@rpcbase/db 0.63.0 → 0.65.0

package/dist/index.js

@@ -1,11 +1,11 @@
-import { a as registerPoliciesFromModules } from "./can-urGFf45M.js";
-import { b, d, f, e, g, c, r } from "./can-urGFf45M.js";
+import { a as registerPoliciesFromModules, h as hasRegisteredPolicy } from "./can--Y-1LK22.js";
+import { b, d, f, e, g, c, r } from "./can--Y-1LK22.js";
 import mongoose, { Schema as Schema$1, Types } from "mongoose";
 import { default as default2 } from "mongoose";
 import { z } from "zod";
 import { timingSafeEqual, createHmac } from "node:crypto";
-import { w as withLocalizedStringFallback } from "./index-Drge1bnG.js";
-import { a, E, L, c as c2, e as e2, m, r as r2, z as z2, b as b2, f as f2, d as d2 } from "./index-Drge1bnG.js";
+import { w as withLocalizedStringFallback } from "./index-g1_0RZ-U.js";
+import { a, E, L, c as c2, e as e2, m, r as r2, z as z2, b as b2, f as f2, d as d2 } from "./index-g1_0RZ-U.js";
 import assert from "assert";
 import { accessibleBy, accessibleRecordsPlugin } from "@casl/mongoose";
 import "@casl/ability";
@@ -34,33 +34,97 @@ const ZRBUser = z.object({
   emailVerificationExpiresAt: z.date().optional()
 });
 const RBUserSchema = new Schema$1({
-  email: { type: String, unique: true, sparse: true },
-  phone: { type: String, unique: true, sparse: true },
-  password: { type: String, required: true },
+  email: {
+    type: String,
+    unique: true,
+    sparse: true
+  },
+  phone: {
+    type: String,
+    unique: true,
+    sparse: true
+  },
+  password: {
+    type: String,
+    required: true
+  },
   name: String,
-  tenants: { type: [String], index: true, required: true },
-  tenantRoles: { type: Map, of: [String], required: false, default: {} },
+  tenants: {
+    type: [String],
+    index: true,
+    required: true
+  },
+  tenantRoles: {
+    type: Map,
+    of: [String],
+    required: false,
+    default: {}
+  },
   oauthProviders: {
     type: Map,
     of: new Schema$1({
-      subject: { type: String, required: true },
-      email: { type: String, required: false },
-      name: { type: String, required: false },
-      accessToken: { type: String, required: false },
-      refreshToken: { type: String, required: false },
-      idToken: { type: String, required: false },
-      scope: { type: String, required: false },
-      tokenType: { type: String, required: false },
-      expiresAt: { type: Date, required: false },
-      rawUserInfo: { type: Schema$1.Types.Mixed, required: false },
-      createdAt: { type: Date, required: false },
-      updatedAt: { type: Date, required: false }
-    }, { _id: false }),
+      subject: {
+        type: String,
+        required: true
+      },
+      email: {
+        type: String,
+        required: false
+      },
+      name: {
+        type: String,
+        required: false
+      },
+      accessToken: {
+        type: String,
+        required: false
+      },
+      refreshToken: {
+        type: String,
+        required: false
+      },
+      idToken: {
+        type: String,
+        required: false
+      },
+      scope: {
+        type: String,
+        required: false
+      },
+      tokenType: {
+        type: String,
+        required: false
+      },
+      expiresAt: {
+        type: Date,
+        required: false
+      },
+      rawUserInfo: {
+        type: Schema$1.Types.Mixed,
+        required: false
+      },
+      createdAt: {
+        type: Date,
+        required: false
+      },
+      updatedAt: {
+        type: Date,
+        required: false
+      }
+    }, {
+      _id: false
+    }),
     default: {},
     required: false
   },
-  emailVerificationCode: { type: String, required: false },
-  emailVerificationExpiresAt: { type: Date, required: false }
+  emailVerificationCode: {
+    type: String,
+    required: false
+  },
+  emailVerificationExpiresAt: {
+    type: Date,
+    required: false
+  }
 });
 const ZRBTenant = z.object({
   tenantId: z.string(),
@@ -68,18 +132,20 @@ const ZRBTenant = z.object({
   name: z.string().optional()
 });
 const RBTenantSchema = new Schema$1({
-  tenantId: { type: String, required: true, unique: true, index: true },
-  parentTenantId: { type: String },
-  name: { type: String }
+  tenantId: {
+    type: String,
+    required: true,
+    unique: true,
+    index: true
+  },
+  parentTenantId: {
+    type: String
+  },
+  name: {
+    type: String
+  }
 });
-const ZRBTenantSubscriptionStatus = z.enum([
-  "trialing",
-  "active",
-  "past_due",
-  "paused",
-  "canceled",
-  "expired"
-]);
+const ZRBTenantSubscriptionStatus = z.enum(["trialing", "active", "past_due", "paused", "canceled", "expired"]);
 const ZRBTenantSubscriptionIntervalUnit = z.enum(["month", "year"]);
 const ZRBTenantSubscriptionType = z.enum(["primary", "addon"]);
 const ZRBTenantSubscriptionScope = z.enum(["tenant", "shop", "custom"]);
@@ -108,46 +174,107 @@ const ZRBTenantSubscription = z.object({
   latestEventAt: z.date().optional(),
   metadata: z.record(z.string(), z.unknown()).optional()
 });
-const RBTenantSubscriptionSchema = new Schema$1(
-  {
-    tenantId: { type: String, required: true, index: true },
-    subscriptionId: { type: String, required: true },
-    type: { type: String, required: true, enum: ZRBTenantSubscriptionType.options, default: "primary" },
-    parentSubscriptionId: { type: String },
-    scope: { type: String, enum: ZRBTenantSubscriptionScope.options, default: "tenant" },
-    scopeId: { type: String },
-    planKey: { type: String, required: true },
-    status: { type: String, required: true, enum: ZRBTenantSubscriptionStatus.options },
-    intervalUnit: { type: String, required: true, enum: ZRBTenantSubscriptionIntervalUnit.options },
-    intervalCount: { type: Number, min: 1, default: 1 },
-    modules: { type: [String], default: [] },
-    currentPeriodStart: { type: Date },
-    currentPeriodEnd: { type: Date },
-    trialEndsAt: { type: Date },
-    cancelAt: { type: Date },
-    cancelAtPeriodEnd: { type: Boolean, default: false },
-    canceledAt: { type: Date },
-    provider: { type: String },
-    providerCustomerId: { type: String },
-    providerSubscriptionId: { type: String },
-    latestEventId: { type: String },
