option's discriminator
@@ -1042,10 +1073,11 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                     ? strippedField
                     : toPatchOptionalField(strippedField);
             }
-            return z.object(updateShape);
+            // PATCH write rule: the form clears this object's direct fields with an explicit null (#989).
+            return markPatchRequestDtoObject(z.object(updateShape));
         }
         catch (error) {
-            throw new Error(`Failed to create request DTO for UPDATE: ${error instanceof Error ? error.message : String(error)}`);
+            throw new Error(`Failed to create request DTO for UPDATE: ${describeCaughtError(error)}`);
         }
         return this.stripTemplatableFileFieldsRecursively(schema);
     }
@@ -1099,7 +1131,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             }
         }
         catch (error) {
-            throw new Error(`Failed to exclude virtual fields from schema: ${error instanceof Error ? error.message : String(error)}`);
+            throw new Error(`Failed to exclude virtual fields from schema: ${describeCaughtError(error)}`);
         }
         return schema;
     }
@@ -1878,9 +1910,11 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 _id: z.never().optional()
             });
             // UPDATE DTO should have _id as required
-            const updateWithRequiredId = childUpdateDto.extend({
+            // `.extend()` returns a fresh object without the child UPDATE DTO's metadata; its PATCH write
+            // rule has to survive, or a form reads the update branch as written whole (#989).
+            const updateWithRequiredId = this.preserveSchemaMetadata(childUpdateDto, childUpdateDto.extend({
                 _id: z.string()
-            });
+            }));
             return z.union([updateWithRequiredId, createWithoutId]);
         }
         // Fallback: use UPDATE DTO
@@ -1930,7 +1964,8 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             return baseDto;
         }
         if (isZodObject(baseDto)) {
-            return baseDto.extend(extensionShape);
+            // Carry the base DTO's metadata (its PATCH write rule among it) across the extension (#989).
+            return this.preserveSchemaMetadata(baseDto, baseDto.extend(extensionShape));
         }
         const zodType = getZodType(baseDto);
         if (zodType === 'union') {
@@ -1938,7 +1973,7 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             const unionOptions = getZodDefArrayProperty(baseDto, 'options');
             if (discriminator && unionOptions && unionOptions.length > 0) {
                 const extendedOptions = unionOptions.map((option) => isZodObject(option)
-                    ? option.extend(extensionShape)
+                    ? this.preserveSchemaMetadata(option, option.extend(extensionShape))
                     : option);
                 if (extendedOptions.every((option) => isZodObject(option))) {
                     if (extendedOptions.length >= 2) {
@@ -2480,23 +2515,143 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
                 });
             }
             catch (error) {
-                throw new Error(`Failed to derive summary schema for object: ${error instanceof Error ? error.message : String(error)}`);
+                throw new Error(`Failed to derive summary schema for object: ${describeCaughtError(error)}`);
             }
         }
         // For other schema types (primitives, etc.), return as-is
         return schema;
     }
+    /**
+     * The schema ONE populated context relative (a parent, or a child row) is described by.
+     *
+     * ## Why a typed schema, and why this shape (#1189)
+     *
+     * A populated relative used to be `z.record(z.string(), z.any())`, which types every embedded
+     * value as `any`. `applyNetworkBoundaryCoercion` has nothing to walk inside that, so every
+     * `z.date()` and `z.bigint()` leaf INSIDE an embed stayed in its wire form — an ISO string, or a
+     * decimal string for a money amount — while the value's declared type said `Date` / `bigint`.
+     *
+     * Measured 2026-09-15: on sign-in, `privacy.consentDecidedAt` reached the frontend as a string
+     * inside `userSelfPreferences` (a 1:1 child of the USER_SELF context read). The preferences event
+     * validated it against the in-memory `z.date()` and the whole event was dropped, so language,
+     * regional, theme and consent preferences all failed to reach their providers.
+     *
+     * ## The schema can only ADD coercion — never a refusal, never a strip
+     *
+     * Three properties, each load-bearing:
+     *
+     * - **Every field is OPTIONAL** (`.partial()`). What an embed actually carries depends on the
+     *   producer's projection and on `objectMode`, so a REQUIRED field would turn a response that
+     *   parses today into a hard validation failure — strictly worse than an uncoerced string.
+     * - **Unknown keys PASS THROUGH** (`.loose()`). Declaring a shape must not strip what the shape
+     *   does not mention. `z.object({ _id })` was tried for parents and dropped every SUMMARY/FULL
+     *   field they carried (#579); this keeps that class unrepresentable.
