prisma-guard 1.2.0 → 1.2.1

package/dist/runtime/index.js

@@ -33,12 +33,6 @@ function formatZodError(err) {
   }).join("; ");
 }
 
-// src/runtime/schema-builder.ts
-import { z as z3 } from "zod";
-
-// src/runtime/zod-type-map.ts
-import { z as z2 } from "zod";
-
 // src/shared/scalar-base.ts
 import { z } from "zod";
 function isJsonSafe(value) {
@@ -89,43 +83,54 @@ function isJsonSafe(value) {
   }
   return true;
 }
-var SCALAR_BASE = {
-  String: () => z.string(),
-  Int: () => z.number().int(),
-  Float: () => z.number(),
-  Decimal: () => z.union([
-    z.number(),
-    z.string().refine(
-      (s) => /^-?(\d+\.?\d*|\.\d+)([eE]-?\d+)?$/.test(s),
-      "Invalid decimal string"
-    ),
-    z.custom(
-      (v) => v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function",
-      "Expected Decimal-compatible object"
-    )
-  ]),
-  BigInt: () => z.union([
-    z.bigint(),
-    z.number().int().refine(
-      (v) => v >= Number.MIN_SAFE_INTEGER && v <= Number.MAX_SAFE_INTEGER,
-      "Number exceeds safe integer range for BigInt conversion"
-    ).transform((v) => BigInt(v)),
-    z.string().regex(/^-?\d+$/).transform((v) => BigInt(v))
-  ]),
-  Boolean: () => z.boolean(),
-  DateTime: () => z.union([
-    z.date(),
-    z.string().datetime({ offset: true }),
-    z.string().datetime()
-  ]).pipe(z.coerce.date()),
-  Json: () => z.unknown().refine(isJsonSafe, "Value must be JSON-serializable (no undefined, functions, symbols, class instances, NaN, Infinity, or circular references)"),
-  Bytes: () => z.union([
-    z.string(),
-    z.custom((v) => v instanceof Uint8Array)
-  ])
-};
+var DECIMAL_REGEX = /^-?(\d+\.?\d*|\.\d+)([eE]-?\d+)?$/;
+var decimalStringSchema = z.string().refine(
+  (s) => DECIMAL_REGEX.test(s),
+  "Invalid decimal string"
+);
+var decimalObjectSchema = z.custom(
+  (v) => v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function",
+  "Expected Decimal-compatible object"
+);
+function createDecimalFactory(strict) {
+  if (strict) {
+    return () => z.union([decimalStringSchema, decimalObjectSchema]);
+  }
+  return () => z.union([z.number(), decimalStringSchema, decimalObjectSchema]);
+}
+function createScalarBase(strictDecimal) {
+  return {
+    String: () => z.string(),
+    Int: () => z.number().int(),
+    Float: () => z.number(),
+    Decimal: createDecimalFactory(strictDecimal),
+    BigInt: () => z.union([
+      z.bigint(),
+      z.number().int().refine(
+        (v) => v >= Number.MIN_SAFE_INTEGER && v <= Number.MAX_SAFE_INTEGER,
+        "Number exceeds safe integer range for BigInt conversion"
+      ).transform((v) => BigInt(v)),
+      z.string().regex(/^-?\d+$/).transform((v) => BigInt(v))
+    ]),
+    Boolean: () => z.boolean(),
+    DateTime: () => z.union([
+      z.date(),
+      z.string().datetime({ offset: true })
+    ]).pipe(z.coerce.date()),
+    Json: () => z.unknown().refine(isJsonSafe, "Value must be JSON-serializable (no undefined, functions, symbols, class instances, NaN, Infinity, or circular references)"),
+    Bytes: () => z.union([
+      z.string(),
+      z.custom((v) => v instanceof Uint8Array)
+    ])
+  };
+}
+var SCALAR_BASE = createScalarBase(false);
+
+// src/runtime/schema-builder.ts
+import { z as z3 } from "zod";
 
 // src/runtime/zod-type-map.ts
+import { z as z2 } from "zod";
 var SCALAR_OPERATORS = {
   String: /* @__PURE__ */ new Set(["equals", "not", "contains", "startsWith", "endsWith", "in", "notIn"]),
   Int: /* @__PURE__ */ new Set(["equals", "not", "gt", "gte", "lt", "lte", "in", "notIn"]),
@@ -150,7 +155,7 @@ function getSupportedOperators(fieldMeta) {
     return [];
   return [...ops];
 }
-function createBaseType(fieldMeta, enumMap) {
+function createBaseType(fieldMeta, enumMap, scalarBase) {
   let base;
   if (fieldMeta.isEnum) {
     const values = enumMap[fieldMeta.type];
@@ -159,7 +164,7 @@ function createBaseType(fieldMeta, enumMap) {
     }
     base = z2.enum(values);
   } else {
-    const factory = SCALAR_BASE[fieldMeta.type];
+    const factory = scalarBase[fieldMeta.type];
     if (!factory) {
       throw new ShapeError(`Unknown scalar type: ${fieldMeta.type}`);
     }
@@ -170,7 +175,7 @@ function createBaseType(fieldMeta, enumMap) {
   }
   return base;
 }
-function createScalarListOperatorSchema(fieldMeta, operator, enumMap) {
+function createScalarListOperatorSchema(fieldMeta, operator, enumMap, scalarBase) {
   if (!SCALAR_LIST_OPERATORS.has(operator)) {
     throw new ShapeError(`Operator "${operator}" not supported for scalar list fields`);
   }
@@ -179,19 +184,19 @@ function createScalarListOperatorSchema(fieldMeta, operator, enumMap) {
   }
   if (operator === "equals") {
     const itemMeta2 = { ...fieldMeta, isList: false };
-    const itemBase2 = createBaseType(itemMeta2, enumMap);
+    const itemBase2 = createBaseType(itemMeta2, enumMap, scalarBase);
     return fieldMeta.isRequired ? z2.array(itemBase2) : z2.union([z2.array(itemBase2), z2.null()]);
   }
   const itemMeta = { ...fieldMeta, isList: false };
-  const itemBase = createBaseType(itemMeta, enumMap);
+  const itemBase = createBaseType(itemMeta, enumMap, scalarBase);
   if (operator === "has") {
     return !fieldMeta.isRequired ? z2.union([itemBase, z2.null()]) : itemBase;
   }
   return z2.array(itemBase);
 }
-function createOperatorSchema(fieldMeta, operator, enumMap) {
+function createOperatorSchema(fieldMeta, operator, enumMap, scalarBase) {
   if (fieldMeta.isList) {
-    return createScalarListOperatorSchema(fieldMeta, operator, enumMap);
+    return createScalarListOperatorSchema(fieldMeta, operator, enumMap, scalarBase);
   }
   if (fieldMeta.isEnum) {
     const values = enumMap[fieldMeta.type];
@@ -220,7 +225,7 @@ function createOperatorSchema(fieldMeta, operator, enumMap) {
   if (!supportedOps.has(operator)) {
     throw new ShapeError(`Operator "${operator}" not supported for type "${fieldMeta.type}"`);
   }
-  const factory = SCALAR_BASE[fieldMeta.type];
+  const factory = scalarBase[fieldMeta.type];
   if (!factory) {
     throw new ShapeError(`Unknown scalar type: ${fieldMeta.type}`);
   }
@@ -237,6 +242,24 @@ function createOperatorSchema(fieldMeta, operator, enumMap) {
   return scalar;
 }
 
+// src/shared/utils.ts
+function isPlainObject(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v))
+    return false;
+  const proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
+function schemaProducesValueForUndefined(schema) {
+  const result = schema.safeParse(void 0);
+  return result.success && result.data !== void 0;
+}
+function isZodSchema(value) {
+  if (value == null || typeof value !== "object")
+    return false;
+  const v = value;
+  return typeof v.parse === "function" && typeof v.optional === "function";
+}
+
 // src/runtime/schema-builder.ts
 var DEFAULT_MAX_CACHE = 500;
 var DEFAULT_MAX_DEPTH = 5;
@@ -258,13 +281,7 @@ function lruSet(cache, key, value, maxSize) {
       cache.delete(oldest);
   }
 }
-function isZodSchema(value) {
-  if (value == null || typeof value !== "object")
-    return false;
-  const v = value;
-  return typeof v.parse === "function" && typeof v.optional === "function";
-}
-function createSchemaBuilder(typeMap, zodChains, enumMap) {
+function createSchemaBuilder(typeMap, zodChains, enumMap, scalarBase, zodDefaults) {
   const chainCache = /* @__PURE__ */ new Map();
   function buildFieldSchema(model, field) {
     const cacheKey = `${model}.${field}`;
@@ -277,7 +294,7 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
     const fieldMeta = modelFields[field];
     if (!fieldMeta)
       throw new ShapeError(`Unknown field "${field}" on model "${model}"`);
