@wildo-ai/zod-decorators 1.1.11 → 1.1.13

package/dist/esm/zod.module-override.js

@@ -77,7 +77,8 @@ export const ZodDecorator_ApplyableType = {
     //     • ZodBigInt × 16 — see its prototype block; every other layer already treats bigint as a leaf.
     //     • ZodObject `isDBIndexed`/`isHidden`/`isNotEditable` — a composite field is indexable,
     //       hideable and non-editable. The TS2320 clash with `z_file()`'s mixin was the only obstacle
-    //       and it cost nothing to remove, because `DecoratedPrimitiveZodType<T>` is `T & {…}`.
+    //       and it cost nothing to remove: a decorator returns `this`, which for `z_file()` is its own
+    //       interface, so the members it adds are kept.
     //     • `isBusinessKey` on ZodBoolean/ZodDate — the map says it mirrors IS_DB_INDEXED's primitive
     //       set, and that IS on both. A date is a legitimate natural-key component.
     //     • ZodOptional `ttl`/`isPassword`/`isOtp`/`isColor`/`businessKeySet` — natural authoring
@@ -129,6 +130,7 @@ export const ZodDecorator_ApplyableType = {
     // The list/FunctionType/prototype-install/`declare module` augmentations are ONE unit here too.
     [ZodDecorator.IS_LAST_ACTION_RECORD]: ApplyableTypeAllTypes,
     [ZodDecorator.IS_DECIDER]: ApplyableTypeAllTypes,
+    [ZodDecorator.IS_ROLE_GRANT]: ApplyableTypeAllTypes,
     // RAG source — deliberately NOT all-types: only TEXT can be a retrieval-corpus source, so the
     // fluent surface is string-backed (plus the wrappers a string field routinely lives under; the
     // string-FORMAT types get the method from the `ZodStringFormat.prototype` install, which — per the
@@ -170,6 +172,9 @@ export const ZodDecorator_ApplyableType = {
     // Every wrapper that can hold an object and whose inner shape `findObjectShape` can reach —
     // Optional, Nullable and Default all already carry the method at runtime via the wrapper loop.
     [ZodDecorator.OBJECT_BUSINESS_KEY_SET]: ['ZodObject', 'ZodOptional', 'ZodNullable', 'ZodDefault'],
+    // A compound index names fields of the object it decorates, so it applies to an object with a shape, and only to
+    // one: an index belongs to a stored row, and a resource's main schema is always a plain object.
+    [ZodDecorator.OBJECT_COMPOUND_INDEX]: ['ZodObject'],
     // A resource reference names its two members, so it applies to an object with a shape, and only to one.
     [ZodDecorator.RESOURCE_REFERENCE]: ['ZodObject'],
     // TTL (Time To Live) - only for Date fields (MongoDB TTL indexes work on Date fields)
@@ -277,6 +282,7 @@ const STRING_SCHEMA_DECORATOR_SURFACE = [
     ZodDecorator.IS_AUDIT_EVIDENCE,
     ZodDecorator.IS_LAST_ACTION_RECORD,
     ZodDecorator.IS_DECIDER,
+    ZodDecorator.IS_ROLE_GRANT,
     // RAG source — string-backed by nature (only text can be a corpus source), and a format validator
     // is a legitimate carrier: markdown/documentation fields are routinely `z.string()`, but a
     // `z.url()` pointing at authored content is not excluded from being chunked as text.
@@ -487,6 +493,25 @@ export const ZodDecorator_FunctionType = {
             },
         ]);
     },
+    // compoundIndex (#3142): one more NON-unique index over several fields of this object. Validated at decoration time,
+    // like businessKeySet, so an index cannot name a field the row does not carry; storage would otherwise build an index
+    // over a path that is always empty, or the SQL plan would refuse at migration time, far from the declaration.
