@web-ts-toolkit/access-router 0.31.5 → 0.33.0

package/index.js

@@ -32,12 +32,15 @@ __export(index_exports, {
   AccessRuntime: () => AccessRuntime,
   DataRouter: () => DataRouter,
   ModelRouter: () => ModelRouter,
+  OpenApiCollisionError: () => OpenApiCollisionError,
+  OpenApiRegistry: () => OpenApiRegistry,
   RootRouter: () => RootRouter,
   acl: () => acl,
   combineRoutes: () => combineRoutes,
   createAccessRuntime: () => createAccessRuntime,
   createOpenApiRouter: () => createOpenApiRouter,
   default: () => index_default,
+  defaultRuntime: () => defaultRuntime,
   defineRequestSchema: () => defineRequestSchema,
   fromAjv: () => fromAjv,
   fromArkType: () => fromArkType,
@@ -53,12 +56,19 @@ __export(index_exports, {
   getDefaultModelOptions: () => getDefaultModelOptions,
   getGlobalOption: () => getGlobalOption,
   getGlobalOptions: () => getGlobalOptions,
+  getModelInstance: () => getModelInstance,
   getModelJsonSchema: () => getModelJsonSchema,
   getModelNames: () => getModelNames,
   getModelOption: () => getModelOption,
   getModelOptions: () => getModelOptions,
   guard: () => guard,
+  hasModelInstance: () => hasModelInstance,
+  isLevelEnabled: () => isLevelEnabled,
   permissionsPlugin: () => permissionsPlugin,
+  redactFilter: () => redactFilter,
+  redactPayload: () => redactPayload,
+  registerModelInstance: () => registerModelInstance,
+  safeStringify: () => safeStringify,
   setDefaultModelOption: () => setDefaultModelOption,
   setDefaultModelOptions: () => setDefaultModelOptions,
   setGlobalOption: () => setGlobalOption,
@@ -71,15 +81,15 @@ var import_utils28 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router2 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils21 = require("@web-ts-toolkit/utils");
+var import_utils22 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
-var import_utils20 = require("@web-ts-toolkit/utils");
+var import_utils21 = require("@web-ts-toolkit/utils");
 
 // src/runtime.ts
 var import_mongoose3 = __toESM(require("mongoose"));
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-var import_utils10 = require("@web-ts-toolkit/utils");
+var import_utils11 = require("@web-ts-toolkit/utils");
 
 // src/helpers/collection.ts
 var import_sift = __toESM(require("sift"));
@@ -100,6 +110,12 @@ var import_utils3 = require("@web-ts-toolkit/utils");
 
 // src/helpers/query.ts
 var import_utils2 = require("@web-ts-toolkit/utils");
+var normalizeSafeInteger = (value, min) => {
+  if ((0, import_utils2.isNil)(value)) return null;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < min) return null;
+  return parsed;
+};
 function genPagination({
   skip,
   limit,
@@ -107,13 +123,21 @@ function genPagination({
   pageSize
 }, hardLimit) {
   let _skip = 0;
-  let _limit = Number(limit ?? pageSize);
-  if ((0, import_utils2.isNaN)(_limit) || _limit > hardLimit) _limit = hardLimit;
-  if (!(0, import_utils2.isNil)(skip)) {
-    _skip = Number(skip);
-  } else if (!(0, import_utils2.isNil)(page)) {
-    const npage = Number(page);
-    if (npage > 1) _skip = (npage - 1) * _limit;
+  let _limit = normalizeSafeInteger(limit ?? pageSize, 1) ?? hardLimit;
+  if (!Number.isSafeInteger(_limit) || _limit > hardLimit) _limit = hardLimit;
+  const normalizedSkip = normalizeSafeInteger(skip, 0);
+  const normalizedPage = normalizeSafeInteger(page, 0);
+  if (normalizedSkip !== null) {
+    _skip = normalizedSkip;
+  } else if (normalizedPage !== null) {
+    const npage = normalizedPage;
+    if (npage > 1) {
+      const derivedSkip = (npage - 1) * _limit;
+      _skip = Number.isSafeInteger(derivedSkip) ? derivedSkip : Number.MAX_SAFE_INTEGER;
+    }
+  }
+  if (!Number.isSafeInteger(_skip) || _skip < 0) {
+    return { skip: 0, limit: _limit };
   }
   return { skip: _skip, limit: _limit };
 }
@@ -182,6 +206,7 @@ async function populateDoc(doc, target) {
   if ((0, import_utils4.isPromise)(p)) return p;
   return "execPopulate" in p && p.execPopulate?.();
 }
+var normalizeSubPopulate = (populate) => (0, import_utils4.isArray)(populate) ? populate.map((item) => (0, import_utils4.isString)(item) ? { path: item } : item) : (0, import_utils4.isString)(populate) ? { path: populate } : populate ?? [];
 var genSubPopulate = (sub, popul) => {
   if (!popul) return [];
   let populate = (0, import_utils4.isArray)(popul) ? popul : [popul];
@@ -197,7 +222,7 @@ var genSubPopulate = (sub, popul) => {
 
 // src/helpers/errors.ts
 var import_express_json_router = __toESM(require("@web-ts-toolkit/express-json-router"));
-var { BadRequestError, ForbiddenError, NotFoundError, UnprocessableEntityError } = import_express_json_router.default.clientErrors;
+var { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError, UnprocessableEntityError } = import_express_json_router.default.clientErrors;
 function mapCodeToMessage(code) {
   switch (code) {
     case "success" /* Success */:
@@ -206,6 +231,8 @@ function mapCodeToMessage(code) {
       return "Created";
     case "bad_request" /* BadRequest */:
       return "Bad Request";
+    case "unauthorized" /* Unauthorized */:
+      return "Unauthorized";
     case "forbidden" /* Forbidden */:
       return "Forbidden";
     case "not_found" /* NotFound */:
@@ -222,6 +249,8 @@ function mapCodeToStatusCode(code) {
       return 201 /* Created */;
     case "bad_request" /* BadRequest */:
       return 400 /* BadRequest */;
+    case "unauthorized" /* Unauthorized */:
+      return 401 /* Unauthorized */;
     case "forbidden" /* Forbidden */:
       return 403 /* Forbidden */;
     case "not_found" /* NotFound */:
@@ -232,11 +261,14 @@ function mapCodeToStatusCode(code) {
 }
 function handleResultError(result) {
   if (result.success) return;
+  if (result.kind !== "error") return;
   const { code, errors = [] } = result;
   const errorOptions = { errors };
   switch (code) {
     case "bad_request" /* BadRequest */:
       throw new BadRequestError("Bad Request", errorOptions);
+    case "unauthorized" /* Unauthorized */:
+      throw new UnauthorizedError("Unauthorized", errorOptions);
     case "forbidden" /* Forbidden */:
       throw new ForbiddenError("Forbidden", errorOptions);
     case "not_found" /* NotFound */:
@@ -563,22 +595,102 @@ function buildOpenApiSpec(routes, options) {
   };
 }
 
+// src/openapi/errors.ts
+var OpenApiCollisionError = class extends Error {
+  constructor(message, details) {
+    super(message);
+    this.name = "OpenApiCollisionError";
+    this.collisionKind = details.collisionKind;
+    this.method = details.method;
+    this.path = details.path;
+    this.operationId = details.operationId;
+    this.existing = details.existing;
+    this.incoming = details.incoming;
+  }
+};
+
 // src/openapi/registry.ts
+var isPlainObject7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var stableKey = (value) => {
+  if (value === null || typeof value === "undefined") return "null";
+  if (typeof value === "function") return "[Function]";
+  if (typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableKey).join(",")}]`;
+  }
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableKey(obj[k])}`).join(",")}}`;
+};
+var descriptorsEqual = (a, b) => {
+  return a.method === b.method && a.path === b.path && (a.operationId ?? "") === (b.operationId ?? "") && (a.acl ?? "") === (b.acl ?? "") && stableKey(a.query) === stableKey(b.query) && stableKey(a.body) === stableKey(b.body) && stableKey(a.pathParams) === stableKey(b.pathParams) && stableKey(a.responses) === stableKey(b.responses) && stableKey(a.tags) === stableKey(b.tags) && (a.summary ?? "") === (b.summary ?? "") && (a.description ?? "") === (b.description ?? "") && Boolean(a.deprecated) === Boolean(b.deprecated);
+};
 var OpenApiRegistry = class {
-  constructor() {
+  constructor(options = {}) {
     this.routes = [];
+    this.options = {
+      rejectConflicts: options.rejectConflicts ?? true,
+      rejectDuplicateOperationIds: options.rejectDuplicateOperationIds ?? true
+    };
   }
   register(route) {
     const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
     if (existingIndex === -1) {
+      this.assertOperationIdAvailable(route);
       this.routes.push(route);
       return;
     }
+    const existing = this.routes[existingIndex];
+    if (route.allowReplace) {
+      this.assertOperationIdAvailable(route, existing);
+      this.routes[existingIndex] = route;
+      return;
+    }
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject7(existing) && existing.idempotent)) {
+      return;
+    }
+    if (this.options.rejectConflicts) {
+      throw new OpenApiCollisionError(
+        `OpenAPI route collision: ${route.method.toUpperCase()} ${route.path} is already registered` + (existing.operationId ? ` as operationId="${existing.operationId}"` : "") + (route.operationId ? `; new registration uses operationId="${route.operationId}"` : "") + ". Set allowReplace:true on the new descriptor to override, or fix the duplicate registration.",
+        {
+          collisionKind: "path",
+          method: route.method,
+          path: route.path,
+          existing,
+          incoming: route
+        }
+      );
+    }
     this.routes[existingIndex] = route;
   }
+  assertOperationIdAvailable(route, replacing) {
+    if (!this.options.rejectDuplicateOperationIds) return;
+    if (!route.operationId) return;
+    const clash = this.routes.find(
+      (item) => item.operationId && item.operationId === route.operationId && item !== replacing
+    );
+    if (clash) {
+      if (route.idempotent && clash.idempotent) return;
+      throw new OpenApiCollisionError(
+        `OpenAPI operationId collision: "${route.operationId}" is already bound to ${clash.method.toUpperCase()} ${clash.path}. Each operationId must be unique across the spec.`,
+        {
+          collisionKind: "operationId",
+          operationId: route.operationId,
+          existing: clash,
+          incoming: route
+        }
+      );
+    }
+  }
   getRoutes() {
     return [...this.routes];
   }
+  clear() {
+    this.routes.length = 0;
+  }
+  setStrictMode(enabled) {
+    this.options.rejectConflicts = enabled;
+    this.options.rejectDuplicateOperationIds = enabled;
+  }
   getSpec(info) {
     return buildOpenApiSpec(this.routes, info);
   }
@@ -600,8 +712,8 @@ var defaultLogger = (0, import_winston.createLogger)({
     import_winston.format.label({ label: "[WTT]" }),
     import_winston.format.timestamp(),
     import_winston.format.printf(({ level, label, message, timestamp, stack, ...meta }) => {
-      const formattedLabel = colorizer.colorize(level, label);
-      const formattedLevel = colorizer.colorize(level, `[${level.toUpperCase()}]`);
+      const formattedLabel = colorizer.colorize(level, String(label));
+      const formattedLevel = colorizer.colorize(level, `[${String(level).toUpperCase()}]`);
       const formattedMessage = colorizer.colorize(level, inspectValue(stack ?? message));
       const formattedMeta = Object.keys(meta).length > 0 ? ` ${inspectValue(meta)}` : "";
       return `${formattedLabel} ${timestamp} ${formattedLevel} ${formattedMessage}${formattedMeta}`;
@@ -636,8 +748,8 @@ var OptionsManager = class {
     this.currentOptions = new Proxy({}, {
       set(target, key, value) {
         const keystr = String(key);
-        const oldvalue = target[key];
-        target[key] = value;
+        const oldvalue = target[keystr];
+        target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
       }
@@ -665,8 +777,116 @@ var OptionsManager = class {
   }
 };
 
