@web-ts-toolkit/access-router-client 0.42.2 → 0.44.0

package/index.mjs

@@ -21,6 +21,39 @@ var MissingPersistenceIdentityError = class extends Error {
     this.name = "MissingPersistenceIdentityError";
   }
 };
+var MODEL_PATH_PATTERN = /[^.[\]]+|\[(?:([^"'[\]]+)|["']([^"']+)["'])\]/g;
+var MODEL_UNSAFE_PATH_PARTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function toModelPathParts(path) {
+  if (path.length === 0) {
+    return [];
+  }
+  const result = [];
+  path.replace(MODEL_PATH_PATTERN, (_match, bare, quoted) => {
+    const token = bare ?? quoted ?? _match;
+    result.push(/^\d+$/.test(token) ? Number(token) : token);
+    return "";
+  });
+  return result.length > 0 ? result : [path];
+}
+function modelPathRoot(path) {
+  const parts = toModelPathParts(path);
+  if (parts.length === 0) {
+    return "";
+  }
+  return String(parts[0]);
+}
+function assertSupportedModelPath(path) {
+  const parts = toModelPathParts(path);
+  if (parts.length === 0) {
+    throw new Error(`Model path must not be empty.`);
+  }
+  for (const part of parts) {
+    if (typeof part === "string" && MODEL_UNSAFE_PATH_PARTS.has(part)) {
+      throw new Error(`Model path "${path}" contains a reserved segment "${part}".`);
+    }
+  }
+  return String(parts[0]);
+}
 var Model = class _Model {
   constructor(data, adapter, persistenceId, fromExisting) {
     this.modifiedPaths = /* @__PURE__ */ new Set();
@@ -93,12 +126,6 @@ var Model = class _Model {
     return queuedSave;
   }
   async saveNow(reqConfig) {
-    const submittedPaths = new Set(this.modifiedPaths);
-    const submittedValues = {};
-    for (const path of submittedPaths) {
-      submittedValues[path] = cloneDeep(getValue(this._data, path));
-    }
-    const submittedData = this.prepareData();
     const persistenceId = this._data._id ?? this._persistenceId;
     if (persistenceId == null && this._fromExisting) {
       throw new MissingPersistenceIdentityError(
@@ -106,17 +133,26 @@ var Model = class _Model {
       );
     }
     const isCreate = persistenceId == null;
+    const submittedPaths = new Set(this.modifiedPaths);
+    const submittedValues = {};
+    for (const path of submittedPaths) {
+      submittedValues[path] = cloneDeep(getValue(this._data, path));
+    }
+    const submittedData = this.prepareData(isCreate);
     const result = isCreate ? await this._service.create(submittedData, void 0, reqConfig) : await this._service.update(String(persistenceId), submittedData, { returningAll: false }, reqConfig);
     if (!result.success) {
       return { ...result, data: null };
     }
+    const preMergeDirty = new Set(this.modifiedPaths);
+    const preMergeValues = {};
+    for (const path of submittedPaths) {
+      preMergeValues[path] = cloneDeep(getValue(this._data, path));
+    }
     const isConcurrentEdit = (path) => {
       if (!submittedPaths.has(path)) {
-        return this.modifiedPaths.has(path);
+        return preMergeDirty.has(path);
       }
-      const current = getValue(this._data, path);
-      const submitted = submittedValues[path];
-      return !isEqual(current, submitted);
+      return !isEqual(preMergeValues[path], submittedValues[path]);
     };
     const serverData = result.raw ?? {};
     for (const key of Object.keys(serverData)) {
@@ -135,6 +171,8 @@ var Model = class _Model {
     for (const path of submittedPaths) {
       if (!isConcurrentEdit(path)) {
         this.modifiedPaths.delete(path);
+      } else {
+        this.modifiedPaths.add(path);
       }
     }
     if (isCreate && serverData._id != null) {
@@ -161,14 +199,13 @@ var Model = class _Model {
     }
     this._snapshot = nextSnapshot;
     this.definePublicDataProps();
+    const returned = _Model.create(this._data, this._service, this._persistenceId, true);
+    returned._snapshot = cloneDeep(this._snapshot);
+    returned.modifiedPaths = new Set(this.modifiedPaths);
+    returned.definePublicDataProps();
     return {
       ...result,
-      // The post-save snapshot is always an existing document, so propagate
-      // `_fromExisting=true` plus the refreshed persistence identity so the
-      // returned wrapper cannot later silently create a duplicate. (If the
-      // caller intends a fresh draft, they construct `new Model({...}, s)`
-      // directly — `${_fromExisting}` defaults to `false` there.)
-      data: _Model.create(this._data, this._service, this._persistenceId, true)
+      data: returned
     };
   }
   isDirty(path) {
@@ -188,6 +225,7 @@ var Model = class _Model {
    * run `reconcilePath` after the write.