+    compoundIndex: function (fields) {
+        if (!Array.isArray(fields) || fields.length < 2) {
+            throw new Error(`compoundIndex([...]) needs at least two field names (received ${JSON.stringify(fields)}); a one-field index is .isDBIndexed() on the field.`);
+        }
+        const repeated = fields.filter((field, index) => fields.indexOf(field) !== index);
+        if (repeated.length > 0) {
+            throw new Error(`compoundIndex([...]) names a field more than once: ${[...new Set(repeated)].join(', ')}.`);
+        }
+        const node = this;
+        const shape = node.shape ?? node._zod?.def?.shape;
+        const missing = fields.filter((field) => !shape || !(field in shape));
+        if (missing.length > 0) {
+            throw new Error(`compoundIndex([...]) references field(s) not present in the schema shape: ${missing.join(', ')}.`);
+        }
+        return addDecorators(this, [{ ref: ZodDecorator.OBJECT_COMPOUND_INDEX, params: { fields: [...fields] } }]);
+    },
     // isResourceReference (#2471): the object names one row of a resource chosen at run time. Validated at decoration
     // time, like businessKeySet: the object must HAVE the two members the reference is read through, or a form would
     // offer a picker that writes into fields the schema does not carry.
@@ -526,6 +551,7 @@ export const ZodDecorator_FunctionType = {
     // Last-action record — a PURE parameterless marker, like isAuditEvidence: it implies no other decorator.
     isLastActionRecord: function () { return addDecorators(this, [ZodDecorator.IS_LAST_ACTION_RECORD]); },
     isDecider: function () { return addDecorators(this, [ZodDecorator.IS_DECIDER]); },
+    isRoleGrant: function () { return addDecorators(this, [ZodDecorator.IS_ROLE_GRANT]); },
     // RAG source (resource-native RAG capability). The config is OPTIONAL — a bare `.ragSource()` is a
     // complete declaration — so unlike impersonalizeWith there is no required-value door to guard;
     // what the shared `applySingleDecorator` chokepoint enforces instead is config validity
@@ -1238,6 +1264,48 @@ function assertCalendarDateNotDateTime(decorator, currentMetadata) {
             'Declare a day with isCalendarDate() (and dateUI() for its display), or a moment with dateTimeUI().');
     }
 }
+/**
+ * The decorators that mark a value as a SECRET, each with the reason a subject-disclosed backend-only field
+ * (`isBackendOnly({ disclosedToSubject: true })`, #2958) may never carry it. One table, consulted in both application
+ * orders by {@link assertSubjectDisclosureAdmissible}, at the same chokepoint as the RAG-source pairs, so no door into the
+ * metadata bypasses it.
+ */
+const SUBJECT_DISCLOSURE_REFUSED_COMPANIONS = new Map([
+    [ZodDecorator.IS_PASSWORD, 'a password never leaves the backend, not even to the person it belongs to.'],
+    [ZodDecorator.IS_OTP, 'a one-time code never leaves the backend once it was sent.'],
+    [ZodDecorator.IS_WRITE_ONLY_SECRET, 'a write-only secret is masked on every response, so it is not disclosed to anyone.'],
+    [ZodDecorator.IS_EPHEMERAL, 'an ephemeral value is shown once, when it is minted, and never again.'],
+]);
+/** Whether a stored `IS_BACKEND_ONLY` value declares the subject-disclosure opt-in. */
+function declaresDisclosedToSubject(value) {
+    return typeof value === 'object' && value !== null && value.disclosedToSubject === true;
+}
+/**
+ * Refuse `isBackendOnly({ disclosedToSubject: true })` on a field that holds a secret, in either order (#2958): applied to
+ * a field already marked a secret, applied with `isReturnedAtCreation` (a server-minted secret shown once), or a secret
+ * marker applied to a field already opted in. Run after an updater is resolved, so an updater that adds the opt-in is
+ * checked too, and before anything is written.
