@web-ts-toolkit/access-router 0.2.0

package/index.mjs

@@ -0,0 +1,3979 @@
+// src/index.ts
+import { isPlainObject as isPlainObject10, isString as isString11, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
+
+// src/middleware.ts
+import JsonRouter2 from "@web-ts-toolkit/express-json-router";
+import { isArray as isArray9, isFunction as isFunction6, isPlainObject as isPlainObject7, isString as isString8 } from "@web-ts-toolkit/utils";
+
+// src/core.ts
+import {
+  castArray as castArray5,
+  compact as compact3,
+  difference,
+  forEach as forEach6,
+  intersection,
+  isArray as isArray8,
+  isBoolean as isBoolean5,
+  isFunction as isFunction5,
+  isString as isString7,
+  isUndefined,
+  reduce as reduce2
+} from "@web-ts-toolkit/utils";
+
+// src/options/manager.ts
+import { assign, get, set } from "@web-ts-toolkit/utils";
+var getNestedOption = (manager, key, defaultValue) => {
+  const keys2 = String(key).split(".");
+  if (keys2.length === 1) {
+    return manager.get(key, defaultValue);
+  }
+  let option = manager.get(key, void 0);
+  if (option !== void 0) {
+    return option;
+  }
+  const parentKey = keys2.slice(0, -1).join(".");
+  option = manager.get(`${parentKey}.default`, void 0);
+  if (option === void 0) {
+    option = manager.get(parentKey, defaultValue);
+  }
+  return option;
+};
+var OptionsManager = class {
+  constructor(defaultOptions) {
+    this.defaultOptions = defaultOptions;
+    this.listeners = {};
+    const _this = this;
+    this.currentOptions = new Proxy({}, {
+      set(target, key, value) {
+        const keystr = String(key);
+        const oldvalue = target[key];
+        target[key] = value;
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
+        return true;
+      }
+    });
+  }
+  build() {
+    this.assign(this.defaultOptions);
+    return this;
+  }
+  get(key, defaultValue) {
+    return get(this.currentOptions, key, defaultValue);
+  }
+  set(key, value) {
+    set(this.currentOptions, key, value);
+  }
+  fetch() {
+    return { ...this.currentOptions };
+  }
+  assign(options) {
+    assign(this.currentOptions, options);
+  }
+  onchange(key, func) {
+    set(this.listeners, key, func);
+    return this;
+  }
+};
+
+// src/logger.ts
+import util from "util";
+import { createLogger, format, transports } from "winston";
+var colorizer = format.colorize();
+var defaultLogLevel = process.env.WTT_LOG_LEVEL || "silent";
+var inspectValue = (value) => {
+  return typeof value === "string" ? value : util.inspect(value, { depth: 5, colors: false });
+};
+var defaultLogger = createLogger({
+  level: defaultLogLevel,
+  format: format.combine(
+    format.errors({ stack: true }),
+    format.splat(),
+    format.label({ label: "[WTT]" }),
+    format.timestamp(),
+    format.printf(({ level, label, message, timestamp, stack, ...meta }) => {
+      const formattedLabel = colorizer.colorize(level, label);
+      const formattedLevel = colorizer.colorize(level, `[${level.toUpperCase()}]`);
+      const formattedMessage = colorizer.colorize(level, inspectValue(stack ?? message));
+      const formattedMeta = Object.keys(meta).length > 0 ? ` ${inspectValue(meta)}` : "";
+      return `${formattedLabel} ${timestamp} ${formattedLevel} ${formattedMessage}${formattedMeta}`;
+    })
+  ),
+  transports: [new transports.Console()]
+});
+var passthrough = (level) => (...args) => {
+  const globalLogger = getGlobalOption("logger");
+  const target = globalLogger?.[level] ?? defaultLogger[level];
+  return target.apply(globalLogger ?? defaultLogger, args);
+};
+var logger = {
+  debug: passthrough("debug"),
+  info: passthrough("info"),
+  warn: passthrough("warn"),
+  error: passthrough("error")
+};
+
+// src/options/global-options.ts
+var globalOptions = new OptionsManager({
+  requestPermissionField: "_permissions",
+  globalPermissions: () => ({}),
+  logger: defaultLogger
+}).build();
+var setGlobalOptions = (options) => {
+  globalOptions.assign(options);
+};
+var setGlobalOption = (key, value) => {
+  globalOptions.set(key, value);
+};
+var getGlobalOptions = () => {
+  return globalOptions.fetch();
+};
+var getGlobalOption = (key, defaultValue) => {
+  return globalOptions.get(key, defaultValue);
+};
+
+// src/options/model-options.ts
+import mongoose from "mongoose";
+import mschema2Jsonschema from "mongoose-schema-jsonschema";
+import { addLeadingSlash, forEach, isArray, isBoolean, isFunction, isNil, isString } from "@web-ts-toolkit/utils";
+
+// src/options/default-model-options.ts
+var DEFAULT_QUERY_PATH = "__query";
+var DEFAULT_MUTATION_PATH = "__mutation";
+var defaultModelOptions = new OptionsManager({
+  listHardLimit: 1e3,
+  documentPermissionField: "_permissions",
+  idParam: "id",
+  identifier: "_id",
+  parentPath: "/",
+  queryPath: DEFAULT_QUERY_PATH,
+  mutationPath: DEFAULT_MUTATION_PATH,
+  routeGuard: false,
+  modelPermissionPrefix: ""
+}).build();
+var setDefaultModelOptions = (options) => {
+  defaultModelOptions.assign(options);
+};
+var setDefaultModelOption = (key, value) => {
+  defaultModelOptions.set(key, value);
+};
+var getDefaultModelOptions = () => {
+  return defaultModelOptions.fetch();
+};
+var getDefaultModelOption = (key, defaultValue) => {
+  return defaultModelOptions.get(key, defaultValue);
+};
+
+// src/options/model-options.ts
+mschema2Jsonschema(mongoose);
+var pluralize = mongoose.pluralize();
+var defaultModelOptions2 = {
+  basePath: null,
+  mandatoryFields: []
+};
+var modelOptions = {};
+var modelJsonSchemas = {};
+var normalizeBasePath = (name, value) => {
+  if (isNil(value)) {
+    return `/${pluralize(name)}`;
+  }
+  return isString(value) ? addLeadingSlash(value) : "";
+};
+var hasModelPermission = (value, modelPermissionPrefix) => {
+  if (!modelPermissionPrefix) {
+    return true;
+  }
+  if (isString(value)) {
+    return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
+  }
+  if (isArray(value)) {
+    return value.some((item) => {
+      if (isString(item) || isArray(item)) {
+        return hasModelPermission(item, modelPermissionPrefix);
+      }
+      return true;
+    });
+  }
+  return isFunction(value);
+};
+var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
+  const schemaKeys = Object.keys(permissionSchema);
+  const globalPermissionKeys = {};
+  const modelPermissionKeys = {};
+  forEach(schemaKeys, (schemaKey) => {
+    forEach(permissionSchema[schemaKey], (value, accessKey) => {
+      if (!isArray(globalPermissionKeys[accessKey])) {
+        globalPermissionKeys[accessKey] = [];
+      }
+      if (!isArray(modelPermissionKeys[accessKey])) {
+        modelPermissionKeys[accessKey] = [];
+      }
+      if (isBoolean(value)) {
+        globalPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      if (hasModelPermission(value, modelPermissionPrefix)) {
+        modelPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      globalPermissionKeys[accessKey].push(schemaKey);
+    });
+  });
+  return {
+    schemaKeys,
+    globalPermissionKeys,
+    modelPermissionKeys
+  };
+};
+var createModelOptions = (modelName) => {
+  const model = mongoose.model(modelName);
+  const manager = new OptionsManager({
+    ...defaultModelOptions2,
+    modelName
+  });
+  manager.onchange("permissionSchema", function(newval, key, target, oldval) {
+    const permissionSchema = newval ?? {};
+    const { schemaKeys, globalPermissionKeys, modelPermissionKeys } = classifyPermissionSchema(
+      permissionSchema,
+      target.modelPermissionPrefix ?? ""
+    );
+    target._permissionSchemaKeys = schemaKeys;
+    target._globalPermissionKeys = globalPermissionKeys;
+    target._modelPermissionKeys = modelPermissionKeys;
+  }).onchange("basePath", function(newval, key, target, oldval) {
+    target[key] = normalizeBasePath(
+      modelName,
+      isString(newval) || isNil(newval) ? newval : void 0
+    );
+  }).build();
+  modelJsonSchemas[modelName] = model.jsonSchema();
+  return manager;
+};
+var getOrCreateModelOptions = (modelName) => {
+  let manager = modelOptions[modelName];
+  if (!manager) {
+    manager = createModelOptions(modelName);
+    modelOptions[modelName] = manager;
+  }
+  return manager;
+};
+var setModelOptions = (modelName, options) => {
+  const manager = getOrCreateModelOptions(modelName);
+  const defaultOptions = getDefaultModelOptions();
+  const modelOptions2 = manager.fetch();
+  manager.assign({ ...defaultOptions, ...modelOptions2, ...options });
+};
+var setModelOption = (modelName, key, value) => {
+  const manager = getOrCreateModelOptions(modelName);
+  manager.set(key, value);
+};
+var getModelOptions = (modelName) => {
+  const manager = getOrCreateModelOptions(modelName);
+  return manager.fetch();
+};
+var getModelOption = (modelName, key, defaultValue) => {
+  const manager = getOrCreateModelOptions(modelName);
+  const defaultModelValue = getDefaultModelOption(
+    key,
+    defaultValue
+  );
+  return getNestedOption(manager, key, defaultModelValue);
+};
+var getExactModelOption = (modelName, key) => {
+  const manager = getOrCreateModelOptions(modelName);
+  const defaultModelValue = getDefaultModelOption(key);
+  return manager.get(key, defaultModelValue);
+};
+var getModelNames = () => {
+  return Object.keys(modelOptions);
+};
+var getModelJsonSchema = (modelName) => {
+  return modelJsonSchemas[modelName];
+};
+
+// src/options/data-options.ts
+import mongoose2 from "mongoose";
+import { addLeadingSlash as addLeadingSlash2, isNil as isNil2, isString as isString2 } from "@web-ts-toolkit/utils";
+var pluralize2 = mongoose2.pluralize();
+var dataOptions = {};
+var defaultDataOptions = {
+  basePath: null,
+  queryPath: "__query"
+};
+var normalizeBasePath2 = (name, value) => {
+  if (isNil2(value)) {
+    return `/${pluralize2(name)}`;
+  }
+  return isString2(value) ? addLeadingSlash2(value) : "";
+};
+var createDataOptions = (dataName) => {
+  const manager = new OptionsManager({
+    ...defaultDataOptions,
+    dataName
+  });
+  manager.onchange("basePath", function(newval, key, target, oldval) {
+    target[key] = normalizeBasePath2(
+      dataName,
+      isString2(newval) || isNil2(newval) ? newval : void 0
+    );
+  }).build();
+  return manager;
+};
+var getOrCreateDataOptions = (dataName) => {
+  let manager = dataOptions[dataName];
+  if (!manager) {
+    manager = createDataOptions(dataName);
+    dataOptions[dataName] = manager;
+  }
+  return manager;
+};
+var setDataOptions = (dataName, options) => {
+  const manager = getOrCreateDataOptions(dataName);
+  const dataOptions2 = manager.fetch();
+  manager.assign({ ...dataOptions2, ...options });
+};
+var setDataOption = (dataName, key, value) => {
+  const manager = getOrCreateDataOptions(dataName);
+  manager.set(key, value);
+};
+var getDataOptions = (dataName) => {
+  const manager = getOrCreateDataOptions(dataName);
+  return manager.fetch();
+};
+var getDataOption = (dataName, key, defaultValue) => {
+  const manager = getOrCreateDataOptions(dataName);
+  return getNestedOption(manager, key, defaultValue);
+};
+var getExactDataOption = (dataName, key) => {
+  const manager = getOrCreateDataOptions(dataName);
+  return manager.get(key);
+};
+
+// src/meta.ts
+import mongoose3 from "mongoose";
+import { get as get3, keys } from "@web-ts-toolkit/utils";
+
+// src/helpers/collection.ts
+import sift from "sift";
+import { filter, find } from "@web-ts-toolkit/utils";
+var filterCollection = (collection, predicate) => {
+  return filter(collection, sift(predicate));
+};
+var findElement = (collection, predicate) => {
+  return find(collection, sift(predicate));
+};
+var matchElement = (element, predicate) => {
+  return sift(predicate)(element);
+};
+var findElementById = (collection, id) => {
+  return findElement(collection, { _id: id });
+};
+
+// src/helpers/document.ts
+import { get as get2, isArray as isArray2, isPlainObject as isPlainObject3, isPromise as isPromise2, isString as isString4, pick, set as set2 } from "@web-ts-toolkit/utils";
+
+// src/lib.ts
+import { Document, Schema } from "mongoose";
+import { addLeadingSlash as addLeadingSlash3, isPlainObject, isPromise } from "@web-ts-toolkit/utils";
+var isSchema = (val) => val instanceof Schema;
+var isObjectIdType = (val) => val === "ObjectId" || val === Schema.Types.ObjectId;
+var isReference = (val) => isPlainObject(val) && !!val.ref && isObjectIdType(val.type);
+var isDocument = function isDocument2(doc) {
+  return doc instanceof Document;
+};
+var mapValuesAsync = async function mapValuesAsync2(object, asyncFn) {
+  return Object.fromEntries(
+    await Promise.all(Object.entries(object).map(async ([key, value]) => [key, await asyncFn(value, key, object)]))
+  );
+};
+var arrToObj = (arr) => {
+  const obj = {};
+  for (let x = 0; x < arr.length; x++) {
+    obj[arr[x]] = true;
+  }
+  return obj;
+};
+var removeConsecutiveSlashesFromUrl = (url) => url.replace(/\/{2,}/g, "/");
+var processUrl = (url) => addLeadingSlash3(removeConsecutiveSlashesFromUrl(url));
+
+// src/helpers/query.ts
+import { flattenDeep, isNaN, isNil as isNil3, isPlainObject as isPlainObject2, isString as isString3, reduce } from "@web-ts-toolkit/utils";
+function genPagination({
+  skip,
+  limit,
+  page,
+  pageSize
+}, hardLimit) {
+  let _skip = 0;
+  let _limit = Number(limit ?? pageSize);
+  if (isNaN(_limit) || _limit > hardLimit) _limit = hardLimit;
+  if (!isNil3(skip)) {
+    _skip = Number(skip);
+  } else if (!isNil3(page)) {
+    const npage = Number(page);
+    if (npage > 1) _skip = (npage - 1) * _limit;
+  }
+  return { skip: _skip, limit: _limit };
+}
+function parseSortString(sortString) {
+  if (!sortString) return { sortKey: "", sortOrder: "asc" };
+  if (sortString.startsWith("-")) {
+    return { sortKey: sortString.substring(1), sortOrder: "desc" };
+  } else {
+    return { sortKey: sortString, sortOrder: "asc" };
+  }
+}
+function normalizeSelect(select) {
+  if (Array.isArray(select)) return flattenDeep(select.map(normalizeSelect));
+  if (isPlainObject2(select)) {
+    return reduce(
+      select,
+      (ret, val, key) => {
+        if (val === 1) ret.push(key);
+        else if (val === -1) ret.push(`-${key}`);
+        return ret;
+      },
+      []
+    );
+  }
+  if (isString3(select)) return select.split(" ").map((v) => v.trim());
+  return [];
+}
+
+// src/helpers/document.ts
+function getDocValue(doc, path, defalutValue) {
+  if (isDocument(doc)) {
+    return get2(doc._doc, path, defalutValue);
+  } else if (isPlainObject3(doc)) {
+    return get2(doc, path, defalutValue);
+  }
+}
+function setDocValue(doc, path, value) {
+  if (isDocument(doc)) {
+    set2(doc._doc, path, value);
+  } else if (isPlainObject3(doc)) {
+    set2(doc, path, value);
+  }
+}
+function getDocPermissions(modelName, doc) {
+  const docPermissionField = getModelOption(modelName, "documentPermissionField");
+  return getDocValue(doc, docPermissionField, {});
+}
+function toObject(doc) {
+  return isDocument(doc) ? doc.toObject() : doc;
+}
+function pickDocFields(doc, fields = []) {
+  if (isDocument(doc)) {
+    doc._doc = pick(doc._doc, fields);
+    return doc;
+  } else {
+    return pick(doc, fields);
+  }
+}
+async function populateDoc(doc, target) {
+  let p = doc.populate(target);
+  if (isPromise2(p)) return p;
+  return "execPopulate" in p && p.execPopulate?.();
+}
+var genSubPopulate = (sub, popul) => {
+  if (!popul) return [];
+  let populate = isArray2(popul) ? popul : [popul];
+  populate = populate.map((p) => {
+    const ret = isString4(p) ? { path: `${sub}.${p}` } : {
+      path: `${sub}.${p.path}`,
+      select: normalizeSelect(p.select)
+    };
+    return ret;
+  });
+  return populate;
+};
+
+// src/helpers/errors.ts
+import JsonRouter from "@web-ts-toolkit/express-json-router";
+
+// src/enums.ts
+var StatusCodes = /* @__PURE__ */ ((StatusCodes3) => {
+  StatusCodes3[StatusCodes3["OK"] = 200] = "OK";
+  StatusCodes3[StatusCodes3["Created"] = 201] = "Created";
+  StatusCodes3[StatusCodes3["BadRequest"] = 400] = "BadRequest";
+  StatusCodes3[StatusCodes3["Unauthorized"] = 401] = "Unauthorized";
+  StatusCodes3[StatusCodes3["Forbidden"] = 403] = "Forbidden";
+  StatusCodes3[StatusCodes3["NotFound"] = 404] = "NotFound";
+  StatusCodes3[StatusCodes3["UnprocessableContent"] = 422] = "UnprocessableContent";
+  return StatusCodes3;
+})(StatusCodes || {});
+var Codes = /* @__PURE__ */ ((Codes2) => {
+  Codes2["Success"] = "success";
+  Codes2["Created"] = "created";
+  Codes2["BadRequest"] = "bad_request";
+  Codes2["Unauthorized"] = "unauthorized";
+  Codes2["Forbidden"] = "forbidden";
+  Codes2["NotFound"] = "not_found";
+  return Codes2;
+})(Codes || {});
+var CustomHeaders = /* @__PURE__ */ ((CustomHeaders2) => {
+  CustomHeaders2["TotalCount"] = "wtt-total-count";
+  CustomHeaders2["ReturnedCount"] = "wtt-returned-count";
+  CustomHeaders2["Page"] = "wtt-page";
+  CustomHeaders2["PageSize"] = "wtt-page-size";
+  CustomHeaders2["TotalPages"] = "wtt-total-pages";
+  CustomHeaders2["HasNextPage"] = "wtt-has-next-page";
+  CustomHeaders2["HasPreviousPage"] = "wtt-has-previous-page";
+  return CustomHeaders2;
+})(CustomHeaders || {});
+var FilterOperator = /* @__PURE__ */ ((FilterOperator2) => {
+  FilterOperator2[FilterOperator2["SubQuery"] = 0] = "SubQuery";
+  FilterOperator2[FilterOperator2["Date"] = 1] = "Date";
+  return FilterOperator2;
+})(FilterOperator || {});
+
+// src/helpers/errors.ts
+var { BadRequestError, ForbiddenError, NotFoundError, UnprocessableEntityError } = JsonRouter.clientErrors;
+function mapCodeToMessage(code) {
+  switch (code) {
+    case "success" /* Success */:
+      return "OK";
+    case "created" /* Created */:
+      return "Created";