    */
   markModified(path) {
+    assertSupportedModelPath(String(path));
     this.trackModified(String(path));
     return this;
   }
@@ -195,6 +233,7 @@ var Model = class _Model {
     return getValue(this._data, path);
   }
   set(path, value) {
+    const root = assertSupportedModelPath(path);
     const currentValue = getValue(this._data, path);
     if (Object.is(currentValue, value)) {
       return this;
@@ -202,7 +241,7 @@ var Model = class _Model {
     setValue(this._data, path, value);
     this.trackModified(path);
     this.definePublicDataProps();
-    this.reconcilePath(this.normalizePath(path));
+    this.reconcilePath(root);
     return this;
   }
   assign(partial) {
@@ -221,8 +260,12 @@ var Model = class _Model {
     return this;
   }
   reset() {
+    const wasDraft = this.isUnsavedDraft();
     this.replaceData(this._snapshot);
     this.modifiedPaths.clear();
+    if (wasDraft) {
+      this.initializeDirtyState();
+    }
     return this;
   }
   toObject() {
@@ -255,7 +298,10 @@ var Model = class _Model {
       }
     }
   }
-  prepareData() {
+  prepareData(isCreate) {
+    if (isCreate) {
+      return cloneDeep(omit(this._data, ["_id"]));
+    }
     return omit(pick(this._data, Array.from(this.modifiedPaths).map(String)), ["_id"]);
   }
   defineHiddenDataProp(initialValue) {
@@ -302,21 +348,20 @@ var Model = class _Model {
     this.modifiedPaths.add(this.normalizePath(path));
   }
   normalizePath(path) {
-    return path.split(".")[0];
+    return modelPathRoot(path);
   }
   /**
-   * Removes `path` from the dirty set when its current top-level value deeply
-   * equals the snapshot baseline. Used uniformly by `set()`, `assign()`,
-   * public property setters (via the proxy), and `markModified()` so all
-   * entry points share the same tracking rule.
-   *
-   * Note: `_id` is intentionally never reconciled away here — it is excluded
-   * from `initializeDirtyState` and managed explicitly during `save()`
-   * reconciliation.
+   * Removes `path` from the dirty set when its current value deeply equals
+   * the snapshot baseline. Invariant: unsaved drafts never reconcile clean
+   * (snapshot is unpersisted); `_id` is never reconciled here.
    */
+  isUnsavedDraft() {
+    return !this._fromExisting && (this._data._id ?? this._persistenceId) == null;
+  }
   reconcilePath(path) {
     if (path === "_id") return;
     if (!this.modifiedPaths.has(path)) return;
+    if (this.isUnsavedDraft()) return;
     const current = this._data[path];
     const base = this._snapshot[path];
     if (isEqual(current, base)) {
@@ -371,7 +416,7 @@ function getWrapContext(url, options, config) {
 }
 
 // src/services/interceptors.ts
-import axios, { AxiosHeaders as AxiosHeaders2 } from "axios";
+import axios, { AxiosError, AxiosHeaders as AxiosHeaders2 } from "axios";
 
 // src/services/cache-utils.ts
 import { AxiosHeaders } from "axios";
@@ -393,6 +438,10 @@ var UnsupportedGroupedRequestConfigError = class extends Error {
     this.name = "UnsupportedGroupedRequestConfigError";
   }
 };
+var isPlainObjectRecord = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
 var normalizeConfigValue = (value) => {
   if (value == null) return value;
   if (value instanceof AxiosHeaders) {
@@ -423,11 +472,52 @@ var normalizeGroupedRequestConfig = (config) => {
         `Grouped requests do not support symbol-valued axios config at ${path}`
       );
     }
+    if (typeof value === "bigint") {
+      throw new UnsupportedGroupedRequestConfigError(
+        `Grouped requests do not support bigint-valued axios config at ${path}`
+      );
+    }
+    if (typeof value === "number") {
+      if (!Number.isFinite(value)) {
+        throw new UnsupportedGroupedRequestConfigError(
+          `Grouped requests do not support non-finite numeric axios config at ${path}`
+        );
+      }
+      return value;
+    }
+    if (typeof value === "string" || typeof value === "boolean") {
+      return value;
+    }
     if (value instanceof AxiosHeaders) {
       return normalize(value.toJSON(), path);
     }
+    if (value instanceof Date) {
+      const time = value.getTime();
+      if (Number.isNaN(time)) {
+        throw new UnsupportedGroupedRequestConfigError(
+          `Grouped requests do not support invalid Date axios config at ${path}`
+        );
+      }
+      return { __type: "Date", iso: value.toISOString() };
+    }
+    if (value instanceof URLSearchParams) {
+      const entries = Array.from(value.entries()).sort(
+        ([leftKey, leftValue], [rightKey, rightValue]) => leftKey === rightKey ? leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0 : leftKey < rightKey ? -1 : 1
+      );
+      return { __type: "URLSearchParams", entries };
+    }
     if (Array.isArray(value)) {
-      return value.map((item, index) => normalize(item, `${path}[${index}]`));