-    const base = createBaseType(fieldMeta, enumMap);
+    const base = createBaseType(fieldMeta, enumMap, scalarBase);
     let result = base;
     const chainFn = zodChains[model]?.[field];
     if (chainFn) {
@@ -300,7 +317,7 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
     const fieldMeta = modelFields[field];
     if (!fieldMeta)
       throw new ShapeError(`Unknown field "${field}" on model "${model}"`);
-    return createBaseType(fieldMeta, enumMap);
+    return createBaseType(fieldMeta, enumMap, scalarBase);
   }
   function buildInputSchema(model, opts) {
     if (opts.pick && opts.omit) {
@@ -311,6 +328,8 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    const zodDefaultFields = zodDefaults[model];
+    const zodDefaultSet = zodDefaultFields ? new Set(zodDefaultFields) : void 0;
     let fieldNames = Object.keys(modelFields).filter((name) => {
       const meta = modelFields[name];
       return !meta.isRelation && !meta.isUpdatedAt;
@@ -336,6 +355,7 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
     for (const name of fieldNames) {
       const fieldMeta = modelFields[name];
       let fieldSchema;
+      let handlesUndefined;
       if (opts.refine?.[name]) {
         let refined;
         try {
@@ -352,14 +372,22 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
           );
         }
         fieldSchema = refined;
+        handlesUndefined = schemaProducesValueForUndefined(fieldSchema);
       } else {
         fieldSchema = buildFieldSchema(model, name);
+        handlesUndefined = zodDefaultSet !== void 0 && zodDefaultSet.has(name);
       }
       if (mode === "create") {
         if (!fieldMeta.isRequired) {
-          fieldSchema = allowNull ? fieldSchema.nullable().optional() : fieldSchema.optional();
+          if (handlesUndefined) {
+            fieldSchema = allowNull ? fieldSchema.nullable() : fieldSchema;
+          } else {
+            fieldSchema = allowNull ? fieldSchema.nullable().optional() : fieldSchema.optional();
+          }
         } else if (fieldMeta.hasDefault) {
-          fieldSchema = fieldSchema.optional();
+          if (!handlesUndefined) {
+            fieldSchema = fieldSchema.optional();
+          }
         }
       } else {
         if (!fieldMeta.isRequired && allowNull) {
@@ -420,7 +448,7 @@ function createSchemaBuilder(typeMap, zodChains, enumMap) {
     const schemaMap = {};
     for (const name of scalarNames) {
       const fieldMeta = modelFields[name];
-      let fieldSchema = createBaseType(fieldMeta, enumMap);
+      let fieldSchema = createBaseType(fieldMeta, enumMap, scalarBase);
       if (!fieldMeta.isRequired) {
         fieldSchema = fieldSchema.nullable();
       }
@@ -505,6 +533,8 @@ var SHAPE_CONFIG_KEYS = /* @__PURE__ */ new Set([
 ]);
 var GUARD_SHAPE_KEYS = /* @__PURE__ */ new Set([
   "data",
+  "create",
+  "update",
   ...SHAPE_CONFIG_KEYS
 ]);
 var COMBINATOR_KEYS = /* @__PURE__ */ new Set(["AND", "OR", "NOT"]);
@@ -514,6 +544,15 @@ var ALL_RELATION_OPS = /* @__PURE__ */ new Set([...TO_MANY_RELATION_OPS, ...TO_O
 function toDelegateKey(modelName) {
   return modelName[0].toLowerCase() + modelName.slice(1);
 }
+var FORCED_MARKER = Symbol.for("prisma-guard.forced");
+function isForcedValue(v) {
+  return v !== null && typeof v === "object" && v[FORCED_MARKER] === true;
+}
+function force(value) {
+  const wrapper = { value };
+  wrapper[FORCED_MARKER] = true;
+  return wrapper;
+}
 
 // src/shared/match-caller.ts
 function matchCallerPattern(patterns, caller) {
@@ -549,14 +588,6 @@ function matchCallerPattern(patterns, caller) {
   return matches[0];
 }
 
-// src/shared/is-plain-object.ts
-function isPlainObject(v) {
-  if (typeof v !== "object" || v === null || Array.isArray(v))
-    return false;
-  const proto = Object.getPrototypeOf(v);
-  return proto === Object.prototype || proto === null;
-}
-
 // src/runtime/policy.ts
 function requireContext(ctx, label) {
   if (ctx === void 0 || ctx === null) {
@@ -580,6 +611,37 @@ function validateContext(ctx) {
 // src/runtime/query-builder-where.ts
 import { z as z4 } from "zod";
 
+// src/shared/deep-clone.ts
+function deepClone(value) {
+  if (value === null || value === void 0)
+    return value;
+  switch (typeof value) {
+    case "string":
+    case "number":
+    case "boolean":
+    case "bigint":
+      return value;
+    case "object": {
+      if (value instanceof Date)
+        return new Date(value.getTime());
+      if (value instanceof Uint8Array)
+        return value.slice();
+      if (Array.isArray(value))
+        return value.map(deepClone);
+      const proto = Object.getPrototypeOf(value);
+      if (proto !== Object.prototype && proto !== null)
+        return value;
+      const result = {};
+      for (const [k, v] of Object.entries(value)) {
+        result[k] = deepClone(v);
+      }
+      return result;
+    }
+    default:
+      return value;
+  }
+}
+
 // src/runtime/query-builder-forced.ts
 var EMPTY_WHERE_FORCED = { conditions: {}, relations: {} };
 function hasWhereForced(f) {
@@ -588,7 +650,7 @@ function hasWhereForced(f) {
 function mergeWhereForced(where, forced) {
   if (!hasWhereForced(forced))
     return where ?? {};
-  let result = where ? structuredClone(where) : {};
+  let result = where ? deepClone(where) : {};
   for (const [relName, opMap] of Object.entries(forced.relations)) {
     if (!result[relName] || typeof result[relName] !== "object") {
       result[relName] = {};
@@ -602,7 +664,7 @@ function mergeWhereForced(where, forced) {
     }
   }
   if (Object.keys(forced.conditions).length > 0) {
-    const scalarClone = structuredClone(forced.conditions);
+    const scalarClone = deepClone(forced.conditions);
     if (Object.keys(result).length === 0) {
       result = scalarClone;
     } else {
@@ -628,7 +690,7 @@ function mergeUniqueWhereForced(where, forced) {
     }
   }
   if (Object.keys(forced.conditions).length > 0) {
-    const conditions = [structuredClone(forced.conditions)];
+    const conditions = [deepClone(forced.conditions)];
     const existing = result.AND;
     if (existing) {
       if (Array.isArray(existing)) {
@@ -670,6 +732,13 @@ function applyBuiltShape(built, body, isUniqueMethod) {
   }
   return validated;
 }
+function buildCountForPlacement(countWhere) {
+  const countSelect = {};
+  for (const [countRel, countForced] of Object.entries(countWhere)) {
+    countSelect[countRel] = { where: mergeWhereForced(void 0, countForced) };
+  }
+  return { _count: { select: countSelect } };
+}
 function applyForcedTree(validated, key, tree) {
   const container = validated[key];
   if (!container)
@@ -692,11 +761,11 @@ function applyForcedTree(validated, key, tree) {
         applyForcedTree(expanded, "select", forced.select);
       }
       if (forced._countWhere && Object.keys(forced._countWhere).length > 0) {
-        const countSelect = {};
-        for (const [countRel, countForced] of Object.entries(forced._countWhere)) {
-          countSelect[countRel] = { where: mergeWhereForced(void 0, countForced) };
-        }
-        expanded._count = { select: countSelect };
+        const placement = forced._countWherePlacement ?? "include";
+        if (!expanded[placement])
+          expanded[placement] = {};
+        const placementObj = expanded[placement];
+        Object.assign(placementObj, buildCountForPlacement(forced._countWhere));
       }
       if (expanded.include && expanded.select) {
         throw new ShapeError(
@@ -725,7 +794,11 @@ function applyForcedTree(validated, key, tree) {
         applyForcedTree(relObj, "select", forced.select);
       }