+    case "bad_request" /* BadRequest */:
+      return "Bad Request";
+    case "forbidden" /* Forbidden */:
+      return "Forbidden";
+    case "not_found" /* NotFound */:
+      return "Not Found";
+    default:
+      return;
+  }
+}
+function mapCodeToStatusCode(code) {
+  switch (code) {
+    case "success" /* Success */:
+      return 200 /* OK */;
+    case "created" /* Created */:
+      return 201 /* Created */;
+    case "bad_request" /* BadRequest */:
+      return 400 /* BadRequest */;
+    case "forbidden" /* Forbidden */:
+      return 403 /* Forbidden */;
+    case "not_found" /* NotFound */:
+      return 404 /* NotFound */;
+    default:
+      return 422 /* UnprocessableContent */;
+  }
+}
+function handleResultError(result) {
+  if (result.success) return;
+  const { code, errors = [] } = result;
+  const errorOptions = { errors };
+  switch (code) {
+    case "bad_request" /* BadRequest */:
+      throw new BadRequestError("Bad Request", errorOptions);
+    case "forbidden" /* Forbidden */:
+      throw new ForbiddenError("Forbidden", errorOptions);
+    case "not_found" /* NotFound */:
+      throw new NotFoundError("Not Found", errorOptions);
+    default:
+      throw new UnprocessableEntityError("Unprocessable Content", errorOptions);
+  }
+}
+
+// src/helpers/index.ts
+import { forEach as forEach2, isArray as isArray3, isEmpty, isObject, isPlainObject as isPlainObject4, isString as isString5, noop } from "@web-ts-toolkit/utils";
+function recurseObject(obj) {
+  if (isSchema(obj)) {
+    return buildRefs(obj.tree);
+  }
+  if (!isObject(obj)) return null;
+  if (isReference(obj)) {
+    return obj.ref;
+  }
+  let ret = null;
+  forEach2(obj, (val) => {
+    ret = recurseObject(val);
+    if (!isEmpty(ret)) {
+      return false;
+    }
+  });
+  return ret;
+}
+function buildRefs(schema) {
+  if (!isObject(schema)) return {};
+  const references = {};
+  forEach2(schema, (val, key) => {
+    const paths = recurseObject(val);
+    if (!isEmpty(paths)) {
+      references[key] = paths;
+    }
+    const target = isObject(val) && "type" in val ? val.type ?? val : val;
+    if (isArray3(target) && target.length > 0) {
+      if (isSchema(target[0]) || isPlainObject4(target[0])) {
+        return;
+      }
+    }
+  });
+  return references;
+}
+function buildSubPaths(schema) {
+  if (!isObject(schema)) return [];
+  const subPaths = [];
+  forEach2(schema, (val, key) => {
+    const target = isObject(val) && "type" in val ? val.type ?? val : val;
+    if (isArray3(target) && target.length > 0) {
+      if (isSchema(target[0]) || isPlainObject4(target[0]) && !isReference(target[0])) {
+        subPaths.push(key);
+      }
+    }
+  });
+  return subPaths;
+}
+async function iterateQuery(query, handler) {
+  if (!isPlainObject4(query)) return query;
+  if (!handler) return noop;
+  const queryObject = query;
+  return mapValuesAsync(queryObject, async (val, key) => {
+    if (isPlainObject4(val)) {
+      const plainValue = val;
+      if (plainValue.$$sq) {
+        return handler(0 /* SubQuery */, plainValue.$$sq, key);
+      } else if (plainValue.$$date) {
+        return handler(1 /* Date */, plainValue.$$date, key);
+      } else {
+        return iterateQuery(val, handler);
+      }
+    }
+    if (isArray3(val)) {
+      return Promise.all(val.map((v) => iterateQuery(v, handler)));
+    }
+    return val;
+  });
+}
+var createValidator = (fn) => {
+  const stringHandler = (key) => key.trim().split(" ").every((v) => fn(v));
+  const arrayHandler = (arr) => arr.some((item) => {
+    if (isString5(item)) return stringHandler(item);
+    else if (isArray3(item)) return arrayHandler(item);
+    else return false;
+  });
+  return { stringHandler, arrayHandler };
+};
+
+// src/meta.ts
+var modelRefs = {};
+var modelSubs = {};
+var modelAtts = {};
+var ensureModelMeta = (modelName) => {
+  if (modelName in modelRefs && modelName in modelSubs && modelName in modelAtts) {
+    return;
+  }
+  const model = mongoose3.models[modelName];
+  if (!model) {
+    modelRefs[modelName] = modelRefs[modelName] ?? {};
+    modelSubs[modelName] = modelSubs[modelName] ?? [];
+    modelAtts[modelName] = modelAtts[modelName] ?? [];
+    return;
+  }
+  const schema = model.schema;
+  modelRefs[modelName] = buildRefs(schema.tree);
+  modelSubs[modelName] = buildSubPaths(schema.tree);
+  modelAtts[modelName] = keys(schema.obj);
+};
+var getModelRef = (modelName, refPath) => {
+  ensureModelMeta(modelName);
+  return get3(modelRefs, `${modelName}.${refPath}`, null);
+};
+var getModelSub = (modelName) => {
+  ensureModelMeta(modelName);
+  return get3(modelSubs, modelName, []);
+};
+
+// src/services/base.ts
+import {
+  castArray,
+  compact,
+  flatten,
+  forEach as forEach3,
+  get as get4,
+  intersectionBy,
+  isArray as isArray4,
+  isPlainObject as isPlainObject5,
+  uniq
+} from "@web-ts-toolkit/utils";
+function validateClientFilter(filter2) {
+  const errors = [];
+  const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
+  const visit = (value, path) => {
+    if (isArray4(value)) {
+      value.forEach((item, index) => visit(item, `${path}[${index}]`));
+      return;
+    }
+    if (!isPlainObject5(value)) return;
+    Object.entries(value).forEach(([key, child]) => {
+      const nextPath = path ? `${path}.${key}` : key;
+      if (blockedOperators.has(key)) {
+        errors.push(`Unsupported filter operator: ${nextPath}`);
+        return;
+      }
+      visit(child, nextPath);
+    });
+  };
+  visit(filter2, "filter");
+  return errors;
+}
+var Base = class {
+  constructor(req, modelName) {
+    this.req = req;
+    this.modelName = modelName;
+  }
+  decorate(doc, access, context) {
+    return this.req.macl.decorate(this.modelName, doc, access, context);
+  }
+  decorateAll(docs, access, context) {
+    return this.req.macl.decorateAll(this.modelName, docs, access, context);
+  }
+  genAllowedFields(doc, access, baseFields) {
+    return this.req.macl.genAllowedFields(this.modelName, doc, access, baseFields);
+  }
+  genDocPermissions(doc, access, context) {
+    return this.req.macl.genDocPermissions(this.modelName, doc, access, context);
+  }
+  genFilter(access, filter2) {
+    return this.req.macl.genFilter(this.modelName, access, filter2);
+  }
+  getIdentifier() {
+    return this.req.macl.getIdentifier(this.modelName);
+  }
+  genIDFilter(id) {
+    return this.req.macl.genIDFilter(this.modelName, id);
+  }
+  genPopulate(access, populate) {
+    return this.req.macl.genPopulate(this.modelName, access, populate);
+  }
+  genSelect(access, targetFields, skipChecks, subPaths) {
+    return this.req.macl.genSelect(this.modelName, access, targetFields, skipChecks, subPaths);
+  }
+  genQuerySelect(access, targetFields, skipChecks, subPaths) {
+    return this.genSelect(access, targetFields, skipChecks, subPaths);
+  }
+  addEmptyPermissions(doc) {
+    return this.req.macl.addEmptyPermissions(this.modelName, doc);
+  }
+  addDocPermissions(doc, access, context) {
+    return this.req.macl.addDocPermissions(this.modelName, doc, access, context);
+  }
+  addFieldPermissions(doc, access, context) {
+    return this.req.macl.addFieldPermissions(this.modelName, doc, access, context);
+  }
+  pickAllowedFields(doc, access, baseFields) {
+    return this.req.macl.pickAllowedFields(this.modelName, doc, access, baseFields);
+  }
+  trimOutputFields(doc, access, baseFields) {
+    return this.pickAllowedFields(doc, access, baseFields);
+  }
+  prepare(allowedData, access, context) {
+    return this.req.macl.prepare(this.modelName, allowedData, access, context);
+  }
+  runTasks(docObject, tasks) {
+    return this.req.macl.runTasks(this.modelName, docObject, tasks);
+  }
+  transform(doc, access, context) {
+    return this.req.macl.transform(this.modelName, doc, access, context);
+  }
+  finalize(doc, access, context) {
+    return this.req.macl.finalize(this.modelName, doc, access, context);
+  }
+  changes(doc, context) {
+    return this.req.macl.changes(this.modelName, doc, context);
+  }
+  validate(allowedData, access, context) {
+    return this.req.macl.validate(this.modelName, allowedData, access, context);
+  }
+  checkIfModelPermissionExists(accesses) {
+    const modelPermissionKeys = getModelOption(this.modelName, "_modelPermissionKeys");
+    return accesses.some((access) => modelPermissionKeys[access]?.length > 0);
+  }
+  validateClientFilter(filter2) {
+    return validateClientFilter(filter2);
+  }
+  processInclude(include) {
+    const includes = compact(castArray(include)).filter(({ model, op, path, localField, foreignField }) => {
+      return model && op && path && localField && foreignField;
+    });
+    let includeLocalFields = [];
+    let includePaths = [];
+    forEach3(includes, (inc) => {
+      includeLocalFields.push(inc.localField);
+      includePaths.push(inc.path);
+    });
+    includeLocalFields = uniq(compact(includeLocalFields));
+    includePaths = uniq(compact(includePaths));
+    return {
+      includes,
+      includeLocalFields,
+      includePaths
+    };
+  }
+  async includeDocs(docs, include) {
+    if (!include) return docs;
+    const includes = compact(castArray(include));
+    if (includes.length === 0) return docs;
+    const isSingle = !isArray4(docs);
+    if (isSingle) docs = [docs];
+    for (let x = 0; x < includes.length; x++) {
+      const include2 = includes[x];
+      if (include2.op === "count") {
+        docs = await this.includeDocsCount(docs, include2);
+      } else {
+        docs = await this.includeDocsList(docs, include2);
+      }
+    }
+    return isSingle ? docs[0] : docs;
+  }
+  async includeDocsList(docs, include) {
+    const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
+    const svc = this.req.macl.getPublicService(model);
+    if (!svc) return docs;
+    const includeLocalValues = [];
+    forEach3(docs, (doc, i) => {
+      includeLocalValues.push(get4(doc, localField));
+    });
+    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: flatten(includeLocalValues) } };
+    const result = await svc.find(filter2, args, {
+      ...options,
+      lean: true,
+      includePermissions: false,
+      includeCount: false
+    });
+    if (!result.success) return docs;
+    for (let y = 0; y < docs.length; y++) {
+      const doc = docs[y];
+      const localValue = get4(doc, localField);
+      const filterFn = (row) => intersectionBy(castArray(localValue), castArray(get4(row, foreignField)), String).length > 0;
+      const matches = result.data.filter(filterFn);
+      setDocValue(doc, path, op === "list" ? matches : matches[0]);
+    }
+    return docs;
+  }
+  async includeDocsCount(docs, include) {
+    const { model, path, localField, foreignField, filter: _filters } = include;
+    const svc = this.req.macl.getPublicService(model);
+    if (!svc) return docs;
+    for (let y = 0; y < docs.length; y++) {
+      const doc = docs[y];
+      const localValue = get4(doc, localField);
+      const filter2 = { ..._filters ?? {}, [foreignField]: localValue };
+      const result = await svc.count(filter2);
+      if (!result.success) continue;
+      setDocValue(doc, path, result.data);
+    }
+    return docs;
+  }
+  async parseClientData(filter2) {
+    const result = await iterateQuery(filter2, async (fo, val, key) => {
+      switch (fo) {
+        case 0 /* SubQuery */:
+          return this.handleSubQuery(val, key);
+        case 1 /* Date */:
+          return this.handleDate(val, key);
+        default:
+          return null;
+      }
+    });
+    return result;
+  }
+  async handleSubQuery(sq, key) {
+    const { model, op, id, filter: filter2, args, options, sqOptions = {} } = sq;
+    const svc = this.req.macl.getPublicService(model);
+    if (!svc) return null;
+    let result;
+    if (op === "list") {
+      result = await svc.find(filter2, args, options);
+    } else if (op === "read") {
+      if (id) {
+        result = await svc.findById(id, args, options);
+      } else if (filter2) {
+        result = await svc.findOne(filter2, args, options);
+      } else {
+        return null;
+      }
+    } else {
+      return null;
+    }
+    if (!result.success) return null;
+    let ret = result.data;
+    if (sqOptions.path) {
+      ret = isArray4(ret) ? flatten(ret.map((v) => get4(v, sqOptions.path))) : get4(ret, sqOptions.path);
+    }
+    if (sqOptions.compact) {
+      ret = compact(castArray(ret));
+    }
+    return ret;
+  }
+  async handleDate(val, key) {
+    return /* @__PURE__ */ new Date();
+  }
+};
+
+// src/services/service.ts
+import {
+  castArray as castArray2,
+  forEach as forEach4,
+  get as get5,
+  isArray as isArray5,
+  isBoolean as isBoolean3,
+  isFunction as isFunction3,
+  omit,
+  pick as pick3,
+  uniq as uniq2
+} from "@web-ts-toolkit/utils";
+import diff from "deep-diff";
+
+// src/model.ts
+import mongoose4 from "mongoose";
+var Model = class {
+  constructor(modelName) {
+    this.modelName = modelName;
+    this.model = mongoose4.model(modelName);
+    if (!this.model) return;
+    this.model.schema.set("optimisticConcurrency", true);
+    const currVersionKey = this.model.schema.get("versionKey");
+    if (!currVersionKey) this.model.schema.set("versionKey", "__v");
+  }
+  new() {
+    const doc = new this.model();
+    return doc;
+  }
+  create(data) {
+    return this.model.create(data);
+  }
+  find({ filter: filter2, select, sort, populate, limit, skip, lean }) {
+    if (!this.validateSort(sort)) {
+      sort = null;
+    }
+    const builder = this.model.find(filter2);
+    if (select) builder.select(select);
+    if (skip) builder.skip(Number(skip));
+    if (limit) builder.limit(Number(limit));
+    if (sort) builder.sort(sort);
+    if (populate) builder.populate(populate);
+    if (lean) builder.lean();
+    return builder;
+  }
+  // See https://github.com/Automattic/mongoose/blob/65b2d12a8f85f86136cfaf32947f338ba0c5f451/lib/query.js#L3011
+  validateSort(sort, logError = console.error) {
+    const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
+    if (sort === null || sort === void 0) return true;
+    if (typeof sort === "string") {
+      if (!/^[a-zA-Z0-9\s-]+/.test(sort)) {
+        logError("Invalid sort string:", sort);
+        return false;
+      }
+      return true;
+    }
+    if (Array.isArray(sort)) {
+      const isValid = sort.every((pair) => {
+        if (!Array.isArray(pair) || pair.length !== 2) {
+          logError("Invalid sort array element: must be [key, order]", pair);
+          return false;
+        }
+        const [key, order] = pair;
+        if (typeof key !== "string") {
+          logError("Invalid sort array key: must be string", key);
+          return false;
+        }
+        if (!validSortOrders.includes(order)) {
+          logError('Invalid sort array order: must be 1, -1, "asc", or "desc"', order);
+          return false;
+        }
+        return true;
+      });
+      return isValid;
+    }
+    if (typeof sort === "object" && !(sort instanceof Map)) {
+      const isValid = Object.values(sort).every((order) => {
+        if (!validSortOrders.includes(order)) {
+          logError('Invalid sort object value: must be 1, -1, "asc", or "desc"', order);
+          return false;
+        }
+        return true;
+      });
+      return isValid;
+    }
+    if (sort instanceof Map) {
+      const isValid = Array.from(sort.values()).every((order) => {
+        if (!validSortOrders.includes(order)) {
+          logError('Invalid sort Map value: must be 1, -1, "asc", or "desc"', order);
+          return false;
+        }
+        return true;
+      });
+      return isValid;
+    }
+    logError("Invalid sort type: must be string, array, object, or Map", sort);
+    return false;
+  }
+  findOne({ filter: filter2, select, sort, populate, lean }) {
+    if (!this.validateSort(sort)) {
+      sort = null;
+    }
+    const builder = this.model.findOne(filter2);
+    if (select) builder.select(select);
+    if (sort) builder.sort(sort);
+    if (populate) builder.populate(populate);
+    if (lean) builder.lean();
+    return builder;
+  }
+  findOneAndDelete(filter2) {
+    return this.model.findOneAndDelete(filter2);
+  }
+  exists(filter2) {
+    if (!filter2) return null;
+    return this.findOne(filter2).select("_id").lean();
+  }
+  // see https://mongoosejs.com/docs/api.html#query_Query-countDocuments
+  countDocuments(filter2 = {}) {
+    return this.model.countDocuments(filter2);
+  }
+  // see https://mongoosejs.com/docs/api.html#model_Model.estimatedDocumentCount
+  estimatedDocumentCount() {
+    return this.model.estimatedDocumentCount();
+  }
+  // see https://mongoosejs.com/docs/api.html#model_Model.distinct
+  distinct(field, conditions = {}) {
+    return this.model.distinct(field, conditions);
+  }
+};
+var model_default = Model;
+
+// src/services/service.ts
+var Service = class extends Base {
+  constructor(req, modelName) {
+    super(req, modelName);
+    this.model = new model_default(modelName);
+    this.options = getModelOptions(modelName);
+    this.defaults = this.options.defaults || {};
+    this.baseFields = ["_id"];
+    this.baseFieldsExt = this.baseFields.concat(this.options.documentPermissionField);
+  }
+  async findOne(filter2, args, options) {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const {
+      select = this.defaults.findOneArgs?.select,
+      sort = this.defaults.findOneArgs?.sort,
+      populate = this.defaults.findOneArgs?.populate,
+      include = this.defaults.findOneArgs?.include,
+      overrides = {}
+    } = args ?? {};
+    const {
+      skim = this.defaults.findOneOptions?.skim ?? false,