+     * - **The shape follows the relationship's resolved `objectMode`**, so a SUMMARY embed is typed by
+     *   the related resource's summary fields and a FULL embed by its whole schema. The
+     *   per-operation override is honoured, because these DTOs are built per operation.
+     *
+     * Falls back to the untyped record — i.e. exactly the previous behaviour — whenever the related
+     * schema cannot be read: an ID_ONLY relative (a bare reference has no leaf to coerce), a registry
+     * that does not hold the related resource, or a related schema that is not a plain object. The
+     * factory pass builds DTOs against an EMPTY registry, so it takes that fallback for everything and
+     * the typed form appears at `rebuildResourceConfigurationsOperationDtos`, which every serving and
+     * documenting consumer runs.
+     *
+     * A POLYMORPHIC relative is typed by its base object, so the variants' own fields pass through
+     * loose and uncoerced. That is a partial improvement rather than a regression, and it is the same
+     * fallback reasoning: a discriminated union has no `.partial()`.
+     *
+     * @param relatedResourceType - The resource on the other side of the relationship
+     * @param contextPolicy - That relationship's context policy (its `objectMode` decides the shape)
+     * @param effectiveOperation - The operation these DTOs are being built for, for `operationOverrides`
+     * @param registry - Resource registry; empty during the factory pass
+     * @returns A single-object schema for one relative (callers wrap it in `.optional()` / `z.array`)
+     */
+    static buildContextRelativeObjectSchema(relatedResourceType, contextPolicy, effectiveOperation, registry) {
+        // Zod 4 requires key and value schemas for z.record
+        const untypedRelative = z.record(z.string(), z.any());
+        const objectMode = contextPolicy?.operationOverrides?.[effectiveOperation]?.objectMode
+            ?? contextPolicy?.objectMode
+            ?? DEFAULT_RELATIONSHIP_CONTEXT_POLICY.objectMode;
+        // ID_ONLY carries a bare reference: no fetch, so no leaf to coerce.
+        if (objectMode === ContextPolicy_ObjectMode.ID_ONLY) {
+            return untypedRelative;
+        }
+        const relatedMainSchema = registry.get(relatedResourceType)?.mainSchema;
+        if (!relatedMainSchema || !isZodObject(relatedMainSchema)) {
+            return untypedRelative;
+        }
+        let relativeSchema = relatedMainSchema;
+        if (objectMode === ContextPolicy_ObjectMode.SUMMARY) {
+            // Mirrors the summary DTO's own derivation, including its fallback: a resource that marks NO
+            // summary field is served its whole object, so the embed must be typed by the whole schema
+            // too. The emptiness test deliberately runs on a derivation WITHOUT `_id` — `includeId` adds
+            // it unconditionally, so asking the id-bearing shape whether it is empty always answers no,
+            // and every such resource would be typed `{ _id }` with its every other leaf left uncoerced.
+            const summaryFieldsOnly = ResourcesSummaryUtils.deriveSummarySchema(relatedMainSchema, {
+                includeId: false,
+                includeForeignKeys: false,
+            });
+            if (Object.keys(getZodObjectShape(summaryFieldsOnly)).length > 0) {
+                relativeSchema = ResourcesSummaryUtils.deriveSummarySchema(relatedMainSchema, {
+                    includeId: true,
+                    includeForeignKeys: false,
+                });
+            }
+        }
+        // Coerced HERE rather than left to a later pass: the CONTEXT variant's `responseDto` IS this
+        // `contextDto`, and nothing re-coerces it after the variant override (step 10).
+        const coercedRelativeSchema = this.applyNetworkBoundaryCoercion(relativeSchema);
+        if (!isZodObject(coercedRelativeSchema)) {
+            return untypedRelative;
+        }
+        // Backend-only fields are deliberately NOT stripped. They never reach the wire, and the same
+        // placeholder types the service-layer `internalDto`, where they legitimately appear — `.loose()`
+        // would pass them through either way, and declaring them means their dates are coerced too.
+        const typedRelative = coercedRelativeSchema.partial().loose();
+        // The union is what makes "can only ADD coercion" true rather than nearly true.
+        //
+        // `.partial()` reaches the TOP level only, so a nested object inside the related schema keeps
+        // its required leaves. An embed that omits one — a projection this builder cannot see, an
+        // application's own resource shaped differently from its schema — would then turn a response
+        // that parses today into a hard validation failure, and a whole context read would be refused
+        // over a field nobody reads. Trying the typed schema FIRST and falling back to the untyped
+        // record bounds the worst case at exactly the previous behaviour: uncoerced, never rejected.