+      if (seen.has(value)) {
+        throw new UnsupportedGroupedRequestConfigError(
+          `Grouped requests do not support circular axios config at ${path}`
+        );
+      }
+      seen.add(value);
+      try {
+        return value.map((item, index) => normalize(item, `${path}[${index}]`));
+      } finally {
+        seen.delete(value);
+      }
     }
     if (typeof value === "object") {
       if (seen.has(value)) {
@@ -435,19 +525,27 @@ var normalizeGroupedRequestConfig = (config) => {
           `Grouped requests do not support circular axios config at ${path}`
         );
       }
+      if (!isPlainObjectRecord(value)) {
+        throw new UnsupportedGroupedRequestConfigError(
+          `Grouped requests do not support non-plain object axios config at ${path}`
+        );
+      }
       seen.add(value);
-      const normalized = Object.entries(omitBy(value, (item) => item === void 0)).sort(([left], [right]) => left.localeCompare(right)).reduce((acc, [key, item]) => {
-        const itemPath = path === "config" ? key : `${path}.${key}`;
-        if (unsupportedGroupConfigKeys.has(key)) {
-          throw new UnsupportedGroupedRequestConfigError(
-            `Grouped requests do not support axios config key ${itemPath}`
-          );
-        }
-        acc[key] = normalize(item, itemPath);
-        return acc;
-      }, {});
-      seen.delete(value);
-      return normalized;
+      try {
+        const normalized = Object.entries(omitBy(value, (item) => item === void 0)).sort(([left], [right]) => left.localeCompare(right)).reduce((acc, [key, item]) => {
+          const itemPath = path === "config" ? key : `${path}.${key}`;
+          if (path === "config" && unsupportedGroupConfigKeys.has(key)) {
+            throw new UnsupportedGroupedRequestConfigError(
+              `Grouped requests do not support axios config key ${itemPath}`
+            );
+          }
+          acc[key] = normalize(item, itemPath);
+          return acc;
+        }, {});
+        return normalized;
+      } finally {
+        seen.delete(value);
+      }
     }
     return value;
   };
@@ -460,13 +558,6 @@ var CACHEABLE_METHODS = /* @__PURE__ */ new Set(["get"]);
 var CACHEABLE_RESPONSE_TYPES = /* @__PURE__ */ new Set(["", "json", "text"]);
 var CACHE_INVALIDATE_ON_SUCCESS = "__accessRouterClientCacheInvalidateOnSuccess";
 var CACHE_INVALIDATE_HEADER = "x-axios-cache-invalidate-on-success";
-var SENSITIVE_CACHE_HEADERS = /* @__PURE__ */ new Set([
-  "authorization",
-  "cookie",
-  "set-cookie",
-  "proxy-authorization",
-  "www-authenticate"
-]);
 var AUTHENTICATION_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "authorization",
   "cookie",
@@ -475,6 +566,7 @@ var AUTHENTICATION_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "x-auth-token",
   "x-access-token"
 ]);
+var SENSITIVE_CACHE_HEADERS = /* @__PURE__ */ new Set([...AUTHENTICATION_REQUEST_HEADERS, "set-cookie", "www-authenticate"]);
 var cloneConfigWithCacheBypass = (config, invalidateOnSuccess = true) => {
   const baseConfig = config ?? {};
   const next = { ...baseConfig };
@@ -486,16 +578,46 @@ var cloneConfigWithCacheBypass = (config, invalidateOnSuccess = true) => {
   } else {
     next.headers = {};
   }
+  for (const key of Object.keys(next.headers)) {
+    if (key.toLowerCase() === CACHE_HEADER.toLowerCase()) {
+      delete next.headers[key];
+    }
+  }
   next.headers[CACHE_HEADER] = "false";
   if (invalidateOnSuccess) {
     next[CACHE_INVALIDATE_ON_SUCCESS] = true;
-    next.headers[CACHE_INVALIDATE_HEADER] = "true";
   }
   return next;
 };
+var findHeaderKey = (headers, name) => {
+  const target = name.toLowerCase();
+  return Object.keys(headers).find((key) => key.toLowerCase() === target);
+};
+var getCacheControlValue = (headers) => {
+  if (!headers || typeof headers !== "object") return void 0;
+  if (headers instanceof AxiosHeaders2) return headers.get(CACHE_HEADER);
+  const key = findHeaderKey(headers, CACHE_HEADER);
+  return key === void 0 ? void 0 : headers[key];
+};
+var hasCacheControlHeader = (headers) => getCacheControlValue(headers) !== void 0;
+var hasInvalidateSignal = (headers) => {
+  if (!headers || typeof headers !== "object") return false;
+  if (headers instanceof AxiosHeaders2) return headers.has(CACHE_INVALIDATE_HEADER);
+  return findHeaderKey(headers, CACHE_INVALIDATE_HEADER) !== void 0;
+};
+var deleteInvalidateSignal = (headers) => {
+  if (headers instanceof AxiosHeaders2) {
+    headers.delete(CACHE_INVALIDATE_HEADER);
+    return;
+  }
+  const key = findHeaderKey(headers, CACHE_INVALIDATE_HEADER);
+  if (key !== void 0) {
+    delete headers[key];
+  }
+};
 var removeCacheInvalidationSignal = (config) => {
   const headers = config.headers;