+      includePermissions = this.defaults.findOneOptions?.includePermissions ?? true,
+      access = this.defaults.findOneOptions?.access ?? "read",
+      populateAccess = this.defaults.findOneOptions?.populateAccess,
+      lean = this.defaults.findOneOptions?.lean ?? false
+    } = options ?? {};
+    const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    let [_filter, _select, _populate] = await Promise.all([
+      overrideFilter || this.genFilter(access, await this.parseClientData(filter2)),
+      overrideSelect || this.genQuerySelect(access, select),
+      overridePopulate || this.genPopulate(populateAccess || access, populate)
+    ]);
+    const { includes, includeLocalFields, includePaths } = this.processInclude(include);
+    const finalSelect = normalizeSelect(_select).concat(includeLocalFields);
+    const query = {
+      filter: _filter,
+      select: finalSelect,
+      sort,
+      populate: _populate
+    };
+    logger.debug(JSON.stringify({ op: "findOne", query }));
+    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let doc = await this.model.findOne({ ...query, lean });
+    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    const context = {
+      model: this.model.model,
+      modelName: this.modelName,
+      originalDocObject: toObject(doc)
+    };
+    doc = await this.includeDocs(doc, includes);
+    let includeDocPermissions = includePermissions;
+    if (!includeDocPermissions && !skim) {
+      includeDocPermissions = this.checkIfModelPermissionExists([access, "read", "update"]);
+    }
+    if (includeDocPermissions) doc = await this.addDocPermissions(doc, access, context);
+    if (includePermissions) doc = await this.addFieldPermissions(doc, access, context);
+    doc = await this.trimOutputFields(
+      doc,
+      access,
+      this.baseFieldsExt.concat(includePaths, normalizeSelect(overrideSelect))
+    );
+    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    return { success: true, kind: "single", code: "success" /* Success */, data: doc, query, context };
+  }
+  async findById(id, args, options) {
+    const {
+      select = this.defaults.findByIdArgs?.select,
+      populate = this.defaults.findByIdArgs?.populate,
+      include = this.defaults.findByIdArgs?.include,
+      overrides = {}
+    } = args ?? {};
+    const {
+      skim = this.defaults.findOneOptions?.skim ?? false,
+      includePermissions = this.defaults.findOneOptions?.includePermissions ?? true,
+      access = this.defaults.findOneOptions?.access ?? "read",
+      populateAccess = this.defaults.findOneOptions?.populateAccess,
+      lean = this.defaults.findOneOptions?.lean ?? false
+    } = options ?? {};
+    const { select: overrideSelect, populate: overridePopulate, idFilter: overrideIdFilter } = overrides ?? {};
+    const filter2 = overrideIdFilter || await this.genIDFilter(id);
+    return this.findOne(
+      filter2,
+      {
+        select,
+        populate,
+        include,
+        overrides: {
+          select: overrideSelect,
+          populate: overridePopulate
+        }
+      },
+      { skim, includePermissions, access, populateAccess, lean }
+    );
+  }
+  async find(filter2, args, options, decorate) {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const {
+      select = this.defaults.findArgs?.select,
+      populate = this.defaults.findArgs?.populate,
+      include = this.defaults.findArgs?.include,
+      sort = this.defaults.findArgs?.sort,
+      skip = this.defaults.findArgs?.skip,
+      limit = this.defaults.findArgs?.limit,
+      page = this.defaults.findArgs?.page,
+      pageSize = this.defaults.findArgs?.pageSize,
+      overrides = {}
+    } = args ?? {};
+    const {
+      skim = this.defaults.findOptions?.skim ?? false,
+      includePermissions = this.defaults.findOptions?.includePermissions ?? true,
+      includeCount = this.defaults.findOptions?.includeCount ?? false,
+      populateAccess = this.defaults.findOptions?.populateAccess ?? "read",
+      lean = this.defaults.findOptions?.lean ?? false
+    } = options ?? {};
+    const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    const [_filter, _select, _populate, pagination] = await Promise.all([
+      overrideFilter || this.genFilter("list", await this.parseClientData(filter2)),
+      overrideSelect || this.genQuerySelect("list", select),
+      overridePopulate || this.genPopulate(populateAccess, populate),
+      genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
+    ]);
+    const finalSelect = normalizeSelect(_select);
+    const filteredPopulate = isArray5(finalSelect) && isArray5(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const { includes, includeLocalFields, includePaths } = this.processInclude(include);
+    const query = {
+      filter: _filter,
+      select: finalSelect.concat(includeLocalFields),
+      populate: filteredPopulate,
+      sort,
+      ...pagination
+    };
+    logger.debug(JSON.stringify({ op: "find", query }));
+    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let docs = await this.model.find({
+      ...query,
+      lean
+    });
+    const contexts = docs.map((doc) => ({
+      model: this.model.model,
+      modelName: this.modelName,
+      originalDocObject: toObject(doc)
+    }));
+    const _decorate = isFunction3(decorate) ? decorate : (v) => v;
+    docs = await this.includeDocs(docs, includes);
+    const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
+    docs = await Promise.all(
+      docs.map(async (doc, i) => {
+        contexts[i].fieldPermissionAccess = fieldPermissionAccess;
+        let includeDocPermissions = includePermissions;
+        if (!includeDocPermissions && !skim) {
+          includeDocPermissions = this.checkIfModelPermissionExists(["list", "read", "update"]);
+        }
+        if (includeDocPermissions) doc = await this.addDocPermissions(doc, "list", contexts[i]);
+        if (includePermissions) doc = await this.addFieldPermissions(doc, "list", contexts[i]);
+        doc = await this.trimOutputFields(
+          doc,
+          "list",
+          this.baseFieldsExt.concat(includePaths, normalizeSelect(overrideSelect))
+        );
+        doc = await _decorate(doc, contexts[i]);
+        if (!includePermissions) doc = this.addEmptyPermissions(doc);
+        return doc;
+      })
+    );
+    return {
+      success: true,
+      kind: "list",
+      code: "success" /* Success */,
+      data: docs,
+      count: docs.length,
+      totalCount: includeCount ? await this.model.countDocuments(_filter) : null,
+      query,
+      contexts
+    };
+  }
+  async create(data, args, options, decorate) {
+    const { populate = this.defaults.createArgs?.populate } = args ?? {};
+    const {
+      skim = this.defaults.createOptions?.skim ?? false,
+      includePermissions = this.defaults.createOptions?.includePermissions ?? true,
+      populateAccess = this.defaults.createOptions?.populateAccess ?? "read"
+    } = options ?? {};
+    const isArr = Array.isArray(data);
+    let dataArr = isArr ? data : [data];
+    dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+    const contexts = [];
+    let validationError = null;
+    const items = await Promise.all(
+      dataArr.map(async (item, index) => {
+        const context = { model: this.model.model, modelName: this.modelName, originalData: item };
+        const allowedFields = await this.genAllowedFields(item, "create");
+        const allowedData = pick3(item, allowedFields);
+        const validated = await this.validate(allowedData, "create", context);
+        if (isBoolean3(validated)) {
+          if (!validated) {
+            validationError = { success: false, code: "bad_request" /* BadRequest */ };
+            return;
+          }
+        } else if (isArray5(validated)) {
+          if (validated.length > 0) {
+            validationError = { success: false, code: "bad_request" /* BadRequest */, errors: validated };
+            return;
+          }
+        }
+        const preparedData = await this.prepare(allowedData, "create", context);
+        context.preparedData = preparedData;
+        contexts.push(context);
+        return preparedData;
+      })
+    );
+    if (validationError) return validationError;
+    const _decorate = isFunction3(decorate) ? decorate : (v) => v;
+    let docs = await this.model.create(items);
+    docs = await Promise.all(
+      docs.map(async (doc, index) => {
+        doc = await this.finalize(doc, "create", contexts[index]);
+        contexts[index].finalDocObject = doc.toObject({ virtuals: false });
+        let includeDocPermissions = includePermissions;
+        if (!includeDocPermissions && !skim) {
+          includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+        }
+        if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
+        if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
+        if (populate) await populateDoc(doc, await this.genPopulate(populateAccess, populate));
+        doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
+        doc = await _decorate(doc, contexts[index]);
+        if (!includePermissions) doc = this.addEmptyPermissions(doc);
+        return doc;
+      })
+    );
+    return {
+      success: true,
+      kind: "list",
+      code: "created" /* Created */,
+      data: docs,
+      input: items,
+      count: docs.length
+    };
+  }
+  async new() {
+    const data = await this.model.new();
+    return {
+      success: true,
+      kind: "single",
+      code: "success" /* Success */,
+      data
+    };
+  }
+  async updateOne(filter2, data, args, options, decorate) {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const { populate = this.defaults.updateOneArgs?.populate, overrides = {} } = args ?? {};
+    const {
+      skim = this.defaults.updateOneOptions?.skim ?? false,
+      includePermissions = this.defaults.updateOneOptions?.includePermissions ?? true,
+      populateAccess = this.defaults.updateOneOptions?.populateAccess ?? "read"
+    } = options ?? {};
+    const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
+    const [_filter, _populate] = await Promise.all([
+      overrideFilter || this.genFilter("update", filter2),
+      overridePopulate || this.genPopulate(populateAccess, populate)
+    ]);
+    const query = { filter: _filter, populate: _populate };
+    logger.debug(JSON.stringify({ op: "updateOne", query }));
+    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let doc = await this.model.findOne({ filter: _filter });
+    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    const context = { model: this.model.model, modelName: this.modelName };
+    data = await this.parseClientData(data);
+    context.originalDocObject = doc.toObject({ virtuals: false });
+    context.originalData = data;
+    doc = await this.addDocPermissions(doc, "update", context);
+    context.docPermissions = this.getDocPermissions(doc);
+    context.currentDoc = doc;
+    const allowedFields = await this.genAllowedFields(doc, "update");
+    const allowedData = pick3(data, allowedFields);
+    const validated = await this.validate(allowedData, "update", context);
+    if (isBoolean3(validated)) {
+      if (!validated) return { success: false, code: "bad_request" /* BadRequest */ };
+    } else if (isArray5(validated)) {
+      if (validated.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: validated };
+    }
+    const prepared = await this.prepare(allowedData, "update", context);
+    context.preparedData = prepared;
+    Object.assign(doc, prepared);
+    context.modifiedPaths = doc.modifiedPaths();
+    doc = await this.transform(doc, "update", context);
+    doc = await doc.save();
+    const diffExcludeFields = [this.options.documentPermissionField, "__v"];
+    context.diff = (d) => {
+      context.changes = diff(
+        omit(context.originalDocObject, diffExcludeFields),
+        omit(d.toObject({ virtuals: false }), diffExcludeFields)
+      ) || [];
+      context.modifiedPaths = uniq2(context.changes.map((di) => di.path.length > 0 ? di.path[0] : ""));
+    };
+    doc = await this.finalize(doc, "update", context);
+    context.finalDocObject = doc.toObject({ virtuals: false });
+    context.diff(doc);
+    await this.changes(doc, context);
+    let includeDocPermissions = includePermissions;
+    if (!includeDocPermissions && !skim) {
+      includeDocPermissions = this.checkIfModelPermissionExists(["read", "update"]);
+    }
+    if (includeDocPermissions) doc = await this.addDocPermissions(doc, "update", context);
+    if (includePermissions) doc = await this.addFieldPermissions(doc, "update", context);
+    if (_populate) await populateDoc(doc, _populate);
+    doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
+    if (isFunction3(decorate)) doc = await decorate(doc, context);
+    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    return { success: true, kind: "single", code: "success" /* Success */, data: doc, input: prepared };
+  }
+  async updateById(id, data, { populate = this.defaults.updateByIdArgs?.populate, overrides = {} } = {}, {
+    skim = this.defaults.updateByIdOptions?.skim ?? false,
+    includePermissions = this.defaults.updateByIdOptions?.includePermissions ?? true,
+    populateAccess = this.defaults.updateByIdOptions?.populateAccess ?? "read"
+  } = {}, decorate) {
+    const { populate: overridePopulate, idFilter: overrideIdFilter } = overrides;
+    const filter2 = overrideIdFilter || await this.genIDFilter(id);
+    return this.updateOne(
+      filter2,
+      data,
+      {
+        populate,
+        overrides: {
+          populate: overridePopulate
+        }
+      },
+      { skim, includePermissions, populateAccess },
+      decorate
+    );
+  }
+  async upsert(filter2, data, args, options, decorate) {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const { populate = this.defaults.upsertArgs?.populate, overrides = {} } = args ?? {};
+    const {
+      skim = this.defaults.upsertOptions?.skim ?? false,
+      includePermissions = this.defaults.upsertOptions?.includePermissions ?? true,
+      populateAccess = this.defaults.upsertOptions?.populateAccess ?? "read"
+    } = options ?? {};
+    const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
+    const theone = await this.model.findOne({ filter: filter2 });
+    if (theone) {
+      const _filter = await (overrideFilter || this.genFilter("update", filter2));
+      const query = { filter: _filter };
+      logger.debug(JSON.stringify({ op: "upsert", query }));
+      if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+      const matched = matchElement(theone, _filter);
+      if (!matched) return { success: false, code: "forbidden" /* Forbidden */, query };
+      return this.updateOne(
+        null,
+        data,
+        {
+          populate,
+          overrides: {
+            filter: _filter,
+            populate: overridePopulate
+          }
+        },
+        { skim, includePermissions, populateAccess },
+        decorate
+      );
+    } else {
+      return this.create(
+        data,
+        { populate },
+        {
+          skim,
+          includePermissions,
+          populateAccess
+        },
+        decorate
+      );
+    }
+  }
+  async delete(id) {
+    const filter2 = await this.genFilter("delete", await this.genIDFilter(id));
+    const query = { filter: filter2 };
+    logger.debug(JSON.stringify({ op: "delete", query }));
+    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let doc = await this.model.findOne({ filter: filter2 });
+    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    await ("deleteOne" in doc ? doc.deleteOne() : doc.remove());
+    return { success: true, kind: "single", code: "success" /* Success */, data: doc._id, query };
+  }
+  async exists(filter2, options) {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const {
+      access = this.defaults.existsOptions?.access ?? "read",
+      includeId = this.defaults.existsOptions?.includeId ?? false
+    } = options ?? {};
+    filter2 = await this.genFilter(access, filter2);
+    const result = await this.model.exists(filter2);
+    return {
+      success: true,
+      kind: "single",
+      code: "success" /* Success */,
+      data: includeId ? result : !!result,
+      query: { filter: filter2 }
+    };
+  }
+  async distinct(field, args) {
+    let { filter: filter2 } = args ?? {};
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    filter2 = await this.genFilter("read", filter2);
+    const query = { filter: filter2 };
+    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const result = await this.model.distinct(field, filter2);
+    return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length, query };
+  }
+  async count(filter2, access = "list") {
+    const filterErrors = this.validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    filter2 = await this.genFilter(access, filter2);
+    const query = { filter: filter2 };
+    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    return { success: true, kind: "single", code: "success" /* Success */, data: await this.model.countDocuments(filter2), query };
+  }
+  getDocPermissions(doc) {
+    return getDocPermissions(this.modelName, doc);
+  }
+  async getFieldPermissionAccess(ids) {
+    const uniqueIds = uniq2(ids.map((id) => String(id)).filter(Boolean));
+    if (uniqueIds.length === 0) {
+      return {
+        readIds: /* @__PURE__ */ new Set(),
+        updateIds: /* @__PURE__ */ new Set()
+      };
+    }
+    const [readIds, updateIds] = await Promise.all([