+// src/request-complexity.ts
+var import_utils10 = require("@web-ts-toolkit/utils");
+var defaultRequestComplexity = {
+  maxDepth: 8,
+  maxNodes: 500,
+  maxLogicalClauses: 50,
+  maxInValues: 100,
+  maxBulkItems: 100,
+  maxIncludeCount: 10,
+  maxSubQueryCount: 10,
+  maxBulkConcurrency: 10
+};
+var normalizePositiveInteger = (value, fallback) => {
+  return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+};
+var resolveRequestComplexity = (options) => ({
+  maxDepth: normalizePositiveInteger(options?.maxDepth, defaultRequestComplexity.maxDepth),
+  maxNodes: normalizePositiveInteger(options?.maxNodes, defaultRequestComplexity.maxNodes),
+  maxLogicalClauses: normalizePositiveInteger(options?.maxLogicalClauses, defaultRequestComplexity.maxLogicalClauses),
+  maxInValues: normalizePositiveInteger(options?.maxInValues, defaultRequestComplexity.maxInValues),
+  maxBulkItems: normalizePositiveInteger(options?.maxBulkItems, defaultRequestComplexity.maxBulkItems),
+  maxIncludeCount: normalizePositiveInteger(options?.maxIncludeCount, defaultRequestComplexity.maxIncludeCount),
+  maxSubQueryCount: normalizePositiveInteger(options?.maxSubQueryCount, defaultRequestComplexity.maxSubQueryCount),
+  maxBulkConcurrency: normalizePositiveInteger(
+    options?.maxBulkConcurrency,
+    defaultRequestComplexity.maxBulkConcurrency
+  )
+});
+function validateRequestComplexity(value, options, scope = "request") {
+  const limits = resolveRequestComplexity(options);
+  const errors = [];
+  let nodes = 0;
+  let logicalClauses = 0;
+  let includeCount = 0;
+  let subQueryCount = 0;
+  const pointer = (path) => path.length === 0 ? "#" : `#/${path.join("/")}`;
+  const pushError = (detail, path) => {
+    if (errors.length === 0) {
+      errors.push({ detail, pointer: pointer(path) });
+    }
+  };
+  const visit = (current, path, depth, parentKey) => {
+    if (errors.length > 0) return;
+    nodes += 1;
+    if (nodes > limits.maxNodes) {
+      pushError(`Request exceeds maximum node budget of ${limits.maxNodes}`, path);
+      return;
+    }
+    if (depth > limits.maxDepth) {
+      pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
+      return;
+    }
+    if ((0, import_utils10.isArray)(current)) {
+      if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
+        logicalClauses += current.length;
+        if (logicalClauses > limits.maxLogicalClauses) {
+          pushError(`Filter exceeds maximum logical clause budget of ${limits.maxLogicalClauses}`, path);
+          return;
+        }
+      }
+      if (parentKey === "$in") {
+        if (current.length > limits.maxInValues) {
+          pushError(`Filter exceeds maximum $in values of ${limits.maxInValues}`, path);
+          return;
+        }
+      }
+      for (let index = 0; index < current.length; index++) {
+        visit(current[index], path.concat(index), depth + 1, parentKey);
+        if (errors.length > 0) return;
+      }
+      return;
+    }
+    if (!(0, import_utils10.isPlainObject)(current)) return;
+    for (const [key, child] of Object.entries(current)) {
+      if (key === "__proto__" || key === "prototype" || key === "constructor") {
+        pushError(`Unsupported key: ${key}`, path.concat(key));
+        return;
+      }
+      if (scope === "request" && key === "include") {
+        includeCount += (0, import_utils10.isArray)(child) ? child.length : 1;
+        if (includeCount > limits.maxIncludeCount) {
+          pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
+          return;
+        }
+      }
+      if (key === "$$sq") {
+        subQueryCount += 1;
+        if (subQueryCount > limits.maxSubQueryCount) {
+          pushError(`Request exceeds maximum subquery count of ${limits.maxSubQueryCount}`, path.concat(key));
+          return;
+        }
+        visit(child, path.concat(key), depth + 1, key);
+        if (errors.length > 0) return;
+        continue;
+      }
+      visit(child, path.concat(key), depth + 1, key);
+      if (errors.length > 0) return;
+    }
+  };
+  visit(value, [], 0);
+  return errors;
+}
+
 // src/runtime.ts
-(0, import_mongoose_schema_jsonschema.default)(import_mongoose3.default);
+var mongooseJsonSchemaInitialized = false;
+var ensureMongooseJsonSchemaInitialized = () => {
+  if (mongooseJsonSchemaInitialized) return;
+  (0, import_mongoose_schema_jsonschema.default)(import_mongoose3.default);
+  mongooseJsonSchemaInitialized = true;
+};
 var pluralize = import_mongoose3.default.pluralize();
 var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
 var defaultModelOptions = {
@@ -675,47 +895,48 @@ var defaultModelOptions = {
 };
 var defaultDataOptions = {
   basePath: null,
+  parentPath: "/",
   queryRouteSegment: "__query"
 };
 var normalizeBasePath = (name, value) => {
-  if ((0, import_utils10.isNil)(value)) {
+  if ((0, import_utils11.isNil)(value)) {
     return `/${pluralize(name)}`;
   }
-  return (0, import_utils10.isString)(value) ? (0, import_utils10.addLeadingSlash)(value) : "";
+  return (0, import_utils11.isString)(value) ? (0, import_utils11.addLeadingSlash)(value) : "";
 };
 var hasModelPermission = (value, modelPermissionPrefix) => {
   if (!modelPermissionPrefix) {
     return true;
   }
-  if ((0, import_utils10.isString)(value)) {
+  if ((0, import_utils11.isString)(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if ((0, import_utils10.isArray)(value)) {
+  if ((0, import_utils11.isArray)(value)) {
     return value.some((item) => {
-      if ((0, import_utils10.isString)(item) || (0, import_utils10.isArray)(item)) {
+      if ((0, import_utils11.isString)(item) || (0, import_utils11.isArray)(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
     });
   }
-  return (0, import_utils10.isFunction)(value);
+  return (0, import_utils11.isFunction)(value);
 };
 var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const schemaKeys = Object.keys(permissionSchema);
   const globalPermissionKeys = {};
   const modelPermissionKeys = {};
-  (0, import_utils10.forEach)(schemaKeys, (schemaKey) => {
+  (0, import_utils11.forEach)(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = (0, import_utils10.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = (0, import_utils11.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!(0, import_utils10.isArray)(globalPermissionKeys[accessKey])) {
+      if (!(0, import_utils11.isArray)(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!(0, import_utils10.isArray)(modelPermissionKeys[accessKey])) {
+      if (!(0, import_utils11.isArray)(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
-      if ((0, import_utils10.isBoolean)(value)) {
+      if ((0, import_utils11.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
         return;
       }
@@ -737,7 +958,8 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
-      logger: defaultLogger
+      logger: defaultLogger,
+      requestComplexity: defaultRequestComplexity
     }).build();
     this.defaultModelOptions = new OptionsManager({
       listHardLimit: 1e3,
@@ -756,14 +978,50 @@ var AccessRuntime = class {
     this.modelRefs = {};
     this.modelSubs = {};
     this.modelAtts = {};
+    this.modelInstances = {};
     this.openApiRegistry = new OpenApiRegistry();
+    ensureMongooseJsonSchemaInitialized();
+  }
+  registerModelInstance(modelName, model) {
+    if (!modelName || typeof modelName !== "string") {
+      throw new TypeError(`registerModelInstance: modelName must be a non-empty string, received ${typeof modelName}`);
+    }
+    const existing = this.modelInstances[modelName];
+    if (existing && existing !== model) {
+      throw new Error(
+        `Runtime model registry conflict: model "${modelName}" is already registered to a different mongoose.Model instance on this runtime. Use a distinct model name or a separate runtime.`
+      );
+    }
+    this.modelInstances[modelName] = model;
+  }
+  hasModelInstance(modelName) {
+    return modelName in this.modelInstances;
+  }
+  getModelInstance(modelName) {
+    const registered = this.modelInstances[modelName];
+    if (registered) return registered;
+    const global = import_mongoose3.default.models[modelName];
+    return global ?? null;
   }
   registerOpenApiRoute(route) {
     this.openApiRegistry.register(route);
   }
+  /**
+   * Enable strict OpenAPI collision detection for the remainder of this
+   * runtime's lifetime. After this call, conflicting method/path
+   * registrations and duplicate operationIds throw {@link OpenApiCollisionError}
+   * instead of silently replacing. Existing already-registered routes are
+   * not retroactively re-validated.
+   */
+  enableOpenApiCollisionDetection() {
+    this.openApiRegistry.setStrictMode(true);
+  }
   getOpenApiRoutes() {
     return this.openApiRegistry.getRoutes();
   }
+  clearOpenApiRoutes() {
+    this.openApiRegistry.clear();
+  }
   getOpenApiSpec(info) {
     return this.openApiRegistry.getSpec(info);
   }
@@ -792,7 +1050,7 @@ var AccessRuntime = class {
     return this.defaultModelOptions.get(key, defaultValue);
   }
   createModelOptions(modelName) {
-    const model = import_mongoose3.default.model(modelName);
+    const model = this.getModelInstance(modelName) ?? import_mongoose3.default.model(modelName);
     const manager = new OptionsManager({
       ...defaultModelOptions,
       modelName
@@ -809,7 +1067,7 @@ var AccessRuntime = class {
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
-        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
+        (0, import_utils11.isString)(newval) || (0, import_utils11.isNil)(newval) ? newval : void 0
       );
     }).build();
     this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -867,7 +1125,7 @@ var AccessRuntime = class {
     manager.onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         dataName,
-        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
+        (0, import_utils11.isString)(newval) || (0, import_utils11.isNil)(newval) ? newval : void 0
       );
     }).build();
     return manager;
@@ -908,7 +1166,7 @@ var AccessRuntime = class {
     if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
       return;
     }
-    const model = import_mongoose3.default.models[modelName];
+    const model = this.getModelInstance(modelName);
     if (!model) {
       this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
       this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
@@ -918,28 +1176,26 @@ var AccessRuntime = class {
     const schema = model.schema;
     this.modelRefs[modelName] = buildRefs(schema.tree);
     this.modelSubs[modelName] = buildSubPaths(schema.tree);
-    this.modelAtts[modelName] = (0, import_utils10.keys)(schema.obj);
+    this.modelAtts[modelName] = (0, import_utils11.keys)(schema.obj);
   }
   getModelRef(modelName, refPath) {
     this.ensureModelMeta(modelName);
-    const value = (0, import_utils10.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-    return (0, import_utils10.isString)(value) ? value : null;
+    const value = (0, import_utils11.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils11.isString)(value) ? value : null;
   }
   getModelSub(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils10.get)(this.modelSubs, modelName, []);
+    return (0, import_utils11.get)(this.modelSubs, modelName, []);
   }
   getModelAtt(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils10.get)(this.modelAtts, modelName, []);
+    return (0, import_utils11.get)(this.modelAtts, modelName, []);
   }
 };
 var defaultRuntime = new AccessRuntime();
 
 // src/runtime-context.ts
 var import_node_async_hooks = require("async_hooks");
-var import_mongoose4 = __toESM(require("mongoose"));
-var ACCESS_RUNTIME = /* @__PURE__ */ Symbol("access-runtime");
 var runtimeStorage = new import_node_async_hooks.AsyncLocalStorage();
 function runWithRuntime(runtime, callback) {
   return runtimeStorage.run(runtime, callback);
@@ -947,16 +1203,6 @@ function runWithRuntime(runtime, callback) {
 function getActiveRuntime() {
   return runtimeStorage.getStore() ?? null;
 }
-function attachRuntimeToModel(modelName, runtime) {
-  const model = import_mongoose4.default.models[modelName];
-  if (model) {
-    model[ACCESS_RUNTIME] = runtime;
-  }
-}
-function getRuntimeForModelName(modelName) {
-  const model = import_mongoose4.default.models[modelName];
-  return model?.[ACCESS_RUNTIME] ?? null;
-}
 
 // src/options/global-options.ts
 var getRuntime = () => getActiveRuntime() ?? defaultRuntime;
@@ -974,27 +1220,36 @@ var getGlobalOption = (key, defaultValue) => {
 };
 
 // src/options/model-options.ts
-var getRuntime2 = (modelName) => getRuntimeForModelName(modelName) ?? getActiveRuntime() ?? defaultRuntime;
+var getRuntime2 = () => getActiveRuntime() ?? defaultRuntime;
 var setModelOptions = (modelName, options) => {
-  getRuntime2(modelName).setModelOptions(modelName, options);
+  getRuntime2().setModelOptions(modelName, options);
 };
 var setModelOption = (modelName, key, value) => {
-  getRuntime2(modelName).setModelOption(modelName, key, value);
+  getRuntime2().setModelOption(modelName, key, value);
 };
 var getModelOptions = (modelName) => {
-  return getRuntime2(modelName).getModelOptions(modelName);
+  return getRuntime2().getModelOptions(modelName);
 };
 var getModelOption = (modelName, key, defaultValue) => {
-  return getRuntime2(modelName).getModelOption(modelName, key, defaultValue);
+  return getRuntime2().getModelOption(modelName, key, defaultValue);
 };
 var getExactModelOption = (modelName, key) => {
-  return getRuntime2(modelName).getExactModelOption(modelName, key);
+  return getRuntime2().getExactModelOption(modelName, key);
 };
 var getModelNames = () => {
   return (getActiveRuntime() ?? defaultRuntime).getModelNames();
 };
 var getModelJsonSchema = (modelName) => {
-  return getRuntime2(modelName).getModelJsonSchema(modelName);
+  return getRuntime2().getModelJsonSchema(modelName);
+};
+var registerModelInstance = (modelName, model) => {
+  getRuntime2().registerModelInstance(modelName, model);
+};
+var hasModelInstance = (modelName) => {
+  return getRuntime2().hasModelInstance(modelName);
+};
+var getModelInstance = (modelName) => {
+  return getRuntime2().getModelInstance(modelName);
 };
 