-  const hasHeaderSignal = headers instanceof AxiosHeaders2 ? headers.has(CACHE_INVALIDATE_HEADER) : Boolean(headers && typeof headers === "object" && CACHE_INVALIDATE_HEADER in headers);
+  const hasHeaderSignal = hasInvalidateSignal(headers);
   if (CACHE_INVALIDATE_ON_SUCCESS in config || hasHeaderSignal) {
     const next = { ...config };
     delete next[CACHE_INVALIDATE_ON_SUCCESS];
@@ -505,7 +627,7 @@ var removeCacheInvalidationSignal = (config) => {
       next.headers = clonedHeaders;
     } else if (headers && typeof headers === "object") {
       next.headers = { ...headers };
-      delete next.headers[CACHE_INVALIDATE_HEADER];
+      deleteInvalidateSignal(next.headers);
     }
     return next;
   }
@@ -615,11 +737,42 @@ var snapshotResponse = (response, clone) => {
     headers: clone(headers)
   };
 };
+var identityTransform = (data) => data;
+var bypassResponseTransform = (config) => {
+  config.transformResponse = [identityTransform];
+};
+var settleSyntheticResponse = (callerConfig, response) => {
+  const status = response.status;
+  const validateStatus = callerConfig.validateStatus;
+  if (!status || !validateStatus || validateStatus(status)) {
+    return response;
+  }
+  throw new AxiosError(
+    `Request failed with status code ${status}`,
+    status >= 400 && status < 500 ? AxiosError.ERR_BAD_REQUEST : AxiosError.ERR_BAD_RESPONSE,
+    callerConfig,
+    void 0,
+    response
+  );
+};
+var isSettlementRejectionFor = (error, sourceConfig) => {
+  const response = error?.response;
+  if (!response || !response.status) return false;
+  const validateStatus = sourceConfig.validateStatus;
+  if (!validateStatus) {
+    return false;
+  }
+  try {
+    return !validateStatus(response.status);
+  } catch {
+    return false;
+  }
+};
 var serializeHeaders = (headers) => {
   const resolvedHeaders = headers instanceof AxiosHeaders2 ? headers.toJSON() : headers;
   const normalizedHeaders = Object.entries(resolvedHeaders ?? {}).filter(([key, value]) => {
     const normalizedKey = key.toLowerCase();
-    return normalizedKey !== CACHE_HEADER.toLowerCase() && !SENSITIVE_CACHE_HEADERS.has(normalizedKey) && value !== void 0;
+    return normalizedKey !== CACHE_HEADER.toLowerCase() && normalizedKey !== CACHE_INVALIDATE_HEADER.toLowerCase() && !SENSITIVE_CACHE_HEADERS.has(normalizedKey) && value !== void 0;
   }).reduce((acc, [key, value]) => {
     acc[key.toLowerCase()] = value;
     return acc;
@@ -634,13 +787,13 @@ var hasHeaderValue = (value) => {
 };
 var consumeCacheInvalidationSignal = (config) => {
   const headers = config.headers;
-  const hasSignal = headers instanceof AxiosHeaders2 ? headers.has(CACHE_INVALIDATE_HEADER) : Boolean(headers && typeof headers === "object" && CACHE_INVALIDATE_HEADER in headers);
+  const hasSignal = hasInvalidateSignal(headers);
   if (!hasSignal && !config[CACHE_INVALIDATE_ON_SUCCESS]) return;
   config[CACHE_INVALIDATE_ON_SUCCESS] = true;
   if (headers instanceof AxiosHeaders2) {
     headers.delete(CACHE_INVALIDATE_HEADER);
   } else if (headers && typeof headers === "object") {
-    delete headers[CACHE_INVALIDATE_HEADER];
+    deleteInvalidateSignal(headers);
   }
 };
 var hasAuthenticationHeader = (headers) => {
@@ -675,10 +828,12 @@ var sameConfigIdentity = (configured, defaultValue) => {
   }
   return configured === defaultValue;
 };
+var PRISTINE_TRANSFORM_REQUEST = axios.defaults.transformRequest;
+var PRISTINE_TRANSFORM_RESPONSE = axios.defaults.transformResponse;
 var isCacheEligible = (config, instance) => {
   const method = (config.method ?? "get").toLowerCase();
   const responseType = config.responseType ?? "";
-  return CACHEABLE_METHODS.has(method) && CACHEABLE_RESPONSE_TYPES.has(responseType) && config.paramsSerializer === void 0 && config.auth === void 0 && config.signal === void 0 && config.cancelToken === void 0 && config.onDownloadProgress === void 0 && config.onUploadProgress === void 0 && sameConfigIdentity(config.adapter, instance.defaults.adapter) && sameTransform(config.transformRequest, instance.defaults.transformRequest) && sameTransform(config.transformResponse, instance.defaults.transformResponse) && hasStableCacheValue(config.params) && hasStableCacheValue(config.data) && hasStableCacheValue(config.headers);
+  return CACHEABLE_METHODS.has(method) && CACHEABLE_RESPONSE_TYPES.has(responseType) && config.paramsSerializer === void 0 && config.auth === void 0 && config.signal === void 0 && config.cancelToken === void 0 && config.onDownloadProgress === void 0 && config.onUploadProgress === void 0 && sameConfigIdentity(config.adapter, instance.defaults.adapter) && sameTransform(config.transformRequest, PRISTINE_TRANSFORM_REQUEST) && sameTransform(config.transformResponse, PRISTINE_TRANSFORM_RESPONSE) && config.parseReviver === void 0 && config.formSerializer === void 0 && hasStableCacheValue(config.params) && hasStableCacheValue(config.data) && hasStableCacheValue(config.headers);