+      this.getAccessibleIdSet(uniqueIds, "read"),
+      this.getAccessibleIdSet(uniqueIds, "update")
+    ]);
+    return { readIds, updateIds };
+  }
+  async getAccessibleIdSet(ids, access) {
+    const filter2 = await this.genFilter(access, { _id: { $in: ids } });
+    if (filter2 === false) return /* @__PURE__ */ new Set();
+    const docs = await this.model.find({ filter: filter2, select: "_id", lean: true });
+    return new Set(docs.map((doc) => String(doc._id)));
+  }
+  async listSub(id, sub, options) {
+    let { filter: ft, fields } = options ?? {};
+    const parentDoc = await this.getParentDoc(id, sub, null, { access: "read" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    let result = get5(parentDoc, sub);
+    const [subFilter, subSelect] = await Promise.all([
+      this.genFilter(`subs.${sub}.list`, ft),
+      this.genQuerySelect("list", fields, false, [sub, "sub"])
+    ]);
+    if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+    result = filterCollection(result, subFilter);
+    if (subSelect) result = result.map((v) => pick3(toObject(v), subSelect.concat("_id")));
+    return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
+  }
+  async readSub(id, sub, subId, options) {
+    let { fields, populate } = options ?? {};
+    const parentDoc = await this.getParentDoc(id, sub, { populate }, { access: "read" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    const result = get5(parentDoc, sub);
+    const [subFilter, subSelect] = await Promise.all([
+      this.genFilter(`subs.${sub}.read`, { _id: subId }),
+      this.genQuerySelect("read", fields, false, [sub, "sub"])
+    ]);
+    if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+    let subdoc = findElement(result, subFilter);
+    if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+    if (subSelect) subdoc = pick3(toObject(subdoc), subSelect.concat(["_id"]));
+    return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
+  }
+  async updateSub(id, sub, subId, data) {
+    const parentDoc = await this.getParentDoc(id, sub, null, { access: "update" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    const result = get5(parentDoc, sub);
+    const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
+      this.genFilter(`subs.${sub}.update`, { _id: subId }),
+      this.genQuerySelect("read", null, false, [sub, "sub"]),
+      this.genQuerySelect("update", null, false, [sub, "sub"])
+    ]);
+    if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+    let subdoc = findElement(result, subFilter);
+    if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+    const allowedData = pick3(data, subUpdateSelect);
+    Object.assign(subdoc, allowedData);
+    await parentDoc.save();
+    if (subReadSelect) subdoc = pick3(toObject(subdoc), subReadSelect.concat(["_id"]));
+    return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
+  }
+  async bulkUpdateSub(id, sub, data) {
+    const parentDoc = await this.getParentDoc(id, sub, null, { access: "update" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    let result = get5(parentDoc, sub);
+    data = castArray2(data);
+    const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
+      this.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
+      this.genQuerySelect("read", null, false, [sub, "sub"]),
+      this.genQuerySelect("update", null, false, [sub, "sub"])
+    ]);
+    if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+    result = filterCollection(result, subFilter);
+    forEach4(result, (subdoc) => {
+      const tdata = findElementById(data, subdoc._id);
+      if (!tdata) return;
+      const allowedData = pick3(tdata, subUpdateSelect);
+      Object.assign(subdoc, allowedData);
+    });
+    await parentDoc.save();
+    if (subReadSelect) result = result.map((v) => pick3(toObject(v), subReadSelect.concat(["_id"])));
+    return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
+  }
+  async createSub(id, sub, data, options) {
+    const { addFirst } = options ?? {};
+    const parentDoc = await this.getParentDoc(id, sub, null, { access: "update" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    let result = get5(parentDoc, sub);
+    const [subCreateSelect, subReadSelect] = await Promise.all([
+      this.genQuerySelect("create", null, false, [sub, "sub"]),
+      this.genQuerySelect("read", null, false, [sub, "sub"])
+    ]);
+    const allowedData = pick3(data, subCreateSelect);
+    addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
+    await parentDoc.save();
+    if (subReadSelect) result = result.map((v) => pick3(toObject(v), subReadSelect.concat(["_id"])));
+    return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
+  }
+  async deleteSub(id, sub, subId) {
+    const parentDoc = await this.getParentDoc(id, sub, null, { access: "update" });
+    if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+    const result = get5(parentDoc, sub);
+    const subFilter = await this.genFilter(`subs.${sub}.delete`, { _id: subId });
+    if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+    const subdoc = findElement(result, subFilter);
+    if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+    await ("deleteOne" in subdoc ? subdoc.deleteOne?.() : subdoc.remove?.());
+    await parentDoc.save();
+    return { success: true, kind: "single", code: "success" /* Success */, data: subdoc._id };
+  }
+  async getParentDoc(id, sub, args, options) {
+    const { populate } = args ?? {};
+    const { access = "read", lean = false } = options ?? {};
+    const parentFilter = await this.genFilter(access, await this.genIDFilter(id));
+    if (parentFilter === false) return null;
+    return this.model.findOne({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
+  }
+};
+
+// src/services/public-service.ts
+import { pick as pick4 } from "@web-ts-toolkit/utils";
+var PublicService = class extends Service {
+  async _list(filter2, args, options) {
+    const {
+      select = this.defaults.publicListArgs?.select,
+      populate = this.defaults.publicListArgs?.populate,
+      include = this.defaults.publicListArgs?.include,
+      sort = this.defaults.publicListArgs?.sort,
+      skip = this.defaults.publicListArgs?.skip,
+      limit = this.defaults.publicListArgs?.limit,
+      page = this.defaults.publicListArgs?.page,
+      pageSize = this.defaults.publicListArgs?.pageSize,
+      tasks = this.defaults.publicListArgs?.tasks ?? []
+    } = args ?? {};
+    const {
+      skim = this.defaults.publicListOptions?.skim ?? true,
+      includePermissions = this.defaults.publicListOptions?.includePermissions ?? false,
+      includeCount = this.defaults.publicListOptions?.includeCount ?? false,
+      populateAccess = this.defaults.publicListOptions?.populateAccess ?? "read",
+      lean = this.defaults.publicListOptions?.lean ?? true
+    } = options ?? {};
+    const result = await this.find(
+      filter2,
+      { select, populate, include, sort, skip, limit, page, pageSize },
+      { skim, includePermissions, includeCount, populateAccess, lean },
+      async (doc, context) => {
+        doc = toObject(doc);
+        return this.decorate(doc, "list", context);
+      }
+    );
+    if (!result.success) {
+      return result;
+    }
+    let docs = result.data;
+    docs = await this.decorateAll(docs, "list", { model: this.model.model, modelName: this.modelName });
+    docs = docs.map((row) => this.runTasks(row, tasks));
+    result.data = docs;
+    return result;
+  }
+  async _create(data, args, options) {
+    const {
+      select = this.defaults.publicCreateArgs?.select,
+      populate = this.defaults.publicCreateArgs?.populate,
+      tasks = this.defaults.publicCreateArgs?.tasks ?? []
+    } = args ?? {};
+    const {
+      skim = this.defaults.publicCreateOptions?.skim ?? false,
+      includePermissions = this.defaults.publicCreateOptions?.includePermissions ?? true,
+      populateAccess = this.defaults.publicCreateOptions?.populateAccess ?? "read"
+    } = options ?? {};
+    const result = await this.create(
+      data,
+      { populate },
+      { skim, includePermissions, populateAccess },
+      async (doc, context) => {
+        doc = toObject(doc);
+        doc = await this.decorate(doc, "create", context);
+        doc = this.runTasks(doc, tasks);
+        if (select) doc = pick4(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        return doc;
+      }
+    );
+    return result;
+  }
+  async _new() {
+    return this.new();
+  }
+  async _read(id, args, options) {
+    const {
+      select = this.defaults.publicReadArgs?.select,
+      populate = this.defaults.publicReadArgs?.populate,
+      include = this.defaults.publicReadArgs?.include,
+      tasks = this.defaults.publicReadArgs?.tasks ?? []
+    } = args ?? {};
+    const {
+      skim = this.defaults.publicReadOptions?.skim ?? false,
+      includePermissions = this.defaults.publicReadOptions?.includePermissions ?? true,
+      tryList = this.defaults.publicReadOptions?.tryList ?? true,
+      populateAccess = this.defaults.publicReadOptions?.populateAccess,
+      lean = this.defaults.publicReadOptions?.lean ?? false
+    } = options ?? {};
+    let access = "read";
+    const idFilter = await this.genIDFilter(id);
+    let result = await this.findById(
+      id,
+      {
+        select,
+        populate,
+        include,
+        overrides: { idFilter }
+      },
+      { skim, includePermissions, access, populateAccess, lean }
+    );
+    if (tryList && (!result.success || !result.data)) {
+      access = "list";
+      result = await this.findById(
+        id,
+        {
+          select,
+          populate,
+          overrides: { idFilter }
+        },
+        { skim, includePermissions, access, populateAccess, lean }
+      );
+    }
+    if (!result.success) {
+      return result;
+    }
+    let doc = toObject(result.data);
+    doc = await this.decorate(doc, access, result.context);
+    doc = this.runTasks(doc, tasks);
+    result.data = doc;
+    return result;
+  }
+  async _readFilter(filter2, args, options) {
+    const {
+      select = this.defaults.publicReadArgs?.select,
+      sort = this.defaults.publicListArgs?.sort,
+      populate = this.defaults.publicReadArgs?.populate,
+      include = this.defaults.publicReadArgs?.include,
+      tasks = this.defaults.publicReadArgs?.tasks ?? []
+    } = args ?? {};
+    const {
+      skim = this.defaults.publicReadOptions?.skim ?? false,
+      includePermissions = this.defaults.publicReadOptions?.includePermissions ?? true,
+      tryList = this.defaults.publicReadOptions?.tryList ?? true,
+      populateAccess = this.defaults.publicReadOptions?.populateAccess,
+      lean = this.defaults.publicReadOptions?.lean ?? false
+    } = options ?? {};
+    let access = "read";
+    let result = await this.findOne(
+      filter2,
+      {
+        select,
+        sort,
+        populate,
+        include,
+        overrides: {}
+      },
+      { skim, includePermissions, access, populateAccess, lean }
+    );
+    if (tryList && (!result.success || !result.data)) {
+      access = "list";
+      result = await this.findOne(
+        filter2,
+        {
+          select,
+          sort,
+          populate,
+          overrides: {}
+        },
+        { skim, includePermissions, access, populateAccess, lean }
+      );
+    }
+    if (!result.success) {
+      return result;
+    }
+    let doc = toObject(result.data);
+    doc = await this.decorate(doc, access, result.context);
+    doc = this.runTasks(doc, tasks);
+    result.data = doc;
+    return result;
+  }
+  async _update(id, data, args, options) {
+    const {
+      select = this.defaults.publicUpdateArgs?.select,
+      populate = this.defaults.publicUpdateArgs?.populate,
+      tasks = this.defaults.publicUpdateArgs?.tasks ?? []
+    } = args ?? {};
+    const {
+      skim = this.defaults.publicUpdateOptions?.skim ?? false,
+      returningAll = this.defaults.publicUpdateOptions?.returningAll ?? true,
+      includePermissions = this.defaults.publicUpdateOptions?.includePermissions ?? true,
+      populateAccess = this.defaults.publicUpdateOptions?.populateAccess ?? "read"
+    } = options ?? {};
+    const result = await this.updateById(
+      id,
+      data,
+      { populate },
+      { skim, includePermissions, populateAccess },
+      async (doc, context) => {
+        doc = toObject(doc);
+        doc = await this.decorate(doc, "update", context);
+        doc = this.runTasks(doc, tasks);
+        if (select) doc = pick4(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) doc = pick4(doc, [...Object.keys(data), "_id"]);
+        return doc;
+      }
+    );
+    return result;
+  }
+  async _delete(id) {
+    const result = await this.delete(id);
+    return result;
+  }
+  async _distinct(field, options = {}) {
+    const result = await this.distinct(field, options);
+    return result;
+  }
+  async _count(filter2, access = "list") {
+    const result = await this.count(filter2, access);
+    return result;
+  }
+};
+
+// src/services/data-service.ts
+import { orderBy, pick as pick5 } from "@web-ts-toolkit/utils";
+var DataService = class {
+  constructor(req, dataName) {
+    this.req = req;
+    this.dataName = dataName;
+    this.options = getDataOptions(dataName);
+    this.data = this.options.data ?? [];
+  }
+  async findOne(filter2, args, options) {
+    const filterErrors = validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const { select } = args ?? {};
+    const { access = "read" } = options ?? {};
+    let [_filter, _select] = await Promise.all([this.genFilter(access, filter2), this.genQuerySelect(access, select)]);
+    const query = {
+      filter: _filter,
+      select: _select
+    };
+    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let doc = await findElement(this.data, _filter);
+    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    doc = await this.trimOutputFields(doc, access);
+    if (_select.length > 0) doc = pick5(doc, _select);
+    return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
+  }
+  async findById(id, args, options) {
+    const { select } = args ?? {};
+    const { access = "read" } = options ?? {};
+    const filter2 = await this.genIDFilter(id);
+    return this.findOne(
+      filter2,
+      {
+        select
+      },
+      { access }
+    );
+  }
+  async find(filter2, args, options) {
+    const filterErrors = validateClientFilter(filter2);
+    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    const { select, sort, skip, limit, page, pageSize } = args ?? {};
+    const [_filter, _select, pagination] = await Promise.all([
+      this.genFilter("list", filter2),
+      this.genQuerySelect("list", select),
+      genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
+    ]);
+    const query = {
+      filter: _filter,
+      select: _select,
+      sort,
+      ...pagination
+    };
+    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    let docs = await filterCollection(this.data, _filter);
+    const totalCount = docs.length;
+    docs = await Promise.all(
+      docs.map(async (doc) => {
+        doc = await this.trimOutputFields(doc, "list");
+        if (_select.length > 0) doc = pick5(doc, _select);
+        return doc;
+      })
+    );
+    if (sort) {
+      const { sortKey, sortOrder } = parseSortString(sort);
+      docs = orderBy(docs, [sortKey], [sortOrder]);
+    }
+    docs = docs.slice(query.skip, query.limit && query.skip + query.limit);
+    return {
+      success: true,
+      kind: "list",
+      code: "success" /* Success */,
+      data: docs,
+      count: docs.length,
+      totalCount,
+      query
+    };
+  }
+  decorate(doc, access, context) {
+    return this.req.dacl.decorate(this.dataName, doc, access, context);
+  }
+  decorateAll(docs, access) {
+    return this.req.dacl.decorateAll(this.dataName, docs, access);
+  }
+  genAllowedFields(doc, access, baseFields) {
+    return this.req.dacl.genAllowedFields(this.dataName, doc, access, baseFields);
+  }
+  genFilter(access, filter2) {
+    return this.req.dacl.genFilter(this.dataName, access, filter2);
+  }
+  genIDFilter(id) {
+    return this.req.dacl.genIDFilter(this.dataName, id);
+  }
+  genSelect(access, targetFields, skipChecks, subPaths) {
+    return this.req.dacl.genSelect(this.dataName, access, targetFields, skipChecks, subPaths);
+  }
+  genQuerySelect(access, targetFields, skipChecks, subPaths) {
+    return this.genSelect(access, targetFields, skipChecks, subPaths);
+  }
+  pickAllowedFields(doc, access, baseFields) {
+    return this.req.dacl.pickAllowedFields(this.dataName, doc, access, baseFields);
+  }
+  trimOutputFields(doc, access, baseFields) {
+    return this.pickAllowedFields(doc, access, baseFields);
+  }
+};
+
+// src/processors.ts
+import { castArray as castArray3, cloneDeep, forEach as forEach5, get as get6, isArray as isArray6, map as map3, set as set5 } from "@web-ts-toolkit/utils";
+var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
+  const obj = get6(options, "mutable", true) ? docObject : cloneDeep(docObject);
+  const idField = get6(options, "idField", "_id");
+  forEach5(castArray3(operations), (op) => {
+    if (!op.src || !op.dest) return;
+    let targets = [obj];
+    const segs = op.src.split(".");
+    forEach5(segs, (seg, ind) => {
+      if (segs.length === ind + 1) {
+        forEach5(targets, (target) => {
+          const targetObject = target;
+          set5(targetObject, op.dest, get6(targetObject, seg));
+          set5(
+            targetObject,
+            seg,