       if (forced._countWhere && Object.keys(forced._countWhere).length > 0) {
-        applyForcedCountWhere(relObj, forced._countWhere);
+        const placement = forced._countWherePlacement ?? "include";
+        const projContainer = relObj[placement];
+        if (projContainer) {
+          applyForcedCountWhere(projContainer, forced._countWhere);
+        }
       }
       if (relObj.include && relObj.select) {
         throw new ShapeError(
@@ -747,11 +820,11 @@ function buildForcedOnlyContainer(tree) {
     if (forced.select)
       nested.select = buildForcedOnlyContainer(forced.select);
     if (forced._countWhere && Object.keys(forced._countWhere).length > 0) {
-      const countSelect = {};
-      for (const [countRel, countForced] of Object.entries(forced._countWhere)) {
-        countSelect[countRel] = { where: mergeWhereForced(void 0, countForced) };
-      }
-      nested._count = { select: countSelect };
+      const placement = forced._countWherePlacement ?? "include";
+      if (!nested[placement])
+        nested[placement] = {};
+      const placementObj = nested[placement];
+      Object.assign(placementObj, buildCountForPlacement(forced._countWhere));
     }
     result[relName] = Object.keys(nested).length > 0 ? nested : true;
   }
@@ -813,29 +886,38 @@ function validateResolvedUniqueWhere(model, where, method, uniqueMap) {
     );
   }
 }
-function validateUniqueEquality(model, where, method, uniqueMap, typeMap) {
-  const constraints = uniqueMap[model];
-  if (!constraints || constraints.length === 0)
-    return;
+function collectEqualityFields(where, model, typeMap) {
   const combinators = /* @__PURE__ */ new Set(["AND", "OR", "NOT"]);
-  const whereFields = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(where)) {
+  const fields = /* @__PURE__ */ new Set();
+  for (const [key, value] of Object.entries(where)) {
+    if (key === "AND") {
+      if (isPlainObject(value)) {
+        for (const f of collectEqualityFields(value, model, typeMap)) {
+          fields.add(f);
+        }
+      }
+      continue;
+    }
     if (combinators.has(key))
       continue;
-    if (typeMap && typeMap[model]?.[key]?.isRelation)
+    if (typeMap && model && typeMap[model]?.[key]?.isRelation)
+      continue;
+    if (!value || !isPlainObject(value))
       continue;
-    whereFields.add(key);
+    if (Object.keys(value).every((op) => op === "equals")) {
+      fields.add(key);
+    }
   }
-  const valid = constraints.some((constraint) => {
-    if (!constraint.every((field) => whereFields.has(field)))
-      return false;
-    return constraint.every((field) => {
-      const ops = where[field];
-      if (!ops || !isPlainObject(ops))
-        return false;
-      return Object.keys(ops).every((op) => op === "equals");
-    });
-  });
+  return fields;
+}
+function validateUniqueEquality(model, where, method, uniqueMap, typeMap) {
+  const constraints = uniqueMap[model];
+  if (!constraints || constraints.length === 0)
+    return;
+  const equalityFields = collectEqualityFields(where, model, typeMap);
+  const valid = constraints.some(
+    (constraint) => constraint.every((field) => equalityFields.has(field))
+  );
   if (!valid) {
     const constraintDesc = constraints.map((c) => `(${c.join(", ")})`).join(" | ");
     throw new ShapeError(
@@ -847,6 +929,7 @@ function validateUniqueEquality(model, where, method, uniqueMap, typeMap) {
 // src/runtime/query-builder-where.ts
 var UNSUPPORTED_WHERE_TYPES = /* @__PURE__ */ new Set(["Json", "Bytes"]);
 var STRING_MODE_OPS = /* @__PURE__ */ new Set(["contains", "startsWith", "endsWith", "equals"]);
+var MAX_WHERE_DEPTH = 10;
 function safeStringify(v) {
   if (typeof v === "bigint")
     return `${v}n`;
@@ -937,8 +1020,14 @@ function mergeRelationForcedMaps(target, source) {
     }
   }
 }
-function createWhereBuilder(typeMap, enumMap) {
-  function buildWhereSchema(model, whereConfig) {
+function createWhereBuilder(typeMap, enumMap, scalarBase) {
+  function buildWhereSchema(model, whereConfig, depth) {
+    const currentDepth = depth ?? 0;
+    if (currentDepth > MAX_WHERE_DEPTH) {
+      throw new ShapeError(
+        `Where schema for model "${model}" exceeds maximum nesting depth (${MAX_WHERE_DEPTH}). Check for circular relation references in the shape.`
+      );
+    }
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
@@ -953,7 +1042,8 @@ function createWhereBuilder(typeMap, enumMap) {
           model,
           fieldSchemas,
           scalarConditions,
-          relationForced
+          relationForced,
+          currentDepth
         );
         continue;
       }
@@ -965,8 +1055,10 @@ function createWhereBuilder(typeMap, enumMap) {
           key,
           value,
           fieldMeta,
+          model,
           fieldSchemas,
-          relationForced
+          relationForced,
+          currentDepth
         );
         continue;
       }
@@ -986,16 +1078,28 @@ function createWhereBuilder(typeMap, enumMap) {
       }
     };
   }
-  function processCombinator(key, value, model, fieldSchemas, parentConditions, parentRelations) {
+  function processCombinator(key, value, model, fieldSchemas, parentConditions, parentRelations, depth) {
     if (!isPlainObject(value)) {
       throw new ShapeError(`"${key}" in where shape must be an object defining allowed fields`);
     }
-    const result = buildWhereSchema(model, value);
+    const result = buildWhereSchema(model, value, depth + 1);
+    if (!result.schema && !hasWhereForced(result.forced)) {
+      throw new ShapeError(
+        `Empty "${key}" combinator in where shape for model "${model}". Define at least one field.`
+      );
+    }
     if (result.schema) {
+      let elementSchema = result.schema;
+      if (!hasWhereForced(result.forced)) {
+        elementSchema = result.schema.refine(
+          (v) => v !== void 0 && v !== null && Object.keys(v).some((k) => v[k] !== void 0),
+          { message: `"${key}" member must specify at least one condition` }
+        );
+      }
       if (key === "NOT") {
-        fieldSchemas[key] = z4.union([result.schema, z4.array(result.schema)]).optional();
+        fieldSchemas[key] = z4.union([elementSchema, z4.array(elementSchema).min(1)]).optional();
       } else {
-        fieldSchemas[key] = z4.array(result.schema).optional();
+        fieldSchemas[key] = z4.array(elementSchema).min(1).optional();
       }
     }
     if (hasWhereForced(result.forced)) {
@@ -1015,11 +1119,16 @@ function createWhereBuilder(typeMap, enumMap) {
       }
     }
   }
-  function processRelationFilter(key, value, fieldMeta, fieldSchemas, parentRelations) {
+  function processRelationFilter(key, value, fieldMeta, model, fieldSchemas, parentRelations, depth) {
     if (!isPlainObject(value)) {
       throw new ShapeError(`Relation filter for "${key}" must be an object with operators (some, every, none, is, isNot)`);
     }
     const allowedOps = fieldMeta.isList ? TO_MANY_RELATION_OPS : TO_ONE_RELATION_OPS;
+    if (Object.keys(value).length === 0) {
+      throw new ShapeError(
+        `Empty relation filter for "${key}" on model "${model}". Define at least one operator: ${[...allowedOps].join(", ")}`
+      );
+    }
     const opSchemas = {};
     const opForced = {};
     let hasClientOps = false;
@@ -1035,7 +1144,12 @@ function createWhereBuilder(typeMap, enumMap) {
           `Relation filter operator "${op}" on "${key}" must be an object defining nested where fields`
         );
       }
-      const nested = buildWhereSchema(fieldMeta.type, opValue);
+      const nested = buildWhereSchema(fieldMeta.type, opValue, depth + 1);