+ */
+function assertSubjectDisclosureAdmissible(decorator, params, currentMetadata) {
+    if (decorator === ZodDecorator.IS_BACKEND_ONLY) {
+        if (!declaresDisclosedToSubject(params))
+            return;
+        if (params.isReturnedAtCreation) {
+            throw new Error('isBackendOnly() cannot declare both disclosedToSubject and isReturnedAtCreation: a value returned once at creation is a '
+                + 'server-minted secret, and a subject export never discloses a secret.');
+        }
+        for (const [companion, reason] of SUBJECT_DISCLOSURE_REFUSED_COMPANIONS) {
+            if (currentMetadata[companion] !== undefined) {
+                throw new Error(`isBackendOnly({ disclosedToSubject: true }) cannot be combined with ${companion}(): ${reason}`);
+            }
+        }
+        return;
+    }
+    const reason = SUBJECT_DISCLOSURE_REFUSED_COMPANIONS.get(decorator);
+    if (reason !== undefined && declaresDisclosedToSubject(currentMetadata[ZodDecorator.IS_BACKEND_ONLY])) {
+        throw new Error(`${decorator}() cannot be combined with isBackendOnly({ disclosedToSubject: true }): ${reason}`);
+    }
+}
 function applySingleDecorator(schema, decorator, params) {
     // Ensure schema exists before accessing Symbol property
     if (!schema) {
@@ -1260,6 +1328,8 @@ function applySingleDecorator(schema, decorator, params) {
         params = params(currentValue);
         resolvedFromUpdater = true;
     }
+    // A subject-disclosed backend-only field never holds a secret (#2958). Checked on the RESOLVED params, before any write.
+    assertSubjectDisclosureAdmissible(decorator, params, currentMetadata);
     // After function resolution, params is a concrete value (never a function).
     // TypeScript can't narrow this from control flow. Use `rp<D>()` for typed
     // access in cases that read properties; use `p` for simple assignments.
@@ -1405,6 +1475,9 @@ function applySingleDecorator(schema, decorator, params) {
         case ZodDecorator.IS_DECIDER:
             currentMetadata[ZodDecorator.IS_DECIDER] = true;
             break;
+        case ZodDecorator.IS_ROLE_GRANT:
+            currentMetadata[ZodDecorator.IS_ROLE_GRANT] = true;
+            break;
         case ZodDecorator.RAG_SOURCE: {
             // NORMALIZE HERE, not in the doors — the impersonalizeWith discipline. A bare `.ragSource()`
             // (the common case) stores `{}` rather than `true`/`undefined`, so every reader sees ONE
@@ -1478,6 +1551,17 @@ function applySingleDecorator(schema, decorator, params) {
         case ZodDecorator.OBJECT_BUSINESS_KEY_SET:
             currentMetadata[ZodDecorator.OBJECT_BUSINESS_KEY_SET] = p;
             break;
+        case ZodDecorator.OBJECT_COMPOUND_INDEX: {
+            // ACCUMULATES: each call declares one more index. A fresh array, never a push, so the schema this one was
+            // derived from keeps its own list (decorators are builders, #1308). The same field list twice is one index.
+            const existing = (currentMetadata[ZodDecorator.OBJECT_COMPOUND_INDEX] ?? []);
+            const declared = p;
+            const key = declared.fields.join('\u0000');
+            currentMetadata[ZodDecorator.OBJECT_COMPOUND_INDEX] = existing.some((index) => index.fields.join('\u0000') === key)
+                ? existing
+                : [...existing, { fields: [...declared.fields] }];
+            break;
+        }
         case ZodDecorator.RESOURCE_REFERENCE:
             currentMetadata[ZodDecorator.RESOURCE_REFERENCE] = p;
             break;
@@ -2042,16 +2126,86 @@ function wrapMethodToPreserveMetadata(originalMethod, methodName) {
  * moves methods back onto prototypes — at which point the guard below stops being theoretical, since
  * `ZodString.prototype` is reached by both the STEP 1 pass and `installStringDecoratorSurface`.
  * Do NOT cite this function as the reason a decorator survives a chain; it is not.