-    latestEventAt: { type: Date },
-    metadata: { type: Schema$1.Types.Mixed }
-  }
-);
-RBTenantSubscriptionSchema.index({ tenantId: 1, subscriptionId: 1 }, { unique: true });
-RBTenantSubscriptionSchema.index({ tenantId: 1, scope: 1, scopeId: 1 });
-const ZRBTenantSubscriptionEventSource = z.enum([
-  "admin",
-  "system",
-  "webhook",
-  "user"
-]);
-const ZRBTenantSubscriptionChangeDirection = z.enum([
-  "upgrade",
-  "downgrade",
-  "lateral"
-]);
+const RBTenantSubscriptionSchema = new Schema$1({
+  tenantId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  subscriptionId: {
+    type: String,
+    required: true
+  },
+  type: {
+    type: String,
+    required: true,
+    enum: ZRBTenantSubscriptionType.options,
+    default: "primary"
+  },
+  parentSubscriptionId: {
+    type: String
+  },
+  scope: {
+    type: String,
+    enum: ZRBTenantSubscriptionScope.options,
+    default: "tenant"
+  },
+  scopeId: {
+    type: String
+  },
+  planKey: {
+    type: String,
+    required: true
+  },
+  status: {
+    type: String,
+    required: true,
+    enum: ZRBTenantSubscriptionStatus.options
+  },
+  intervalUnit: {
+    type: String,
+    required: true,
+    enum: ZRBTenantSubscriptionIntervalUnit.options
+  },
+  intervalCount: {
+    type: Number,
+    min: 1,
+    default: 1
+  },
+  modules: {
+    type: [String],
+    default: []
+  },
+  currentPeriodStart: {
+    type: Date
+  },
+  currentPeriodEnd: {
+    type: Date
+  },
+  trialEndsAt: {
+    type: Date
+  },
+  cancelAt: {
+    type: Date
+  },
+  cancelAtPeriodEnd: {
+    type: Boolean,
+    default: false
+  },
+  canceledAt: {
+    type: Date
+  },
+  provider: {
+    type: String
+  },
+  providerCustomerId: {
+    type: String
+  },
+  providerSubscriptionId: {
+    type: String
+  },
+  latestEventId: {
+    type: String
+  },
+  latestEventAt: {
+    type: Date
+  },
+  metadata: {
+    type: Schema$1.Types.Mixed
+  }
+});
+RBTenantSubscriptionSchema.index({
+  tenantId: 1,
+  subscriptionId: 1
+}, {
+  unique: true
+});
+RBTenantSubscriptionSchema.index({
+  tenantId: 1,
+  scope: 1,
+  scopeId: 1
+});
+const ZRBTenantSubscriptionEventSource = z.enum(["admin", "system", "webhook", "user"]);
+const ZRBTenantSubscriptionChangeDirection = z.enum(["upgrade", "downgrade", "lateral"]);
 const ZRBTenantSubscriptionEvent = z.object({
   tenantId: z.string(),
   subscriptionId: z.string(),
@@ -173,48 +300,123 @@ const ZRBTenantSubscriptionEvent = z.object({
   providerPayload: z.unknown().optional(),
   metadata: z.record(z.string(), z.unknown()).optional()
 });
-const RBTenantSubscriptionEventSchema = new Schema$1(
-  {
-    tenantId: { type: String, required: true, index: true },
-    subscriptionId: { type: String, required: true, index: true },
-    type: { type: String, required: true },
-    occurredAt: { type: Date, required: true, default: Date.now },
-    effectiveAt: { type: Date },
-    fromPlanKey: { type: String },
-    toPlanKey: { type: String },
-    fromStatus: { type: String, enum: ZRBTenantSubscriptionStatus.options },
-    toStatus: { type: String, enum: ZRBTenantSubscriptionStatus.options },
-    fromModules: { type: [String], default: void 0 },
-    toModules: { type: [String], default: void 0 },
-    fromIntervalUnit: { type: String, enum: ZRBTenantSubscriptionIntervalUnit.options },
-    toIntervalUnit: { type: String, enum: ZRBTenantSubscriptionIntervalUnit.options },
-    fromIntervalCount: { type: Number, min: 1 },
-    toIntervalCount: { type: Number, min: 1 },
-    direction: { type: String, enum: ZRBTenantSubscriptionChangeDirection.options },
-    actorUserId: { type: String },
-    source: { type: String, enum: ZRBTenantSubscriptionEventSource.options },
-    reason: { type: String },
-    provider: { type: String },
-    providerEventId: { type: String },
-    providerPayload: { type: Schema$1.Types.Mixed },
-    metadata: { type: Schema$1.Types.Mixed }
-  }
-);
-RBTenantSubscriptionEventSchema.index({ tenantId: 1, subscriptionId: 1, occurredAt: 1 });
-RBTenantSubscriptionEventSchema.index({ provider: 1, providerEventId: 1 }, { unique: true, sparse: true });
+const RBTenantSubscriptionEventSchema = new Schema$1({
+  tenantId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  subscriptionId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  type: {
+    type: String,
+    required: true
+  },
+  occurredAt: {
+    type: Date,
+    required: true,
+    default: Date.now
+  },
+  effectiveAt: {
+    type: Date
+  },
+  fromPlanKey: {
+    type: String
+  },
+  toPlanKey: {
+    type: String
+  },
+  fromStatus: {
+    type: String,
+    enum: ZRBTenantSubscriptionStatus.options
+  },
+  toStatus: {
+    type: String,
+    enum: ZRBTenantSubscriptionStatus.options
+  },
+  fromModules: {
+    type: [String],
+    default: void 0
+  },
+  toModules: {
+    type: [String],
+    default: void 0
+  },
+  fromIntervalUnit: {
+    type: String,
+    enum: ZRBTenantSubscriptionIntervalUnit.options
+  },
+  toIntervalUnit: {
+    type: String,
+    enum: ZRBTenantSubscriptionIntervalUnit.options
+  },
+  fromIntervalCount: {
+    type: Number,
+    min: 1
+  },
+  toIntervalCount: {
+    type: Number,
+    min: 1
+  },
+  direction: {
+    type: String,
+    enum: ZRBTenantSubscriptionChangeDirection.options
+  },
+  actorUserId: {
+    type: String
+  },
+  source: {
+    type: String,
+    enum: ZRBTenantSubscriptionEventSource.options
+  },
+  reason: {
+    type: String
+  },
+  provider: {
+    type: String
+  },
+  providerEventId: {
+    type: String
+  },
+  providerPayload: {
+    type: Schema$1.Types.Mixed
+  },
+  metadata: {
+    type: Schema$1.Types.Mixed
+  }
+});
+RBTenantSubscriptionEventSchema.index({
+  tenantId: 1,
+  subscriptionId: 1,
+  occurredAt: 1
+});
+RBTenantSubscriptionEventSchema.index({
+  provider: 1,
+  providerEventId: 1
+}, {
+  unique: true,
+  sparse: true
+});
 const ZRBRtsCounter = z.object({
   _id: z.string(),
   seq: z.number().int().min(0)
 });
-const RBRtsCounterSchema = new Schema$1(
-  {
-    _id: { type: String, required: true },
-    seq: { type: Number, required: true, default: 0 }
+const RBRtsCounterSchema = new Schema$1({