+      if (!nested.schema && !hasWhereForced(nested.forced)) {
+        throw new ShapeError(
+          `Empty nested where for relation "${key}.${op}" on model "${model}". Define at least one field.`
+        );
+      }
       if (nested.schema) {
         if (!hasWhereForced(nested.forced)) {
           opSchemas[op] = nested.schema.refine(
@@ -1051,6 +1165,11 @@ function createWhereBuilder(typeMap, enumMap) {
         opForced[op] = nested.forced;
       }
     }
+    if (!hasClientOps && Object.keys(opForced).length === 0) {
+      throw new ShapeError(
+        `Relation filter for "${key}" on model "${model}" produced no conditions. Define at least one nested field in the operator shape.`
+      );
+    }
     if (hasClientOps) {
       const clientOpKeys = Object.keys(opSchemas);
       const opObjSchema = z4.object(opSchemas).strict();
@@ -1080,17 +1199,18 @@ function createWhereBuilder(typeMap, enumMap) {
     const clientOpKeys = [];
     for (const [op, opValue] of Object.entries(operators)) {
       if (opValue === true) {
-        opSchemas[op] = createOperatorSchema(fieldMeta, op, enumMap).optional();
+        opSchemas[op] = createOperatorSchema(fieldMeta, op, enumMap, scalarBase).optional();
         hasClientOps = true;
         clientOpKeys.push(op);
         if (fieldMeta.type === "String" && !fieldMeta.isList && STRING_MODE_OPS.has(op)) {
           hasStringModeOp = true;
         }
       } else {
-        const opSchema = createOperatorSchema(fieldMeta, op, enumMap);
+        const actualOpValue = isForcedValue(opValue) ? opValue.value : opValue;
+        const opSchema = createOperatorSchema(fieldMeta, op, enumMap, scalarBase);
         let parsed;
         try {
-          parsed = opSchema.parse(opValue);
+          parsed = opSchema.parse(actualOpValue);
         } catch (err) {
           throw new ShapeError(
             `Invalid forced value for "${model}.${fieldName}.${op}": ${err.message}`
@@ -1124,11 +1244,21 @@ function createWhereBuilder(typeMap, enumMap) {
 // src/runtime/query-builder-args.ts
 import { z as z5 } from "zod";
 var UNSUPPORTED_BY_TYPES = /* @__PURE__ */ new Set(["Json", "Bytes"]);
-function createArgsBuilder(typeMap, enumMap, uniqueMap) {
+function requireConfigTrue(config, context) {
+  for (const [key, value] of Object.entries(config)) {
+    if (value !== true) {
+      throw new ShapeError(
+        `Config value for "${key}" in ${context} must be true, got ${typeof value}`
+      );
+    }
+  }
+}
+function createArgsBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
   function buildOrderBySchema(model, orderByConfig) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(orderByConfig, `orderBy on model "${model}"`);
     const fieldSchemas = {};
     for (const fieldName of Object.keys(orderByConfig)) {
       const fieldMeta = modelFields[fieldName];
@@ -1174,16 +1304,17 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(cursorConfig, `cursor on model "${model}"`);
     const cursorFields = new Set(Object.keys(cursorConfig));
     const constraints = uniqueMap[model];
     if (constraints && constraints.length > 0) {
       const covered = constraints.some(
-        (constraint) => constraint.every((field) => cursorFields.has(field))
+        (constraint) => constraint.length === cursorFields.size && constraint.every((field) => cursorFields.has(field))
       );
       if (!covered) {
         const constraintDesc = constraints.map((c) => `(${c.join(", ")})`).join(" | ");
         throw new ShapeError(
-          `cursor on model "${model}" must cover a unique constraint: ${constraintDesc}`
+          `cursor on model "${model}" must exactly match a unique constraint: ${constraintDesc}`
         );
       }
     }
@@ -1196,7 +1327,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
         throw new ShapeError(`Relation field "${fieldName}" cannot be used in cursor`);
       if (fieldMeta.isList)
         throw new ShapeError(`List field "${fieldName}" cannot be used in cursor`);
-      fieldSchemas[fieldName] = createBaseType(fieldMeta, enumMap);
+      fieldSchemas[fieldName] = createBaseType(fieldMeta, enumMap, scalarBase);
     }
     return z5.object(fieldSchemas).strict().optional();
   }
@@ -1245,6 +1376,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(havingConfig, `having on model "${model}"`);
     const fieldSchemas = {};
     for (const fieldName of Object.keys(havingConfig)) {
       const fieldMeta = modelFields[fieldName];
@@ -1261,7 +1393,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
       const opSchemas = {};
       const opKeys = [];
       for (const op of ops) {
-        opSchemas[op] = createOperatorSchema(fieldMeta, op, enumMap).optional();
+        opSchemas[op] = createOperatorSchema(fieldMeta, op, enumMap, scalarBase).optional();
         opKeys.push(op);
       }
       if (fieldMeta.type === "String" && !fieldMeta.isList) {
@@ -1282,6 +1414,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(fieldConfig, `${opName} on model "${model}"`);
     const isNumericOnly = opName === "_avg" || opName === "_sum";
     const isComparableOnly = opName === "_min" || opName === "_max";
     const fieldSchemas = {};
@@ -1295,6 +1428,8 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
         throw new ShapeError(`Unknown field "${fieldName}" on model "${model}" in ${opName}`);
       if (fieldMeta.isRelation)
         throw new ShapeError(`Relation field "${fieldName}" cannot be used in ${opName}`);
+      if (fieldMeta.isList)
+        throw new ShapeError(`List field "${fieldName}" cannot be used in ${opName}`);
       if (isNumericOnly && !NUMERIC_TYPES.has(fieldMeta.type)) {
         throw new ShapeError(
           `Field "${fieldName}" (${fieldMeta.type}) cannot be used in ${opName}. Only numeric types (Int, Float, Decimal, BigInt) are supported.`
@@ -1320,6 +1455,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(config, `${context} on model "${model}"`);
     const fieldSchemas = {};
     for (const fieldName of Object.keys(config)) {
       if (fieldName !== "_all") {
@@ -1341,6 +1477,7 @@ function createArgsBuilder(typeMap, enumMap, uniqueMap) {
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
+    requireConfigTrue(selectConfig, `count select on model "${model}"`);
     const fieldSchemas = {};
     for (const fieldName of Object.keys(selectConfig)) {
       if (fieldName === "_all") {
@@ -1393,6 +1530,7 @@ var KNOWN_NESTED_SELECT_KEYS = /* @__PURE__ */ new Set([
   "skip"
 ]);
 var KNOWN_COUNT_SELECT_ENTRY_KEYS = /* @__PURE__ */ new Set(["where"]);
+var MAX_PROJECTION_DEPTH = 10;
 function validateNestedKeys(keys, allowed, context) {
   for (const key of keys) {
     if (!allowed.has(key)) {
@@ -1446,6 +1584,11 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
       if (fieldConfig === true) {
         countSelectFields[fieldName] = z6.literal(true).optional();
       } else if (isPlainObject(fieldConfig)) {
+        if (Object.keys(fieldConfig).length === 0) {
+          throw new ShapeError(
+            `Empty config for _count.select.${fieldName} on model "${model}". Use true or { where: { ... } }.`
+          );
+        }
         validateNestedKeys(
           Object.keys(fieldConfig),
           KNOWN_COUNT_SELECT_ENTRY_KEYS,
@@ -1474,13 +1617,28 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
         );
       }
     }
-    const selectSchema = z6.object(countSelectFields).strict();
+    const countSelectKeys = Object.keys(countSelectFields);
+    const selectSchema = z6.object(countSelectFields).strict().refine(
+      (v) => countSelectKeys.some((k) => v[k] !== void 0),