 // src/options/default-model-options.ts
@@ -1022,25 +1277,35 @@ var getDataOption = (dataName, key, defaultValue) => {
 };
 
 // src/meta.ts
-var getRuntime5 = (modelName) => getRuntimeForModelName(modelName) ?? getActiveRuntime() ?? defaultRuntime;
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
 var getModelRef = (modelName, refPath) => {
-  return getRuntime5(modelName).getModelRef(modelName, refPath);
+  return getRuntime5().getModelRef(modelName, refPath);
 };
 var getModelSub = (modelName) => {
-  return getRuntime5(modelName).getModelSub(modelName);
+  return getRuntime5().getModelSub(modelName);
 };
 
 // src/services/base.ts
-var import_utils11 = require("@web-ts-toolkit/utils");
+var import_utils12 = require("@web-ts-toolkit/utils");
+var ClientRequestError = class extends Error {
+  constructor(result) {
+    super(String(result.code));
+    this.result = result;
+  }
+};
 function validateClientFilter(filter2) {
   const errors = [];
+  const complexityErrors = validateRequestComplexity(filter2, getGlobalOption("requestComplexity"), "filter");
+  if (complexityErrors.length > 0) {
+    return complexityErrors.map((error2) => error2.detail);
+  }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils11.isArray)(value)) {
+    if ((0, import_utils12.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils11.isPlainObject)(value)) return;
+    if (!(0, import_utils12.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -1134,18 +1399,43 @@ var Base = class {
   validateClientFilter(filter2) {
     return validateClientFilter(filter2);
   }
+  getRequestComplexity() {
+    return resolveRequestComplexity(getGlobalOption("requestComplexity"));
+  }
+  getClientRequestErrorResult(error2) {
+    return error2 instanceof ClientRequestError ? error2.result : null;
+  }
+  throwClientRequestError(code, detail) {
+    throw new ClientRequestError({
+      success: false,
+      kind: "error",
+      code,
+      errors: [{ detail }]
+    });
+  }
+  async getAuthorizedTargetService(modelName, op) {
+    const runtime = getActiveRuntime();
+    if (runtime && !runtime.hasModel(modelName)) {
+      this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
+    }
+    const allowed = await this.req.macl.isAllowed(modelName, op);
+    if (!allowed) {
+      this.throwClientRequestError("unauthorized" /* Unauthorized */, "Unauthorized");
+    }
+    return this.req.macl.getPublicService(modelName);
+  }
   processInclude(include) {
-    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
+    const includes = (0, import_utils12.compact)((0, import_utils12.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
       return model && op && path && localField && foreignField;
     });
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils11.forEach)(includes, (inc) => {
+    (0, import_utils12.forEach)(includes, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils11.uniq)((0, import_utils11.compact)(includeLocalFields));
-    includePaths = (0, import_utils11.uniq)((0, import_utils11.compact)(includePaths));
+    includeLocalFields = (0, import_utils12.uniq)((0, import_utils12.compact)(includeLocalFields));
+    includePaths = (0, import_utils12.uniq)((0, import_utils12.compact)(includePaths));
     return {
       includes,
       includeLocalFields,
@@ -1154,72 +1444,80 @@ var Base = class {
   }
   async includeDocs(docs, include) {
     if (!include) return docs;
-    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include));
+    const includes = (0, import_utils12.compact)((0, import_utils12.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils11.isArray)(docs);
-    if (isSingle) docs = [docs];
+    const isSingle = !(0, import_utils12.isArray)(docs);
+    let docList = isSingle ? [docs] : docs;
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
       if (include2.op === "count") {
-        docs = await this.includeDocsCount(docs, include2);
+        docList = await this.includeDocsCount(docList, include2);
       } else {
-        docs = await this.includeDocsList(docs, include2);
+        docList = await this.includeDocsList(docList, include2);
       }
     }
-    return isSingle ? docs[0] : docs;
+    return isSingle ? docList[0] : docList;
   }
   async includeDocsList(docs, include) {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return docs;
+    const svc = await this.getAuthorizedTargetService(model, op);
     const includeLocalValues = [];
-    (0, import_utils11.forEach)(docs, (doc, i) => {
-      includeLocalValues.push((0, import_utils11.get)(doc, localField));
+    (0, import_utils12.forEach)(docs, (doc, i) => {
+      includeLocalValues.push((0, import_utils12.get)(doc, localField));
     });
-    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils11.flatten)(includeLocalValues) } };
-    const result = await svc.find(filter2, args, {
+    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils12.flatten)(includeLocalValues) } };
+    const authorizedFilter = await svc.genFilter(op, filter2);
+    const trustedArgs = {
+      ...args,
+      overrides: {
+        filter: authorizedFilter
+      }
+    };
+    const trustedOptions = {
       ...options,
       lean: true,
       includePermissions: false,
       includeCount: false
-    });
-    if (!result.success) return docs;
+    };
+    const trustedResult = await svc.find(filter2, trustedArgs, trustedOptions);
+    if (!trustedResult.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils11.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils11.intersectionBy)((0, import_utils11.castArray)(localValue), (0, import_utils11.castArray)((0, import_utils11.get)(row, foreignField)), String).length > 0;
-      const matches = result.data.filter(filterFn);
+      const localValue = (0, import_utils12.get)(doc, localField);
+      const filterFn = (row) => (0, import_utils12.intersectionBy)((0, import_utils12.castArray)(localValue), (0, import_utils12.castArray)((0, import_utils12.get)(row, foreignField)), String).length > 0;
+      const matches = trustedResult.data.filter(filterFn);
       setDocValue(doc, path, op === "list" ? matches : matches[0]);
     }
     return docs;
   }
   async includeDocsCount(docs, include) {
     const { model, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return docs;
+    const svc = await this.getAuthorizedTargetService(model, "count");
     const includeLocalValues = [];
-    (0, import_utils11.forEach)(docs, (doc) => {
-      includeLocalValues.push((0, import_utils11.get)(doc, localField));
+    (0, import_utils12.forEach)(docs, (doc) => {
+      includeLocalValues.push((0, import_utils12.get)(doc, localField));
     });
-    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils11.flatten)(includeLocalValues) } };
-    const result = await svc.find(
-      filter2,
-      {
-        ...args,
-        select: [foreignField]
-      },
-      {
-        ...options,
-        lean: true,
-        includePermissions: false,
-        includeCount: false
+    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils12.flatten)(includeLocalValues) } };
+    const authorizedFilter = await svc.genFilter("list", filter2);
+    const trustedArgs = {
+      ...args,
+      select: [foreignField],
+      overrides: {
+        filter: authorizedFilter
       }
-    );
+    };
+    const trustedOptions = {
+      ...options,
+      lean: true,
+      includePermissions: false,
+      includeCount: false
+    };
+    const result = await svc.find(filter2, trustedArgs, trustedOptions);
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils11.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils11.intersectionBy)((0, import_utils11.castArray)(localValue), (0, import_utils11.castArray)((0, import_utils11.get)(row, foreignField)), String).length > 0;
+      const localValue = (0, import_utils12.get)(doc, localField);
+      const filterFn = (row) => (0, import_utils12.intersectionBy)((0, import_utils12.castArray)(localValue), (0, import_utils12.castArray)((0, import_utils12.get)(row, foreignField)), String).length > 0;
       setDocValue(doc, path, result.data.filter(filterFn).length);
     }
     return docs;
@@ -1239,29 +1537,32 @@ var Base = class {
   }
   async handleSubQuery(sq, key) {
     const { model, op, id, filter: filter2, args, options, sqOptions = {} } = sq;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return null;
     let result;
     if (op === "list") {
-      result = await svc.find(filter2, args, options);
+      const svc = await this.getAuthorizedTargetService(model, "list");
+      result = await svc._list(filter2, args, options);
     } else if (op === "read") {
+      const svc = await this.getAuthorizedTargetService(model, "read");
+      const readOptions = { ...options, tryList: false };
       if (id) {
-        result = await svc.findById(id, args, options);
+        result = await svc._read(id, args, readOptions);
       } else if (filter2) {
-        result = await svc.findOne(filter2, args, options);
+        result = await svc._readFilter(filter2, args, readOptions);
       } else {
-        return null;
+        this.throwClientRequestError("bad_request" /* BadRequest */, `Subquery for field ${key} requires an id or filter`);
       }
     } else {
-      return null;
+      this.throwClientRequestError("bad_request" /* BadRequest */, `Unsupported subquery operation: ${op}`);
+    }
+    if (!result.success) {
+      throw new ClientRequestError(result);
     }
-    if (!result.success) return null;
     let ret = result.data;
     if (sqOptions.path) {
-      ret = (0, import_utils11.isArray)(ret) ? (0, import_utils11.flatten)(ret.map((v) => (0, import_utils11.get)(v, sqOptions.path))) : (0, import_utils11.get)(ret, sqOptions.path);
+      ret = (0, import_utils12.isArray)(ret) ? (0, import_utils12.flatten)(ret.map((v) => (0, import_utils12.get)(v, sqOptions.path))) : (0, import_utils12.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils11.compact)((0, import_utils11.castArray)(ret));
+      ret = (0, import_utils12.compact)((0, import_utils12.castArray)(ret));
     }
     return ret;
   }
@@ -1273,34 +1574,203 @@ var Base = class {
 };
 
 // src/services/service.ts
-var import_utils13 = require("@web-ts-toolkit/utils");
+var import_utils14 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
-var import_mongoose5 = __toESM(require("mongoose"));
+var import_mongoose4 = __toESM(require("mongoose"));
 