+  _id: {
+    type: String,
+    required: true
   },
-  {
-    versionKey: false
+  seq: {
+    type: Number,
+    required: true,
+    default: 0
   }
-);
+}, {
+  versionKey: false
+});
 const ttlSecondsRaw = process.env.RB_RTS_CHANGES_TTL_S ?? "";
 const ttlSeconds = Number.isFinite(Number(ttlSecondsRaw)) ? Math.max(60, Math.floor(Number(ttlSecondsRaw))) : 60 * 60 * 24 * 30;
 const ZRBRtsChangeOp = z.enum(["delete", "reset_model"]);
@@ -225,20 +427,43 @@ const ZRBRtsChange = z.object({
   docId: z.string().optional(),
   ts: z.date()
 });
-const RBRtsChangeSchema = new Schema$1(
-  {
-    seq: { type: Number, required: true },
-    modelName: { type: String, required: true, index: true },
-    op: { type: String, required: true, enum: ZRBRtsChangeOp.options },
-    docId: { type: String, required: false },
-    ts: { type: Date, required: true, default: Date.now }
-  },
-  {
-    versionKey: false
-  }
-);
-RBRtsChangeSchema.index({ seq: 1 }, { unique: true });
-RBRtsChangeSchema.index({ ts: 1 }, { expireAfterSeconds: ttlSeconds });
+const RBRtsChangeSchema = new Schema$1({
+  seq: {
+    type: Number,
+    required: true
+  },
+  modelName: {
+    type: String,
+    required: true,
+    index: true
+  },
+  op: {
+    type: String,
+    required: true,
+    enum: ZRBRtsChangeOp.options
+  },
+  docId: {
+    type: String,
+    required: false
+  },
+  ts: {
+    type: Date,
+    required: true,
+    default: Date.now
+  }
+}, {
+  versionKey: false
+});
+RBRtsChangeSchema.index({
+  seq: 1
+}, {
+  unique: true
+});
+RBRtsChangeSchema.index({
+  ts: 1
+}, {
+  expireAfterSeconds: ttlSeconds
+});
 const ZRBUploadSessionStatus = z.enum(["uploading", "assembling", "done", "error"]);
 const ZRBUploadSession = z.object({
   _id: z.string(),
@@ -256,42 +481,100 @@ const ZRBUploadSession = z.object({
   isPublic: z.boolean().optional(),
   error: z.string().optional()
 });
-const RBUploadSessionSchema = new Schema$1(
-  {
-    _id: { type: String, required: true },
-    userId: { type: String, required: false, index: true },
-    ownerKeyHash: { type: String, required: false },
-    filename: { type: String, required: true },
-    mimeType: { type: String, required: true },
-    totalSize: { type: Number, required: true },
-    chunkSize: { type: Number, required: true },
-    chunksTotal: { type: Number, required: true },
-    status: { type: String, required: true, enum: ZRBUploadSessionStatus.options },
-    createdAt: { type: Date, required: true, default: Date.now },
-    expiresAt: { type: Date, required: true },
-    fileId: { type: String, required: false },
-    isPublic: { type: Boolean, required: false },
-    error: { type: String, required: false }
-  },
-  {
-    versionKey: false
-  }
-);
-RBUploadSessionSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+const RBUploadSessionSchema = new Schema$1({
+  _id: {
+    type: String,
+    required: true
+  },
+  userId: {
+    type: String,
+    required: false,
+    index: true
+  },
+  ownerKeyHash: {
+    type: String,
+    required: false
+  },
+  filename: {
+    type: String,
+    required: true
+  },
+  mimeType: {
+    type: String,
+    required: true
+  },
+  totalSize: {
+    type: Number,
+    required: true
+  },
+  chunkSize: {
+    type: Number,
+    required: true
+  },
+  chunksTotal: {
+    type: Number,
+    required: true
+  },
+  status: {
+    type: String,
+    required: true,
+    enum: ZRBUploadSessionStatus.options
+  },
+  createdAt: {
+    type: Date,
+    required: true,
+    default: Date.now
+  },
+  expiresAt: {
+    type: Date,
+    required: true
+  },
+  fileId: {
+    type: String,
+    required: false
+  },
+  isPublic: {
+    type: Boolean,
+    required: false
+  },
+  error: {
+    type: String,
+    required: false
+  }
+}, {
+  versionKey: false
+});
+RBUploadSessionSchema.index({
+  expiresAt: 1
+}, {
+  expireAfterSeconds: 0
+});
 const RBUploadSessionPolicy = {
   subject: "RBUploadSession",
   define: (builder, ctx) => {
     builder.can("create", "RBUploadSession");
     if (ctx.userId) {
-      builder.can("read", "RBUploadSession", { userId: ctx.userId });
-      builder.can("update", "RBUploadSession", { userId: ctx.userId });
-      builder.can("delete", "RBUploadSession", { userId: ctx.userId });
+      builder.can("read", "RBUploadSession", {
+        userId: ctx.userId
+      });
+      builder.can("update", "RBUploadSession", {
+        userId: ctx.userId
+      });
+      builder.can("delete", "RBUploadSession", {
+        userId: ctx.userId
+      });
     }
     const uploadKeyHash = typeof ctx.claims?.uploadKeyHash === "string" ? ctx.claims.uploadKeyHash.trim() : "";
     if (uploadKeyHash) {
-      builder.can("read", "RBUploadSession", { ownerKeyHash: uploadKeyHash });
-      builder.can("update", "RBUploadSession", { ownerKeyHash: uploadKeyHash });
-      builder.can("delete", "RBUploadSession", { ownerKeyHash: uploadKeyHash });
+      builder.can("read", "RBUploadSession", {
+        ownerKeyHash: uploadKeyHash
+      });
+      builder.can("update", "RBUploadSession", {
+        ownerKeyHash: uploadKeyHash
+      });
+      builder.can("delete", "RBUploadSession", {
+        ownerKeyHash: uploadKeyHash
+      });
     }
   }
 };
@@ -304,22 +587,51 @@ const ZRBUploadChunk = z.object({
   createdAt: z.date(),
   expiresAt: z.date()
 });
-const RBUploadChunkSchema = new Schema$1(
-  {
-    uploadId: { type: String, required: true, index: true },
-    index: { type: Number, required: true },
-    data: { type: Buffer, required: true },
-    size: { type: Number, required: true },
-    sha256: { type: String, required: false },
-    createdAt: { type: Date, required: true, default: Date.now },
-    expiresAt: { type: Date, required: true }
-  },
-  {
-    versionKey: false
-  }
-);
-RBUploadChunkSchema.index({ uploadId: 1, index: 1 }, { unique: true });
-RBUploadChunkSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+const RBUploadChunkSchema = new Schema$1({
+  uploadId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  index: {
+    type: Number,
+    required: true
+  },
+  data: {
+    type: Buffer,
+    required: true
+  },
+  size: {
+    type: Number,