+      { message: "_count.select must specify at least one field" }
+    );
     return {
       schema: z6.object({ select: selectSchema }).strict().optional(),
       forcedCountWhere
     };
   }
-  function buildIncludeSchema(model, includeConfig) {
+  function buildIncludeSchema(model, includeConfig, depth) {
+    const currentDepth = depth ?? 0;
+    if (currentDepth > MAX_PROJECTION_DEPTH) {
+      throw new ShapeError(
+        `Include schema for model "${model}" exceeds maximum nesting depth (${MAX_PROJECTION_DEPTH}). Check for circular relation references in the shape.`
+      );
+    }
+    if (Object.keys(includeConfig).length === 0) {
+      throw new ShapeError(
+        `Empty include config on model "${model}". Define at least one relation.`
+      );
+    }
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
@@ -1530,20 +1688,24 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
             relForced.where = forced;
         }
         if (config.include) {
-          const nested = buildIncludeSchema(fieldMeta.type, config.include);
+          const nested = buildIncludeSchema(fieldMeta.type, config.include, currentDepth + 1);
           nestedSchemas["include"] = nested.schema;
           if (Object.keys(nested.forcedTree).length > 0)
             relForced.include = nested.forcedTree;
-          if (Object.keys(nested.forcedCountWhere).length > 0)
+          if (Object.keys(nested.forcedCountWhere).length > 0) {
             relForced._countWhere = nested.forcedCountWhere;
+            relForced._countWherePlacement = "include";
+          }
         }
         if (config.select) {
-          const nested = buildSelectSchema(fieldMeta.type, config.select);
+          const nested = buildSelectSchema(fieldMeta.type, config.select, currentDepth + 1);
           nestedSchemas["select"] = nested.schema;
           if (Object.keys(nested.forcedTree).length > 0)
             relForced.select = nested.forcedTree;
-          if (Object.keys(nested.forcedCountWhere).length > 0)
+          if (Object.keys(nested.forcedCountWhere).length > 0) {
             relForced._countWhere = nested.forcedCountWhere;
+            relForced._countWherePlacement = "select";
+          }
         }
         if (config.orderBy) {
           nestedSchemas["orderBy"] = deps.buildOrderBySchema(fieldMeta.type, config.orderBy);
@@ -1563,13 +1725,30 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
           forcedTree[relName] = relForced;
       }
     }
+    const includeFieldKeys = Object.keys(fieldSchemas);
+    const baseSchema = z6.object(fieldSchemas).strict();
+    const schema = includeFieldKeys.length > 0 ? baseSchema.refine(
+      (v) => includeFieldKeys.some((k) => v[k] !== void 0),
+      { message: "include must specify at least one field" }
+    ).optional() : baseSchema.optional();
     return {
-      schema: z6.object(fieldSchemas).strict().optional(),
+      schema,
       forcedTree,
       forcedCountWhere: topLevelForcedCountWhere
     };
   }
-  function buildSelectSchema(model, selectConfig) {
+  function buildSelectSchema(model, selectConfig, depth) {
+    const currentDepth = depth ?? 0;
+    if (currentDepth > MAX_PROJECTION_DEPTH) {
+      throw new ShapeError(
+        `Select schema for model "${model}" exceeds maximum nesting depth (${MAX_PROJECTION_DEPTH}). Check for circular relation references in the shape.`
+      );
+    }
+    if (Object.keys(selectConfig).length === 0) {
+      throw new ShapeError(
+        `Empty select config on model "${model}". Define at least one field.`
+      );
+    }
     const modelFields = typeMap[model];
     if (!modelFields)
       throw new ShapeError(`Unknown model: ${model}`);
@@ -1607,12 +1786,14 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
         const nestedSchemas = {};
         const relForced = {};
         if (config.select) {
-          const nested = buildSelectSchema(fieldMeta.type, config.select);
+          const nested = buildSelectSchema(fieldMeta.type, config.select, currentDepth + 1);
           nestedSchemas["select"] = nested.schema;
           if (Object.keys(nested.forcedTree).length > 0)
             relForced.select = nested.forcedTree;
-          if (Object.keys(nested.forcedCountWhere).length > 0)
+          if (Object.keys(nested.forcedCountWhere).length > 0) {
             relForced._countWhere = nested.forcedCountWhere;
+            relForced._countWherePlacement = "select";
+          }
         }
         if (config.where) {
           const { schema: whereSchema, forced } = deps.buildWhereSchema(
@@ -1642,8 +1823,14 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
           forcedTree[fieldName] = relForced;
       }
     }
+    const selectFieldKeys = Object.keys(fieldSchemas);
+    const baseSchema = z6.object(fieldSchemas).strict();
+    const schema = selectFieldKeys.length > 0 ? baseSchema.refine(
+      (v) => selectFieldKeys.some((k) => v[k] !== void 0),
+      { message: "select must specify at least one field" }
+    ).optional() : baseSchema.optional();
     return {
-      schema: z6.object(fieldSchemas).strict().optional(),
+      schema,
       forcedTree,
       forcedCountWhere: topLevelForcedCountWhere
     };
@@ -1663,9 +1850,9 @@ var METHOD_ALLOWED_ARGS = {
   groupBy: /* @__PURE__ */ new Set(["where", "by", "having", "_count", "_avg", "_sum", "_min", "_max", "orderBy", "take", "skip"])
 };
 var UNIQUE_WHERE_METHODS = /* @__PURE__ */ new Set(["findUnique", "findUniqueOrThrow"]);
-function createQueryBuilder(typeMap, enumMap, uniqueMap = {}) {
-  const whereBuilder = createWhereBuilder(typeMap, enumMap);
-  const argsBuilder = createArgsBuilder(typeMap, enumMap, uniqueMap);
+function createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
+  const whereBuilder = createWhereBuilder(typeMap, enumMap, scalarBase);
+  const argsBuilder = createArgsBuilder(typeMap, enumMap, uniqueMap, scalarBase);
   const projectionBuilder = createProjectionBuilder(typeMap, enumMap, {
     buildWhereSchema: whereBuilder.buildWhereSchema,
     buildOrderBySchema: argsBuilder.buildOrderBySchema,
@@ -1774,8 +1961,12 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap = {}) {
       schemaFields["cursor"] = argsBuilder.buildCursorSchema(model, shape.cursor);
     if (shape.take)
       schemaFields["take"] = argsBuilder.buildTakeSchema(shape.take);
-    if (shape.skip)
+    if (shape.skip !== void 0) {
+      if (shape.skip !== true) {
+        throw new ShapeError('Shape config "skip" must be true');
+      }
       schemaFields["skip"] = z7.number().int().min(0).optional();
+    }
     if (shape.distinct)
       schemaFields["distinct"] = argsBuilder.buildDistinctSchema(model, shape.distinct);
     if (shape._count)
@@ -1831,6 +2022,7 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap = {}) {
         [...builtCache.entries()].map(([k, v]) => [k, v.zodSchema])
       ),
       parse(body, opts) {
+        const normalizedBody = body === void 0 || body === null ? {} : body;
         let built;
         if (isSingle) {
           if (typeof config === "function") {
@@ -1840,9 +2032,9 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap = {}) {
             built = builtCache.get("_default");
           }
         } else {
-          if (!isPlainObject(body))
+          if (!isPlainObject(normalizedBody))
             throw new ShapeError("Request body must be an object");
-          if ("caller" in body) {
+          if ("caller" in normalizedBody) {
             throw new CallerError(
               "Pass caller via opts.caller, not in the request body."