-// src/logger.ts
-var passthrough = (level) => (...args) => {
-  const globalLogger = getGlobalOption("logger");
-  const target = globalLogger?.[level] ?? defaultLogger[level];
-  return target.apply(globalLogger ?? defaultLogger, args);
+// src/logger-helpers.ts
+var SENSITIVE_FILTER_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "pwd",
+  "secret",
+  "token",
+  "access_token",
+  "refreshtoken",
+  "api_key",
+  "apikey",
+  "authorization",
+  "authtoken",
+  "credentials",
+  "privatekey",
+  "ssn",
+  "creditcard",
+  "cardnumber",
+  "cvv",
+  "tenantid",
+  "tenant"
+]);
+var SENSITIVE_PAYLOAD_KEYS = new Set(SENSITIVE_FILTER_KEYS);
+var safeReplace = (value, seen) => {
+  if (value === null || typeof value === "undefined") return value;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return value;
+  }
+  if (typeof value === "function") return "[Function]";
+  if (typeof value === "object") {
+    if (seen.has(value)) return "[Circular]";
+    seen.add(value);
+    try {
+      if (Array.isArray(value)) {
+        return value.map((entry) => safeReplace(entry, seen));
+      }
+      const out = {};
+      for (const [k, v] of Object.entries(value)) {
+        out[k] = safeReplace(v, seen);
+      }
+      return out;
+    } finally {
+      seen.delete(value);
+    }
+  }
+  return value;
+};
+var redactObjectKeys = (value, sensitiveKeys, seen) => {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry) => redactObjectKeys(entry, sensitiveKeys, seen));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const lowered = String(k).toLowerCase();
+      if (sensitiveKeys.has(lowered)) {
+        out[k] = "[REDACTED]";
+      } else {
+        out[k] = redactObjectKeys(v, sensitiveKeys, seen);
+      }
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+};
+var redactFilter = (filter2) => {
+  return redactObjectKeys(filter2, SENSITIVE_FILTER_KEYS, /* @__PURE__ */ new WeakSet());
+};
+var redactPayload = (payload) => {
+  return redactObjectKeys(payload, SENSITIVE_PAYLOAD_KEYS, /* @__PURE__ */ new WeakSet());
+};
+var safeStringify = (value) => {
+  try {
+    return JSON.stringify(safeReplace(value, /* @__PURE__ */ new WeakSet()));
+  } catch {
+    return "[Unserializable]";
+  }
+};
+var countFilterKeys = (filter2) => {
+  if (filter2 === null || typeof filter2 === "undefined") return 0;
+  if (typeof filter2 !== "object") return 0;
+  if (Array.isArray(filter2)) return 0;
+  let count = 0;
+  const stack = [filter2];
+  const seen = /* @__PURE__ */ new WeakSet();
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === null || typeof current !== "object" || Array.isArray(current)) continue;
+    if (seen.has(current)) continue;
+    seen.add(current);
+    for (const [key, value] of Object.entries(current)) {
+      count += 1;
+      if (typeof key === "string" && key.startsWith("$") && value !== null && typeof value === "object") {
+        if (Array.isArray(value)) {
+          for (const entry of value) {
+            if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+              stack.push(entry);
+            }
+          }
+        } else {
+          stack.push(value);
+        }
+      }
+    }
+  }
+  return count;
+};
+var summarizeFilter = (filter2) => {
+  return { filterKeyValueCount: countFilterKeys(filter2) };
 };
-var logger = {
-  debug: passthrough("debug"),
-  info: passthrough("info"),
-  warn: passthrough("warn"),
-  error: passthrough("error")
+var resolveLogger = () => {
+  return getGlobalOption("logger") ?? defaultLogger;
+};
+var isLevelEnabled = (level) => {
+  const target = resolveLogger();
+  const fn = target?.isLevelEnabled;
+  if (typeof fn === "function") {
+    try {
+      return !!fn.call(target, level);
+    } catch {
+      return true;
+    }
+  }
+  return true;
+};
+var buildOpMessage = (ctx) => {
+  const trimmed = { op: ctx.op };
+  if (ctx.modelName) trimmed.modelName = ctx.modelName;
+  if (ctx.dataName) trimmed.dataName = ctx.dataName;
+  if (ctx.page != null) trimmed.page = ctx.page;
+  if (ctx.pageSize != null) trimmed.pageSize = ctx.pageSize;
+  if (ctx.skip != null) trimmed.skip = ctx.skip;
+  if (ctx.limit != null) trimmed.limit = ctx.limit;
+  if (ctx.sort != null) trimmed.sort = ctx.sort;
+  if (ctx.populateCount != null) trimmed.populateCount = ctx.populateCount;
+  if (ctx.selectCount != null) trimmed.selectCount = ctx.selectCount;
+  if (ctx.filterKeyValueCount != null) trimmed.filterKeyValueCount = ctx.filterKeyValueCount;
+  if (ctx.startedAt != null && ctx.durationMs == null) {
+    trimmed.startedAt = ctx.startedAt;
+  }
+  if (ctx.durationMs != null) trimmed.durationMs = ctx.durationMs;
+  if (ctx.resultCode != null) trimmed.resultCode = ctx.resultCode;
+  return safeStringify(trimmed);
+};
+var safeApply = (fn, thisArg, args) => {
+  try {
+    fn.apply(thisArg, args);
+  } catch {
+  }
+};
+var debug = (ctx) => {
+  if (!isLevelEnabled("debug")) return;
+  const target = resolveLogger();
+  const fn = target?.debug ?? defaultLogger.debug;
+  const message = buildOpMessage(ctx);
+  safeApply(fn, target ?? defaultLogger, [message]);
+};
+var warn = (message, meta) => {
+  const target = resolveLogger();
+  const fn = target?.warn ?? defaultLogger.warn;
+  safeApply(fn, target ?? defaultLogger, meta != null ? [message, meta] : [message]);
+};
+var logInfoMessage = (message, ...args) => {
+  const target = resolveLogger();
+  const fn = target?.info ?? defaultLogger.info;
+  const payload = args.length > 0 ? [message, ...args] : [message];
+  safeApply(fn, target ?? defaultLogger, payload);
+};
+var error = (error2) => {
+  const target = resolveLogger();
+  const fn = target?.error ?? defaultLogger.error;
+  safeApply(fn, target ?? defaultLogger, [error2]);
 };
 
 // src/model.ts
+var safeSortLogError = (msg, ...args) => {
+  const message = args.length > 0 ? `${msg} ${safeStringify(args.length === 1 ? args[0] : args)}` : msg;
+  error(message);
+};
 var Model = class {
-  constructor(modelName) {
+  constructor(modelName, runtime) {
     this.modelName = modelName;
-    this.model = import_mongoose5.default.model(modelName);
+    this.runtime = runtime ?? null;
+    const resolvedRuntime = runtime ?? getActiveRuntime();
+    const registered = resolvedRuntime?.getModelInstance(modelName) ?? null;
+    const global = import_mongoose4.default.models[modelName];
+    this.model = registered ?? global ?? import_mongoose4.default.model(modelName);
     if (!this.model) return;
-    this.model.schema.set("optimisticConcurrency", true);
-    const currVersionKey = this.model.schema.get("versionKey");
-    if (!currVersionKey) this.model.schema.set("versionKey", "__v");
   }
   new() {
     const doc = new this.model();
@@ -1309,20 +1779,25 @@ var Model = class {
   create(data) {
     return this.model.create(data);
   }
-  find({ filter: filter2, select, sort, populate, limit, skip, lean }) {
+  find({ filter: filter2, select, sort, populate, limit, hardLimit, skip, lean }) {
     if (!this.validateSort(sort)) {
       sort = null;
     }
     const builder = this.model.find(filter2);
     if (select) builder.select(select);
     if (skip) builder.skip(Number(skip));
-    if (limit) builder.limit(Number(limit));
+    const normalizedLimit = Number(limit);
+    if (Number.isSafeInteger(normalizedLimit) && normalizedLimit > 0) {
+      builder.limit(normalizedLimit);
+    } else if (Number.isSafeInteger(hardLimit) && Number(hardLimit) > 0) {
+      builder.limit(Number(hardLimit));
+    }
     if (sort) builder.sort(sort);
     if (populate) builder.populate(populate);
     if (lean) builder.lean();
     return builder;
   }
-  validateSort(sort, logError = logger.error) {
+  validateSort(sort, logError = safeSortLogError) {
     const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
     const fieldPathPattern = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
     const isValidFieldPath = (field) => fieldPathPattern.test(field);
@@ -1399,7 +1874,7 @@ var Model = class {
   }
   exists(filter2) {
     if (!filter2) return null;
-    return this.findOne(filter2).select("_id").lean();
+    return this.findOne({ filter: filter2 }).select("_id").lean();
   }
   // see https://mongoosejs.com/docs/api.html#query_Query-countDocuments
   countDocuments(filter2 = {}) {
@@ -1413,98 +1888,122 @@ var Model = class {
 var model_default = Model;
 
 // src/services/model-subdocument-service.ts
-var import_utils12 = require("@web-ts-toolkit/utils");
+var import_utils13 = require("@web-ts-toolkit/utils");
 async function listSub(service, id, sub, options) {
   const { filter: ft, select } = options ?? {};
+  const filterErrors = validateClientFilter(ft);
+  if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "read" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  let result = (0, import_utils13.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.list`, ft),
     service.genQuerySelect("list", select, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  if (subSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subSelect.concat("_id")));
+  if (subSelect) result = result.map((v) => (0, import_utils13.pick)(toObject(v), subSelect.concat("_id")));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function readSub(service, id, sub, subId, options) {
   const { select, populate } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, { populate }, { access: "read" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  const result = (0, import_utils13.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.read`, { _id: subId }),
     service.genQuerySelect("read", select, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  if (subSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subSelect.concat(["_id"]));
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  if (subSelect) subdoc = (0, import_utils13.pick)(toObject(subdoc), subSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function updateSub(service, id, sub, subId, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  const result = (0, import_utils13.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: subId }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  const allowedData = (0, import_utils12.pick)(data, subUpdateSelect);
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  const allowedData = (0, import_utils13.pick)(data, subUpdateSelect);
   Object.assign(subdoc, allowedData);
   await parentDoc.save();
-  if (subReadSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
+  if (subReadSelect) subdoc = (0, import_utils13.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function bulkUpdateSub(service, id, sub, data) {
+  const { maxBulkItems } = service.getRequestComplexity();
+  if (data.length > maxBulkItems) {
+    return {
+      success: false,
+      kind: "error",
+      code: "bad_request" /* BadRequest */,
+      errors: [{ detail: `Bulk subdocument update exceeds maximum item count of ${maxBulkItems}` }]
+    };
+  }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  let result = (0, import_utils13.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  (0, import_utils12.forEach)(result, (subdoc) => {
+  (0, import_utils13.forEach)(result, (subdoc) => {
     const tdata = findElementById(data, subdoc._id);
     if (!tdata) return;
-    const allowedData = (0, import_utils12.pick)(tdata, subUpdateSelect);
+    const allowedData = (0, import_utils13.pick)(tdata, subUpdateSelect);
     Object.assign(subdoc, allowedData);
   });
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils13.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function createSub(service, id, sub, data, options) {
   const { addFirst } = options ?? {};
+  const { maxBulkItems } = service.getRequestComplexity();
+  if (Array.isArray(data) && data.length > maxBulkItems) {
+    return {
+      success: false,
+      kind: "error",
+      code: "bad_request" /* BadRequest */,
+      errors: [{ detail: `Bulk subdocument create exceeds maximum item count of ${maxBulkItems}` }]
+    };
+  }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  let result = (0, import_utils13.get)(parentDoc, sub);
   const [subCreateSelect, subReadSelect] = await Promise.all([
     service.genQuerySelect("create", null, false, [sub, "sub"]),
     service.genQuerySelect("read", null, false, [sub, "sub"])
   ]);
-  const allowedData = (0, import_utils12.pick)(data, subCreateSelect);
-  addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
+  const allowedData = Array.isArray(data) ? data.map((row) => (0, import_utils13.pick)(row, subCreateSelect)) : (0, import_utils13.pick)(data, subCreateSelect);
+  if (Array.isArray(allowedData)) {
+    addFirst === true ? result.unshift(...allowedData) : result.push(...allowedData);
+  } else {
+    addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
+  }
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils13.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
 }
 async function deleteSub(service, id, sub, subId) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils12.get)(parentDoc, sub);
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
+  const result = (0, import_utils13.get)(parentDoc, sub);
   const subFilter = await service.genFilter(`subs.${sub}.delete`, { _id: subId });
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   const subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   await ("deleteOne" in subdoc ? subdoc.deleteOne?.() : subdoc.remove?.());
   await parentDoc.save();
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc._id };
@@ -1514,7 +2013,7 @@ async function getParentDoc(service, id, sub, args, options) {
   const { access = "read", lean = false } = options ?? {};
   const parentFilter = await service.genFilter(access, await service.genIDFilter(id));
   if (parentFilter === false) return null;
-  return service.model.findOne({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
+  return service.findRawParentDoc({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
 }
 
