fix(orm): enforce at most one key per orderBy array element

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ymc9

packages/orm/src/client/zod/factory.ts

@@ -1126,6 +1126,10 @@ export class ZodSchemaFactory<
     ) {
         const fields: Record<string, ZodType> = {};
         const sort = z.union([z.literal('asc'), z.literal('desc')]);
+        const refineAtMostOneKey = (s: ZodObject) =>
+            s.refine((v: object) => Object.keys(v).length <= 1, {
+                message: 'Each orderBy element must have at most one key',
+            });
         const nextOpts = this.nextOptions(options);
         for (const [field, fieldDef] of this.getModelFields(model)) {
             if (fieldDef.relation) {
@@ -1139,9 +1143,8 @@ export class ZodSchemaFactory<
                             nextOpts,
                         );
                         if (fieldDef.array) {
-                            relationOrderBy = relationOrderBy.extend({
-                                _count: sort,
-                            });
+                            // safeExtend drops existing refinements, so re-apply after extending
+                            relationOrderBy = refineAtMostOneKey(relationOrderBy.safeExtend({ _count: sort }));
                         }
                         return relationOrderBy.optional();
                     });
@@ -1172,7 +1175,7 @@ export class ZodSchemaFactory<
             }
         }
 
-        return z.strictObject(fields);
+        return refineAtMostOneKey(z.strictObject(fields));
     }
 
     @cache()

tests/e2e/orm/client-api/find.test.ts

@@ -1189,6 +1189,21 @@ describe('Client find tests ', () => {
         expect(result3?._count.posts).toBe(1);
     });
 
+    it('rejects orderBy array elements with multiple keys', async () => {
+        await createUser(client, 'u1@test.com');
+
+        // zero keys is valid
+        await expect(client.user.findMany({ orderBy: [{}] })).resolves.toBeDefined();
+
+        // single key is valid
+        await expect(client.user.findMany({ orderBy: [{ email: 'asc' }] })).resolves.toBeDefined();
+
+        // multiple keys in one element is rejected
+        await expect(
+            client.user.findMany({ orderBy: [{ email: 'asc', role: 'desc' }] } as any),
+        ).toBeRejectedByValidation();
+    });
+
     it('supports $expr', async () => {
         await createUser(client, 'yiming@gmail.com');
         await createUser(client, 'yiming@zenstack.dev');