 };
 function generateCacheKey(config, partition) {
   const responseSemantics = JSON.stringify({
@@ -717,12 +872,14 @@ function useCacheInterceptors(instance, policyOrTtl) {
   const store = new SimpleCache({ capacity: policy.capacity, clone: policy.clone });
   const withCredentialsDefault = policy.withCredentialsDefault ?? Boolean(instance.defaults.withCredentials);
   const inflight = /* @__PURE__ */ new Map();
+  const activeSlots = /* @__PURE__ */ new Set();
   let generation = 0;
   let disposed = false;
   const finalizeInflight = (slot) => {
     if (inflight.get(slot.key) === slot) {
       inflight.delete(slot.key);
     }
+    activeSlots.delete(slot);
   };
   const resolveInflight = (slot, response) => {
     if (slot.settled) return;
@@ -744,7 +901,8 @@ function useCacheInterceptors(instance, policyOrTtl) {
   instance.interceptors.request.use(
     async (config) => {
       consumeCacheInvalidationSignal(config);
-      if (disposed || config.headers[CACHE_HEADER] === "false" || !isCacheEligible(config, instance)) return config;
+      if (disposed || getCacheControlValue(config.headers) === "false" || !isCacheEligible(config, instance))
+        return config;
       const isCredentialed = resolveWithCredentials(config, withCredentialsDefault) || hasAuthenticationHeader(config.headers);
       const partitionKey = policy.partitionForRequest?.(config);
       if (isCredentialed && !hasUsablePartition(partitionKey)) {
@@ -755,29 +913,33 @@ function useCacheInterceptors(instance, policyOrTtl) {
       const snapshot = store.get(key);
       if (snapshot) {
         setCacheRequestState(config, Object.freeze({ key, generation, role: "hit" }));
+        bypassResponseTransform(config);
         config.adapter = async (_config) => {
-          return {
+          const response = {
             data: snapshot.data,
             status: snapshot.status,
             statusText: snapshot.statusText,
             headers: { ...snapshot.headers, [CACHE_HEADER]: "true" },
             config: _config
           };
+          return settleSyntheticResponse(_config, response);
         };
         return config;
       }
       const existing = inflight.get(key);
       if (existing) {
+        bypassResponseTransform(config);
         config.adapter = async (_config) => {
           const response = await existing.promise;
           const shared = response;
-          return {
+          const tailResponse = {
             data: clone(shared.data),
             status: shared.status,
             statusText: shared.statusText,
             headers: { ...shared.headers, [CACHE_HEADER]: "true" },
             config: _config
           };
+          return settleSyntheticResponse(_config, tailResponse);
         };
         setCacheRequestState(config, Object.freeze({ key, generation, role: "tail", slot: existing }));
         return config;
@@ -799,8 +961,33 @@ function useCacheInterceptors(instance, policyOrTtl) {
         settled: false
       };
       inflight.set(key, slot);
+      activeSlots.add(slot);
       const nextConfig = { ...config };
       setCacheRequestState(nextConfig, Object.freeze({ key, generation, role: "source", slot }));
+      const settleTransformFailure = (error) => {
+        rejectInflight(slot, error);
+        throw error;
+      };
+      const wrapTransformList = (value) => {
+        const list = Array.isArray(value) ? value : [value];
+        return list.map((fn) => {
+          if (typeof fn !== "function") return fn;
+          const original = fn;
+          return function(...args) {
+            try {
+              const result = original.apply(this, args);
+              if (result && typeof result.catch === "function") {
+                return result.catch((error) => settleTransformFailure(error));
+              }
+              return result;
+            } catch (error) {
+              return settleTransformFailure(error);
+            }
+          };
+        });
+      };
+      nextConfig.transformRequest = wrapTransformList(nextConfig.transformRequest);
+      nextConfig.transformResponse = wrapTransformList(nextConfig.transformResponse);
       let realAdapter = config.adapter;
       if (realAdapter === void 0 || realAdapter === null) {
         realAdapter = instance.defaults.adapter;
@@ -818,7 +1005,12 @@ function useCacheInterceptors(instance, policyOrTtl) {
           const response = await dispatch(adapterConfig);
           return response;
         } catch (error) {
-          rejectInflight(slot, error);
+          const errResponse = error?.response;
+          if (errResponse && isSettlementRejectionFor(error, adapterConfig)) {
+            resolveInflight(slot, errResponse);
+          } else {
+            rejectInflight(slot, error);