 // src/services/model-service-defaults.ts
@@ -1640,10 +2139,53 @@ var assertModelDocument = (value, modelName, hookName) => {
   }
   throw new Error(`${hookName} hook for model=${modelName} must return a Mongoose document instance`);
 };
+var mapWithConcurrencyLimit = async (items, limit, iteratee) => {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workerCount = Math.min(Math.max(limit, 1), items.length || 1);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor < items.length) {
+        const current = cursor;
+        cursor += 1;
+        results[current] = await iteratee(items[current], current);
+      }
+    })
+  );
+  return results;
+};
 var Service = class extends Base {
+  findRawParentDoc(args) {
+    return this.model.findOne({
+      ...args,
+      filter: args.filter,
+      populate: args.populate
+    });
+  }
   asServiceHookContext(context) {
     return context;
   }
+  beginOp(op, filter2, extra) {
+    const startedAt = Date.now();
+    debug({
+      op,
+      modelName: this.modelName,
+      filterKeyValueCount: summarizeFilter(filter2).filterKeyValueCount,
+      startedAt,
+      ...extra ?? {}
+    });
+    return startedAt;
+  }
+  completeOp(op, startedAt, resultCode, filter2, extra) {
+    debug({
+      op,
+      modelName: this.modelName,
+      filterKeyValueCount: summarizeFilter(filter2).filterKeyValueCount,
+      durationMs: Date.now() - startedAt,
+      resultCode,
+      ...extra ?? {}
+    });
+  }
   constructor(req, modelName) {
     super(req, modelName);
     this.model = new model_default(modelName);
@@ -1654,12 +2196,20 @@ var Service = class extends Base {
   }
   async findOne(filter2, args, options) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
     const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    let parsedFilter;
+    try {
+      parsedFilter = await this.parseClientData(filter2);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     let [_filter, _select, _populate] = await Promise.all([
-      overrideFilter || this.genFilter(access, await this.parseClientData(filter2)),
+      overrideFilter || this.genFilter(access, parsedFilter),
       overrideSelect || this.genQuerySelect(access, select),
       overridePopulate || this.genPopulate(populateAccess || access, populate)
     ]);
@@ -1671,10 +2221,20 @@ var Service = class extends Base {
       sort,
       populate: _populate
     };
-    logger.debug(JSON.stringify({ op: "findOne", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("findOne", _filter, {
+      sort,
+      selectCount: finalSelect.length,
+      populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ ...query, lean });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("findOne", startedAt, "not_found" /* NotFound */, _filter);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
@@ -1682,7 +2242,16 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    doc = await this.includeDocs(doc, includes);
+    try {
+      doc = await this.includeDocs(doc, includes);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("findOne", startedAt, result.code, _filter);
+        return { ...result, query };
+      }
+      throw error2;
+    }
     let includeDocPermissions = includePermissions;
     if (!includeDocPermissions && !skim) {
       includeDocPermissions = this.checkIfModelPermissionExists([access, "read", "update"]);
@@ -1695,6 +2264,7 @@ var Service = class extends Base {
       this.baseFieldsExt.concat(includePaths, normalizeSelect(overrideSelect))
     );
     if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    this.completeOp("findOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query, context };
   }
   async findById(id, args, options) {
@@ -1718,18 +2288,26 @@ var Service = class extends Base {
   }
   async find(filter2, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, populate, include, sort, skip, limit, page, pageSize, overrides } = this.resolveFindArgs(args);
     const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    let parsedFilter;
+    try {
+      parsedFilter = await this.parseClientData(filter2);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     const [_filter, _select, _populate, pagination] = await Promise.all([
-      overrideFilter || this.genFilter("list", await this.parseClientData(filter2)),
+      overrideFilter || this.genFilter("list", parsedFilter),
       overrideSelect || this.genQuerySelect("list", select),
       overridePopulate || this.genPopulate(populateAccess, populate),
       genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
     ]);
     const finalSelect = normalizeSelect(_select);
-    const filteredPopulate = (0, import_utils13.isArray)(finalSelect) && (0, import_utils13.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const filteredPopulate = (0, import_utils14.isArray)(finalSelect) && (0, import_utils14.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, includeLocalFields, includePaths } = this.processInclude(include);
     const query = {
       filter: _filter,
@@ -1738,10 +2316,20 @@ var Service = class extends Base {
       sort,
       ...pagination
     };
-    logger.debug(JSON.stringify({ op: "find", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("find", _filter, {
+      sort,
+      skip: pagination.skip,
+      limit: pagination.limit,
+      selectCount: finalSelect.concat(includeLocalFields).length,
+      populateCount: Array.isArray(filteredPopulate) ? filteredPopulate.length : filteredPopulate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let docs = await this.model.find({
       ...query,
+      hardLimit: this.options.listHardLimit,
       lean
     });
     const contexts = docs.map((doc) => ({
@@ -1751,8 +2339,17 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     }));
-    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
-    docs = await this.includeDocs(docs, includes);
+    const _decorate = (0, import_utils14.isFunction)(decorate) ? decorate : (v) => v;
+    try {
+      docs = await this.includeDocs(docs, includes);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("find", startedAt, result.code, _filter);
+        return { ...result, query };
+      }
+      throw error2;
+    }
     const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
       docs.map(async (doc, i) => {
@@ -1773,6 +2370,7 @@ var Service = class extends Base {
         return doc;
       })
     );
+    this.completeOp("find", startedAt, "success" /* Success */, _filter);
     return {
       success: true,
       kind: "list",
@@ -1789,67 +2387,96 @@ var Service = class extends Base {
     const { skim, includePermissions, populateAccess } = this.resolveCreateOptions(options);
     const isArr = Array.isArray(data);
     let dataArr = isArr ? data : [data];
-    dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+    const { maxBulkItems, maxBulkConcurrency } = this.getRequestComplexity();
+    if (dataArr.length > maxBulkItems) {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: `Bulk create exceeds maximum item count of ${maxBulkItems}` }]
+      };
+    }
+    try {
+      dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     const resolvedPopulate = populate ? await this.genPopulate(populateAccess, populate) : [];
     const contexts = [];
-    let validationError = null;
-    const items = await Promise.all(
-      dataArr.map(async (item, index) => {
-        const context = {
-          mongooseModel: this.model.model,
-          modelName: this.modelName,
-          operation: "create",
-          originalData: item,
-          resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
-        };
-        const allowedFields = await this.genAllowedFields(item, "create");
-        const allowedData = (0, import_utils13.pick)(item, allowedFields);
-        context.allowedFields = allowedFields;
-        context.allowedData = allowedData;
-        const validated = await this.validate(allowedData, "create", context);
-        if ((0, import_utils13.isBoolean)(validated)) {
-          if (!validated) {
-            validationError = { success: false, code: "bad_request" /* BadRequest */ };
-            return;
-          }
-        } else if ((0, import_utils13.isArray)(validated)) {
-          if (validated.length > 0) {
-            validationError = { success: false, code: "bad_request" /* BadRequest */, errors: validated };
-            return;
-          }
+    const validationErrors = [];
+    const validationItems = await mapWithConcurrencyLimit(dataArr, maxBulkConcurrency, async (item, index) => {
+      const context = {
+        mongooseModel: this.model.model,
+        modelName: this.modelName,
+        operation: "create",
+        originalData: item,
+        resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
+      };
+      const allowedFields = await this.genAllowedFields(item, "create");
+      const allowedData = (0, import_utils14.pick)(item, allowedFields);
+      context.allowedFields = allowedFields;
+      context.allowedData = allowedData;
+      const validated = await this.validate(allowedData, "create", context);
+      if ((0, import_utils14.isBoolean)(validated)) {
+        if (!validated) {
+          validationErrors.push({ index, errors: [] });
+          return void 0;
         }
-        const preparedData = await this.prepare(allowedData, "create", context);
-        context.preparedData = preparedData;
-        contexts[index] = context;
-        return preparedData;
-      })
-    );
-    if (validationError) return validationError;
-    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
-    const createdDocs = await this.model.create(items);
-    const docs = await Promise.all(
-      createdDocs.map(async (doc, index) => {
-        contexts[index].currentDocument = doc;
-        doc = assertModelDocument(
-          await this.afterPersist(doc, "create", contexts[index]),
-          this.modelName,
-          "afterPersist"
-        );
-        contexts[index].currentDocument = doc;
-        contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
-        let includeDocPermissions = includePermissions;
-        if (!includeDocPermissions && !skim) {
-          includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+      } else if ((0, import_utils14.isArray)(validated)) {
+        if (validated.length > 0) {
+          validationErrors.push({
+            index,
+            errors: isArr ? validated.map((issue) => this.formatBulkValidationIssue(issue, index)) : validated
+          });
+          return void 0;
         }
-        if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
-        if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
-        if (resolvedPopulate.length > 0) await populateDoc(doc, resolvedPopulate);
-        doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
-        let outputDoc = await _decorate(doc, contexts[index]);
-        if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
-        return outputDoc;
-      })
-    );
+      }
+      contexts[index] = context;
+      return allowedData;
+    });
+    if (validationErrors.length > 0) {
+      const aggregate = validationErrors.slice().sort((a, b) => a.index - b.index).flatMap((entry) => entry.errors);
+      if (isArr) {
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: aggregate };
+      }
+      const single = validationErrors[0];
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: single?.errors ?? []
+      };
+    }
+    const items = await mapWithConcurrencyLimit(validationItems, maxBulkConcurrency, async (allowedData, index) => {
+      const preparedData = await this.prepare(allowedData, "create", contexts[index]);
+      contexts[index].preparedData = preparedData;
+      return preparedData;
+    });
+    const _decorate = (0, import_utils14.isFunction)(decorate) ? decorate : (v) => v;
+    const createdDocs = await this.model.create(items);
+    const docs = await mapWithConcurrencyLimit(createdDocs, maxBulkConcurrency, async (doc, index) => {
+      contexts[index].currentDocument = doc;
+      doc = assertModelDocument(
+        await this.afterPersist(doc, "create", contexts[index]),
+        this.modelName,
+        "afterPersist"
+      );
+      contexts[index].currentDocument = doc;
+      contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
+      let includeDocPermissions = includePermissions;
+      if (!includeDocPermissions && !skim) {
+        includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+      }
+      if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
+      if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
+      if (resolvedPopulate.length > 0) await populateDoc(doc, resolvedPopulate);
+      doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
+      let outputDoc = await _decorate(doc, contexts[index]);
+      if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      return outputDoc;
+    });
     return {
       success: true,
       kind: "list",
@@ -1859,18 +2486,50 @@ var Service = class extends Base {
       count: docs.length
     };
   }
-  async new() {
+  formatBulkValidationIssue(issue, index) {
+    if (!issue || typeof issue !== "object") {
+      return {
+        detail: typeof issue === "string" && issue.length > 0 ? issue : "Bad Request",
+        ...index === null ? {} : { pointer: `#/${index}` }
+      };
+    }
+    const typedIssue = issue;
+    const detail = typedIssue.detail ?? typedIssue.message ?? "Bad Request";
+    if (index === null) {
+      return typedIssue.pointer || typedIssue.path ? {
+        detail,
+        ...typedIssue.pointer ? { pointer: typedIssue.pointer } : {}
+      } : { detail };
+    }
+    if (typedIssue.pointer?.startsWith("#/")) {
+      return { ...typedIssue, detail, pointer: `#/${index}${typedIssue.pointer.slice(1)}` };
+    }
+    if (typedIssue.path) {
+      return { ...typedIssue, detail, pointer: `#/${[index, ...typedIssue.path].join("/")}` };
+    }
+    return { ...typedIssue, detail, pointer: `#/${index}` };
+  }
+  async new(args, options) {
+    const { skim, includePermissions } = options ?? {};
     const data = await this.model.new();
+    let doc = data;
+    doc = await this.trimOutputFields(doc, "create", this.baseFieldsExt);
+    let includeDocPermissions = includePermissions;
+    if (!includeDocPermissions && !skim) {
+      includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+    }
+    if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", {});
+    if (!includePermissions) doc = this.addEmptyPermissions(doc);
     return {
       success: true,
       kind: "single",
       code: "success" /* Success */,
-      data
+      data: doc
     };
   }
   async updateOne(filter2, data, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpdateOneArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpdateOneOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
@@ -1879,31 +2538,54 @@ var Service = class extends Base {
       overridePopulate || this.genPopulate(populateAccess, populate)
     ]);
     const query = { filter: _filter, populate: _populate };
-    logger.debug(JSON.stringify({ op: "updateOne", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("updateOne", _filter, {
+      populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("updateOne", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ filter: _filter });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("updateOne", startedAt, "not_found" /* NotFound */, _filter);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
       operation: "update",
       resolvedQuery: query
     };
-    data = await this.parseClientData(data);
+    try {
+      data = await this.parseClientData(data);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("updateOne", startedAt, result.code, _filter);
+        return result;
+      }
+      throw error2;
+    }
     context.originalDocumentSnapshot = doc.toObject({ virtuals: false });
     context.originalData = data;
     doc = await this.addDocPermissions(doc, "update", context);
     context.docPermissions = this.getDocPermissions(doc);
     context.currentDocument = doc;
     const allowedFields = await this.genAllowedFields(doc, "update");
-    const allowedData = (0, import_utils13.pick)(data, allowedFields);
+    const allowedData = (0, import_utils14.pick)(data, allowedFields);
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils13.isBoolean)(validated)) {
-      if (!validated) return { success: false, code: "bad_request" /* BadRequest */ };
-    } else if ((0, import_utils13.isArray)(validated)) {
-      if (validated.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: validated };
+    if ((0, import_utils14.isBoolean)(validated)) {
+      if (!validated) {
+        this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
+      }
+    } else if ((0, import_utils14.isArray)(validated)) {
+      if (validated.length > 0) {
+        this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
+      }
     }
     const prepared = await this.prepare(allowedData, "update", context);
     context.preparedData = prepared;
@@ -1915,10 +2597,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils13.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils13.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils14.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils14.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils13.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils14.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -1934,8 +2616,9 @@ var Service = class extends Base {
     if (_populate) await populateDoc(doc, _populate);
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
-    if ((0, import_utils13.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
+    if ((0, import_utils14.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
     if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+    this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
   async updateById(id, data, args = {}, options = {}, decorate) {
@@ -1958,17 +2641,21 @@ var Service = class extends Base {
   }
   async upsert(filter2, data, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpsertArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpsertOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const _filter = await (overrideFilter || this.genFilter("update", filter2));
     const query = { filter: _filter };
-    logger.debug(JSON.stringify({ op: "upsert", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("upsert", _filter);
+    if (_filter === false) {
+      this.completeOp("upsert", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     const theone = await this.model.findOne({ filter: _filter });
+    let result;
     if (theone) {
-      return this.updateOne(
+      result = await this.updateOne(
         null,
         data,
         {
@@ -1982,7 +2669,7 @@ var Service = class extends Base {
         decorate
       );
     } else {
-      return this.create(
+      result = await this.create(
         data,
         { populate },
         {
@@ -1993,14 +2680,22 @@ var Service = class extends Base {
         decorate
       );
     }
+    this.completeOp("upsert", startedAt, result.code, _filter);
+    return result;
   }
   async delete(id) {
     const filter2 = await this.genFilter("delete", await this.genIDFilter(id));
     const query = { filter: filter2 };
-    logger.debug(JSON.stringify({ op: "delete", query }));
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("delete", filter2);
+    if (filter2 === false) {
+      this.completeOp("delete", startedAt, "forbidden" /* Forbidden */, filter2);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ filter: filter2 });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("delete", startedAt, "not_found" /* NotFound */, filter2);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
@@ -2013,11 +2708,12 @@ var Service = class extends Base {
     await ("deleteOne" in doc ? doc.deleteOne() : doc.remove());
     context.finalDocumentSnapshot = toObject(doc);
     await this.afterDelete(doc, context);
+    this.completeOp("delete", startedAt, "success" /* Success */, filter2);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc._id, query };
   }
   async exists(filter2, options) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { access, includeId } = this.resolveExistsOptions(options);
     filter2 = await this.genFilter(access, filter2);
     const result = await this.model.exists(filter2);
@@ -2029,22 +2725,58 @@ var Service = class extends Base {
       query: { filter: filter2 }
     };
   }
+  isValidDistinctFieldName(field) {
+    if (typeof field !== "string" || field.length === 0) return false;
+    if (field.includes("$")) return false;
+    if (field.includes("..")) return false;
+    if (field.startsWith(".") || field.endsWith(".")) return false;
+    if (/\s/.test(field)) return false;
+    return true;
+  }
+  async authorizeDistinctField(field) {
+    const allowedFields = await this.genAllowedFields(null, "read");
+    const isAllowed = allowedFields.some((allowed) => {
+      if (allowed === field) return true;
+      if (allowed.startsWith(`${field}.`)) return true;
+      if (field.startsWith(`${allowed}.`)) return true;
+      return false;
+    });
+    if (!isAllowed) {
+      return {
+        success: false,
+        kind: "error",
+        code: "forbidden" /* Forbidden */,
+        errors: [{ detail: `Distinct field not allowed: ${field}` }]
+      };
+    }
+    return null;
+  }
   async distinct(field, args) {
+    if (!this.isValidDistinctFieldName(field)) {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: `Invalid distinct field: ${field}` }]
+      };
+    }
+    const fieldError = await this.authorizeDistinctField(field);
+    if (fieldError) return fieldError;
     let { filter: filter2 } = args ?? {};
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     filter2 = await this.genFilter("read", filter2);
     const query = { filter: filter2 };
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     const result = await this.model.distinct(field, filter2);
     return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length, query };
   }
   async count(filter2, access = "list") {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     filter2 = await this.genFilter(access, filter2);
     const query = { filter: filter2 };
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     return { success: true, kind: "single", code: "success" /* Success */, data: await this.model.countDocuments(filter2), query };
   }
   getDocPermissions(doc) {
@@ -2096,7 +2828,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils13.compact)((0, import_utils13.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils14.compact)((0, import_utils14.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -2126,7 +2858,7 @@ var Service = class extends Base {
     return updateSub(this, id, sub, subId, data);
   }
   async bulkUpdateSub(id, sub, data) {
-    return bulkUpdateSub(this, id, sub, (0, import_utils13.castArray)(data));
+    return bulkUpdateSub(this, id, sub, (0, import_utils14.castArray)(data));
   }
   async createSub(id, sub, data, options) {
     return createSub(this, id, sub, data, options);
@@ -2140,7 +2872,7 @@ var Service = class extends Base {
 };
 