+ *
+ * ⚠️ zod@4.6 DID move them (2026-11-09), as binding ACCESSORS installed lazily on the first instance. So
+ * this function is now live whenever a schema was built before this module ran, and inert otherwise
+ * (zod's own install then lands after it). It reads and writes through `readPrototypeMethod` /
+ * `installBoundPrototypeMethod`, because a plain `prototype[name]` read binds the method to the
+ * PROTOTYPE — see `readPrototypeMethod` for what that broke.
  */
 function patchPrototypeMethodsForMetadataPreservation(prototype, methodNames) {
     for (const methodName of methodNames) {
-        const originalMethod = prototype[methodName];
+        const originalMethod = readPrototypeMethod(prototype, methodName);
         if (typeof originalMethod !== 'function')
             continue;
         if (originalMethod.__prototypeMetadataWrapped)
             continue;
-        prototype[methodName] = wrapMethodToPreserveMetadata(originalMethod, methodName);
+        installBoundPrototypeMethod(prototype, methodName, wrapMethodToPreserveMetadata(originalMethod, methodName));
+    }
+}
+/**
+ * Reads a schema method off a PROTOTYPE without binding it to the prototype.
+ *
+ * zod 4.6 moved schema methods onto prototypes, as ACCESSORS: a trait's members are installed lazily on the
+ * constructor's prototype when its first instance is built (`util.members` → `defineBound`), and the getter binds the
+ * method to its receiver and memoizes it there — `own(this, key, fn.bind(this))`. So a plain `prototype[name]` runs
+ * that getter with the PROTOTYPE as `this` and permanently shadows the prototype with a method bound to itself. Every
+ * schema then inherited a `refine` whose `this` was the prototype, and zod's `check` read `this.def` off it: measured
+ * 2026-11-09 under vitest as `Cannot read properties of undefined (reading 'checks')` at `z.string().refine(…)`, which
+ * failed 13 suites of `saas-specifications` at import. It reproduced only when a schema had been built before this
+ * module ran (so the members were already installed), which is why `zod-decorators`' own suite stayed green.
+ *
+ * zod's getter answers the RAW method for a nullish receiver ("vitest's spyOn calls a prototype getter bare"), which is
+ * the read this needs. A data property (zod ≤ 4.3, or our own decorator) is returned as it is.
+ */
+function readPrototypeMethod(prototype, methodName) {
+    for (let at = prototype; at && at !== Object.prototype; at = Object.getPrototypeOf(at)) {
+        const descriptor = Object.getOwnPropertyDescriptor(at, methodName);
+        if (!descriptor)
+            continue;
+        if ('value' in descriptor)
+            return descriptor.value;
+        if (!descriptor.get)
+            return undefined;
+        try {
+            return descriptor.get.call(undefined);
+        }
+        catch {
+            // A getter that derives a value from its instance is not a method; there is nothing to wrap.
+            return undefined;
+        }
     }
+    return undefined;
+}
+/**
+ * Installs a method on a prototype with zod 4.6's own member semantics: bound to the instance on first read and
+ * memoized there, so a detached member (`const opt = schema.optional; opt()`) keeps working as it does for zod's own,
+ * and assignment shadows on the instance.
+ *
+ * Only a receiver that INHERITS from `prototype` is an instance read. Every other receiver gets the unbound method and
+ * nothing is memoized, which is what zod's own getter answers for a nullish one. The test is deliberately not
+ * `this == null`: in sloppy-mode code a getter called with an `undefined` receiver sees `globalThis`, and this module
+ * runs sloppy whenever tsx transforms it to CommonJS (every `wildo.saas.config.ts` imported through tsx — see
+ * `prototype-member-binding.zod46.test.ts`). Measured 2026-11-09: `readPrototypeMethod`'s bare read then memoized
+ * eleven zod methods on `globalThis` and returned a copy bound to it without the wrap marker, the next patch pass wrapped
+ * that copy, and `z.string().refine(…)` threw `this.check is not a function` while `@wildo-ai/zod-decorators` loaded.
+ * The same predicate keeps a plain `prototype[name]` read from binding the method to the prototype itself.