+            isArray6(targetObject[seg]) ? map3(targetObject[seg], idField) : get6(targetObject, `${seg}.${idField}`)
+          );
+        });
+      } else {
+        targets = targets.reduce((ret, target) => {
+          const targetObject = target;
+          if (isArray6(targetObject[seg])) ret.push(...targetObject[seg]);
+          else ret.push(targetObject[seg]);
+          return ret;
+        }, []);
+      }
+    });
+  });
+  return obj;
+};
+
+// src/symbols.ts
+var MIDDLEWARE = /* @__PURE__ */ Symbol("middleware");
+var DATA_MIDDLEWARE = /* @__PURE__ */ Symbol("data-middleware");
+var CORE = /* @__PURE__ */ Symbol("core");
+var PERMISSIONS = /* @__PURE__ */ Symbol("permissions");
+var PERMISSION_KEYS = /* @__PURE__ */ Symbol("permission-keys");
+
+// src/cache.ts
+var Cache = class {
+  constructor() {
+    this.cache = /* @__PURE__ */ new Map();
+  }
+  set(key, value) {
+    this.cache.set(key, value);
+  }
+  get(key) {
+    return this.cache.get(key);
+  }
+  delete(key) {
+    this.cache.delete(key);
+  }
+  clear() {
+    this.cache.clear();
+  }
+  has(key) {
+    return this.cache.has(key);
+  }
+  keys() {
+    return Array.from(this.cache.keys());
+  }
+  values() {
+    return Array.from(this.cache.values());
+  }
+  size() {
+    return this.cache.size;
+  }
+};
+
+// src/core-shared.ts
+import {
+  castArray as castArray4,
+  isArray as isArray7,
+  isBoolean as isBoolean4,
+  isEmpty as isEmpty2,
+  isEqual,
+  isFunction as isFunction4,
+  isPlainObject as isPlainObject6,
+  isString as isString6
+} from "@web-ts-toolkit/utils";
+
+// src/permission.ts
+var Permission = class {
+  constructor(permissions) {
+    this.$_permissions = permissions;
+    this.$_permissionKeys = Object.keys(permissions);
+    for (let x = 0; x < this.$_permissionKeys.length; x++) {
+      const key = this.$_permissionKeys[x];
+      Object.defineProperty(this, key, {
+        enumerable: true,
+        get: function() {
+          return this.has(key);
+        }
+      });
+    }
+  }
+  prop(permission) {
+    return this.$_permissions.hasOwnProperty(permission);
+  }
+  has(permission) {
+    return this.$_permissions[permission] || false;
+  }
+  hasAny(permissions) {
+    return permissions.some((permission) => {
+      return this.has(permission);
+    });
+  }
+  hasAll(permissions) {
+    return permissions.every((permission) => {
+      return this.has(permission);
+    });
+  }
+  any(permissions) {
+    return this.hasAny(permissions);
+  }
+  all(permissions) {
+    return this.hasAll(permissions);
+  }
+};
+var permission_default = Permission;
+
+// src/core-shared.ts
+function isAndFilter(filter2) {
+  return !!filter2 && isPlainObject6(filter2) && Object.keys(filter2).length === 1 && isArray7(filter2.$and);
+}
+function isMergeableClause(filter2) {
+  return !!filter2 && isPlainObject6(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+}
+function optimizeAndFilter(clausesInput) {
+  const clauses = [];
+  for (let x = 0; x < clausesInput.length; x++) {
+    const clause = normalizeFilter(clausesInput[x]);
+    if (clause === false) return false;
+    if (!clause) continue;
+    if (isAndFilter(clause)) {
+      clauses.push(...clause.$and);
+    } else {
+      clauses.push(clause);
+    }
+  }
+  const dedupedClauses = clauses.filter(
+    (clause, index) => clauses.findIndex((item) => isEqual(item, clause)) === index
+  );
+  const mergedClause = {};
+  const remainingClauses = [];
+  for (let x = 0; x < dedupedClauses.length; x++) {
+    const clause = dedupedClauses[x];
+    if (!isMergeableClause(clause)) {
+      remainingClauses.push(clause);
+      continue;
+    }
+    let canMerge = true;
+    for (const [key, value] of Object.entries(clause)) {
+      if (Object.prototype.hasOwnProperty.call(mergedClause, key) && !isEqual(mergedClause[key], value)) {
+        canMerge = false;
+        break;
+      }
+    }
+    if (!canMerge) {
+      remainingClauses.push(clause);
+      continue;
+    }
+    Object.assign(mergedClause, clause);
+  }
+  const finalClauses = isEmpty2(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  if (finalClauses.length === 0) return null;
+  if (finalClauses.length === 1) return finalClauses[0];
+  return { $and: finalClauses };
+}
+function normalizeFilter(filter2) {
+  if (filter2 === false) return false;
+  if (!filter2 || !isPlainObject6(filter2) || isEmpty2(filter2)) return null;
+  if (!isAndFilter(filter2)) {
+    return filter2;
+  }
+  return optimizeAndFilter(filter2.$and);
+}
+async function resolveIdentifierFilter(req, identifier, id) {
+  if (isString6(identifier)) {
+    return { [identifier]: id };
+  }
+  if (isFunction4(identifier)) {
+    return identifier.call(req, id);
+  }
+  return { _id: id };
+}
+async function resolveAccessFilter({
+  req,
+  permissions,
+  cache,
+  cacheKey,
+  access = "read",
+  filter: filter2 = null,
+  getOption
+}) {
+  let nextFilter = normalizeFilter(filter2);
+  const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
+  if (isFunction4(overrideFilterFn)) {
+    nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
+  }
+  const baseFilterFn = getOption(`baseFilter.${access}`, null);
+  if (!isFunction4(baseFilterFn)) return nextFilter || {};
+  const baseFilter = normalizeFilter(
+    cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
+  );
+  if (!cache.has(cacheKey)) {
+    cache.set(cacheKey, baseFilter);
+  }
+  if (baseFilter === false) return false;
+  if (!baseFilter) return nextFilter || {};
+  if (!nextFilter) return baseFilter;
+  return optimizeAndFilter([baseFilter, nextFilter]);
+}
+function getRequestPermissions(req) {
+  const requestPermissionField = getGlobalOption("requestPermissionField");
+  return new permission_default(req[requestPermissionField] || {});
+}
+async function setRequestPermissions(req) {
+  const requestPermissionField = getGlobalOption("requestPermissionField");
+  if (req[requestPermissionField]) return;
+  const globalPermissions = getGlobalOption("globalPermissions");
+  if (!isFunction4(globalPermissions)) return;
+  const permissions = await globalPermissions.call(req, req);
+  if (isPlainObject6(permissions)) req[requestPermissionField] = permissions;
+  else if (isArray7(permissions)) req[requestPermissionField] = arrToObj(permissions);
+  else if (isString6(permissions)) req[requestPermissionField] = { [permissions]: true };
+}
+async function evaluateRouteGuard(req, permissions, routeGuard) {
+  const phas = (key) => permissions.has(key);
+  const { stringHandler, arrayHandler } = createValidator(phas);
+  if (isBoolean4(routeGuard)) {
+    return routeGuard === true;
+  }
+  if (isString6(routeGuard)) {
+    return stringHandler(routeGuard);
+  }
+  if (isArray7(routeGuard)) {
+    return arrayHandler(routeGuard);
+  }
+  if (isFunction4(routeGuard)) {
+    return routeGuard.call(req, permissions);
+  }
+  return false;
+}
+async function callMiddlewareChain(req, middleware, doc, permissions, context) {
+  const middlewares = castArray4(middleware);
+  for (let x = 0; x < middlewares.length; x++) {
+    if (isFunction4(middlewares[x])) {
+      doc = await middlewares[x].call(req, doc, permissions, context);
+    }
+  }
+  return doc;
+}
+async function collectSchemaFields({
+  req,
+  permissionSchema,
+  access,
+  baseFields = [],
+  hasPermission,
+  functionArgs = []
+}) {
+  const fields = [...baseFields ?? []];
+  if (!permissionSchema) return fields;
+  const { stringHandler, arrayHandler } = createValidator(hasPermission);
+  const keys2 = Object.keys(permissionSchema);
+  for (let x = 0; x < keys2.length; x++) {
+    const key = keys2[x];
+    if (baseFields.includes(key)) continue;
+    const val = permissionSchema[key];
+    const value = val && val[access] || val;
+    if (isBoolean4(value)) {
+      if (value) fields.push(key);
+    } else if (isString6(value)) {
+      if (stringHandler(value)) fields.push(key);
+    } else if (isArray7(value)) {
+      if (arrayHandler(value)) fields.push(key);
+    } else if (isFunction4(value)) {
+      if (await value.call(req, ...functionArgs)) fields.push(key);
+    }
+  }
+  return fields;
+}
+
+// src/core.ts
+var Core = class {
+  constructor(req) {
+    this.req = req;
+    this.caches = {
+      baseFilter: new Cache()
+    };
+  }
+  getIdentifier(modelName) {
+    const identifier = getModelOption(modelName, "identifier");
+    if (isFunction5(identifier)) {
+      return null;
+    }
+    if (isString7(identifier)) {
+      return identifier;
+    }
+    return "_id";
+  }
+  async genIDFilter(modelName, id) {
+    const identifier = getModelOption(modelName, "identifier");
+    return resolveIdentifierFilter(this.req, identifier, id);
+  }
+  async genFilter(modelName, access = "read", _filter = null) {
+    const permissions = this.getGlobalPermissions();
+    const cacheKey = `${modelName}_baseFilter_${access}`;
+    return resolveAccessFilter({
+      req: this.req,
+      permissions,
+      cache: this.caches.baseFilter,
+      cacheKey,
+      access,
+      filter: _filter,
+      getOption: (key, defaultValue) => getModelOption(modelName, key, defaultValue)
+    });
+  }
+  removePrefix(str, prefix) {
+    if (!prefix) return str;
+    if (str.startsWith(prefix)) {
+      return str.substring(prefix.length);
+    }
+    return str;
+  }
+  async genAllowedFields(modelName, doc, access, baseFields = []) {
+    const permissionSchema = getModelOption(modelName, "permissionSchema");
+    const modelPermissionPrefix = getModelOption(modelName, "modelPermissionPrefix", "");
+    const permissions = this.getGlobalPermissions();
+    const docPermissions = getDocPermissions(modelName, doc);
+    return collectSchemaFields({
+      req: this.req,
+      permissionSchema,
+      access,
+      baseFields,
+      hasPermission: (key) => permissions.has(key) || docPermissions[this.removePrefix(key, modelPermissionPrefix)],
+      functionArgs: [permissions, docPermissions]
+    });
+  }
+  async pickAllowedFields(modelName, doc, access, baseFields = []) {
+    const allowed = await this.genAllowedFields(modelName, doc, access, baseFields);
+    return pickDocFields(doc, allowed);
+  }
+  async genSelect(modelName, access, targetFields = null, skipChecks = true, subPaths = []) {
+    let normalizedSelect = normalizeSelect(targetFields);
+    const permissionSchema = getModelOption(modelName, ["permissionSchema"].concat(subPaths).join("."));
+    if (!permissionSchema) return [];
+    const permissions = this.getGlobalPermissions();
+    let fields = await collectSchemaFields({
+      req: this.req,
+      permissionSchema,
+      access,
+      hasPermission: (key) => {
+        if (permissions.prop(key)) {
+          return permissions.has(key);
+        }
+        return !!skipChecks;
+      },
+      functionArgs: [permissions]
+    });
+    if (normalizedSelect.length > 0) {
+      const excludeid = normalizedSelect.includes("-_id");
+      const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
+      if (excludeall) {
+        normalizedSelect = normalizedSelect.map((v) => v.substring(1));
+        fields = difference(fields, normalizedSelect);
+        if (excludeid) fields.push("-_id");
+      } else {
+        fields = intersection(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+      }
+    }
+    const mandatoryFields = subPaths.length > 0 ? [] : getModelOption(modelName, `mandatoryFields.${access}`, []);
+    return fields.concat(mandatoryFields);
+  }
+  async genPopulate(modelName, access = "read", _populate = null) {
+    if (!_populate) return [];
+    let populate = Array.isArray(_populate) ? _populate : [_populate];
+    populate = compact3(
+      await Promise.all(
+        populate.map(async (p) => {
+          const populateAccess = !isString7(p) && p.access ? p.access : access;
+          const ret = isString7(p) ? { path: p } : {
+            path: p.path,
+            select: normalizeSelect(p.select)
+          };
+          const allowedParentPaths = await this.genSelect(modelName, populateAccess, [ret.path], false);
+          if (!allowedParentPaths.includes(ret.path)) return null;
+          const refModelName = getModelRef(modelName, ret.path);
+          if (!refModelName) return null;
+          ret.select = await this.genSelect(refModelName, populateAccess, ret.select, false);
+          const filter2 = await this.genFilter(refModelName, populateAccess, null);
+          if (filter2 === false) return null;
+          ret.match = filter2;
+          return ret;
+        })
+      )
+    );
+    return populate;
+  }
+  async validate(modelName, allowedData, access, context) {
+    const validate = getModelOption(modelName, `validate.${access}`, null);
+    if (isFunction5(validate)) {
+      const permissions = this.getGlobalPermissions();
+      return validate.call(this.req, allowedData, permissions, context);
+    } else if (isBoolean5(validate) || isArray8(validate)) {
+      return validate;
+    } else {
+      return true;
+    }
+  }
+  async prepare(modelName, allowedData, access, context) {
+    const prepare = getModelOption(modelName, `prepare.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, prepare, allowedData, permissions, context);
+  }
+  async transform(modelName, doc, access, context) {
+    const transform = getModelOption(modelName, `transform.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, transform, doc, permissions, context);
+  }
+  async finalize(modelName, doc, access, context) {
+    const finalize = getModelOption(modelName, `finalize.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, finalize, doc, permissions, context);
+  }
+  async changes(modelName, doc, context) {
+    const changeOptions = getModelOption(modelName, `change`, {});
+    for (let x = 0; x < context.modifiedPaths.length; x++) {
+      const mpath = context.modifiedPaths[x];
+      if (isFunction5(changeOptions[mpath])) {
+        await changeOptions[mpath].call(
+          this.req,
+          context.originalDocObject[mpath],
+          doc[mpath],
+          context.changes.filter((di) => di.path.length > 0 && di.path[0] === mpath),
+          context
+        );
+      }
+    }
+  }
+  async genDocPermissions(modelName, doc, access, context) {
+    const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
+    let docPermissions = {};
+    if (isFunction5(docPermissionsFn)) {
+      const permissions = this.getGlobalPermissions();
+      try {
+        docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
+      } catch (error) {
+        logger.warn(
+          `docPermissions hook failed for model=${modelName} access=${access}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    return docPermissions;
+  }
+  addEmptyPermissions(modelName, doc) {
+    const docPermissionField = getModelOption(modelName, "documentPermissionField");
+    setDocValue(doc, docPermissionField, { _view: { $: "_" }, _edit: { $: "_" } });
+    return doc;
+  }
+  async addDocPermissions(modelName, doc, access, context) {
+    const docPermissionField = getModelOption(modelName, "documentPermissionField");
+    const docPermissions = await this.genDocPermissions(modelName, doc, access, context);
+    setDocValue(doc, docPermissionField, docPermissions);
+    return doc;
+  }
+  async addFieldPermissions(modelName, doc, access, context) {
+    const docPermissionField = getModelOption(modelName, "documentPermissionField");
+    const docId = String(doc._id);
+    let readExists = true;
+    let updateExists = true;
+    if (access !== "read") {
+      if (context.fieldPermissionAccess?.readIds) {
+        readExists = context.fieldPermissionAccess.readIds.has(docId);
+      } else {
+        const existsResult = await this.req.macl.getService(modelName).exists({ _id: doc._id }, { access: "read" });
+        readExists = existsResult.success ? !!existsResult.data : false;
+      }
+    }
+    if (access !== "update") {
+      if (context.fieldPermissionAccess?.updateIds) {
+        updateExists = context.fieldPermissionAccess.updateIds.has(docId);
+      } else {
+        const existsResult = await this.req.macl.getService(modelName).exists({ _id: doc._id }, { access: "update" });
+        updateExists = existsResult.success ? !!existsResult.data : false;
+      }
+    }
+    const [views, edits] = await Promise.all([
+      readExists ? this.genAllowedFields(modelName, doc, "read") : [],
+      updateExists ? this.genAllowedFields(modelName, doc, "update") : []
+    ]);
+    const viewObj = reduce2(
+      views,
+      (ret, view) => {
+        ret[view] = true;
+        return ret;
+      },
+      {}
+    );
+    const editObj = reduce2(
+      edits,
+      (ret, view) => {
+        ret[view] = true;
+        return ret;
+      },
+      {}
+    );
+    setDocValue(doc, `${docPermissionField}._view`, viewObj);
+    setDocValue(doc, `${docPermissionField}._edit`, editObj);
+    return doc;
+  }
+  async decorate(modelName, doc, access, context) {
+    const decorate = getModelOption(modelName, `decorate.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    context.docPermissions = getDocPermissions(modelName, doc);
+    return callMiddlewareChain(this.req, decorate, doc, permissions, context);
+  }
+  async decorateAll(modelName, docs, access, context) {
+    const decorateAll = getModelOption(modelName, `decorateAll.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, decorateAll, docs, permissions, context);
+  }
+  runTasks(modelName, docObject, task) {
+    const tasks = compact3(castArray5(task));
+    if (tasks.length === 0) return docObject;
+    forEach6(tasks, (task2) => {