 // src/services/public-service.ts
-var import_utils14 = require("@web-ts-toolkit/utils");
+var import_utils15 = require("@web-ts-toolkit/utils");
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
@@ -2176,11 +2908,11 @@ var PublicService = class extends Service {
       { populate },
       { skim, includePermissions, populateAccess },
       async (doc, context) => {
-        doc = toObject(doc);
-        doc = await this.decorate(doc, "create", context);
-        doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        return doc;
+        let d = toObject(doc);
+        d = await this.decorate(d, "create", context);
+        d = this.runTasks(d, tasks);
+        if (select) d = (0, import_utils15.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        return d;
       }
     );
     if (!result.success) {
@@ -2188,8 +2920,8 @@ var PublicService = class extends Service {
     }
     return result;
   }
-  async _new() {
-    return this.new();
+  async _new(args, options) {
+    return this.new(args, options);
   }
   async _read(id, args, options) {
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
@@ -2271,12 +3003,12 @@ var PublicService = class extends Service {
       { populate },
       { skim, includePermissions, populateAccess },
       async (doc, context) => {
-        doc = toObject(doc);
-        doc = await this.decorate(doc, "update", context);
-        doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) doc = (0, import_utils14.pick)(doc, [...Object.keys(data), "_id"]);
-        return doc;
+        let d = toObject(doc);
+        d = await this.decorate(d, "update", context);
+        d = this.runTasks(d, tasks);
+        if (select) d = (0, import_utils15.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) d = (0, import_utils15.pick)(d, [...Object.keys(data), "_id"]);
+        return d;
       }
     );
     if (!result.success) {
@@ -2287,7 +3019,7 @@ var PublicService = class extends Service {
   async _upsert(data, args, options) {
     const idKey = this.getIdentifier();
     if (idKey !== "_id") {
-      return { success: false, code: "bad_request" /* BadRequest */, errors: ["not supported custom id field"] };
+      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: ["not supported custom id field"] };
     }
     const { [idKey]: idVal, ...otherData } = data;
     const upsertId = typeof idVal === "string" ? idVal : void 0;
@@ -2297,7 +3029,7 @@ var PublicService = class extends Service {
         return existing;
       }
       if (!existing.data) {
-        return { success: false, code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
       }
       return this._update(upsertId, otherData, args, options);
     }
@@ -2397,7 +3129,7 @@ var PublicService = class extends Service {
 };
 
 // src/services/data-service.ts
-var import_utils15 = require("@web-ts-toolkit/utils");
+var import_utils16 = require("@web-ts-toolkit/utils");
 var DataService = class {
   constructor(req, dataName) {
     this.req = req;
@@ -2407,7 +3139,7 @@ var DataService = class {
   }
   async findOne(filter2, args, options) {
     const filterErrors = validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select } = args ?? {};
     const { access = "read" } = options ?? {};
     let [_filter, _select] = await Promise.all([this.genFilter(access, filter2), this.genQuerySelect(access, select)]);
@@ -2415,11 +3147,11 @@ var DataService = class {
       filter: _filter,
       select: _select
     };
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (_filter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     let doc = await findElement(this.data, _filter);
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils16.pick)(doc, _select);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
   }
   async findById(id, args, options) {
@@ -2436,7 +3168,7 @@ var DataService = class {
   }
   async find(filter2, args, options) {
     const filterErrors = validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, sort, skip, limit, page, pageSize } = args ?? {};
     const [_filter, _select, pagination] = await Promise.all([
       this.genFilter("list", filter2),
@@ -2449,27 +3181,33 @@ var DataService = class {
       sort,
       ...pagination
     };
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (_filter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    if (sort) {
+      const sortFieldErrors = await this.validateSortFields(sort, "list");
+      if (sortFieldErrors.length > 0) {
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortFieldErrors, query };
+      }
+    }
     let docs = await filterCollection(this.data, _filter);
     const totalCount = docs.length;
-    docs = await Promise.all(
-      docs.map(async (doc) => {
+    if (sort) {
+      const { sortKey, sortOrder } = parseSortString(sort);
+      docs = (0, import_utils16.orderBy)(docs, [sortKey], [sortOrder]);
+    }
+    const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
+    const trimmed = await Promise.all(
+      pagedDocs.map(async (doc) => {
         doc = await this.trimOutputFields(doc, "list");
-        if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
+        if (_select.length > 0) doc = (0, import_utils16.pick)(doc, _select);
         return doc;
       })
     );
-    if (sort) {
-      const { sortKey, sortOrder } = parseSortString(sort);
-      docs = (0, import_utils15.orderBy)(docs, [sortKey], [sortOrder]);
-    }
-    docs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     return {
       success: true,
       kind: "list",
       code: "success" /* Success */,
-      data: docs,
-      count: docs.length,
+      data: trimmed,
+      count: trimmed.length,
       totalCount,
       query
     };
@@ -2501,33 +3239,101 @@ var DataService = class {
   trimOutputFields(doc, access, baseFields) {
     return this.pickAllowedFields(doc, access, baseFields);
   }
+  async validateSortFields(sort, access) {
+    const fieldPathPattern = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)*$/;
+    const fields = sort.trim().split(/\s+/).filter(Boolean).map((field) => ({
+      raw: field,
+      name: field.startsWith("-") ? field.slice(1) : field
+    }));
+    const errors = [];
+    for (const { raw, name } of fields) {
+      if (!fieldPathPattern.test(name)) {
+        errors.push({ detail: `Invalid sort field: ${raw}`, pointer: `#/sort` });
+        continue;
+      }
+      if (name === "id" || name === "_id") continue;
+      const allowed = await this.genAllowedFields({}, access);
+      if (!allowed.includes(name)) {
+        errors.push({ detail: `Sort field is not allowed: ${name}`, pointer: `#/sort` });
+      }
+    }
+    return errors;
+  }
 };
 
 // src/processors.ts
-var import_utils16 = require("@web-ts-toolkit/utils");
+var import_utils17 = require("@web-ts-toolkit/utils");
+var UNSAFE_PATH_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function failUnsafeSegment(path) {
+  throw new Error(
+    `copyAndDepopulate: refusing path '${path}' because it contains an unsafe segment (__proto__, prototype, or constructor).`
+  );
+}
+function failMissingId(path) {
+  throw new Error(`copyAndDepopulate: path '${path}' resolved to a record missing the configured id field.`);
+}
+function assertSafePath(path) {
+  const segs = path.split(".");
+  for (const seg of segs) {
+    if (seg.length === 0) continue;
+    if (UNSAFE_PATH_KEYS.has(seg)) {
+      failUnsafeSegment(path);
+    }
+  }
+}
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
-  const obj = (0, import_utils16.get)(options, "mutable", true) ? docObject : (0, import_utils16.cloneDeep)(docObject);
-  const idField = (0, import_utils16.get)(options, "idField", "_id");
-  (0, import_utils16.forEach)((0, import_utils16.castArray)(operations), (op) => {
-    if (!op.src || !op.dest) return;
+  const mutable = options.mutable !== false;
+  const idField = options.idField ?? "_id";
+  const obj = mutable ? docObject : (0, import_utils17.cloneDeep)(docObject);
+  (0, import_utils17.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+    if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
+    const src = op.src;
+    const dest = op.dest;
+    if (src.length === 0 || dest.length === 0) return;
+    assertSafePath(src);
+    assertSafePath(dest);
     let targets = [obj];
-    const segs = op.src.split(".");
-    (0, import_utils16.forEach)(segs, (seg, ind) => {
+    const segs = src.split(".");
+    (0, import_utils17.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils16.forEach)(targets, (target) => {
+        (0, import_utils17.forEach)(targets, (target) => {
+          if (!(0, import_utils17.isPlainObject)(target)) return;
           const targetObject = target;
-          (0, import_utils16.set)(targetObject, op.dest, (0, import_utils16.get)(targetObject, seg));
-          (0, import_utils16.set)(
-            targetObject,
-            seg,
-            (0, import_utils16.isArray)(targetObject[seg]) ? (0, import_utils16.map)(targetObject[seg], idField) : (0, import_utils16.get)(targetObject, `${seg}.${idField}`)
-          );
+          const leaf = targetObject[seg];
+          const sourceForDest = leaf;
+          let depopulated;
+          if ((0, import_utils17.isArray)(leaf)) {
+            if (leaf.length === 0) {
+              depopulated = [];
+            } else if (leaf.every((item) => (0, import_utils17.isPlainObject)(item))) {
+              depopulated = (0, import_utils17.map)(leaf, idField).map((id, i) => {
+                if (id === void 0) {
+                  failMissingId(`${src}[${i}]`);
+                }
+                return id;
+              });
+            } else {
+              return;
+            }
+          } else if ((0, import_utils17.isPlainObject)(leaf)) {
+            const id = (0, import_utils17.get)(leaf, idField);
+            if (id === void 0) {
+              failMissingId(src);
+            }
+            depopulated = id;
+          } else {
+            return;
+          }
+          (0, import_utils17.set)(targetObject, dest, sourceForDest);
+          (0, import_utils17.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
+          if (!(0, import_utils17.isPlainObject)(target)) return ret;
           const targetObject = target;
-          if ((0, import_utils16.isArray)(targetObject[seg])) ret.push(...targetObject[seg]);
-          else ret.push(targetObject[seg]);
+          const next = targetObject[seg];
+          if ((0, import_utils17.isArray)(next)) ret.push(...next);
+          else if (next !== null && next !== void 0) ret.push(next);
           return ret;
         }, []);
       }
@@ -2574,10 +3380,10 @@ var Cache = class {
 };
 