+        return z.union([typedRelative, untypedRelative]);
+    }
     /**
      * Add relationship placeholders to schema for context DTO.
-     * Placeholders are optional fields: parentResourceType?: { _id: string }
+     * Placeholders are optional and named by `Resources_SharedUtils.resolveRelationshipObjectIdentity`
+     * — the same authority `ResourcePopulationBackendService.populateForContext` names them with.
+     * Each one's SHAPE comes from {@link buildContextRelativeObjectSchema}.
      *
      * @param schema - Base schema
      * @param relationships - Resource relationships configuration
+     * @param effectiveOperation - Operation these DTOs are for, for per-operation context overrides
      * @param registry - Resource registry for type resolution
      * @returns Schema with relationship placeholders added
      */
-    static addRelationshipPlaceholders(schema, relationships, registry) {
-        // Only add placeholders to object schemas
+    static addRelationshipPlaceholders(schema, relationships, effectiveOperation, registry) {
+        // A POLYMORPHIC resource's response is a discriminated union: every variant carries the same
+        // relationships, so every variant gets the same placeholders, and the union is rebuilt with the
+        // discriminator it had — the pattern `excludeVirtualFieldsFromSchema` already uses. Returning a
+        // union unchanged (the previous behaviour) left its context DTO with NO placeholder at all, so
+        // `internalDto.parse` and the response serializer stripped every populated child and parent of,
+        // e.g., Wonder Todos' `todos` — and the generated API reference documented its context as the
+        // plain read response. A union WITHOUT a discriminator has no rebuild this builder can promise,
+        // so it stays as-is.
+        if (getZodType(schema) === 'union') {
+            const discriminator = getZodDefStringProperty(schema, 'discriminator');
+            const options = getZodDefArrayProperty(schema, 'options');
+            if (discriminator && options && options.length > 0) {
+                const withPlaceholders = options.map((option) => this.addRelationshipPlaceholders(option, relationships, effectiveOperation, registry));
+                return withPlaceholders.length >= 2
+                    ? z.discriminatedUnion(discriminator, withPlaceholders)
+                    : withPlaceholders[0];
+            }
+            return schema;
+        }
+        // Otherwise only object schemas carry placeholders
         if (!isZodObject(schema)) {
             return schema;
         }
@@ -2511,10 +2666,13 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             const fieldName = this.getRelationshipObjectFieldName(relationship, relationship.resourceType1, ResourceRelationshipCardinality.ONE, registry);
             // Only add if field doesn't already exist (avoid conflicts)
             if (!shape[fieldName]) {
-                // Placeholder format: parentResourceType?: { _id: string }
-                placeholderFields[fieldName] = z.object({
-                    _id: z.string()
-                }).optional();
+                // A parent carries what its contextPolicy's `objectMode` fetched — a bare reference for
+                // ID_ONLY, the parent's summary fields for SUMMARY (the default), its whole object for FULL
+                // — and the placeholder is typed from that same mode, optional-everywhere and loose (#1189).
+                // It was once `z.object({ _id })`, which stripped every SUMMARY/FULL field even under the
+                // right name: no parent object had ever reached a client, on any resource (#579). That is
+                // why the typed form below can only ever ADD coercion.
+                placeholderFields[fieldName] = this.buildContextRelativeObjectSchema(relationship.resourceType1, relationship.contextPolicy, effectiveOperation, registry).optional();
             }
         }
         // Add child relationship placeholders (includes self-refs acting as children)
@@ -2537,9 +2695,10 @@ export class ResourcesConfigOperationsDtosBuilderUtils {
             const isOneToOne = isOneToOneCardinality(relationship.cardinality2);
             // Only add if field doesn't already exist (avoid conflicts)
             if (!shape[fieldName]) {
-                // Use a passthrough schema to allow any fields from the child
-                // Zod 4 requires key and value schemas for z.record
-                const childPlaceholder = z.record(z.string(), z.any());
+                // Typed from the child's own schema by the relationship's resolved `objectMode`, with every
+                // field optional and unknown keys passed through, so the declaration coerces the child's
+                // date and money leaves without being able to strip or refuse anything (#1189).
+                const childPlaceholder = this.buildContextRelativeObjectSchema(relationship.resourceType2, relationship.contextPolicy, effectiveOperation, registry);
                 if (isOneToOne) {
                     // 1:1: single object (optional)
                     placeholderFields[fieldName] = childPlaceholder.optional();