             );
@@ -1868,7 +2060,7 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap = {}) {
             built = builtCache.get(matched.key);
           }
         }
-        return applyBuiltShape(built, body, isUnique);
+        return applyBuiltShape(built, normalizedBody, isUnique);
       }
     };
   }
@@ -2055,10 +2247,24 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         const overrides = Object.fromEntries(
           presentScopes.map((s) => [s.fk, ctx[s.root]])
         );
+        const nextArgs = { ...args };
         if (operation === "upsert") {
-          throw new PolicyError(
-            `Scoped model "${model}" cannot use upsert via extension. Handle upsert explicitly in route logic.`
-          );
+          nextArgs.where = buildScopedUniqueWhere(args.where, conditions);
+          if (args.create !== void 0 && args.create !== null) {
+            if (typeof args.create !== "object" || Array.isArray(args.create)) {
+              throw new ShapeError(`upsert expects create to be an object`);
+            }
+            nextArgs.create = { ...args.create };
+            enforceDataScope(nextArgs.create, scopes, overrides, log, model, operation, onScopeRelationWrite, "create");
+          }
+          if (args.update !== void 0 && args.update !== null) {
+            if (typeof args.update !== "object" || Array.isArray(args.update)) {
+              throw new ShapeError(`upsert expects update to be an object`);
+            }
+            nextArgs.update = { ...args.update };
+            enforceDataScope(nextArgs.update, scopes, overrides, log, model, operation, onScopeRelationWrite, "mutate");
+          }
+          return query(nextArgs);
         }
         if (FIND_UNIQUE_OPS.has(operation)) {
           if (findUniqueMode === "reject") {
@@ -2068,7 +2274,6 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
           }
           return handleFindUnique(args, query, conditions, scopes, operation, log);
         }
-        const nextArgs = { ...args };
         if (READ_OPS.has(operation)) {
           nextArgs.where = buildAndConditions(args.where, conditions);
           return query(nextArgs);
@@ -2219,18 +2424,14 @@ var ALLOWED_BODY_KEYS_UPDATE = /* @__PURE__ */ new Set(["data", "where"]);
 var ALLOWED_BODY_KEYS_UPDATE_PROJECTION = /* @__PURE__ */ new Set(["data", "where", "select", "include"]);
 var ALLOWED_BODY_KEYS_DELETE = /* @__PURE__ */ new Set(["where"]);
 var ALLOWED_BODY_KEYS_DELETE_PROJECTION = /* @__PURE__ */ new Set(["where", "select", "include"]);
+var ALLOWED_BODY_KEYS_UPSERT = /* @__PURE__ */ new Set(["where", "create", "update", "select", "include"]);
 var VALID_SHAPE_KEYS_CREATE = /* @__PURE__ */ new Set(["data"]);
 var VALID_SHAPE_KEYS_CREATE_PROJECTION = /* @__PURE__ */ new Set(["data", "select", "include"]);
 var VALID_SHAPE_KEYS_UPDATE = /* @__PURE__ */ new Set(["data", "where"]);
 var VALID_SHAPE_KEYS_UPDATE_PROJECTION = /* @__PURE__ */ new Set(["data", "where", "select", "include"]);
 var VALID_SHAPE_KEYS_DELETE = /* @__PURE__ */ new Set(["where"]);
 var VALID_SHAPE_KEYS_DELETE_PROJECTION = /* @__PURE__ */ new Set(["where", "select", "include"]);
-function isZodSchema2(value) {
-  if (value == null || typeof value !== "object")
-    return false;
-  const v = value;
-  return typeof v.parse === "function" && typeof v.optional === "function";
-}
+var VALID_SHAPE_KEYS_UPSERT = /* @__PURE__ */ new Set(["where", "create", "update", "select", "include"]);
 function validateMutationBodyKeys(body, allowed, method) {
   for (const key of Object.keys(body)) {
     if (!allowed.has(key)) {
@@ -2275,10 +2476,12 @@ function validateCreateCompleteness(modelName, dataConfig, typeMap, scopeFks, zo
     );
   }
 }
-function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder) {
+function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder, zodDefaults) {
   const modelFields = typeMap[model];
   if (!modelFields)
     throw new ShapeError(`Unknown model: ${model}`);
+  const zodDefaultFields = zodDefaults[model];
+  const zodDefaultSet = zodDefaultFields ? new Set(zodDefaultFields) : void 0;
   const schemaMap = {};
   const forced = {};
   for (const [fieldName, value] of Object.entries(dataConfig)) {
@@ -2300,15 +2503,18 @@ function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder) {
           { cause: err }
         );
       }
-      if (!isZodSchema2(refined)) {
+      if (!isZodSchema(refined)) {
         throw new ShapeError(`Inline refine for "${model}.${fieldName}" must return a Zod schema`);
       }
       let fieldSchema = refined;
+      const handlesUndefined = schemaProducesValueForUndefined(fieldSchema);
       if (mode === "create") {
         if (!fieldMeta.isRequired) {
-          fieldSchema = fieldSchema.nullable().optional();
+          fieldSchema = handlesUndefined ? fieldSchema.nullable() : fieldSchema.nullable().optional();
         } else if (fieldMeta.hasDefault) {
-          fieldSchema = fieldSchema.optional();
+          if (!handlesUndefined) {
+            fieldSchema = fieldSchema.optional();
+          }
         }
       } else {
         if (!fieldMeta.isRequired) {
@@ -2320,11 +2526,14 @@ function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder) {
       schemaMap[fieldName] = fieldSchema;
     } else if (value === true) {
       let fieldSchema = schemaBuilder.buildFieldSchema(model, fieldName);
+      const isZodDefaultField = zodDefaultSet !== void 0 && zodDefaultSet.has(fieldName);
       if (mode === "create") {
         if (!fieldMeta.isRequired) {
-          fieldSchema = fieldSchema.nullable().optional();
+          fieldSchema = isZodDefaultField ? fieldSchema.nullable() : fieldSchema.nullable().optional();
         } else if (fieldMeta.hasDefault) {
-          fieldSchema = fieldSchema.optional();
+          if (!isZodDefaultField) {
+            fieldSchema = fieldSchema.optional();
+          }
         }
       } else {
         if (!fieldMeta.isRequired) {
@@ -2335,13 +2544,14 @@ function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder) {
       }
       schemaMap[fieldName] = fieldSchema;
     } else {
+      const actualValue = isForcedValue(value) ? value.value : value;
       let fieldSchema = schemaBuilder.buildFieldSchema(model, fieldName);
       if (!fieldMeta.isRequired) {
         fieldSchema = fieldSchema.nullable();
       }
       let parsed;
       try {
-        parsed = fieldSchema.parse(value);
+        parsed = fieldSchema.parse(actualValue);
       } catch (err) {
         throw new ShapeError(
           `Invalid forced data value for "${model}.${fieldName}": ${err.message}`
@@ -2350,6 +2560,28 @@ function buildDataSchema(model, dataConfig, mode, typeMap, schemaBuilder) {
       forced[fieldName] = parsed;
     }
   }
+  if (mode === "create" && zodDefaultFields) {
+    for (const fieldName of zodDefaultFields) {
+      if (fieldName in dataConfig)
+        continue;
+      const fieldMeta = modelFields[fieldName];
+      if (!fieldMeta)
+        continue;
+      if (fieldMeta.isRelation)
+        continue;
+      if (fieldMeta.isUpdatedAt)
+        continue;
+      const fieldSchema = schemaBuilder.buildFieldSchema(model, fieldName);
+      const result = fieldSchema.safeParse(void 0);
+      if (result.success && result.data !== void 0) {
+        forced[fieldName] = result.data;
+      } else {
+        throw new ShapeError(
+          `Field "${fieldName}" on model "${model}" has @zod default/catch but its schema does not produce a value for undefined input`
+        );
+      }
+    }
+  }
   return {
     schema: z8.object(schemaMap).strict(),
     forced
@@ -2360,7 +2592,7 @@ function validateAndMergeData(bodyData, cached, method) {
     throw new ShapeError(`${method} requires "data" in request body`);
   }
   const validated = cached.schema.parse(bodyData);
-  return { ...validated, ...cached.forced };
+  return { ...validated, ...deepClone(cached.forced) };
 }
 function hasDataRefines(dataConfig) {
   for (const value of Object.values(dataConfig)) {
@@ -2422,7 +2654,7 @@ function resolveShape(input, body, contextFn, caller) {
       );
     }
   }
-  const parsed = requireBody(body);
+  const parsed = body === void 0 || body === null ? {} : requireBody(body);
   if ("caller" in parsed) {
     throw new CallerError(
       "Pass caller as second argument to .guard() or via context function, not in the request body."