+    required: true
+  },
+  sha256: {
+    type: String,
+    required: false
+  },
+  createdAt: {
+    type: Date,
+    required: true,
+    default: Date.now
+  },
+  expiresAt: {
+    type: Date,
+    required: true
+  }
+}, {
+  versionKey: false
+});
+RBUploadChunkSchema.index({
+  uploadId: 1,
+  index: 1
+}, {
+  unique: true
+});
+RBUploadChunkSchema.index({
+  expiresAt: 1
+}, {
+  expireAfterSeconds: 0
+});
 const ZRBNotification = z.object({
   userId: z.string(),
   topic: z.string().optional(),
@@ -333,35 +645,92 @@ const ZRBNotification = z.object({
   metadata: z.record(z.string(), z.unknown()).optional()
 });
 const TTL_90_DAYS_S = 60 * 60 * 24 * 90;
-const RBNotificationSchema = new Schema$1(
-  {
-    userId: { type: String, required: true, index: true },
-    topic: { type: String, required: false, index: true },
-    title: { type: String, required: true },
-    body: { type: String, required: false },
-    url: { type: String, required: false },
-    createdAt: { type: Date, required: true, default: Date.now, index: true },
-    seenAt: { type: Date, required: false, index: true },
-    readAt: { type: Date, required: false, index: true },
-    archivedAt: { type: Date, required: false },
-    metadata: { type: Schema$1.Types.Mixed, required: false }
-  },
-  {
-    versionKey: false
-  }
-);
-RBNotificationSchema.index({ userId: 1, archivedAt: 1, createdAt: -1 });
-RBNotificationSchema.index({ userId: 1, seenAt: 1, archivedAt: 1, createdAt: -1 });
-RBNotificationSchema.index({ userId: 1, readAt: 1, archivedAt: 1, createdAt: -1 });
-RBNotificationSchema.index({ archivedAt: 1 }, { expireAfterSeconds: TTL_90_DAYS_S });
+const RBNotificationSchema = new Schema$1({
+  userId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  topic: {
+    type: String,
+    required: false,
+    index: true
+  },
+  title: {
+    type: String,
+    required: true
+  },
+  body: {
+    type: String,
+    required: false
+  },
+  url: {
+    type: String,
+    required: false
+  },
+  createdAt: {
+    type: Date,
+    required: true,
+    default: Date.now,
+    index: true
+  },
+  seenAt: {
+    type: Date,
+    required: false,
+    index: true
+  },
+  readAt: {
+    type: Date,
+    required: false,
+    index: true
+  },
+  archivedAt: {
+    type: Date,
+    required: false
+  },
+  metadata: {
+    type: Schema$1.Types.Mixed,
+    required: false
+  }
+}, {
+  versionKey: false
+});
+RBNotificationSchema.index({
+  userId: 1,
+  archivedAt: 1,
+  createdAt: -1
+});
+RBNotificationSchema.index({
+  userId: 1,
+  seenAt: 1,
+  archivedAt: 1,
+  createdAt: -1
+});
+RBNotificationSchema.index({
+  userId: 1,
+  readAt: 1,
+  archivedAt: 1,
+  createdAt: -1
+});
+RBNotificationSchema.index({
+  archivedAt: 1
+}, {
+  expireAfterSeconds: TTL_90_DAYS_S
+});
 const RBNotificationPolicy = {
   subject: "RBNotification",
   define: (builder, ctx) => {
     if (!ctx.userId) return;
     builder.can("create", "RBNotification");
-    builder.can("read", "RBNotification", { userId: ctx.userId });
-    builder.can("update", "RBNotification", { userId: ctx.userId });
-    builder.can("delete", "RBNotification", { userId: ctx.userId });
+    builder.can("read", "RBNotification", {
+      userId: ctx.userId
+    });
+    builder.can("update", "RBNotification", {
+      userId: ctx.userId
+    });
+    builder.can("delete", "RBNotification", {
+      userId: ctx.userId
+    });
   }
 };
 const ZRBNotificationDigestFrequency = z.enum(["off", "daily", "weekly"]);
@@ -377,44 +746,72 @@ const ZRBNotificationSettings = z.object({
   topicPreferences: z.array(ZRBNotificationTopicPreference).optional(),
   lastDigestSentAt: z.date().optional()
 });
-const TopicPreferenceSchema = new Schema$1(
-  {
-    topic: { type: String, required: true },
-    inApp: { type: Boolean, required: true, default: true },
-    emailDigest: { type: Boolean, required: true, default: true },
-    push: { type: Boolean, required: true, default: false }
-  },
-  { _id: false }
-);
-const RBNotificationSettingsSchema = new Schema$1(
-  {
-    userId: { type: String, required: true },
-    digestFrequency: {
-      type: String,
-      required: true,
-      enum: ZRBNotificationDigestFrequency.options,
-      default: "weekly"
-    },
-    topicPreferences: {
-      type: [TopicPreferenceSchema],
-      default: []
-    },
-    lastDigestSentAt: { type: Date, required: false }
+const TopicPreferenceSchema = new Schema$1({
+  topic: {
+    type: String,
+    required: true
+  },
+  inApp: {
+    type: Boolean,
+    required: true,
+    default: true
+  },
+  emailDigest: {
+    type: Boolean,
+    required: true,
+    default: true
   },
-  {
-    versionKey: false,
-    timestamps: true
+  push: {
+    type: Boolean,
+    required: true,
+    default: false
   }
-);
-RBNotificationSettingsSchema.index({ userId: 1 }, { unique: true });
-RBNotificationSettingsSchema.index({ userId: 1, "topicPreferences.topic": 1 });
+}, {
+  _id: false
+});
+const RBNotificationSettingsSchema = new Schema$1({
+  userId: {
+    type: String,
+    required: true
+  },
+  digestFrequency: {
+    type: String,
+    required: true,
+    enum: ZRBNotificationDigestFrequency.options,
+    default: "weekly"
+  },
+  topicPreferences: {
+    type: [TopicPreferenceSchema],
+    default: []
+  },
+  lastDigestSentAt: {
+    type: Date,
+    required: false
+  }
+}, {
+  versionKey: false,
+  timestamps: true
+});
+RBNotificationSettingsSchema.index({
+  userId: 1
+}, {
+  unique: true
+});
+RBNotificationSettingsSchema.index({
+  userId: 1,
+  "topicPreferences.topic": 1
+});
 const RBNotificationSettingsPolicy = {
   subject: "RBNotificationSettings",
   define: (builder, ctx) => {
     if (!ctx.userId) return;
     builder.can("create", "RBNotificationSettings");
-    builder.can("read", "RBNotificationSettings", { userId: ctx.userId });
-    builder.can("update", "RBNotificationSettings", { userId: ctx.userId });
+    builder.can("read", "RBNotificationSettings", {
+      userId: ctx.userId
+    });
+    builder.can("update", "RBNotificationSettings", {
+      userId: ctx.userId
+    });
   }
 };
 const ZRBOAuthRequest = z.object({