+ */
+function installBoundPrototypeMethod(prototype, methodName, method) {
+    Object.defineProperty(prototype, methodName, {
+        configurable: true,
+        enumerable: false,
+        get() {
+            if (!Object.prototype.isPrototypeOf.call(prototype, this))
+                return method;
+            const bound = method.bind(this);
+            Object.defineProperty(this, methodName, { configurable: true, enumerable: true, writable: true, value: bound });
+            return bound;
+        },
+        set(value) {
+            Object.defineProperty(this, methodName, { configurable: true, enumerable: true, writable: true, value });
+        },
+    });
 }
 /**
  * Install the WHOLE string decorator surface on one string-backed prototype.
@@ -2063,8 +2217,9 @@ function patchPrototypeMethodsForMetadataPreservation(prototype, methodNames) {
  * the method while the other is not.
  *
  * Also calls the metadata-preservation patch, matching what each of the three install sites did
- * before. Note that this call is INERT on zod@4.3.6 — see that function's own docblock; schema
- * methods live on instances, and `addChainableMethods` is what preserves metadata through a chain.
+ * before. Note that this call was INERT on zod@4.3.6 and is live on 4.6 only when a schema was built
+ * first — see that function's own docblock; `addChainableMethods` is what preserves metadata through a
+ * chain.
  * It is passed through rather than dropped so the two stay coupled if Zod's method placement changes.
  *
  * @param prototype - a Zod string-schema prototype (`ZodString.prototype`, `ZodUUID.prototype`, …)
@@ -2173,6 +2328,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodNumber.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodNumber.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodNumber.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodNumber.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodNumber.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodNumber.prototype[ZodDecorator.IS_DISCRIMINATOR] = ZodDecorator_FunctionType[ZodDecorator.IS_DISCRIMINATOR];
     zodInstance.ZodNumber.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
@@ -2220,6 +2376,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodBigInt.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodBigInt.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodBigInt.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodBigInt.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodBigInt.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodBigInt.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
     zodInstance.ZodBigInt.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2243,6 +2400,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodBoolean.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodBoolean.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodBoolean.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodBoolean.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodBoolean.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodBoolean.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
     zodInstance.ZodBoolean.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2273,6 +2431,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodDate.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodDate.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodDate.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodDate.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodDate.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodDate.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
     zodInstance.ZodDate.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2310,6 +2469,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodOptional.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodOptional.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodOptional.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodOptional.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     // RAG source — ZodOptional is the ONE wrapper with a hand-enumerated block (its siblings get every
     // FunctionType entry from the blanket wrapper loop below), so this line is what keeps
     // `z.string().optional().ragSource()` from being the order-dependent half-live trap the
@@ -2402,6 +2562,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodEnum.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodEnum.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodEnum.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodEnum.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodEnum.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodEnum.prototype[ZodDecorator.IS_DISCRIMINATOR] = ZodDecorator_FunctionType[ZodDecorator.IS_DISCRIMINATOR];
     zodInstance.ZodEnum.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
@@ -2438,6 +2599,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
     zodInstance.ZodArray.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
     zodInstance.ZodArray.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
     zodInstance.ZodArray.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+    zodInstance.ZodArray.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
     zodInstance.ZodArray.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
     zodInstance.ZodArray.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
     zodInstance.ZodArray.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2473,10 +2635,13 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
      * before the object is wrapped (`WorkUnitRefSchema.optional()`), and read through any wrapper. `ZodOptional`,
      * whose list is written by hand, does not carry it either.
      *
+     * `compoundIndex` (#3142) is excluded for the same reason: it names fields of the OBJECT it decorates, and an index
+     * belongs to the stored row, whose schema is a plain object. It is read from the top-level object only.
+     *
      * Keep this a SET with a reason per member, never a silent condition in the loop body. An excluded
      * decorator is a decision; a missing one is a bug, and the two must not look alike.