@@ -2448,7 +2680,7 @@ function resolveShape(input, body, contextFn, caller) {
 }
 
 // src/runtime/model-guard.ts
-var UNIQUE_MUTATION_METHODS = /* @__PURE__ */ new Set(["update", "delete"]);
+var UNIQUE_MUTATION_METHODS = /* @__PURE__ */ new Set(["update", "delete", "upsert"]);
 var UNIQUE_READ_METHODS = /* @__PURE__ */ new Set(["findUnique", "findUniqueOrThrow"]);
 var BULK_MUTATION_METHODS = /* @__PURE__ */ new Set([
   "updateMany",
@@ -2458,6 +2690,7 @@ var BULK_MUTATION_METHODS = /* @__PURE__ */ new Set([
 var PROJECTION_MUTATION_METHODS = /* @__PURE__ */ new Set([
   "create",
   "update",
+  "upsert",
   "delete",
   "createManyAndReturn",
   "updateManyAndReturn"
@@ -2466,11 +2699,148 @@ var BATCH_CREATE_METHODS = /* @__PURE__ */ new Set([
   "createMany",
   "createManyAndReturn"
 ]);
+function buildDefaultSelectInput(config) {
+  const result = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "_count") {
+      result[key] = buildDefaultCountInput(value);
+      continue;
+    }
+    if (value === true) {
+      result[key] = true;
+    } else {
+      const nested = {};
+      if (value.select)
+        nested.select = buildDefaultSelectInput(value.select);
+      result[key] = Object.keys(nested).length > 0 ? nested : true;
+    }
+  }
+  return result;
+}
+function buildDefaultIncludeInput(config) {
+  const result = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "_count") {
+      result[key] = buildDefaultCountInput(value);
+      continue;
+    }
+    if (value === true) {
+      result[key] = true;
+    } else {
+      const nested = {};
+      if (value.include)
+        nested.include = buildDefaultIncludeInput(value.include);
+      if (value.select)
+        nested.select = buildDefaultSelectInput(value.select);
+      result[key] = Object.keys(nested).length > 0 ? nested : true;
+    }
+  }
+  return result;
+}
+function buildDefaultCountInput(config) {
+  if (config === true)
+    return true;
+  if (!isPlainObject(config) || !config.select || !isPlainObject(config.select))
+    return true;
+  const selectObj = config.select;
+  const result = {};
+  for (const key of Object.keys(selectObj)) {
+    result[key] = true;
+  }
+  return { select: result };
+}
+function buildDefaultProjectionBody(shape) {
+  if (shape.select) {
+    return { select: buildDefaultSelectInput(shape.select) };
+  }
+  if (shape.include) {
+    return { include: buildDefaultIncludeInput(shape.include) };
+  }
+  return {};
+}
+function hasClientControlledValues(obj) {
+  for (const value of Object.values(obj)) {
+    if (isForcedValue(value))
+      continue;
+    if (value === true)
+      return true;
+    if (isPlainObject(value) && hasClientControlledValues(value))
+      return true;
+  }
+  return false;
+}
+function checkIncludeForClientArgs(config) {
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "_count") {
+      if (value !== true && isPlainObject(value) && isPlainObject(value.select)) {
+        const selectObj = value.select;
+        for (const entryVal of Object.values(selectObj)) {
+          if (isPlainObject(entryVal) && entryVal.where) {
+            const w = entryVal.where;
+            if (isPlainObject(w) && hasClientControlledValues(w))
+              return true;
+          }
+        }
+      }
+      continue;
+    }
+    if (value === true)
+      continue;
+    if (value.orderBy || value.cursor || value.take || value.skip)
+      return true;
+    if (value.where && isPlainObject(value.where) && hasClientControlledValues(value.where))
+      return true;
+    if (value.include && checkIncludeForClientArgs(value.include))
+      return true;
+    if (value.select && checkSelectForClientArgs(value.select))
+      return true;
+  }
+  return false;
+}
+function checkSelectForClientArgs(config) {
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "_count") {
+      if (value !== true && isPlainObject(value) && isPlainObject(value.select)) {
+        const selectObj = value.select;
+        for (const entryVal of Object.values(selectObj)) {
+          if (isPlainObject(entryVal) && entryVal.where) {
+            const w = entryVal.where;
+            if (isPlainObject(w) && hasClientControlledValues(w))
+              return true;
+          }
+        }
+      }
+      continue;
+    }
+    if (value === true)
+      continue;
+    if (value.orderBy || value.cursor || value.take || value.skip)
+      return true;
+    if (value.where && isPlainObject(value.where) && hasClientControlledValues(value.where))
+      return true;
+    if (value.select && checkSelectForClientArgs(value.select))
+      return true;
+  }
+  return false;
+}
+function hasNestedClientControlledArgs(shape) {
+  if (shape.include) {
+    if (checkIncludeForClientArgs(shape.include))
+      return true;
+  }
+  if (shape.select) {
+    if (checkSelectForClientArgs(shape.select))
+      return true;
+  }
+  return false;
+}
 function createModelGuardExtension(config) {
-  const { typeMap, enumMap, zodChains, zodDefaults, uniqueMap, scopeMap, contextFn } = config;
+  const { typeMap, enumMap, zodChains, zodDefaults, uniqueMap, scopeMap, guardConfig, contextFn } = config;
   const wrapZodErrors = config.wrapZodErrors ?? false;
-  const schemaBuilder = createSchemaBuilder(typeMap, zodChains, enumMap);
-  const queryBuilder = createQueryBuilder(typeMap, enumMap, uniqueMap);
+  const enforceProjection = guardConfig.enforceProjection ?? false;
+  const scalarBase = createScalarBase(guardConfig.strictDecimal ?? false);
+  const schemaBuilder = createSchemaBuilder(typeMap, zodChains, enumMap, scalarBase, zodDefaults);
+  const queryBuilder = createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase);
   const modelScopeFks = /* @__PURE__ */ new Map();
   for (const [model, entries] of Object.entries(scopeMap)) {
     const fks = /* @__PURE__ */ new Set();
@@ -2523,11 +2893,11 @@ function createModelGuardExtension(config) {
         const cached = dataSchemaCache.get(cacheKey);
         if (cached)
           return cached;
-        const built = buildDataSchema(modelName, dataConfig, mode, typeMap, schemaBuilder);
+        const built = buildDataSchema(modelName, dataConfig, mode, typeMap, schemaBuilder, zodDefaults);
         dataSchemaCache.set(cacheKey, built);
         return built;
       }
-      return buildDataSchema(modelName, dataConfig, mode, typeMap, schemaBuilder);
+      return buildDataSchema(modelName, dataConfig, mode, typeMap, schemaBuilder, zodDefaults);
     }
     function getWhereBuilt(whereConfig, matchedKey, wasDynamic) {
       if (!wasDynamic) {
@@ -2597,12 +2967,26 @@ function createModelGuardExtension(config) {
       }
       if (!hasShapeProjection)
         return {};
+      if (!hasBodyProjection && !enforceProjection)
+        return {};
+      if (!hasBodyProjection && enforceProjection) {