+      const { type, args, options } = task2;
+      switch (type) {
+        case "COPY_AND_DEPOPULATE":
+          docObject = copyAndDepopulate(
+            docObject,
+            args,
+            options
+          );
+          break;
+      }
+    });
+    return docObject;
+  }
+  getPermissions() {
+    return getRequestPermissions(this.req);
+  }
+  async setPermissions() {
+    await setRequestPermissions(this.req);
+  }
+  async canActivate(routeGuard) {
+    const permissions = this.getGlobalPermissions();
+    return evaluateRouteGuard(this.req, permissions, routeGuard);
+  }
+  async isAllowed(modelName, access) {
+    if (access.startsWith("subs")) {
+      const keys2 = access.split(".");
+      if (keys2.length < 3) {
+        return false;
+      }
+      const [, field, op] = keys2;
+      const subOption = getExactModelOption(modelName, `routeGuard.${access}`);
+      if (isUndefined(subOption)) {
+        const subFieldOption = getExactModelOption(modelName, `routeGuard.subs.${field}`);
+        if (isUndefined(subFieldOption)) {
+          const opOption = getModelOption(modelName, `routeGuard.${op}`);
+          return this.canActivate(opOption);
+        }
+        return this.canActivate(subFieldOption);
+      }
+      return this.canActivate(subOption);
+    }
+    const routeGuard = getModelOption(modelName, `routeGuard.${access}`);
+    return this.canActivate(routeGuard);
+  }
+  getService(modelName) {
+    return new Service(this.req, modelName);
+  }
+  getPublicService(modelName) {
+    return new PublicService(this.req, modelName);
+  }
+  service(modelName) {
+    return this.getPublicService(modelName);
+  }
+  svc(modelName) {
+    return this.getPublicService(modelName);
+  }
+  getGlobalPermissions() {
+    return this.req[PERMISSIONS];
+  }
+};
+async function setCore(req, res, next) {
+  if (req[MIDDLEWARE]) return next();
+  const core = new Core(req);
+  await core.setPermissions();
+  req.macl = core;
+  req[PERMISSIONS] = core.getPermissions();
+  req[PERMISSION_KEYS] = req[PERMISSIONS].$_permissionKeys;
+  req[MIDDLEWARE] = true;
+  next();
+}
+
+// src/middleware.ts
+function macl() {
+  return async function(req, res, next) {
+    await setCore(req, res, next);
+  };
+}
+function guard(condition) {
+  return async (req, _res, next) => {
+    const permissions = req[PERMISSIONS];
+    let cond = condition;
+    let phas = (key) => permissions.has(key);
+    if (isPlainObject7(condition)) {
+      const { modelName, id, condition: _cond } = condition;
+      const svc = req.macl.getPublicService(modelName);
+      const select = getModelOption(modelName, `mandatoryFields.read`, void 0);
+      let _id = isString8(id) ? id : null;
+      if (isPlainObject7(id)) {
+        const { type = "param", key } = id;
+        if (type === "param") {
+          const paramValue = req.params[key];
+          _id = isArray9(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+        } else if (type === "query") {
+          const _qval = req.query[key];
+          if (isArray9(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          else _id = _qval;
+        } else {
+          _id = null;
+        }
+      }
+      if (!isString8(_id) || !_id) {
+        return next(new JsonRouter2.clientErrors.BadRequestError());
+      }
+      const result = await svc._read(_id, { select });
+      if (!result.success) {
+        return next(new JsonRouter2.clientErrors.UnauthorizedError());
+      }
+      const docPermissions = getDocPermissions(modelName, result.data);
+      phas = (key) => permissions.has(key) || docPermissions[key];
+      cond = _cond;
+    }
+    const { stringHandler, arrayHandler } = createValidator(phas);
+    if (isString8(cond)) {
+      if (stringHandler(cond)) return next();
+    } else if (isArray9(cond)) {
+      if (arrayHandler(cond)) return next();
+    } else if (isFunction6(cond)) {
+      const result = await cond.call(req, permissions);
+      if (!!result) return next();
+    }
+    next(new JsonRouter2.clientErrors.UnauthorizedError());
+  };
+}
+
+// src/routers/model-router.ts
+import JsonRouter4 from "@web-ts-toolkit/express-json-router";
+import { forEach as forEach7, isPlainObject as isPlainObject8, isString as isString9, isUndefined as isUndefined2, padEnd } from "@web-ts-toolkit/utils";
+
+// src/routers/shared.ts
+var parseBooleanString = (str, defaultValue) => str ? str === "true" : defaultValue;
+var formatListResponse = (req, result, includeCount, includeExtraHeaders) => {
+  const { data, count: returnedCount, totalCount } = result;
+  const query = result.query ?? {};
+  const rawLimit = Number(query.limit ?? 0);
+  const skip = Number(query.skip ?? 0);
+  const limit = rawLimit > 0 ? rawLimit : returnedCount;
+  const pageSize = limit;
+  const page = rawLimit > 0 ? Math.floor(skip / limit) + 1 : 1;
+  const hasPreviousPage = skip > 0;
+  const meta = {
+    returnedCount,
+    skip,
+    limit,
+    page,
+    pageSize,
+    hasPreviousPage,
+    ...includeCount && totalCount != null ? {
+      totalCount,
+      totalPages: limit > 0 ? Math.ceil(totalCount / limit) : 1,
+      hasNextPage: skip + returnedCount < totalCount
+    } : {}
+  };
+  if (includeExtraHeaders) {
+    req.res.setHeader("wtt-returned-count" /* ReturnedCount */, returnedCount);
+    req.res.setHeader("wtt-page" /* Page */, page);
+    req.res.setHeader("wtt-page-size" /* PageSize */, pageSize);
+    req.res.setHeader("wtt-has-previous-page" /* HasPreviousPage */, String(hasPreviousPage));
+    if (includeCount && totalCount != null) {
+      req.res.setHeader("wtt-total-count" /* TotalCount */, totalCount);
+      req.res.setHeader("wtt-total-pages" /* TotalPages */, meta.totalPages);
+      req.res.setHeader("wtt-has-next-page" /* HasNextPage */, String(meta.hasNextPage));
+    }
+  }
+  return { data, meta };
+};
+var formatCreatedData = (result) => {
+  return result.count === 1 ? result.data[0] : result.data;
+};
+var formatUpsertCreatedData = (result) => {
+  return result.data.length > 0 ? result.data[0] : null;
+};
+
+// src/routers/validation.ts
+import JsonRouter3 from "@web-ts-toolkit/express-json-router";
+import { z } from "zod";
+var clientErrors = JsonRouter3.clientErrors;
+var stringOrStringArray = z.union([z.string(), z.array(z.string())]);
+var queryBooleanString = z.enum(["true", "false"]);
+var positiveIntegerString = z.string().regex(/^\d+$/, "Expected a non-negative integer");
+var unknownRecord = z.record(z.string(), z.unknown());
+var projectionObjectSchema = z.record(z.string(), z.union([z.literal(1), z.literal(-1)]));
+var projectionSchema = z.union([z.string(), z.array(z.string()), projectionObjectSchema]);
+var sortOrderSchema = z.union([
+  z.literal(-1),
+  z.literal(1),
+  z.literal("asc"),
+  z.literal("ascending"),
+  z.literal("desc"),
+  z.literal("descending")
+]);
+var sortSchema = z.union([
+  z.string(),
+  z.record(z.string(), sortOrderSchema),
+  z.array(z.tuple([z.string(), sortOrderSchema])),
+  z.null()
+]);
+var populateSchema = z.union([
+  z.string(),
+  z.array(
+    z.union([
+      z.string(),
+      z.object({
+        path: z.string().min(1),
+        select: projectionSchema.optional(),
+        match: z.unknown().optional(),
+        access: z.enum(["list", "read"]).optional()
+      }).passthrough()
+    ])
+  ),
+  z.object({
+    path: z.string().min(1),
+    select: projectionSchema.optional(),
+    match: z.unknown().optional(),
+    access: z.enum(["list", "read"]).optional()
+  }).passthrough()
+]);
+var subPopulateSchema = z.union([
+  z.string(),
+  z.array(
+    z.union([
+      z.string(),
+      z.object({
+        path: z.string().min(1),
+        select: projectionSchema.optional()
+      }).passthrough()
+    ])
+  ),
+  z.object({
+    path: z.string().min(1),
+    select: projectionSchema.optional()
+  }).passthrough()
+]);
+var includeItemSchema = z.object({
+  model: z.string().min(1),
+  op: z.enum(["list", "read", "count"]),
+  path: z.string().min(1),
+  filter: z.record(z.string(), z.unknown()).optional(),
+  localField: z.string().min(1),
+  foreignField: z.string().min(1),
+  args: z.unknown().optional(),
+  options: z.unknown().optional()
+}).passthrough();
+var includeSchema = z.union([includeItemSchema, z.array(includeItemSchema)]);
+var fieldsSchema = z.array(z.string().min(1));
+var taskSchema = z.object({
+  type: z.string().min(1),
+  args: z.unknown(),
+  options: unknownRecord.optional()
+});
+var tasksSchema = z.union([taskSchema, z.array(taskSchema)]);
+var objectOrArraySchema = z.union([z.record(z.string(), z.unknown()), z.array(z.unknown())]);
+var listQuerySchema = z.object({
+  skip: positiveIntegerString.optional(),
+  limit: positiveIntegerString.optional(),
+  page: positiveIntegerString.optional(),
+  page_size: positiveIntegerString.optional(),
+  skim: queryBooleanString.optional(),
+  include_permissions: queryBooleanString.optional(),
+  include_count: queryBooleanString.optional(),
+  include_extra_headers: queryBooleanString.optional()
+}).passthrough();
+var createQuerySchema = z.object({
+  include_permissions: queryBooleanString.optional()
+}).passthrough();
+var readQuerySchema = z.object({
+  include_permissions: queryBooleanString.optional(),
+  try_list: queryBooleanString.optional()
+}).passthrough();
+var updateQuerySchema = z.object({
+  returning_all: queryBooleanString.optional()
+}).passthrough();
+var upsertQuerySchema = z.object({
+  returning_all: queryBooleanString.optional(),
+  include_permissions: queryBooleanString.optional()
+}).passthrough();
+var rootQueryEntrySchema = z.object({
+  model: z.string().min(1),
+  op: z.string().min(1),
+  id: z.string().min(1).optional(),
+  field: z.string().min(1).optional(),
+  filter: objectOrArraySchema.optional(),
+  data: z.unknown().optional(),
+  args: z.unknown().optional(),
+  options: z.unknown().optional(),
+  order: z.number().int().optional()
+}).passthrough();
+var rootQuerySchema = z.array(rootQueryEntrySchema);
+var listBodySchema = z.object({
+  query: objectOrArraySchema.optional(),
+  filter: objectOrArraySchema.optional(),
+  select: projectionSchema.optional(),
+  sort: sortSchema.optional(),
+  populate: populateSchema.optional(),
+  include: includeSchema.optional(),
+  tasks: tasksSchema.optional(),
+  skip: z.union([z.number(), positiveIntegerString]).optional(),
+  limit: z.union([z.number(), positiveIntegerString]).optional(),
+  page: z.union([z.number(), positiveIntegerString]).optional(),
+  pageSize: z.union([z.number(), positiveIntegerString]).optional(),
+  options: z.object({
+    skim: z.boolean().optional(),
+    includePermissions: z.boolean().optional(),
+    includeCount: z.boolean().optional(),
+    includeExtraHeaders: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var dataListBodySchema = z.object({
+  filter: objectOrArraySchema.optional(),
+  select: projectionSchema.optional(),
+  sort: sortSchema.optional(),
+  skip: z.union([z.number(), positiveIntegerString]).optional(),
+  limit: z.union([z.number(), positiveIntegerString]).optional(),
+  page: z.union([z.number(), positiveIntegerString]).optional(),
+  pageSize: z.union([z.number(), positiveIntegerString]).optional(),
+  options: z.object({
+    includeCount: z.boolean().optional(),
+    includeExtraHeaders: z.boolean().optional()
+  }).passthrough().optional()
+}).passthrough();
+var countBodySchema = z.object({
+  query: objectOrArraySchema.optional(),
+  filter: objectOrArraySchema.optional(),
+  access: z.unknown().optional()
+}).passthrough();
+var readFilterBodySchema = z.object({
+  filter: objectOrArraySchema.optional(),
+  select: projectionSchema.optional(),
+  sort: sortSchema.optional(),
+  populate: populateSchema.optional(),
+  include: includeSchema.optional(),
+  tasks: tasksSchema.optional(),
+  options: z.object({
+    skim: z.boolean().optional(),
+    includePermissions: z.boolean().optional(),
+    tryList: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var dataReadFilterBodySchema = z.object({
+  filter: objectOrArraySchema.optional(),
+  select: projectionSchema.optional(),
+  options: z.object({}).passthrough().optional()
+}).passthrough();
+var readByIdBodySchema = z.object({
+  select: projectionSchema.optional(),
+  populate: populateSchema.optional(),
+  include: includeSchema.optional(),
+  tasks: tasksSchema.optional(),
+  options: z.object({
+    skim: z.boolean().optional(),
+    includePermissions: z.boolean().optional(),
+    tryList: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var dataReadByIdBodySchema = z.object({
+  select: projectionSchema.optional(),
+  options: z.object({}).passthrough().optional()
+}).passthrough();
+var advancedCreateBodySchema = z.object({
+  data: z.unknown(),
+  select: projectionSchema.optional(),
+  populate: populateSchema.optional(),
+  tasks: tasksSchema.optional(),
+  options: z.object({
+    includePermissions: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var createBodySchema = z.union([
+  z.record(z.string(), z.unknown()),
+  z.array(z.record(z.string(), z.unknown()))
+]);
+var updateBodySchema = z.record(z.string(), z.unknown());
+var advancedUpdateBodySchema = z.object({
+  data: z.unknown(),
+  select: projectionSchema.optional(),
+  populate: populateSchema.optional(),
+  tasks: tasksSchema.optional(),
+  options: z.object({
+    returningAll: z.boolean().optional(),
+    includePermissions: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var upsertBodySchema = z.record(z.string(), z.unknown());
+var advancedUpsertBodySchema = z.object({
+  data: z.record(z.string(), z.unknown()),
+  select: projectionSchema.optional(),
+  populate: populateSchema.optional(),
+  tasks: tasksSchema.optional(),
+  options: z.object({
+    returningAll: z.boolean().optional(),
+    includePermissions: z.boolean().optional(),
+    populateAccess: z.unknown().optional()
+  }).passthrough().optional()
+}).passthrough();
+var distinctBodySchema = z.object({
+  query: objectOrArraySchema.optional(),
+  filter: objectOrArraySchema.optional()
+}).passthrough();
+var subListBodySchema = z.object({
+  filter: z.record(z.string(), z.unknown()).optional(),
+  fields: fieldsSchema.optional()
+}).passthrough();
+var subMutationBodySchema = z.union([
+  z.record(z.string(), z.unknown()),
+  z.array(z.record(z.string(), z.unknown()))
+]);
+var subReadBodySchema = z.object({
+  fields: fieldsSchema.optional(),
+  populate: subPopulateSchema.optional()
+}).passthrough();
+function parsePathParam(value, parameter) {
+  const result = stringOrStringArray.safeParse(value);
+  if (!result.success) {
+    throwValidationError(result.error.issues, parameter, "parameter");
+  }
+  const param = Array.isArray(result.data) ? result.data[0] : result.data;
+  if (!param) {
+    throw new clientErrors.BadRequestError("Bad Request", {
+      errors: [{ detail: "Required", parameter }]
+    });
+  }
+  return param;
+}
+function parseQuery(schema, value) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throwValidationError(result.error.issues, void 0, "parameter");
+  }
+  return result.data;
+}
+function parseBody(schema, value) {
+  const result = schema.safeParse(value ?? {});
+  if (!result.success) {
+    throwValidationError(result.error.issues, void 0, "pointer");
+  }
+  return result.data;
+}
+function parseBodyWithSchema(schema, value, userSchema) {
+  const body = parseBody(schema, value);
+  return isZodSchema(userSchema) ? parseUserSchema(userSchema, body) : body;
+}
+function parseNestedBodyWithSchema(schema, value, nestedKey, userSchema) {
+  const body = parseBody(schema, value);
+  if (!isZodSchema(userSchema)) return body;
+  return {
+    ...body,
+    [nestedKey]: parseUserSchema(userSchema, body?.[nestedKey], [nestedKey])
+  };
+}
+function throwValidationError(issues, key, location = "pointer") {
+  const errors = issues.map((issue) => formatIssue(issue, key, location));
+  throw new clientErrors.BadRequestError("Bad Request", { errors });
+}
+function parseUserSchema(schema, value, prefix = []) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    const issues = result.error.issues.map((issue) => ({
+      ...issue,
+      path: prefix.concat(issue.path.map(String))
+    }));
+    throwValidationError(issues, void 0, "pointer");
+  }
+  return result.data;
+}
+function isZodSchema(schema) {
+  return typeof schema === "object" && schema !== null && "safeParse" in schema && typeof schema.safeParse === "function";
+}
+function formatIssue(issue, key, location = "pointer") {
+  const path = issue.path.map(String);
+  const joinedPath = path.join(".");
+  if (location === "parameter") {
+    return {
+      detail: issue.message,
+      parameter: (key ?? joinedPath) || void 0
+    };
+  }
+  return {
+    detail: issue.message,
+    pointer: buildPointer(path)
+  };
+}
+function buildPointer(path) {
+  return path.length === 0 ? "#" : `#/${path.join("/")}`;
+}
+var requestSchemas = {
+  listQuery: listQuerySchema,
+  createQuery: createQuerySchema,
+  readQuery: readQuerySchema,
+  updateQuery: updateQuerySchema,
+  upsertQuery: upsertQuerySchema
+};
+
+// src/routers/model-router.ts
+var clientErrors2 = JsonRouter4.clientErrors;
+var success = JsonRouter4.success;
+function setOption(parentKey, optionKey, option) {
+  const key = isUndefined2(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = isUndefined2(option) ? optionKey : option;
+  setModelOption(this.modelName, key, value);
+  return this;
+}
+var ModelRouter = class {
+  constructor(modelName, initialOptions) {
+    /**
+     * The maximum limit of the number of documents returned from the `list` operation.