@@ -425,18 +822,41 @@ const ZRBOAuthRequest = z.object({
   createdAt: z.date(),
   expiresAt: z.date()
 });
-const RBOAuthRequestSchema = new Schema$1(
-  {
-    _id: { type: String, required: true },
-    providerId: { type: String, required: true, index: true },
-    codeVerifier: { type: String, required: true },
-    returnTo: { type: String, required: false },
-    createdAt: { type: Date, required: true, default: Date.now },
-    expiresAt: { type: Date, required: true }
-  },
-  { versionKey: false }
-);
-RBOAuthRequestSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+const RBOAuthRequestSchema = new Schema$1({
+  _id: {
+    type: String,
+    required: true
+  },
+  providerId: {
+    type: String,
+    required: true,
+    index: true
+  },
+  codeVerifier: {
+    type: String,
+    required: true
+  },
+  returnTo: {
+    type: String,
+    required: false
+  },
+  createdAt: {
+    type: Date,
+    required: true,
+    default: Date.now
+  },
+  expiresAt: {
+    type: Date,
+    required: true
+  }
+}, {
+  versionKey: false
+});
+RBOAuthRequestSchema.index({
+  expiresAt: 1
+}, {
+  expireAfterSeconds: 0
+});
 const frameworkSchemas = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   RBNotificationPolicy,
@@ -493,7 +913,10 @@ function localizedStringField(options) {
     get: (value) => withLocalizedStringFallback(userGet ? userGet(value) : value)
   };
 }
-const { Schema, model } = mongoose;
+const {
+  Schema,
+  model
+} = mongoose;
 class PaginationValidationError extends Error {
   code = "invalid_pagination";
   statusCode = 400;
@@ -515,18 +938,26 @@ const normalizePaginationSpec = (spec) => {
   const direction = spec.direction ?? "next";
   if (direction !== "next" && direction !== "prev") throw new PaginationValidationError("Invalid pagination direction");
   if (!Array.isArray(spec.sort) || spec.sort.length === 0) throw new PaginationValidationError("Invalid pagination sort");
-  const sort = spec.sort.map(({ field, order }) => ({
+  const sort = spec.sort.map(({
+    field,
+    order
+  }) => ({
     field: assertSafeMongoFieldPath(field),
     order: normalizeOrder(order)
   }));
   const seenFields = /* @__PURE__ */ new Set();
-  for (const { field } of sort) {
+  for (const {
+    field
+  } of sort) {
     if (seenFields.has(field)) throw new PaginationValidationError(`Duplicate pagination sort field: ${field}`);
     seenFields.add(field);
   }
   const primaryOrder = sort[0]?.order;
   if (!seenFields.has("_id")) {
-    sort.push({ field: "_id", order: primaryOrder });
+    sort.push({
+      field: "_id",
+      order: primaryOrder
+    });
   }
   return {
     ...spec,
@@ -562,14 +993,19 @@ const assertSafeMongoFieldPath = (field) => {
 const encodePaginationCursor = (spec, node, options) => {
   const normalized = normalizePaginationSpec(spec);
   const values = /* @__PURE__ */ Object.create(null);
-  for (const { field } of normalized.sort) {
+  for (const {
+    field
+  } of normalized.sort) {
     const value = readFieldValue(node, field);
     if (typeof value === "undefined") {
       throw new Error(`Pagination cursor encode failed (missing field: ${field})`);
     }
     values[field] = encodeCursorValue(field, value);
   }
-  const payload = { v: 1, values };
+  const payload = {
+    v: 1,
+    values
+  };
   const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
   const sigB64 = signCursorPayloadB64(payloadB64, options.signingSecret);
   return `${payloadB64}.${sigB64}`;
@@ -592,7 +1028,9 @@ const decodePaginationCursor = (spec, cursor, options) => {
   if (payload.v !== 1) throw new PaginationValidationError("Unsupported pagination cursor version");
   if (!payload.values || typeof payload.values !== "object") throw new PaginationValidationError("Invalid pagination cursor payload");
   const decoded = /* @__PURE__ */ Object.create(null);
-  for (const { field } of normalized.sort) {
+  for (const {
+    field
+  } of normalized.sort) {
     if (!Object.prototype.hasOwnProperty.call(payload.values, field)) {
       throw new PaginationValidationError(`Pagination cursor missing field: ${field}`);
     }
@@ -615,13 +1053,19 @@ const verifyCursorSignature = (payloadB64, sigB64, secret) => {
 const encodeCursorValue = (field, value) => {
   if (value === null) return null;
   if (field === "_id") {
-    if (value instanceof Types.ObjectId) return { $oid: value.toHexString() };
+    if (value instanceof Types.ObjectId) return {
+      $oid: value.toHexString()
+    };
     if (typeof value === "string") return value;
     throw new Error("Pagination cursor encode failed (_id must be an ObjectId or string)");
   }
-  if (value instanceof Date) return { $date: value.toISOString() };
+  if (value instanceof Date) return {
+    $date: value.toISOString()
+  };
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
-  if (value instanceof Types.ObjectId) return { $oid: value.toHexString() };
+  if (value instanceof Types.ObjectId) return {
+    $oid: value.toHexString()
+  };
   throw new Error(`Unsupported pagination cursor value type for field: ${field}`);
 };
 const decodeCursorValue = (field, value) => {
@@ -681,7 +1125,10 @@ const compileMongoPagination = (spec, options) => {
 };
 const toMongoSort = (spec) => {
   const mongoSort = /* @__PURE__ */ Object.create(null);
-  for (const { field, order } of spec.sort) {
+  for (const {
+    field,
+    order
+  } of spec.sort) {
     const forQueryOrder = spec.direction === "prev" ? invertOrder(order) : order;
     mongoSort[field] = forQueryOrder === "asc" ? 1 : -1;
   }
@@ -706,9 +1153,13 @@ const buildKeysetFilterDelta = (spec, cursorValues) => {
     const cmp = /* @__PURE__ */ Object.create(null);
     cmp[current.field] = cmpOp;
     and.push(cmp);
-    branches.push(and.length === 1 ? and[0] : { $and: and });
+    branches.push(and.length === 1 ? and[0] : {
+      $and: and
+    });
   }
-  return { $or: branches };
+  return {
+    $or: branches
+  };
 };
 const getKeysetOp = (order, direction) => {
   if (direction === "next") return order === "asc" ? "$gt" : "$lt";
@@ -729,7 +1180,10 @@ const materializeMongoPagination = (compiled, fetchedNodes, options) => {
     hasPrevPage
   };