+          }
           throw error;
         }
       };
@@ -854,7 +1046,13 @@ function useCacheInterceptors(instance, policyOrTtl) {
     (error) => {
       const state = (error?.config ?? {})[CACHE_REQUEST_STATE];
       if (state?.role === "source" && state.slot) {
-        rejectInflight(state.slot, error);
+        const errResponse = error?.response;
+        const sourceConfig = error?.config ?? {};
+        if (errResponse && isSettlementRejectionFor(error, sourceConfig)) {
+          resolveInflight(state.slot, errResponse);
+        } else {
+          rejectInflight(state.slot, error);
+        }
       }
       return Promise.reject(error);
     }
@@ -867,10 +1065,11 @@ function useCacheInterceptors(instance, policyOrTtl) {
       generation += 1;
       store.dispose();
       const error = new Error(CACHE_DISPOSED_ERROR);
-      for (const slot of inflight.values()) {
+      for (const slot of [...activeSlots]) {
         rejectInflight(slot, error);
       }
       inflight.clear();
+      activeSlots.clear();
     }
   };
 }
@@ -1114,7 +1313,7 @@ var Service = class {
       cloned.set(CACHE_HEADER, cacheValue);
       return cloned;
     }
-    if (CACHE_HEADER in headers) return headers;
+    if (hasCacheControlHeader(headers)) return headers;
     return {
       ...headers,
       [CACHE_HEADER]: cacheValue
@@ -1271,26 +1470,86 @@ var isLegacyListPayload = (value) => {
   }
   return "count" in value && typeof value.count === "number" && "rows" in value && Array.isArray(value.rows);
 };
-var cloneDefaultValue = (value) => {
+var UnsupportedServiceDefaultValueError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsupportedServiceDefaultValueError";
+  }
+};
+var isPlainDefaultObject = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+var cloneDefaultValueInner = (value, seen, path) => {
+  if (value == null) return value;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new UnsupportedServiceDefaultValueError(
+        `Service defaults do not support non-finite numeric value at ${path}`
+      );
+    }
+    return value;
+  }
+  if (typeof value === "function") {
+    throw new UnsupportedServiceDefaultValueError(`Service defaults do not support function value at ${path}`);
+  }
+  if (typeof value === "symbol") {
+    throw new UnsupportedServiceDefaultValueError(`Service defaults do not support symbol value at ${path}`);
+  }
+  if (typeof value === "bigint") {
+    throw new UnsupportedServiceDefaultValueError(`Service defaults do not support bigint value at ${path}`);
+  }
+  if (value instanceof Date) {
+    const time = value.getTime();
+    if (Number.isNaN(time)) {
+      throw new UnsupportedServiceDefaultValueError(`Service defaults do not support invalid Date at ${path}`);
+    }
+    return new Date(time);
+  }
   if (Array.isArray(value)) {
-    return value.map((item) => cloneDefaultValue(item));
+    if (seen.has(value)) {
+      throw new UnsupportedServiceDefaultValueError(`Service defaults do not support circular value at ${path}`);
+    }
+    seen.add(value);
+    try {
+      return value.map((item, index) => cloneDefaultValueInner(item, seen, `${path}[${index}]`));
+    } finally {
+      seen.delete(value);
+    }
   }
-  if (value && typeof value === "object") {
-    const cloned = {};
-    for (const [key, item] of Object.entries(value)) {
-      cloned[key] = cloneDefaultValue(item);
+  if (typeof value === "object") {
+    if (seen.has(value)) {
+      throw new UnsupportedServiceDefaultValueError(`Service defaults do not support circular value at ${path}`);
+    }
+    if (!isPlainDefaultObject(value)) {
+      throw new UnsupportedServiceDefaultValueError(
+        `Service defaults do not support non-plain object instance at ${path}`
+      );
+    }
+    seen.add(value);
+    try {
+      const cloned = {};
+      for (const [key, item] of Object.entries(value)) {
+        cloned[key] = cloneDefaultValueInner(item, seen, path === "defaults" ? `defaults.${key}` : `${path}.${key}`);
+      }
+      return cloned;
+    } finally {
+      seen.delete(value);
     }
-    return cloned;
   }
   return value;
 };
-var deepFreeze = (value) => {
-  if (!value || typeof value !== "object" || Object.isFrozen(value)) {
+var cloneDefaultValue = (value) => cloneDefaultValueInner(value, /* @__PURE__ */ new WeakSet(), "defaults");
+var cloneServiceDefaultValue = (value) => cloneDefaultValueInner(value, /* @__PURE__ */ new WeakSet(), "defaults");
+var deepFreeze = (value, seen = /* @__PURE__ */ new WeakSet()) => {
+  if (!value || typeof value !== "object" || Object.isFrozen(value) || seen.has(value)) {
     return value;
   }
+  seen.add(value);
   Object.freeze(value);
   for (const item of Object.values(value)) {
-    deepFreeze(item);
+    deepFreeze(item, seen);
   }
   return value;
 };