+     */
+    this.listHardLimit = setOption.bind(this, "listHardLimit");
+    /**
+     * The object schema to define the access control policy for each model field.
+     */
+    this.permissionSchema = setOption.bind(this, "permissionSchema");
+    /**
+     * The object field to store the document permissions.
+     */
+    this.documentPermissionField = setOption.bind(this, "documentPermissionField");
+    /**
+     * The essential model fields involved in generating document permissions.
+     */
+    this.mandatoryFields = setOption.bind(this, "mandatoryFields");
+    /**
+     * The function called in the process of generating document permissions.
+     */
+    this.docPermissions = setOption.bind(this, "docPermissions");
+    /**
+     * The access control policy for CRUDL endpoints.
+     * @operation `create`, `list`, `read`, `update`, `delete`
+     */
+    this.routeGuard = setOption.bind(this, "routeGuard");
+    /**
+     * The base filter definitions applied in every query transaction.
+     * @operation `list`, `read`, `update`, `delete`
+     */
+    this.baseFilter = setOption.bind(this, "baseFilter");
+    /**
+     * The override filter definitions applied in every query transaction.
+     * @operation `list`, `read`, `update`, `delete`
+     */
+    this.overrideFilter = setOption.bind(this, "overrideFilter");
+    /**
+     * Middleware
+     *
+     * The function called before a new/update document data is processed in `prepare` hooks. This method is used to validate `write data` and throw an error if not valid.
+     * @operation `create`, `update`
+     */
+    this.validate = setOption.bind(this, "validate");
+    /**
+     * Middleware
+     *
+     * The function called before a new document is created or an existing document is updated. This method is used to process raw data passed into the API endpoints.
+     * @operation `create`, `update`
+     */
+    this.prepare = setOption.bind(this, "prepare");
+    /**
+     * Middleware
+     *
+     * The function called before an updated document is saved.
+     * @operation `update`
+     */
+    this.transform = setOption.bind(this, "transform");
+    /**
+     * Middleware
+     *
+     * The function called after a new document is created or an updated document is saved.
+     * @operation `create`, `update`
+     */
+    this.finalize = setOption.bind(this, "finalize");
+    /**
+     * Middleware
+     *
+     * The function called after a updated document finalized
+     * @operation `update`
+     */
+    this.change = setOption.bind(this, "change");
+    /**
+     * Middleware
+     *
+     * The function called before response data is sent. This method is used to process raw data to apply custom logic before sending the result.
+     * @operation `list`, `read`, `create`, `update`
+     */
+    this.decorate = setOption.bind(this, "decorate");
+    /**
+     * Middleware
+     *
+     * The function are called before response data is sent and after `decorate` middleware runs. This method is used to process and filter multiple document objects before sending the result.
+     * @operation `list`
+     */
+    this.decorateAll = setOption.bind(this, "decorateAll");
+    /**
+     * The document selector definition with the `id` param.
+     * @option `string` | `Function`
+     * @operation `read`, `update`, `delete`
+     */
+    this.identifier = setOption.bind(this, "identifier");
+    /**
+     * The default values used when missing in the operations.
+     */
+    this.defaults = setOption.bind(this, "defaults");
+    setModelOptions(modelName, initialOptions);
+    this.options = getModelOptions(modelName);
+    this.fullBasePath = processUrl(this.options.parentPath + this.options.basePath);
+    this.modelName = modelName;
+    this.router = new JsonRouter4(this.options.basePath, setCore, accessRouterResponseHandler);
+    this.model = new model_default(modelName);
+    this.setCollectionRoutes();
+    this.setDocumentRoutes();
+    this.setSubDocumentRoutes();
+    this.logEndpoints();
+  }
+  getRequestSchema(key) {
+    return getExactModelOption(this.modelName, key);
+  }
+  async assertAllowed(req, access) {
+    const allowed = await req.macl.isAllowed(this.modelName, access);
+    if (!allowed) throw new clientErrors2.UnauthorizedError();
+  }
+  ///////////////////////
+  // Collection Routes //
+  ///////////////////////
+  setCollectionRoutes() {
+    this.router.get("", async (req) => {
+      await this.assertAllowed(req, "list");
+      const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
+      const svc = req.macl.getPublicService(this.modelName);
+      const includeCount = parseBooleanString(include_count);
+      const includeExtraHeaders = parseBooleanString(include_extra_headers);
+      const result = await svc._list(
+        {},
+        { skip, limit, page, pageSize: page_size },
+        {
+          skim: parseBooleanString(skim),
+          includePermissions: parseBooleanString(include_permissions),
+          includeCount
+        }
+      );
+      handleResultError(result);
+      return formatListResponse(req, result, includeCount, includeExtraHeaders);
+    });
+    this.router.post(`/${this.options.queryPath}`, async (req) => {
+      await this.assertAllowed(req, "list");
+      const body = parseBodyWithSchema(
+        listBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.advancedList")
+      );
+      let { query, filter: filter2, select, sort, populate, include, tasks, skip, limit, page, pageSize } = body;
+      const options = body.options ?? {};
+      const { skim, includePermissions, includeCount, includeExtraHeaders, populateAccess } = options;
+      const svc = req.macl.getPublicService(this.modelName);
+      const listFilter = filter2 ?? query ?? {};
+      const result = await svc._list(
+        listFilter,
+        { select, sort, populate, include, tasks, skip, limit, page, pageSize },
+        {
+          skim,
+          includePermissions,
+          includeCount,
+          populateAccess
+        }
+      );
+      handleResultError(result);
+      return formatListResponse(req, result, includeCount, includeExtraHeaders);
+    });
+    this.router.post("", async (req, res) => {
+      await this.assertAllowed(req, "create");
+      const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+      const data = parseBodyWithSchema(createBodySchema, req.body, this.getRequestSchema("requestSchemas.create"));
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._create(data, {}, { includePermissions: parseBooleanString(include_permissions) });
+      handleResultError(result);
+      return new success.Created(formatCreatedData(result));
+    });
+    this.router.post(`/${this.options.mutationPath}`, async (req, res) => {
+      await this.assertAllowed(req, "create");
+      const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+      const body = parseNestedBodyWithSchema(
+        advancedCreateBodySchema,
+        req.body,
+        "data",
+        this.getRequestSchema("requestSchemas.advancedCreate.data")
+      );
+      const { data, select, populate, tasks } = body;
+      const options = body.options ?? {};
+      parseBodyWithSchema(
+        advancedCreateBodySchema,
+        { data, select, populate, tasks, options },
+        this.getRequestSchema("requestSchemas.advancedCreate.default") ?? this.getRequestSchema("requestSchemas.advancedCreate")
+      );
+      const { includePermissions, populateAccess } = options;
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._create(
+        data,
+        { select, populate, tasks },
+        {
+          includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+          populateAccess
+        }
+      );
+      handleResultError(result);
+      return new success.Created(formatCreatedData(result));
+    });
+    this.router.get("/new", async (req) => {
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._new();
+      handleResultError(result);
+      return result.data;
+    });
+  }
+  /////////////////////
+  // Document Routes //
+  /////////////////////
+  setDocumentRoutes() {
+    this.router.get("/count", async (req) => {
+      await this.assertAllowed(req, "count");
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._count({});
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post("/count", async (req) => {
+      await this.assertAllowed(req, "count");
+      const { query, filter: filter2, access } = parseBodyWithSchema(
+        countBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.count")
+      );
+      const svc = req.macl.getPublicService(this.modelName);
+      const countFilter = filter2 ?? query ?? {};
+      const result = await svc._count(countFilter, access);
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.get(`/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "read");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const { include_permissions, try_list } = parseQuery(requestSchemas.readQuery, req.query);
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._read(
+        id,
+        {},
+        {
+          includePermissions: parseBooleanString(include_permissions),
+          tryList: parseBooleanString(try_list)
+        }
+      );
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post(`/${this.options.queryPath}/__filter`, async (req) => {
+      await this.assertAllowed(req, "read");
+      const body = parseBodyWithSchema(
+        readFilterBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.advancedReadFilter")
+      );
+      let { filter: filter2, select, sort, populate, include, tasks } = body;
+      const options = body.options ?? {};
+      const { skim, includePermissions, tryList, populateAccess } = options;
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._readFilter(
+        filter2 ?? {},
+        {
+          select,
+          sort,
+          populate,
+          include,
+          tasks
+        },
+        { skim, includePermissions, tryList, populateAccess }
+      );
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post(`/${this.options.queryPath}/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "read");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const body = parseBodyWithSchema(
+        readByIdBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.advancedRead")
+      );
+      let { select, populate, include, tasks } = body;
+      const options = body.options ?? {};
+      const { skim, includePermissions, tryList, populateAccess } = options;
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._read(
+        id,
+        {
+          select,
+          populate,
+          include,
+          tasks
+        },
+        { skim, includePermissions, tryList, populateAccess }
+      );
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.patch(`/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "update");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const { returning_all } = parseQuery(requestSchemas.updateQuery, req.query);
+      const data = parseBodyWithSchema(updateBodySchema, req.body, this.getRequestSchema("requestSchemas.update"));
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._update(id, data, {}, { returningAll: parseBooleanString(returning_all) });
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.patch(`/${this.options.mutationPath}/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "update");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const { returning_all } = parseQuery(requestSchemas.updateQuery, req.query);
+      const body = parseNestedBodyWithSchema(
+        advancedUpdateBodySchema,
+        req.body,
+        "data",
+        this.getRequestSchema("requestSchemas.advancedUpdate.data")
+      );
+      const { data, select, populate, tasks } = body;
+      const options = body.options ?? {};
+      parseBodyWithSchema(
+        advancedUpdateBodySchema,
+        { data, select, populate, tasks, options },
+        this.getRequestSchema("requestSchemas.advancedUpdate.default") ?? this.getRequestSchema("requestSchemas.advancedUpdate")
+      );
+      const { returningAll, includePermissions, populateAccess } = options;
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._update(
+        id,
+        data,
+        { select, populate, tasks },
+        {
+          returningAll: returningAll ?? parseBooleanString(returning_all),
+          includePermissions,
+          populateAccess
+        }
+      );
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.put(`/`, async (req) => {
+      await this.assertAllowed(req, "upsert");
+      const svc = req.macl.getPublicService(this.modelName);
+      const idKey = svc.getIdentifier();
+      if (idKey !== "_id") throw new clientErrors2.BadRequestError("not supported identifier");
+      const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+      const body = parseBodyWithSchema(upsertBodySchema, req.body, this.getRequestSchema("requestSchemas.upsert"));
+      const { [idKey]: idVal, ...data } = body;
+      const upsertId = idVal;
+      if (upsertId) {
+        const existing = await svc.exists({ [idKey]: upsertId }, { access: "update" });
+        handleResultError(existing);
+        if (!existing.data) throw new clientErrors2.UnauthorizedError();
+        const result = await svc._update(upsertId, data, {}, { returningAll: parseBooleanString(returning_all) });
+        handleResultError(result);
+        return result.data;
+      } else {
+        const result = await svc._create(data, {}, { includePermissions: parseBooleanString(include_permissions) });
+        handleResultError(result);
+        return new success.Created(formatUpsertCreatedData(result));
+      }
+    });
+    this.router.put(`/${this.options.mutationPath}`, async (req) => {
+      await this.assertAllowed(req, "upsert");
+      const svc = req.macl.getPublicService(this.modelName);
+      const idKey = svc.getIdentifier();
+      if (idKey !== "_id") throw new clientErrors2.BadRequestError("not supported identifier");
+      const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+      const body = parseNestedBodyWithSchema(
+        advancedUpsertBodySchema,
+        req.body,
+        "data",
+        this.getRequestSchema("requestSchemas.advancedUpsert.data")
+      );
+      const { data, select, populate, tasks } = body;
+      const options = body.options ?? {};
+      parseBodyWithSchema(
+        advancedUpsertBodySchema,
+        { data, select, populate, tasks, options },
+        this.getRequestSchema("requestSchemas.advancedUpsert.default") ?? this.getRequestSchema("requestSchemas.advancedUpsert")
+      );
+      const { returningAll, includePermissions, populateAccess } = options;
+      const { [idKey]: idVal, ...otherData } = data;
+      const upsertId = idVal;
+      if (upsertId) {
+        const existing = await svc.exists({ [idKey]: upsertId }, { access: "update" });
+        handleResultError(existing);
+        if (!existing.data) throw new clientErrors2.UnauthorizedError();
+        const result = await svc._update(
+          upsertId,
+          otherData,
+          { select, populate, tasks },
+          {
+            returningAll: returningAll ?? parseBooleanString(returning_all),
+            includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+            populateAccess
+          }
+        );
+        handleResultError(result);
+        return result.data;
+      } else {
+        const result = await svc._create(
+          otherData,
+          { select, populate, tasks },
+          {
+            includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+            populateAccess
+          }
+        );
+        handleResultError(result);
+        return new success.Created(formatUpsertCreatedData(result));
+      }
+    });
+    this.router.delete(`/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "delete");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._delete(id);
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.get("/distinct/:field", async (req) => {
+      await this.assertAllowed(req, "distinct");
+      const field = parsePathParam(req.params.field, "field");
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._distinct(field);
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post("/distinct/:field", async (req) => {
+      await this.assertAllowed(req, "distinct");
+      const field = parsePathParam(req.params.field, "field");
+      const { query, filter: filter2 } = parseBodyWithSchema(
+        distinctBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.distinct")
+      );
+      const svc = req.macl.getPublicService(this.modelName);
+      const result = await svc._distinct(field, { filter: filter2 ?? query ?? {} });
+      handleResultError(result);
+      return result.data;
+    });
+  }
+  /////////////////////////
+  // Sub-Document Routes //
+  /////////////////////////
+  setSubDocumentRoutes() {
+    const subs = getModelSub(this.modelName);
+    for (let x = 0; x < subs.length; x++) {
+      const sub = subs[x];
+      this.router.get(`/:${this.options.idParam}/${sub}`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.list`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.listSub(id, sub);
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.post(`/:${this.options.idParam}/${sub}/${this.options.queryPath}`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.list`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const body = parseBodyWithSchema(
+          subListBodySchema,
+          req.body,
+          this.getRequestSchema("requestSchemas.subList")
+        );
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.listSub(id, sub, { filter: body.filter ?? {}, fields: body.fields ?? [] });
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.patch(`/:${this.options.idParam}/${sub}`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.update`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const data = parseBodyWithSchema(
+          subMutationBodySchema,
+          req.body,
+          this.getRequestSchema("requestSchemas.subBulkUpdate")
+        );
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.bulkUpdateSub(id, sub, data);
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.get(`/:${this.options.idParam}/${sub}/:subId`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.read`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const subId = parsePathParam(req.params.subId, "subId");
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.readSub(id, sub, subId);
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.post(`/:${this.options.idParam}/${sub}/:subId/${this.options.queryPath}`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.read`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const subId = parsePathParam(req.params.subId, "subId");
+        const body = parseBodyWithSchema(
+          subReadBodySchema,
+          req.body,
+          this.getRequestSchema("requestSchemas.subRead")
+        );
+        const populate = body.populate;
+        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => isString9(item) ? { path: item } : item) : isString9(populate) ? { path: populate } : populate ?? [];
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.readSub(id, sub, subId, { fields: body.fields ?? [], populate: normalizedPopulate });