   if (nodes.length === 0) {
-    return { nodes, pageInfo };
+    return {
+      nodes,
+      pageInfo
+    };
   }
   if (hasPrevPage) {
     pageInfo.prevCursor = encodePaginationCursor(compiled.spec, nodes[0], options.cursor);
@@ -737,7 +1191,10 @@ const materializeMongoPagination = (compiled, fetchedNodes, options) => {
   if (hasNextPage) {
     pageInfo.nextCursor = encodePaginationCursor(compiled.spec, nodes[nodes.length - 1], options.cursor);
   }
-  return { nodes, pageInfo };
+  return {
+    nodes,
+    pageInfo
+  };
 };
 const MongoAdapter = {
   applyPagination: (query, compiled) => {
@@ -748,13 +1205,17 @@ const MongoAdapter = {
   }
 };
 const paginateMongoQuery = async (query, pagination, options) => {
-  const compiled = compileMongoPagination(pagination, { cursor: options.cursor });
+  const compiled = compileMongoPagination(pagination, {
+    cursor: options.cursor
+  });
   MongoAdapter.applyPagination(query, compiled);
   const fetchedNodes = await query.exec();
   if (!Array.isArray(fetchedNodes)) {
     throw new Error("paginateMongoQuery expects query.exec() to return an array");
   }
-  return materializeMongoPagination(compiled, fetchedNodes, { cursor: options.cursor });
+  return materializeMongoPagination(compiled, fetchedNodes, {
+    cursor: options.cursor
+  });
 };
 const getQueryOptions$1 = (query) => {
   if (!query || typeof query !== "object") return void 0;
@@ -775,7 +1236,9 @@ const mongoPaginationPlugin = (schema, pluginOptions) => {
     if (!spec) throw new Error("Missing pagination spec");
     const cursor = options?.cursor ?? getCursorFromOptions(this) ?? pluginOptions?.cursor;
     if (!cursor?.signingSecret) throw new Error("Missing pagination cursor signingSecret");
-    return await paginateMongoQuery(this, spec, { cursor });
+    return await paginateMongoQuery(this, spec, {
+      cursor
+    });
   };
 };
 const buildSearchTextStage = (options) => {
@@ -793,14 +1256,20 @@ const buildSearchTextStage = (options) => {
     }
   };
   if (options.highlightPath) {
-    stage.$search.highlight = { path: options.highlightPath };
+    stage.$search.highlight = {
+      path: options.highlightPath
+    };
   }
   return stage;
 };
 const searchMetaProjection = () => {
   return {
-    score: { $meta: "searchScore" },
-    highlights: { $meta: "searchHighlights" }
+    score: {
+      $meta: "searchScore"
+    },
+    highlights: {
+      $meta: "searchHighlights"
+    }
   };
 };
 const listResultHasIndex = (listResult, name) => {
@@ -826,27 +1295,38 @@ const ensureSearchIndex = async (params) => {
   if (!name) throw new Error("Missing search index name");
   let listResult;
   try {
-    listResult = await params.db.command({ listSearchIndexes: collection });
+    listResult = await params.db.command({
+      listSearchIndexes: collection
+    });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`listSearchIndexes failed for "${collection}": ${message}`);
   }
   if (listResultHasIndex(listResult, name)) {
-    return { created: false };
+    return {
+      created: false
+    };
   }
   try {
     await params.db.command({
       createSearchIndexes: collection,
-      indexes: [{ name, definition: params.definition }]
+      indexes: [{
+        name,
+        definition: params.definition
+      }]
     });
   } catch (error) {
     if (isIndexAlreadyExistsError(error)) {
-      return { created: false };
+      return {
+        created: false
+      };
     }
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`createSearchIndexes failed for "${collection}" (index "${name}"): ${message}`);
   }
-  return { created: true };
+  return {
+    created: true
+  };
 };
 const getAppName$1 = (env = process.env) => {
   const appName = env.APP_NAME?.trim();
@@ -899,7 +1379,9 @@ const ensureMongooseConnection = async (dbName) => {
     });
   }
   await waitForOpen(rootConnection);
-  const connection = rootConnection.name === normalizedDbName ? rootConnection : rootConnection.useDb(normalizedDbName, { useCache: true });
+  const connection = rootConnection.name === normalizedDbName ? rootConnection : rootConnection.useDb(normalizedDbName, {
+    useCache: true
+  });
   await waitForOpen(connection);
   connections.set(normalizedDbName, connection);
   return connection;
@@ -937,22 +1419,42 @@ const getQuerySession = (query) => {
 const getRtsModels = (db) => {
   const RtsCounter = db.models.RBRtsCounter ?? db.model("RBRtsCounter", RBRtsCounterSchema);
   const RtsChange = db.models.RBRtsChange ?? db.model("RBRtsChange", RBRtsChangeSchema);
-  return { RtsCounter, RtsChange };
+  return {
+    RtsCounter,
+    RtsChange
+  };
 };
 const allocateSeqRange = async (db, count, session) => {
-  const { RtsCounter } = getRtsModels(db);
-  const updated = await RtsCounter.findOneAndUpdate(
-    { _id: RTS_COUNTER_ID },
-    { $inc: { seq: count } },
-    { upsert: true, new: true, setDefaultsOnInsert: true, projection: { seq: 1 }, session }
-  ).lean();
+  const {
+    RtsCounter
+  } = getRtsModels(db);
+  const updated = await RtsCounter.findOneAndUpdate({
+    _id: RTS_COUNTER_ID
+  }, {
+    $inc: {
+      seq: count
+    }
+  }, {
+    upsert: true,
+    returnDocument: "after",
+    setDefaultsOnInsert: true,
+    projection: {
+      seq: 1
+    },
+    session
+  }).lean();
   const end = Number(updated?.seq ?? 0);
   const start = end - count + 1;
-  return { start, end };
+  return {
+    start,
+    end
+  };
 };
 const insertChanges = async (db, changes, session) => {
   if (!changes.length) return;
-  const { RtsChange } = getRtsModels(db);
+  const {
+    RtsChange
+  } = getRtsModels(db);
   const ts = /* @__PURE__ */ new Date();
   const docs = changes.map((c3) => ({
     seq: c3.seq,
@@ -962,7 +1464,9 @@ const insertChanges = async (db, changes, session) => {
     ts
   }));
   if (session) {
-    await RtsChange.insertMany(docs, { session });
+    await RtsChange.insertMany(docs, {
+      session
+    });
     return;
   }
   await RtsChange.insertMany(docs);
@@ -970,7 +1474,9 @@ const insertChanges = async (db, changes, session) => {
 const recordDeleteChanges = async (db, modelName, ids, session) => {