@@ -1730,9 +1989,9 @@ var ModelService = class extends Service {
       includePermissions = this._defaults.listOptions.includePermissions ?? false,
       includeCount = this._defaults.listOptions.includeCount ?? false,
       includeExtraHeaders = this._defaults.listOptions.includeExtraHeaders ?? false,
-      ignoreCache = this._defaults.listOptions.ignoreCache ?? false,
-      sq
+      ignoreCache = this._defaults.listOptions.ignoreCache ?? false
     } = options ?? {};
+    const sq = options?.sq ?? cloneServiceDefaultValue(this._defaults.listOptions.sq);
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     reqConfig.headers = this.updateHeaders(reqConfig.headers, { ignoreCache });
     return makeRequest(
@@ -1781,25 +2040,25 @@ var ModelService = class extends Service {
   }
   listAdvanced(filter, args, options, axiosRequestConfig) {
     const {
-      populate = this._defaults.listAdvancedArgs.populate,
-      include = this._defaults.listAdvancedArgs.include,
-      sort = this._defaults.listAdvancedArgs.sort,
       skip = this._defaults.listAdvancedArgs.skip,
       limit = this._defaults.listAdvancedArgs.limit,
       page = this._defaults.listAdvancedArgs.page,
-      pageSize = this._defaults.listAdvancedArgs.pageSize,
-      tasks = this._defaults.listAdvancedArgs.tasks
+      pageSize = this._defaults.listAdvancedArgs.pageSize
     } = args ?? {};
-    const select = args?.select ?? this._defaults.listAdvancedArgs.select;
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.listAdvancedArgs.populate);
+    const include = args?.include ?? cloneServiceDefaultValue(this._defaults.listAdvancedArgs.include);
+    const sort = args?.sort ?? cloneServiceDefaultValue(this._defaults.listAdvancedArgs.sort);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.listAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.listAdvancedArgs.select);
     const {
       skim = this._defaults.listAdvancedOptions.skim ?? true,
       includePermissions = this._defaults.listAdvancedOptions.includePermissions ?? false,
       includeCount = this._defaults.listAdvancedOptions.includeCount ?? false,
       includeExtraHeaders = this._defaults.listAdvancedOptions.includeExtraHeaders ?? false,
       populateAccess = this._defaults.listAdvancedOptions.populateAccess,
-      ignoreCache = this._defaults.listAdvancedOptions.ignoreCache ?? false,
-      sq
+      ignoreCache = this._defaults.listAdvancedOptions.ignoreCache ?? false
     } = options ?? {};
+    const sq = options?.sq ?? cloneServiceDefaultValue(this._defaults.listAdvancedOptions.sq);
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     reqConfig.headers = this.updateHeaders(reqConfig.headers, { ignoreCache });
     const _filter = replaceSubQuery(filter);
@@ -1888,8 +2147,9 @@ var ModelService = class extends Service {
     );
   }
   createAdvanced(data, args, options, axiosRequestConfig) {
-    const { populate = this._defaults.createAdvancedArgs.populate, tasks = this._defaults.createAdvancedArgs.tasks } = args ?? {};
-    const select = args?.select ?? this._defaults.createAdvancedArgs.select;
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.createAdvancedArgs.populate);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.createAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.createAdvancedArgs.select);
     const {
       includePermissions = this._defaults.createAdvancedOptions.includePermissions ?? true,
       populateAccess = this._defaults.createAdvancedOptions.populateAccess
@@ -1964,8 +2224,9 @@ var ModelService = class extends Service {
     );
   }
   upsertAdvanced(data, args, options, axiosRequestConfig) {
-    const { populate = this._defaults.upsertAdvancedArgs.populate, tasks = this._defaults.upsertAdvancedArgs.tasks } = args ?? {};
-    const select = args?.select ?? this._defaults.upsertAdvancedArgs.select;
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.upsertAdvancedArgs.populate);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.upsertAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.upsertAdvancedArgs.select);
     const {
       returningAll = this._defaults.upsertAdvancedOptions.returningAll ?? true,
       includePermissions = this._defaults.upsertAdvancedOptions.includePermissions ?? true,
@@ -2052,6 +2313,14 @@ var ModelService = class extends Service {
       }
     );
   }
+  /**
+   * BND-11: distinct values are `unknown[]`, not `string[]`. The sibling
+   * server returns raw distinct values without string conversion, so numeric
+   * and boolean values arrive as-is. Source-compat: callers that assumed
+   * `string[]` must narrow first (e.g. `typeof v === 'string'` or a type
+   * guard) before calling string methods; see the BND-11 task record for
+   * migration. No server values are stringified to satisfy the old type.