 // src/core-shared.ts
-var import_utils18 = require("@web-ts-toolkit/utils");
+var import_utils19 = require("@web-ts-toolkit/utils");
 
 // src/permission.ts
-var import_utils17 = require("@web-ts-toolkit/utils");
+var import_utils18 = require("@web-ts-toolkit/utils");
 var Permission = class {
   constructor(permissions) {
     this.permissions = { ...permissions };
@@ -2593,7 +3399,7 @@ var Permission = class {
     return [permissionOrPermissions].concat(permissions);
   }
   hasKey(permission) {
-    return (0, import_utils17.hasOwn)(this.permissions, permission);
+    return (0, import_utils18.hasOwn)(this.permissions, permission);
   }
   has(permission) {
     return this.permissions[permission] === true;
@@ -2613,10 +3419,10 @@ var permission_default = Permission;
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils18.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils18.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils19.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils19.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils18.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils19.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -2630,9 +3436,24 @@ function optimizeAndFilter(clausesInput) {
       clauses.push(clause);
     }
   }
-  const dedupedClauses = clauses.filter(
-    (clause, index) => clauses.findIndex((item) => (0, import_utils18.isEqual)(item, clause)) === index
-  );
+  const dedupeKey = (value) => {
+    if ((0, import_utils19.isArray)(value)) {
+      return `[${value.map(dedupeKey).join(",")}]`;
+    }
+    if ((0, import_utils19.isPlainObject)(value)) {
+      return `{${Object.keys(value).sort().map((key) => `${key}:${dedupeKey(value[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+  };
+  const dedupedClauses = [];
+  const seenClauses = /* @__PURE__ */ new Set();
+  for (let x = 0; x < clauses.length; x++) {
+    const clause = clauses[x];
+    const key = dedupeKey(clause);
+    if (seenClauses.has(key)) continue;
+    seenClauses.add(key);
+    dedupedClauses.push(clause);
+  }
   const mergedClause = {};
   const remainingClauses = [];
   for (let x = 0; x < dedupedClauses.length; x++) {
@@ -2643,7 +3464,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils18.hasOwn)(mergedClause, key) && !(0, import_utils18.isEqual)(mergedClause[key], value)) {
+      if ((0, import_utils19.hasOwn)(mergedClause, key) && !(0, import_utils19.isEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -2654,24 +3475,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils18.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils19.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils18.isPlainObject)(filter2) || (0, import_utils18.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils19.isPlainObject)(filter2) || (0, import_utils19.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils18.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils19.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils18.isString)(idField)) {
+  if ((0, import_utils19.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -2687,11 +3508,11 @@ async function resolveAccessFilter({
 }) {
   let nextFilter = normalizeFilter(filter2);
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
-  if ((0, import_utils18.isFunction)(overrideFilterFn)) {
+  if ((0, import_utils19.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   const baseFilterFn = getOption(`baseFilter.${access}`, null);
-  if (!(0, import_utils18.isFunction)(baseFilterFn)) return nextFilter || {};
+  if (!(0, import_utils19.isFunction)(baseFilterFn)) return nextFilter || {};
   const baseFilter = normalizeFilter(
     cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
   );
@@ -2711,33 +3532,33 @@ async function setRequestPermissions(req) {
   const requestPermissionField = getGlobalOption("requestPermissionField");
   if (req[requestPermissionField]) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  if (!(0, import_utils18.isFunction)(globalPermissions)) return;
+  if (!(0, import_utils19.isFunction)(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
-  if ((0, import_utils18.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils18.isArray)(permissions)) req[requestPermissionField] = (0, import_utils18.arrayToRecord)(permissions);
-  else if ((0, import_utils18.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  if ((0, import_utils19.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils19.isArray)(permissions)) req[requestPermissionField] = (0, import_utils19.arrayToRecord)(permissions);
+  else if ((0, import_utils19.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils18.isBoolean)(routeGuard)) {
+  if ((0, import_utils19.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils18.isString)(routeGuard)) {
+  if ((0, import_utils19.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils18.isArray)(routeGuard)) {
+  if ((0, import_utils19.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils18.isFunction)(routeGuard)) {
+  if ((0, import_utils19.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils18.castArray)(hook);
+  const hooks = (0, import_utils19.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils18.isFunction)(hooks[x])) {
+    if ((0, import_utils19.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -2760,13 +3581,13 @@ async function collectSchemaFields({
     if (baseFields.includes(key)) continue;
     const val = permissionSchema[key];
     const value = val && val[access] || val;
-    if ((0, import_utils18.isBoolean)(value)) {
+    if ((0, import_utils19.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils18.isString)(value)) {
+    } else if ((0, import_utils19.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils18.isArray)(value)) {
+    } else if ((0, import_utils19.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils18.isFunction)(value)) {
+    } else if ((0, import_utils19.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
@@ -2800,7 +3621,7 @@ async function initializeAclRequest({
   await core.setPermissions();
   assignCore(core);
   req[PERMISSIONS] = core.getPermissions();
-  req[PERMISSION_KEYS] = req[PERMISSIONS].keys;
+  req[PERMISSION_KEYS] = [...req[PERMISSIONS].keys];
   req[flag] = true;
   return core;
 }
@@ -2855,7 +3676,7 @@ async function runDecorateAllHook({
 }
 
 // src/acl/select-resolution.ts
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 async function collectAllowedFieldsForRequest({
   req,
   permissionSchema,
@@ -2923,15 +3744,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils19.difference)(fields, normalizedSelect);
+        fields = (0, import_utils20.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils19.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils20.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(alwaysSelectFields);
   }
-  return (0, import_utils19.intersection)(normalizedSelect, fields);
+  return (0, import_utils20.intersection)(normalizedSelect, fields);
 }
 
 // src/core.ts
@@ -2945,10 +3766,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils20.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils21.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils20.isString)(idField)) {
+    if ((0, import_utils21.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -3026,11 +3847,11 @@ var Core = class {
   async genPopulate(modelName, access = "read", _populate = null) {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
-    populate = (0, import_utils20.compact)(
+    populate = (0, import_utils21.compact)(
       await Promise.all(
         populate.map(async (p) => {
-          const populateAccess = !(0, import_utils20.isString)(p) && p.access ? p.access : access;
-          const ret = (0, import_utils20.isString)(p) ? { path: p } : {
+          const populateAccess = !(0, import_utils21.isString)(p) && p.access ? p.access : access;
+          const ret = (0, import_utils21.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -3044,6 +3865,14 @@ var Core = class {
           if (!allowedParentPaths.includes(parentPath)) return null;
           const refModelName = getModelRef(modelName, ret.path);
           if (!refModelName) return null;
+          const runtime = getActiveRuntime();
+          if (runtime && !runtime.hasModel(refModelName)) {
+            return null;
+          }
+          const allowedTargetOperation = await this.req.macl.isAllowed(refModelName, populateAccess);
+          if (!allowedTargetOperation) {
+            return null;
+          }
           ret.select = await this.genSelect(refModelName, populateAccess, ret.select, false);
           const filter2 = await this.genFilter(refModelName, populateAccess, null);
           if (filter2 === false) return null;
@@ -3056,10 +3885,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils20.isFunction)(validate)) {
+    if ((0, import_utils21.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils20.isBoolean)(validate) || (0, import_utils20.isArray)(validate)) {
+    } else if ((0, import_utils21.isBoolean)(validate) || (0, import_utils21.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -3084,7 +3913,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils20.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils21.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -3108,14 +3937,17 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils20.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils21.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
-      } catch (error) {
-        logger.warn(
-          `docPermissions hook failed for model=${modelName} access=${access}: ${error instanceof Error ? error.message : String(error)}`
-        );
+      } catch (error2) {
+        warn("docPermissions hook failed; applying empty document permissions", {
+          modelName,
+          access,
+          operation: context.operation,
+          error: error2 instanceof Error ? error2.message : String(error2)
+        });
       }
     }
     return docPermissions;
@@ -3156,7 +3988,7 @@ var Core = class {
       readExists ? this.genAllowedFields(modelName, doc, "read") : [],
       updateExists ? this.genAllowedFields(modelName, doc, "update") : []
     ]);
-    const viewObj = (0, import_utils20.reduce)(
+    const viewObj = (0, import_utils21.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -3164,7 +3996,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils20.reduce)(
+    const editObj = (0, import_utils21.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -3188,9 +4020,9 @@ var Core = class {
     return runDecorateAllHook({ req: this.req, hook: decorateAll, docs, permissions, context });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils20.compact)((0, import_utils20.castArray)(task));
+    const tasks = (0, import_utils21.compact)((0, import_utils21.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils20.forEach)(tasks, (task2) => {
+    (0, import_utils21.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -3221,9 +4053,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils20.isUndefined)(subOption)) {
+      if ((0, import_utils21.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils20.isUndefined)(subFieldOption)) {
+        if ((0, import_utils21.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -3273,25 +4105,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils21.isPlainObject)(condition)) {
+    if ((0, import_utils22.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils21.isString)(id) ? id : null;
-      if ((0, import_utils21.isPlainObject)(id)) {
+      let _id = (0, import_utils22.isString)(id) ? id : null;
+      if ((0, import_utils22.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils21.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils22.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils21.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils22.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils21.isString)(_id) || !_id) {
+      if (!(0, import_utils22.isString)(_id) || !_id) {
         return next(new import_express_json_router2.default.clientErrors.BadRequestError());
       }
       const result = await svc._read(_id, { select });
@@ -3303,11 +4135,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils21.isString)(cond)) {
+    if ((0, import_utils22.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils21.isArray)(cond)) {
+    } else if ((0, import_utils22.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils21.isFunction)(cond)) {
+    } else if ((0, import_utils22.isFunction)(cond)) {
       const result = await cond.call(req, permissions);
       if (!!result) return next();
     }
@@ -3350,9 +4182,37 @@ function assertMutableRouterOptions(kind, options) {
 // src/http/response-pipelines/model-response.ts
 var import_express_json_router3 = __toESM(require("@web-ts-toolkit/express-json-router"));
 
+// src/http/response-pipelines/service-result.ts
+var toPublicErrorResult = (result) => ({
+  success: false,
+  code: result.code,
+  errors: result.errors
+});
+var toPublicSingleResult = (result) => ({
+  success: true,
+  kind: "single",
+  code: result.code,
+  data: result.data
+});
+var toPublicListResult = (result) => ({
+  success: true,
+  kind: "list",
+  code: result.code,
+  data: result.data,
+  count: result.count,
+  totalCount: result.totalCount ?? null
+});
+var toPublicServiceResult = (result) => {
+  if (result.kind === "error") {
+    return toPublicErrorResult(result);
+  }
+  return result.kind === "list" ? toPublicListResult(result) : toPublicSingleResult(result);
+};
+
 // src/http/response-pipelines/list-response.ts
 var formatListResponse = (req, result, includeCount, includeExtraHeaders) => {
-  const { data, count: returnedCount, totalCount } = result;
+  const publicResult = toPublicListResult(result);
+  const { data, count: returnedCount, totalCount } = publicResult;
   const query = result.query ?? {};
   const rawLimit = Number(query.limit ?? 0);
   const skip = Number(query.skip ?? 0);
@@ -3387,16 +4247,18 @@ var formatListResponse = (req, result, includeCount, includeExtraHeaders) => {
   return { data, meta };
 };
 var formatCreatedData = (result) => {
-  return result.count === 1 ? result.data[0] : result.data;
+  const publicResult = toPublicListResult(result);
+  return publicResult.count === 1 ? publicResult.data[0] : publicResult.data;
 };
 var formatUpsertCreatedData = (result) => {
-  return result.data.length > 0 ? result.data[0] : null;
+  const publicResult = toPublicListResult(result);
+  return publicResult.data.length > 0 ? publicResult.data[0] : null;
 };
 