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.patch(`/:${this.options.idParam}/${sub}/:subId`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.update`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const subId = parsePathParam(req.params.subId, "subId");
+        const data = parseBodyWithSchema(
+          subMutationBodySchema,
+          req.body,
+          this.getRequestSchema("requestSchemas.subUpdate")
+        );
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.updateSub(id, sub, subId, data);
+        handleResultError(result);
+        return result.data;
+      });
+      this.router.post(`/:${this.options.idParam}/${sub}`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.create`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const data = parseBodyWithSchema(
+          subMutationBodySchema,
+          req.body,
+          this.getRequestSchema("requestSchemas.subCreate")
+        );
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.createSub(id, sub, data);
+        handleResultError(result);
+        return new success.Created(result.data);
+      });
+      this.router.delete(`/:${this.options.idParam}/${sub}/:subId`, async (req) => {
+        await this.assertAllowed(req, `subs.${sub}.delete`);
+        const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+        const subId = parsePathParam(req.params.subId, "subId");
+        const svc = req.macl.getPublicService(this.modelName);
+        const result = await svc.deleteSub(id, sub, subId);
+        handleResultError(result);
+        return result.data;
+      });
+    }
+  }
+  logEndpoints() {
+    forEach7(this.router.endpoints, ({ method, path }) => {
+      logger.info(`${padEnd(method, 6)} ${processUrl(this.options.parentPath + path)}`);
+    });
+  }
+  set(keyOrOptions, value) {
+    if (arguments.length === 2 && isString9(keyOrOptions)) {
+      setModelOption(this.modelName, keyOrOptions, value);
+    }
+    if (arguments.length === 1 && isPlainObject8(keyOrOptions)) {
+      setModelOptions(this.modelName, keyOrOptions);
+    }
+    return this;
+  }
+  setOption(key, option) {
+    setModelOption(this.modelName, key, option);
+    return this;
+  }
+  setOptions(options) {
+    setModelOptions(this.modelName, options);
+    return this;
+  }
+  get routes() {
+    return this.router.original;
+  }
+};
+
+// src/routers/root-router.ts
+import JsonRouter5 from "@web-ts-toolkit/express-json-router";
+import { isNumber as _isNumber, orderBy as _orderBy } from "@web-ts-toolkit/utils";
+var clientErrors3 = JsonRouter5.clientErrors;
+var ALL_ROUTES = ["new", "list", "read", "update", "delete", "create", "distinct", "count"];
+var RootRouter = class {
+  constructor(options = { basePath: "", routeGuard: true }) {
+    const { basePath, routeGuard } = options;
+    this.basename = basePath || "";
+    this.routeGuard = routeGuard;
+    this.router = new JsonRouter5(this.basename, setCore, accessRouterResponseHandler);
+    this.setRoutes();
+  }
+  processResult(op, result) {
+    const message = mapCodeToMessage(result.code);
+    const statusCode = mapCodeToStatusCode(result.code);
+    if (!result.success) {
+      const { success: success3, code: code2, errors } = result;
+      return { success: success3, code: code2, errors, message, statusCode, op };
+    }
+    if (result.kind === "list") {
+      const { success: success3, code: code2, data: data2, count, totalCount } = result;
+      return { success: success3, code: code2, data: data2, count, totalCount, message, statusCode, op };
+    }
+    const { success: success2, code, data } = result;
+    return { success: success2, code, data, message, statusCode, op };
+  }
+  async processOp(req, item) {
+    const svc = req.macl.getPublicService(item.model);
+    if (!svc) return { success: false, code: "bad_request" /* BadRequest */, data: null, message: `Model ${item.model} not found` };
+    if (!ALL_ROUTES.includes(item.op))
+      return { success: false, code: "bad_request" /* BadRequest */, data: null, message: `Operation ${item.op} not found` };
+    const routeGuard = getModelOption(item.model, `routeGuard.${item.op}`);
+    const allowed = await req.macl.canActivate(routeGuard);
+    if (!allowed) return { success: false, code: "unauthorized" /* Unauthorized */, data: null, message: "Unauthorized" };
+    if (item.op === "list") {
+      return this.processResult(item.op, await svc._list(item.filter, item.args, item.options));
+    } else if (item.op === "create") {
+      return this.processResult(item.op, await svc._create(item.data, item.args));
+    } else if (item.op === "new") {
+      return this.processResult(item.op, await svc._new());
+    } else if (item.op === "read") {
+      if (item.id) {
+        return this.processResult(item.op, await svc._read(item.id, item.args, item.options));
+      }
+      if (item.filter) {
+        return this.processResult(item.op, await svc._readFilter(item.filter, item.args, item.options));
+      }
+      return { success: false, code: "bad_request" /* BadRequest */, data: null, message: `Operation ${item.op} invalid` };
+    } else if (item.op === "update") {
+      return this.processResult(item.op, await svc._update(item.id, item.data, item.args, item.options));
+    } else if (item.op === "delete") {
+      return this.processResult(item.op, await svc._delete(item.id));
+    } else if (item.op === "distinct") {
+      return this.processResult(item.op, await svc._distinct(item.field, { filter: item.filter }));
+    } else if (item.op === "count") {
+      return this.processResult(item.op, await svc._count(item.filter));
+    } else {
+      return { success: false, code: "bad_request" /* BadRequest */, data: null, message: `operation ${item.op} not found` };
+    }
+  }
+  groupItemsByOrder(items) {
+    return items.reduce((acc, item, index) => {
+      let order = 0;
+      if (_isNumber(item.order)) {
+        order = item.order < 0 ? 0 : item.order;
+      }
+      if (!acc[order]) {
+        acc[order] = [];
+      }
+      acc[order].push({ index, item });
+      return acc;
+    }, []);
+  }
+  async assertAllowed(req) {
+    const allowed = await req.macl.canActivate(this.routeGuard);
+    if (!allowed) throw new clientErrors3.UnauthorizedError();
+  }
+  setRoutes() {
+    this.router.post("", async (req) => {
+      await this.assertAllowed(req);
+      const items = parseBody(rootQuerySchema, req.body).map((item) => ({
+        ...item,
+        filter: item.filter ?? {}
+      }));
+      const groupedItems = this.groupItemsByOrder(items);
+      const results = [];
+      for (let x = 0; x < groupedItems.length; x++) {
+        const arrResult = await Promise.all(
+          groupedItems[x].map(async ({ item, index }) => {
+            const ret = await this.processOp(req, item);
+            return { ret, index };
+          })
+        );
+        results.push(...arrResult);
+      }
+      return _orderBy(results, ["index"], ["asc"]).map(({ ret }) => ret);
+    });
+  }
+  get routes() {
+    return this.router.original;
+  }
+};
+
+// src/routers/data-router.ts
+import JsonRouter6 from "@web-ts-toolkit/express-json-router";
+import { isPlainObject as isPlainObject9, isString as isString10, isUndefined as isUndefined3 } from "@web-ts-toolkit/utils";
+
+// src/core-data.ts
+import { intersection as intersection2 } from "@web-ts-toolkit/utils";
+var DataCore = class {
+  constructor(req) {
+    this.req = req;
+    this.caches = {
+      baseFilter: new Cache()
+    };
+  }
+  async genIDFilter(dataName, id) {
+    const identifier = getDataOption(dataName, "identifier");
+    return resolveIdentifierFilter(this.req, identifier, id);
+  }
+  async genFilter(dataName, access = "read", _filter = null) {
+    const permissions = this.getGlobalPermissions();
+    const cacheKey = `${dataName}_baseFilter_${access}`;
+    return resolveAccessFilter({
+      req: this.req,
+      permissions,
+      cache: this.caches.baseFilter,
+      cacheKey,
+      access,
+      filter: _filter,
+      getOption: (key, defaultValue) => getDataOption(dataName, key, defaultValue)
+    });
+  }
+  async genAllowedFields(dataName, _doc, access, baseFields = []) {
+    const permissionSchema = getDataOption(dataName, "permissionSchema");
+    const permissions = this.getGlobalPermissions();
+    return collectSchemaFields({
+      req: this.req,
+      permissionSchema,
+      access,
+      baseFields,
+      hasPermission: (key) => permissions.has(key),
+      functionArgs: [permissions]
+    });
+  }
+  async pickAllowedFields(dataName, doc, access, baseFields = []) {
+    const allowed = await this.genAllowedFields(dataName, doc, access, baseFields);
+    return pickDocFields(doc, allowed);
+  }
+  async genSelect(dataName, access, targetFields = null, skipChecks = true, subPaths = []) {
+    let normalizedSelect = normalizeSelect(targetFields);
+    const permissionSchema = getDataOption(dataName, ["permissionSchema"].concat(subPaths).join("."));
+    if (!permissionSchema) return [];
+    const permissions = this.getGlobalPermissions();
+    let fields = await collectSchemaFields({
+      req: this.req,
+      permissionSchema,
+      access,
+      hasPermission: (key) => {
+        if (permissions.prop(key)) {
+          return permissions.has(key);
+        }
+        return !!skipChecks;
+      },
+      functionArgs: [permissions]
+    });
+    fields = intersection2(normalizedSelect, fields);
+    return fields;
+  }
+  async decorate(dataName, doc, access, context = {}) {
+    const decorate = getDataOption(dataName, `decorate.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, decorate, doc, permissions, context);
+  }
+  async decorateAll(dataName, docs, access) {
+    const decorateAll = getDataOption(dataName, `decorateAll.${access}`, null);
+    const permissions = this.getGlobalPermissions();
+    return callMiddlewareChain(this.req, decorateAll, docs, permissions, {});
+  }
+  getPermissions() {
+    return getRequestPermissions(this.req);
+  }
+  async setPermissions() {
+    await setRequestPermissions(this.req);
+  }
+  async canActivate(routeGuard) {
+    const permissions = this.getGlobalPermissions();
+    return evaluateRouteGuard(this.req, permissions, routeGuard);
+  }
+  async isAllowed(dataName, access) {
+    const routeGuard = getDataOption(dataName, `routeGuard.${access}`);
+    return this.canActivate(routeGuard);
+  }
+  getService(dataName) {
+    return new DataService(this.req, dataName);
+  }
+  service(dataName) {
+    return this.getService(dataName);
+  }
+  svc(dataName) {
+    return this.getService(dataName);
+  }
+  getGlobalPermissions() {
+    return this.req[PERMISSIONS];
+  }
+};
+async function setDataCore(req, _res, next) {
+  if (req[DATA_MIDDLEWARE]) return next();
+  const core = new DataCore(req);
+  await core.setPermissions();
+  req.dacl = core;
+  req[PERMISSIONS] = core.getPermissions();
+  req[PERMISSION_KEYS] = req[PERMISSIONS].$_permissionKeys;
+  req[DATA_MIDDLEWARE] = true;
+  next();
+}
+
+// src/routers/data-router.ts
+var clientErrors4 = JsonRouter6.clientErrors;
+function setOption2(parentKey, optionKey, option) {
+  const key = isUndefined3(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = isUndefined3(option) ? optionKey : option;
+  setDataOption(this.dataName, key, value);
+  return this;
+}
+var DataRouter = class {
+  constructor(dataName, initialOptions) {
+    this.data = setOption2.bind(this, "data");
+    this.listHardLimit = setOption2.bind(this, "listHardLimit");
+    this.permissionSchema = setOption2.bind(this, "permissionSchema");
+    this.routeGuard = setOption2.bind(this, "routeGuard");
+    this.baseFilter = setOption2.bind(this, "baseFilter");
+    this.overrideFilter = setOption2.bind(this, "overrideFilter");
+    this.decorate = setOption2.bind(this, "decorate");
+    this.decorateAll = setOption2.bind(this, "decorateAll");
+    this.identifier = setOption2.bind(this, "identifier");
+    setDataOptions(dataName, initialOptions);
+    this.options = getDataOptions(dataName);
+    this.fullBasePath = processUrl(this.options.parentPath + this.options.basePath);
+    this.dataName = dataName;
+    this.router = new JsonRouter6(this.options.basePath, setDataCore, accessRouterResponseHandler);
+    this.setCollectionRoutes();
+    this.setDocumentRoutes();
+  }
+  getRequestSchema(key) {
+    return getExactDataOption(this.dataName, key);
+  }
+  async assertAllowed(req, access) {
+    const allowed = await req.dacl.isAllowed(this.dataName, access);
+    if (!allowed) throw new clientErrors4.UnauthorizedError();
+  }
+  ///////////////////////
+  // Collection Routes //
+  ///////////////////////
+  setCollectionRoutes() {
+    this.router.get("", async (req) => {
+      await this.assertAllowed(req, "list");
+      const { skip, limit, page, page_size, include_count, include_extra_headers } = parseQuery(
+        requestSchemas.listQuery,
+        req.query
+      );
+      const svc = req.dacl.getService(this.dataName);
+      const includeCount = parseBooleanString(include_count);
+      const includeExtraHeaders = parseBooleanString(include_extra_headers);
+      const result = await svc.find(
+        {},
+        { skip, limit, page, pageSize: page_size },
+        {
+          includeCount
+        }
+      );
+      handleResultError(result);
+      return formatListResponse(req, result, includeCount, includeExtraHeaders);
+    });
+    this.router.post(`/${this.options.queryPath}`, async (req) => {
+      await this.assertAllowed(req, "list");
+      let {
+        filter: filter2,
+        select,
+        sort,
+        skip,
+        limit,
+        page,
+        pageSize,
+        options = {}
+      } = parseBodyWithSchema(dataListBodySchema, req.body, this.getRequestSchema("requestSchemas.advancedList"));
+      const { includeCount, includeExtraHeaders } = options;
+      const svc = req.dacl.getService(this.dataName);
+      const result = await svc.find(
+        filter2 ?? {},
+        { select, sort: typeof sort === "string" ? sort : void 0, skip, limit, page, pageSize },
+        { includeCount }
+      );
+      handleResultError(result);
+      return formatListResponse(req, result, includeCount, includeExtraHeaders);
+    });
+  }
+  /////////////////////
+  // Document Routes //
+  /////////////////////
+  setDocumentRoutes() {
+    this.router.get(`/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "read");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      const svc = req.dacl.getService(this.dataName);
+      const result = await svc.findById(id, {}, {});
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post(`/${this.options.queryPath}/__filter`, async (req) => {
+      await this.assertAllowed(req, "read");
+      let { filter: filter2, select } = parseBodyWithSchema(
+        dataReadFilterBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.advancedReadFilter")
+      );
+      const svc = req.dacl.getService(this.dataName);
+      const result = await svc.findOne(filter2 ?? {}, { select }, {});
+      handleResultError(result);
+      return result.data;
+    });
+    this.router.post(`/${this.options.queryPath}/:${this.options.idParam}`, async (req) => {
+      await this.assertAllowed(req, "read");
+      const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
+      let { select } = parseBodyWithSchema(
+        dataReadByIdBodySchema,
+        req.body,
+        this.getRequestSchema("requestSchemas.advancedRead")
+      );
+      const svc = req.dacl.getService(this.dataName);
+      const result = await svc.findById(id, { select }, {});
+      handleResultError(result);
+      return result.data;
+    });
+  }
+  set(keyOrOptions, value) {
+    if (arguments.length === 2 && isString10(keyOrOptions)) {
+      setDataOption(this.dataName, keyOrOptions, value);
+    }
+    if (arguments.length === 1 && isPlainObject9(keyOrOptions)) {
+      setDataOptions(this.dataName, keyOrOptions);
+    }
+    return this;
+  }
+  setOption(key, option) {
+    setDataOption(this.dataName, key, option);
+    return this;
+  }
+  setOptions(options) {
+    setDataOptions(this.dataName, options);
+    return this;
+  }
+  get routes() {
+    return this.router.original;
+  }
+};
+
+// src/routers/index.ts
+import JsonRouter7 from "@web-ts-toolkit/express-json-router";
+var accessRouterResponseHandler = JsonRouter7.createHandler({
+  errorFormat: JsonRouter7.ErrorFormats.rfc9457,
+  rfc9457ContentType: "application/problem+json"
+});
+accessRouterResponseHandler.errorMessageProvider = function(error) {
+  const errorLike = error;
+  console.error(error);
+  return errorLike.message || errorLike._message || String(error);
+};
+
+// src/plugins.ts
+function permissionsPlugin(schema, options) {
+  if (!options?.modelName) return;
+  schema.virtual(options?.virtualPermissionField || "permissions").get(function() {
+    const docPermissionField = getModelOption(options.modelName, "documentPermissionField");
+    return this._doc[docPermissionField];
+  });
+}
+
+// src/index.ts
+var wtt = macl;
+wtt.createRouter = function(modelName, options) {
+  return isUndefined4(options) ? new RootRouter(modelName) : new ModelRouter(modelName, options);
+};
+wtt.createDataRouter = function(dataName, options) {
+  return new DataRouter(dataName, options);
+};
+wtt.set = function(keyOrOptions, value) {
+  if (arguments.length === 2 && isString11(keyOrOptions)) {
+    return setGlobalOption(keyOrOptions, value);
+  }
+  if (arguments.length === 1 && isPlainObject10(keyOrOptions)) {
+    return setGlobalOptions(keyOrOptions);
+  }
+};
+wtt.setGlobalOptions = setGlobalOptions;
+wtt.setGlobalOption = setGlobalOption;
+wtt.getGlobalOptions = getGlobalOptions;
+wtt.getGlobalOption = getGlobalOption;
+wtt.setModelOptions = setModelOptions;
+wtt.setModelOption = setModelOption;
+wtt.getModelOptions = getModelOptions;
+wtt.getModelOption = getModelOption;
+wtt.setDefaultModelOptions = setDefaultModelOptions;
+wtt.setDefaultModelOption = setDefaultModelOption;
+wtt.getDefaultModelOptions = getDefaultModelOptions;
+wtt.getDefaultModelOption = getDefaultModelOption;
+wtt.RootRouter = RootRouter;
+wtt.ModelRouter = ModelRouter;
+wtt.DataRouter = DataRouter;
+var index_default = wtt;
+export {
+  CORE,
+  Codes,
+  CustomHeaders,
+  DATA_MIDDLEWARE,
+  FilterOperator,
+  MIDDLEWARE,
+  ModelRouter,
+  PERMISSIONS,
+  PERMISSION_KEYS,
+  RootRouter,
+  StatusCodes,
+  advancedCreateBodySchema,
+  advancedUpdateBodySchema,
+  advancedUpsertBodySchema,
+  countBodySchema,
+  createBodySchema,
+  dataListBodySchema,
+  dataReadByIdBodySchema,
+  dataReadFilterBodySchema,
+  index_default as default,
+  distinctBodySchema,
+  getDefaultModelOption,
+  getDefaultModelOptions,
+  getGlobalOption,
+  getGlobalOptions,
+  getModelJsonSchema,
+  getModelNames,
+  getModelOption,
+  getModelOptions,
+  guard,
+  listBodySchema,
+  parseBody,
+  parseBodyWithSchema,
+  parseNestedBodyWithSchema,
+  parsePathParam,
+  parseQuery,
+  permissionsPlugin,
+  readByIdBodySchema,
+  readFilterBodySchema,
+  requestSchemas,
+  rootQuerySchema,
+  setDefaultModelOption,
+  setDefaultModelOptions,
+  setGlobalOption,
+  setGlobalOptions,
+  setModelOption,
+  setModelOptions,
+  subListBodySchema,
+  subMutationBodySchema,
+  subReadBodySchema,
+  updateBodySchema,
+  upsertBodySchema
+};