+   */
   distinct(field, axiosRequestConfig) {
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     return makeRequest(
@@ -2074,6 +2343,11 @@ var ModelService = class extends Service {
       }
     );
   }
+  /**
+   * BND-11: filtered distinct variant. Same `unknown[]` contract as
+   * {@link distinct}: narrow elements before assuming strings. No
+   * stringification is applied; dynamic field names are accepted as `string`.
+   */
   distinctAdvanced(field, conditions, axiosRequestConfig) {
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     return makeRequest(
@@ -2147,9 +2421,9 @@ var ModelService = class extends Service {
     const {
       includePermissions = this._defaults.readOptions.includePermissions ?? true,
       tryList = this._defaults.readOptions.tryList ?? true,
-      ignoreCache = this._defaults.readOptions.ignoreCache ?? false,
-      sq
+      ignoreCache = this._defaults.readOptions.ignoreCache ?? false
     } = options ?? {};
+    const sq = options?.sq ?? cloneServiceDefaultValue(this._defaults.readOptions.sq);
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     reqConfig.headers = this.updateHeaders(reqConfig.headers, { ignoreCache });
     return makeRequest(
@@ -2181,20 +2455,18 @@ var ModelService = class extends Service {
     );
   }
   readAdvanced(identifier, args, options, axiosRequestConfig) {
-    const {
-      populate = this._defaults.readAdvancedArgs.populate,
-      include = this._defaults.readAdvancedArgs.include,
-      tasks = this._defaults.readAdvancedArgs.tasks
-    } = args ?? {};
-    const select = args?.select ?? this._defaults.readAdvancedArgs.select;
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.populate);
+    const include = args?.include ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.include);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.select);
     const {
       skim = this._defaults.readAdvancedOptions.skim ?? true,
       includePermissions = this._defaults.readAdvancedOptions.includePermissions ?? true,
       tryList = this._defaults.readAdvancedOptions.tryList ?? true,
       populateAccess = this._defaults.readAdvancedOptions.populateAccess,
-      ignoreCache = this._defaults.readAdvancedOptions.ignoreCache ?? false,
-      sq
+      ignoreCache = this._defaults.readAdvancedOptions.ignoreCache ?? false
     } = options ?? {};
+    const sq = options?.sq ?? cloneServiceDefaultValue(this._defaults.readAdvancedOptions.sq);
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     reqConfig.headers = this.updateHeaders(reqConfig.headers, { ignoreCache });
     return makeRequest(
@@ -2233,21 +2505,19 @@ var ModelService = class extends Service {
     );
   }
   readAdvancedFilter(filter, args, options, axiosRequestConfig) {
-    const {
-      sort = this._defaults.readAdvancedArgs.sort,
-      populate = this._defaults.readAdvancedArgs.populate,
-      include = this._defaults.readAdvancedArgs.include,
-      tasks = this._defaults.readAdvancedArgs.tasks
-    } = args ?? {};
-    const select = args?.select ?? this._defaults.readAdvancedArgs.select;
+    const sort = args?.sort ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.sort);
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.populate);
+    const include = args?.include ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.include);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.readAdvancedArgs.select);
     const {
       skim = this._defaults.readAdvancedOptions.skim ?? true,
       includePermissions = this._defaults.readAdvancedOptions.includePermissions ?? true,
       tryList = this._defaults.readAdvancedOptions.tryList ?? true,
       populateAccess = this._defaults.readAdvancedOptions.populateAccess,
-      ignoreCache = this._defaults.readAdvancedOptions.ignoreCache ?? false,
-      sq
+      ignoreCache = this._defaults.readAdvancedOptions.ignoreCache ?? false
     } = options ?? {};
+    const sq = options?.sq ?? cloneServiceDefaultValue(this._defaults.readAdvancedOptions.sq);
     const { throwOnError, ...reqConfig } = axiosRequestConfig ?? {};
     reqConfig.headers = this.updateHeaders(reqConfig.headers, { ignoreCache });
     const _filter = replaceSubQuery(filter);
@@ -2323,8 +2593,9 @@ var ModelService = class extends Service {
     );
   }
   updateAdvanced(identifier, data, args, options, axiosRequestConfig) {
-    const { populate = this._defaults.updateAdvancedArgs.populate, tasks = this._defaults.updateAdvancedArgs.tasks } = args ?? {};
-    const select = args?.select ?? this._defaults.updateAdvancedArgs.select;
+    const populate = args?.populate ?? cloneServiceDefaultValue(this._defaults.updateAdvancedArgs.populate);
+    const tasks = args?.tasks ?? cloneServiceDefaultValue(this._defaults.updateAdvancedArgs.tasks);
+    const select = args?.select ?? cloneServiceDefaultValue(this._defaults.updateAdvancedArgs.select);
     const {
       returningAll = this._defaults.updateAdvancedOptions.returningAll ?? true,
       includePermissions = this._defaults.updateAdvancedOptions.includePermissions ?? true,