+        if (hasNestedClientControlledArgs(shape)) {
+          throw new ShapeError(
+            `Guard shape defines nested client-controlled projection args (orderBy/take/cursor/skip/where) but the client did not provide select/include in the ${method} body. With enforceProjection enabled, either always provide projection in the body or remove client-controlled nested args from the shape.`
+          );
+        }
+      }
       const projection = getProjection(shape, matchedKey, wasDynamic);
-      const projectionBody = {};
-      if ("select" in parsed)
-        projectionBody.select = parsed.select;
-      if ("include" in parsed)
-        projectionBody.include = parsed.include;
+      let projectionBody;
+      if (hasBodyProjection) {
+        projectionBody = {};
+        if ("select" in parsed)
+          projectionBody.select = parsed.select;
+        if ("include" in parsed)
+          projectionBody.include = parsed.include;
+      } else {
+        projectionBody = buildDefaultProjectionBody(shape);
+      }
       const validated = projection.zodSchema.parse(projectionBody);
       if (Object.keys(projection.forcedIncludeTree).length > 0) {
         applyForcedTree(validated, "include", projection.forcedIncludeTree);
@@ -2633,6 +3017,12 @@ function createModelGuardExtension(config) {
       let validatedWhere;
       if (built.schema) {
         validatedWhere = built.schema.parse(bodyWhere);
+      } else if (bodyWhere !== void 0) {
+        if (bodyWhere === null || !isPlainObject(bodyWhere) || Object.keys(bodyWhere).length > 0) {
+          throw new ShapeError(
+            "Guard shape where contains only forced conditions. Client where input is not accepted."
+          );
+        }
       }
       if (hasWhereForced(built.forced)) {
         return preserveUnique ? mergeUniqueWhereForced(validatedWhere, built.forced) : mergeWhereForced(validatedWhere, built.forced);
@@ -2785,6 +3175,70 @@ function createModelGuardExtension(config) {
         return callDelegate(method, args);
       };
     }
+    function makeUpsertMethod() {
+      return (body) => {
+        const caller = resolveCaller();
+        const resolved = resolveShape(input, body, contextFn, caller);
+        if (resolved.shape.data) {
+          throw new ShapeError('Guard shape "data" is not valid for upsert. Use "create" and "update" instead.');
+        }
+        if (!resolved.shape.create) {
+          throw new ShapeError('Guard shape requires "create" for upsert');
+        }
+        if (!resolved.shape.update) {
+          throw new ShapeError('Guard shape requires "update" for upsert');
+        }
+        if (!resolved.shape.where) {
+          throw new ShapeError('Guard shape requires "where" for upsert');
+        }
+        validateMutationShapeKeys(
+          resolved.shape,
+          VALID_SHAPE_KEYS_UPSERT,
+          "upsert"
+        );
+        validateMutationBodyKeys(resolved.body, ALLOWED_BODY_KEYS_UPSERT, "upsert");
+        maybeValidateUniqueWhere(modelName, resolved.shape, "upsert");
+        const fks = modelScopeFks.get(modelName) ?? /* @__PURE__ */ new Set();
+        validateCreateCompleteness(modelName, resolved.shape.create, typeMap, fks, zodDefaults);
+        const createDataSchema = getDataSchema(
+          "create",
+          resolved.shape.create,
+          `upsert:create\0${resolved.matchedKey}`,
+          resolved.wasDynamic
+        );
+        const createData = validateAndMergeData(resolved.body.create, createDataSchema, "upsert (create)");
+        const updateDataSchema = getDataSchema(
+          "update",
+          resolved.shape.update,
+          `upsert:update\0${resolved.matchedKey}`,
+          resolved.wasDynamic
+        );
+        const updateData = validateAndMergeData(resolved.body.update, updateDataSchema, "upsert (update)");
+        const where = requireWhere(
+          resolved.shape,
+          resolved.body.where,
+          "upsert",
+          true,
+          resolved.matchedKey,
+          resolved.wasDynamic
+        );
+        validateResolvedUniqueWhere(modelName, where, "upsert", uniqueMap);
+        const args = {
+          where,
+          create: createData,
+          update: updateData
+        };
+        const projectionArgs = resolveProjection(
+          resolved.shape,
+          resolved.body,
+          "upsert",
+          resolved.matchedKey,
+          resolved.wasDynamic
+        );
+        Object.assign(args, projectionArgs);
+        return callDelegate("upsert", args);
+      };
+    }
     return {
       findMany: makeReadMethod("findMany"),
       findFirst: makeReadMethod("findFirst"),
@@ -2800,6 +3254,7 @@ function createModelGuardExtension(config) {
       update: makeUpdateMethod("update"),
       updateMany: makeUpdateMethod("updateMany"),
       updateManyAndReturn: makeUpdateMethod("updateManyAndReturn"),
+      upsert: makeUpsertMethod(),
       delete: makeDeleteMethod("delete"),
       deleteMany: makeDeleteMethod("deleteMany")
     };
@@ -2845,15 +3300,19 @@ function createModelGuardExtension(config) {
 
 // src/runtime/guard.ts
 function createGuard(config) {
+  const scalarBase = createScalarBase(config.guardConfig.strictDecimal ?? false);
   const schemaBuilder = createSchemaBuilder(
     config.typeMap,
     config.zodChains,
-    config.enumMap
+    config.enumMap,
+    scalarBase,
+    config.zodDefaults ?? {}
   );
   const queryBuilder = createQueryBuilder(
     config.typeMap,
     config.enumMap,
-    config.uniqueMap ?? {}
+    config.uniqueMap ?? {},
+    scalarBase
   );
   const log = config.logger ?? { warn: (msg) => console.warn(msg) };
   const wrapZodErrors = config.wrapZodErrors ?? false;
@@ -2912,8 +3371,8 @@ function createGuard(config) {
           if (typeof val === "string" || typeof val === "number" || typeof val === "bigint") {
             scopeCtx[key] = val;
           } else if (val !== null && val !== void 0) {
-            log.warn(
-              `prisma-guard: Scope root "${key}" has non-primitive value (${typeof val}). Only string, number, and bigint values are used for scope context.`
+            throw new PolicyError(
+              `prisma-guard: Scope root "${key}" has non-primitive value (${typeof val}). Only string, number, and bigint values are accepted for scope context.`
             );
           }
         }
@@ -2932,6 +3391,7 @@ function createGuard(config) {
         zodDefaults: config.zodDefaults ?? {},
         uniqueMap: config.uniqueMap ?? {},
         scopeMap: config.scopeMap,
+        guardConfig: config.guardConfig,
         contextFn,
         wrapZodErrors
       });
@@ -2947,6 +3407,7 @@ export {
   CallerError,
   PolicyError,
   ShapeError,
-  createGuard
+  createGuard,
+  force
 };
 //# sourceMappingURL=index.js.map