   const uniqueIds = Array.from(new Set(ids)).filter(Boolean);
   if (!uniqueIds.length) return;
-  const { start } = await allocateSeqRange(db, uniqueIds.length, session);
+  const {
+    start
+  } = await allocateSeqRange(db, uniqueIds.length, session);
   await insertChanges(db, uniqueIds.map((docId, idx) => ({
     seq: start + idx,
     modelName,
@@ -979,8 +1485,14 @@ const recordDeleteChanges = async (db, modelName, ids, session) => {
   })), session);
 };
 const recordResetModel = async (db, modelName, session) => {
-  const { start } = await allocateSeqRange(db, 1, session);
-  await insertChanges(db, [{ seq: start, modelName, op: "reset_model" }], session);
+  const {
+    start
+  } = await allocateSeqRange(db, 1, session);
+  await insertChanges(db, [{
+    seq: start,
+    modelName,
+    op: "reset_model"
+  }], session);
 };
 const captureDeleteMeta = async (query, mode) => {
   const modelName = String(query?.model?.modelName ?? "");
@@ -988,7 +1500,9 @@ const captureDeleteMeta = async (query, mode) => {
   if (isGlobalDb(query?.model?.db)) return;
   const filter = typeof query.getFilter === "function" ? query.getFilter() : query.getQuery?.() ?? {};
   const session = getQuerySession(query);
-  const findQuery = query.model.find(filter, { _id: 1 });
+  const findQuery = query.model.find(filter, {
+    _id: 1
+  });
   if (session && typeof findQuery.session === "function") {
     findQuery.session(session);
   }
@@ -1027,19 +1541,34 @@ const flushDeleteMeta = async (query) => {
   }
 };
 const rtsChangeLogPlugin = (schema) => {
-  schema.pre("deleteOne", { query: true, document: false }, async function() {
+  schema.pre("deleteOne", {
+    query: true,
+    document: false
+  }, async function() {
     await captureDeleteMeta(this, "one");
   });
-  schema.pre("deleteMany", { query: true, document: false }, async function() {
+  schema.pre("deleteMany", {
+    query: true,
+    document: false
+  }, async function() {
     await captureDeleteMeta(this, "many");
   });
-  schema.post("deleteOne", { query: true, document: false }, async function() {
+  schema.post("deleteOne", {
+    query: true,
+    document: false
+  }, async function() {
     await flushDeleteMeta(this);
   });
-  schema.post("deleteMany", { query: true, document: false }, async function() {
+  schema.post("deleteMany", {
+    query: true,
+    document: false
+  }, async function() {
     await flushDeleteMeta(this);
   });
-  schema.post("findOneAndDelete", { query: true, document: false }, async function(doc) {
+  schema.post("findOneAndDelete", {
+    query: true,
+    document: false
+  }, async function(doc) {
     const modelName = String(this?.model?.modelName ?? "");
     if (!modelName || modelName.startsWith("RB") || EXCLUDED_MODEL_NAMES.has(modelName)) return;
     const db = this?.model?.db;
@@ -1060,7 +1589,9 @@ const mergeMongoQuery = (left, right) => {
   const leftQuery = isRecord(left) ? left : {};
   if (Object.keys(leftQuery).length === 0) return right;
   if (Object.keys(right).length === 0) return leftQuery;
-  return { $and: [leftQuery, right] };
+  return {
+    $and: [leftQuery, right]
+  };
 };
 const getQueryOptions = (query) => {
   if (!query || typeof query !== "object") return void 0;
@@ -1094,12 +1625,16 @@ const addQueryAclFilter = (query, action) => {
 };
 const injectAggregateMatch = (pipeline, match) => {
   if (pipeline.length === 0) {
-    pipeline.unshift({ $match: match });
+    pipeline.unshift({
+      $match: match
+    });
     return;
   }
   const first = pipeline[0];
   if (!isRecord(first)) {
-    pipeline.unshift({ $match: match });
+    pipeline.unshift({
+      $match: match
+    });
     return;
   }
   if ("$geoNear" in first) {
@@ -1110,10 +1645,14 @@ const injectAggregateMatch = (pipeline, match) => {
     }
   }
   if ("$search" in first || "$vectorSearch" in first || "$searchMeta" in first) {
-    pipeline.splice(1, 0, { $match: match });
+    pipeline.splice(1, 0, {
+      $match: match
+    });
     return;
   }
-  pipeline.unshift({ $match: match });
+  pipeline.unshift({
+    $match: match
+  });
 };
 const addAggregateAclFilter = (aggregate, action) => {
   const storedAcl = getStoredAclFromAggregate(aggregate);
@@ -1132,13 +1671,23 @@ const patchAggregateAcl = () => {
   const AggregatePrototype = mongoose.Aggregate.prototype;
   if (typeof AggregatePrototype.acl === "function") return;
   AggregatePrototype.acl = function(ability, action = "read") {
-    this.option({ rbAcl: { ability, action } });
+    this.option({
+      rbAcl: {
+        ability,
+        action
+      }
+    });
     return this;
   };
 };
 const createModelAclProxy = (model2, ability) => {
   return new Proxy(model2, {
     get(target, prop, receiver) {
+      if (prop === "acl") {
+        return () => {
+          throw new Error(`Model "${target.modelName}" is already ACL-scoped. Do not call .acl(...) again.`);
+        };
+      }
       const value = Reflect.get(target, prop, receiver);
       if (typeof value !== "function") return value;
       return (...args) => {
@@ -1154,7 +1703,12 @@ const createModelAclProxy = (model2, ability) => {
 const mongooseAclPlugin = (schema) => {
   patchAggregateAcl();
   schema.query.acl = function(ability, action) {
-    this.setOptions({ rbAcl: { ability, action } });
+    this.setOptions({
+      rbAcl: {
+        ability,
+        action
+      }
+    });
     return this;
   };
   schema.statics.acl = function(ability) {
@@ -1201,20 +1755,10 @@ const mongooseAclPlugin = (schema) => {
   });
 };
 let cachedModels = null;
-const DEFAULT_GLOBAL_RB_MODEL_NAMES_SET = /* @__PURE__ */ new Set([
-  "RBUser",
-  "RBTenant",
-  "RBOAuthRequest"
-]);
+const DEFAULT_GLOBAL_RB_MODEL_NAMES_SET = /* @__PURE__ */ new Set(["RBUser", "RBTenant", "RBOAuthRequest"]);
 const assertSchema = (exportName, value) => {
   if (value instanceof mongoose.Schema) return value;
-  throw new Error(
-    [
-      `Expected ${exportName} to be an instance of mongoose.Schema, but it was not.`,
-      "rpcbase supports mongoose 9+ only.",
-      "Fix: ensure the project is using mongoose 9.x and that all packages resolve the same mongoose instance (try `npm ls mongoose`)."