      */
-    const WRAPPER_INSTALL_EXCLUSIONS = new Set([ZodDecorator.IS_PRIMARY_KEY, ZodDecorator.DOCUMENT_SEQUENCE, ZodDecorator.RESOURCE_REFERENCE]);
+    const WRAPPER_INSTALL_EXCLUSIONS = new Set([ZodDecorator.IS_PRIMARY_KEY, ZodDecorator.DOCUMENT_SEQUENCE, ZodDecorator.RESOURCE_REFERENCE, ZodDecorator.OBJECT_COMPOUND_INDEX]);
     // Wrapper types (ZodDefault, ZodNullable) need ALL decorators for chaining
     // e.g. z.date().default(...).excludeFromCreate().isNotEditable().showWhen(...)
     //
@@ -2514,6 +2679,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
         zi.ZodUnion.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
         zi.ZodUnion.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
         zi.ZodUnion.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+        zi.ZodUnion.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
         zi.ZodUnion.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
         zi.ZodUnion.prototype[ZodDecorator.IS_DISCRIMINATOR] = ZodDecorator_FunctionType[ZodDecorator.IS_DISCRIMINATOR];
         zi.ZodUnion.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
@@ -2536,6 +2702,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
         zi.ZodObject.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
         zi.ZodObject.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
         zi.ZodObject.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+        zi.ZodObject.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
         zi.ZodObject.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
         zi.ZodObject.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
         zi.ZodObject.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2543,6 +2710,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
         zi.ZodObject.prototype[ZodDecorator.IS_CRDT] = ZodDecorator_FunctionType[ZodDecorator.IS_CRDT];
         // Composite business key (data-seeding subsystem)
         zi.ZodObject.prototype[ZodDecorator.OBJECT_BUSINESS_KEY_SET] = ZodDecorator_FunctionType[ZodDecorator.OBJECT_BUSINESS_KEY_SET];
+        zi.ZodObject.prototype[ZodDecorator.OBJECT_COMPOUND_INDEX] = ZodDecorator_FunctionType[ZodDecorator.OBJECT_COMPOUND_INDEX];
         zi.ZodObject.prototype[ZodDecorator.RESOURCE_REFERENCE] = ZodDecorator_FunctionType[ZodDecorator.RESOURCE_REFERENCE];
         // Generic form-field decorators (conditional visibility / draft relaxation).
         zi.ZodObject.prototype[ZodDecorator.SHOW_WHEN] = ZodDecorator_FunctionType[ZodDecorator.SHOW_WHEN];
@@ -2568,6 +2736,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
         zi.ZodRecord.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
         zi.ZodRecord.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
         zi.ZodRecord.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+        zi.ZodRecord.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
         zi.ZodRecord.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
         zi.ZodRecord.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
         zi.ZodRecord.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];
@@ -2598,6 +2767,7 @@ export function ensureZodDecoratorsLoaded(zodInstance = z) {
         zi.ZodMap.prototype[ZodDecorator.IS_AUDIT_EVIDENCE] = ZodDecorator_FunctionType[ZodDecorator.IS_AUDIT_EVIDENCE];
         zi.ZodMap.prototype[ZodDecorator.IS_LAST_ACTION_RECORD] = ZodDecorator_FunctionType[ZodDecorator.IS_LAST_ACTION_RECORD];
         zi.ZodMap.prototype[ZodDecorator.IS_DECIDER] = ZodDecorator_FunctionType[ZodDecorator.IS_DECIDER];
+        zi.ZodMap.prototype[ZodDecorator.IS_ROLE_GRANT] = ZodDecorator_FunctionType[ZodDecorator.IS_ROLE_GRANT];
         zi.ZodMap.prototype[ZodDecorator.IS_VIRTUAL] = ZodDecorator_FunctionType[ZodDecorator.IS_VIRTUAL];
         zi.ZodMap.prototype[ZodDecorator.EXCLUDE_FROM_CREATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_CREATE];
         zi.ZodMap.prototype[ZodDecorator.EXCLUDE_FROM_UPDATE] = ZodDecorator_FunctionType[ZodDecorator.EXCLUDE_FROM_UPDATE];