-    ].join(" ")
-  );
+  throw new Error([`Expected ${exportName} to be an instance of mongoose.Schema, but it was not.`, "rpcbase supports mongoose 9+ only.", "Fix: ensure the project is using mongoose 9.x and that all packages resolve the same mongoose instance (try `npm ls mongoose`)."].join(" "));
 };
 const getFrameworkSchemaForModelName = (modelName) => {
   const exportName = `${modelName}Schema`;
@@ -1237,14 +1781,23 @@ const registerSchema = (target, other, modelName, schema, scope) => {
 const buildSchemasFromModules = (modules) => Object.entries(modules).filter(([key]) => key.endsWith("Schema")).map(([key, schemaValue]) => {
   const schema = assertSchema(key, schemaValue);
   const modelName = key.replace(/Schema$/, "");
-  return { modelName, schema };
+  return {
+    modelName,
+    schema
+  };
 });
-const registerModels = ({ tenant, global }) => {
+const registerModels = ({
+  tenant,
+  global
+}) => {
   registerPoliciesFromModules(frameworkSchemas);
   registerPoliciesFromModules(tenant);
   const tenantSchemas = {};
   const globalSchemas = {};
-  for (const { modelName, schema } of buildSchemasFromModules(frameworkSchemas)) {
+  for (const {
+    modelName,
+    schema
+  } of buildSchemasFromModules(frameworkSchemas)) {
     if (DEFAULT_GLOBAL_RB_MODEL_NAMES_SET.has(modelName)) {
       const cloned = schema.clone();
       registerSchema(globalSchemas, tenantSchemas, modelName, cloned);
@@ -1254,7 +1807,10 @@ const registerModels = ({ tenant, global }) => {
       registerSchema(tenantSchemas, globalSchemas, modelName, cloned);
     }
   }
-  for (const { modelName, schema } of buildSchemasFromModules(tenant)) {
+  for (const {
+    modelName,
+    schema
+  } of buildSchemasFromModules(tenant)) {
     if (modelName === "RBUser" || modelName === "RBTenant") {
       throw new Error(`Invalid tenant model name "${modelName}". RBUser/RBTenant are global models.`);
     }
@@ -1267,7 +1823,10 @@ const registerModels = ({ tenant, global }) => {
     applyTenantPlugins(cloned);
     registerSchema(tenantSchemas, globalSchemas, modelName, cloned);
   }
-  for (const { modelName, schema } of buildSchemasFromModules(global ?? {})) {
+  for (const {
+    modelName,
+    schema
+  } of buildSchemasFromModules(global ?? {})) {
     if (modelName.startsWith("RB")) {
       const frameworkSchema = getFrameworkSchemaForModelName(modelName);
       if (frameworkSchema && schema === frameworkSchema) continue;
@@ -1276,15 +1835,24 @@ const registerModels = ({ tenant, global }) => {
     const cloned = schema.clone();
     registerSchema(globalSchemas, tenantSchemas, modelName, cloned);
   }
-  const allSchemas = { ...globalSchemas, ...tenantSchemas };
+  const allSchemas = {
+    ...globalSchemas,
+    ...tenantSchemas
+  };
   for (const [modelName, schema] of Object.entries(allSchemas)) {
     if (!mongoose.models[modelName]) {
       mongoose.model(modelName, schema);
     }
   }
   cachedModels = {
-    tenant: { ...cachedModels?.tenant ?? {}, ...tenantSchemas },
-    global: { ...cachedModels?.global ?? {}, ...globalSchemas }
+    tenant: {
+      ...cachedModels?.tenant ?? {},
+      ...tenantSchemas
+    },
+    global: {
+      ...cachedModels?.global ?? {},
+      ...globalSchemas
+    }
   };
 };
 const getRegisteredModels = (scope) => {
@@ -1310,11 +1878,24 @@ const getTenantIdFromCtx = (ctx) => {
 };
 const models = {
   register: registerModels,
-  get: async (modelName, ctx) => {
+  getUnsafe: async (modelName, ctx) => {
     const tenantId = getTenantIdFromCtx(ctx);
     const dbName = getTenantDbName(tenantId);
     return loadModelFromDb(modelName, dbName, "tenant");
   },
+  get: async (modelName, ctx) => {
+    const model2 = await models.getUnsafe(modelName, ctx);
+    const resolvedAbility = ctx.ability;
+    const isProtected = hasRegisteredPolicy(modelName);
+    if (!isProtected) {
+      return model2;
+    }
+    if (!resolvedAbility) {
+      throw new Error(`Model "${modelName}" is ACL-protected. Set ctx.ability or use models.getUnsafe(...) explicitly.`);
+    }
+    if (typeof model2.acl !== "function") return model2;
+    return model2.acl(resolvedAbility);
+  },
   getGlobal: async (modelName, ctx) => {
     const dbName = getGlobalDbName();
     return loadModelFromDb(modelName, dbName, "global");
@@ -1328,6 +1909,12 @@ const createModels = (modules) => {
     }
     return models.get(modelNameOrNames, ctx);
   });
+  const getUnsafe = (async (modelNameOrNames, ctx) => {
+    if (Array.isArray(modelNameOrNames)) {
+      return Promise.all(modelNameOrNames.map((modelName) => models.getUnsafe(modelName, ctx)));
+    }
+    return models.getUnsafe(modelNameOrNames, ctx);
+  });
   const getGlobal = (async (modelNameOrNames, ctx) => {
     if (Array.isArray(modelNameOrNames)) {
       return Promise.all(modelNameOrNames.map((modelName) => models.getGlobal(modelName, ctx)));
@@ -1337,6 +1924,7 @@ const createModels = (modules) => {
   return {
     register: registerModels,
     get,
+    getUnsafe,
     getGlobal
   };
 };
@@ -1392,7 +1980,11 @@ async function withTransaction(scope, fn, options) {
   const filesystemDb = await ensureMongooseConnection(filesystemDbName);
   const session = await tenantDb.startSession();
   const tenantCtx = typeof scope === "object" && "ctx" in scope ? scope.ctx : buildTenantLoadModelCtx(normalizedTenantId);
-  const globalCtx = { req: { session: null } };
+  const globalCtx = {
+    req: {
+      session: null
+    }
+  };
   try {
     return await session.withTransaction(async () => fn({
       tenantId: normalizedTenantId,
@@ -1467,6 +2059,7 @@ export {
   getTenantFilesystemDbFromCtx,
   getTenantFilesystemDbName,
   c as getTenantRolesFromSessionUser,
+  hasRegisteredPolicy,
   isPaginationValidationError,
   localizedStringField,
   m as makeZE164Phone,