 // src/http/response-pipelines/model-response.ts
 var success = import_express_json_router3.default.success;
 function unwrapServiceData(result) {
-  return result.data;
+  return result.kind === "list" ? toPublicListResult(result).data : toPublicSingleResult(result).data;
 }
 function formatModelListResponse(req, result, includeCount, includeExtraHeaders) {
   return formatListResponse(req, result, includeCount, includeExtraHeaders);
@@ -3405,7 +4267,13 @@ function formatModelCreatedResponse(result) {
   return new success.Created(formatCreatedData(result));
 }
 function formatModelUpsertResponse(result) {
-  return result.kind === "list" ? new success.Created(formatUpsertCreatedData(result)) : result.data;
+  if (result.kind === "list") {
+    return new success.Created(formatUpsertCreatedData(result));
+  }
+  if (result.kind === "single") {
+    return toPublicSingleResult(result).data;
+  }
+  throw new Error(`Unexpected ServiceResult kind: ${String(result.kind)}`);
 }
 
 // src/validation/parsers.ts
@@ -3414,9 +4282,12 @@ var import_express_json_router4 = __toESM(require("@web-ts-toolkit/express-json-
 // src/validation/common.ts
 var import_zod2 = require("zod");
 var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
+var safeIntegerString = (min, message) => import_zod2.z.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
 var queryBooleanString = import_zod2.z.enum(["true", "false"]);
-var positiveIntegerString = import_zod2.z.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = import_zod2.z.number().int().min(0);
+var nonNegativeIntegerString = safeIntegerString(0, "Expected a non-negative integer");
+var positiveIntegerString = safeIntegerString(1, "Expected a positive integer");
+var nonNegativeIntegerSchema = import_zod2.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var positiveIntegerSchema = import_zod2.z.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
 var unknownRecord = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
 var projectionObjectSchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(-1)]));
 var projectionSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), projectionObjectSchema]);
@@ -3517,6 +4388,10 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value);
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "parameter");
@@ -3524,6 +4399,10 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value ?? {});
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "pointer");
@@ -3626,10 +4505,10 @@ function fromYup(schema) {
         success: true,
         data
       };
-    } catch (error) {
+    } catch (error2) {
       return {
         success: false,
-        issues: normalizeYupIssues(error)
+        issues: normalizeYupIssues(error2)
       };
     }
   };
@@ -3732,10 +4611,10 @@ function fromVine(validator) {
         success: true,
         data: output
       };
-    } catch (error) {
+    } catch (error2) {
       return {
         success: false,
-        issues: normalizeVineError(error)
+        issues: normalizeVineError(error2)
       };
     }
   };
@@ -3756,11 +4635,11 @@ function normalizePathSegment(segment) {
 function isStandardSchemaPathSegment(segment) {
   return typeof segment === "object" && segment !== null && "key" in segment;
 }
-function normalizeYupIssues(error) {
-  if (!isYupValidationError(error)) {
+function normalizeYupIssues(error2) {
+  if (!isYupValidationError(error2)) {
     return [{ message: "Validation failed" }];
   }
-  const issues = error.inner?.length ? error.inner : [error];
+  const issues = error2.inner?.length ? error2.inner : [error2];
   return issues.map((issue) => ({
     message: issue.message,
     path: parsePathString(issue.path)
@@ -3811,11 +4690,11 @@ function normalizeSuperstructPath(failure) {
   if (typeof failure.key === "string" || typeof failure.key === "number") return [failure.key];
   return void 0;
 }
-function normalizeVineError(error) {
-  if (!isVineValidationError(error)) {
+function normalizeVineError(error2) {
+  if (!isVineValidationError(error2)) {
     return [{ message: "Validation failed" }];
   }
-  return error.messages.map((message) => ({
+  return error2.messages.map((message) => ({
     message: message.message,
     path: normalizeVineField(message)
   }));
@@ -3838,14 +4717,14 @@ function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
-function isYupValidationError(error) {
-  return typeof error === "object" && error !== null && "message" in error;
+function isYupValidationError(error2) {
+  return typeof error2 === "object" && error2 !== null && "message" in error2;
 }
 function isArkTypeErrors(value) {
   return Array.isArray(value);
 }
-function isVineValidationError(error) {
-  return typeof error === "object" && error !== null && "messages" in error && Array.isArray(error.messages);
+function isVineValidationError(error2) {
+  return typeof error2 === "object" && error2 !== null && "messages" in error2 && Array.isArray(error2.messages);
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -3868,9 +4747,9 @@ function buildPointer(path) {
 // src/validation/model-router.ts
 var import_zod3 = require("zod");
 var listQuerySchema = import_zod3.z.object({
-  skip: positiveIntegerString.optional(),
+  skip: nonNegativeIntegerString.optional(),
   limit: positiveIntegerString.optional(),
-  page: positiveIntegerString.optional(),
+  page: nonNegativeIntegerString.optional(),
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
@@ -3899,10 +4778,10 @@ var listBodySchema = import_zod3.z.object({
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   options: import_zod3.z.object({
     skim: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
@@ -3912,11 +4791,8 @@ var listBodySchema = import_zod3.z.object({
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
 var countBodySchema = import_zod3.z.object({
-  filter: objectOrArraySchema.optional(),
-  options: import_zod3.z.object({
-    access: import_zod3.z.unknown().optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
+  filter: objectOrArraySchema.optional()
+}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options"]));
 var readFilterBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
@@ -4010,10 +4886,10 @@ var dataListBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: import_zod4.z.string().optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod4.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod4.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   options: import_zod4.z.object({
     includeCount: import_zod4.z.boolean().optional(),
     includeExtraHeaders: import_zod4.z.boolean().optional()
@@ -4032,17 +4908,17 @@ var import_zod5 = require("zod");
 var rootEntryBaseSchema = {
   target: import_zod5.z.enum(["model", "data"]),
   name: import_zod5.z.string().min(1),
-  order: import_zod5.z.number().int().optional()
+  order: nonNegativeIntegerSchema.optional()
 };
 var rootModelListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
 var rootModelListOptionsSchema = import_zod5.z.object({
@@ -4098,16 +4974,14 @@ var rootModelSubReadArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = import_zod5.z.object({
-  access: import_zod5.z.unknown().optional()
-}).passthrough();
+var rootModelCountOptionsSchema = import_zod5.z.object({}).strict().optional();
 var rootDataListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   sort: import_zod5.z.string().optional(),
-  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
 var rootDataListOptionsSchema = import_zod5.z.object({
   includeCount: import_zod5.z.boolean().optional()
@@ -4115,8 +4989,21 @@ var rootDataListOptionsSchema = import_zod5.z.object({
 var rootDataReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional()
 }).passthrough();
+var rootModelNewArgsSchema = import_zod5.z.object({
+  select: projectionSchema.optional()
+}).passthrough();
+var rootModelNewOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional()
+}).passthrough();
 var rootModelQueryEntrySchema = import_zod5.z.union([
-  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("new") }).passthrough(),
+  import_zod5.z.object({
+    ...rootEntryBaseSchema,
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("new"),
+    args: rootModelNewArgsSchema.optional(),
+    options: rootModelNewOptionsSchema.optional()
+  }).passthrough(),
   import_zod5.z.object({
     ...rootEntryBaseSchema,
     target: import_zod5.z.literal("model"),
@@ -4231,7 +5118,7 @@ var rootModelQueryEntrySchema = import_zod5.z.union([
     op: import_zod5.z.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
-  }).passthrough()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["access"]))
 ]);
 var rootDataQueryEntrySchema = import_zod5.z.union([
   import_zod5.z.object({
@@ -4260,7 +5147,7 @@ var rootDataQueryEntrySchema = import_zod5.z.union([
 var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 
 // src/routers/shared.ts
-var import_utils22 = require("@web-ts-toolkit/utils");
+var import_utils23 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 function setModelCollectionRoutes(context) {
@@ -4278,14 +5165,14 @@ function setModelCollectionRoutes(context) {
     await context.assertAllowed(req, "list");
     const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils22.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils22.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils23.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils23.parseBooleanString)(include_extra_headers);
     const result = await svc._list(
       {},
       { skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils22.parseBooleanString)(skim),
-        includePermissions: (0, import_utils22.parseBooleanString)(include_permissions),
+        skim: (0, import_utils23.parseBooleanString)(skim),
+        includePermissions: (0, import_utils23.parseBooleanString)(include_permissions),
         includeCount
       }
     );
@@ -4340,7 +5227,7 @@ function setModelCollectionRoutes(context) {
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: (0, import_utils22.parseBooleanString)(include_permissions) });
+    const result = await svc._create(data, {}, { includePermissions: (0, import_utils23.parseBooleanString)(include_permissions) });
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
@@ -4374,7 +5261,7 @@ function setModelCollectionRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils22.parseBooleanString)(include_permissions),
+        includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -4390,8 +5277,9 @@ function setModelCollectionRoutes(context) {
     body: defineOpenApiSchemaResolver(getAdvancedCreateOpenApiBody)
   });
   router.get("/new", async (req) => {
+    await context.assertAllowed(req, "new");
     const svc = context.getPublicService(req);
-    const result = await svc._new();
+    const result = await svc._new({}, { includePermissions: false });
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -4439,16 +5327,13 @@ function setModelDocumentRoutes(context) {
   });
   router.post("/count", async (req) => {
     await context.assertAllowed(req, "count");
-    const { filter: filter2, options: countOptions = {} } = await parseBodyWithSchema(
+    const { filter: filter2 } = await parseBodyWithSchema(
       countBodySchema,
       req.body,
       context.getRequestSchema("requestSchemas.count")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._count(
-      filter2 ?? {},
-      countOptions.access
-    );
+    const result = await svc._count(filter2 ?? {});
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -4468,8 +5353,8 @@ function setModelDocumentRoutes(context) {
       id,
       {},
       {
-        includePermissions: (0, import_utils22.parseBooleanString)(include_permissions),
-        tryList: (0, import_utils22.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils23.parseBooleanString)(include_permissions),
+        tryList: (0, import_utils23.parseBooleanString)(try_list)
       }
     );
     handleResultError(result);
@@ -4554,8 +5439,8 @@ function setModelDocumentRoutes(context) {
       data,
       {},
       {
-        returningAll: (0, import_utils22.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils22.parseBooleanString)(include_permissions)
+        returningAll: (0, import_utils23.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils23.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
@@ -4593,8 +5478,8 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? (0, import_utils22.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils22.parseBooleanString)(include_permissions),
+        returningAll: returningAll ?? (0, import_utils23.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -4622,8 +5507,8 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils22.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils22.parseBooleanString)(include_permissions)
+        returningAll: (0, import_utils23.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils23.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
@@ -4659,8 +5544,8 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? (0, import_utils22.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils22.parseBooleanString)(include_permissions),
+        returningAll: returningAll ?? (0, import_utils23.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -4726,7 +5611,6 @@ function setModelDocumentRoutes(context) {
 }
 
 // src/routers/model-router-subdocument-routes.ts
-var import_utils23 = require("@web-ts-toolkit/utils");
 function setModelSubDocumentRoutes(context) {
   const subs = getModelSub(context.modelName);
   for (let x = 0; x < subs.length; x++) {
@@ -4756,7 +5640,10 @@ function setModelSubDocumentRoutes(context) {
           context.getRequestSchema("requestSchemas.subList")
         );
         const svc = context.getPublicService(req);
-        const result = await svc.listSub(id, sub, { filter: body.filter ?? {}, select: body.select ?? [] });
+        const result = await svc.listSub(id, sub, {
+          filter: body.filter ?? {},
+          select: body.select ?? []
+        });
         handleResultError(result);
         return unwrapServiceData(result);
       }
@@ -4816,10 +5703,11 @@ function setModelSubDocumentRoutes(context) {
           req.body,
           context.getRequestSchema("requestSchemas.subRead")
         );
-        const populate = body.populate;
-        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => (0, import_utils23.isString)(item) ? { path: item } : item) : (0, import_utils23.isString)(populate) ? { path: populate } : populate ?? [];
         const svc = context.getPublicService(req);
-        const result = await svc.readSub(id, sub, subId, { select: body.select ?? [], populate: normalizedPopulate });
+        const result = await svc.readSub(id, sub, subId, {
+          select: body.select ?? [],
+          populate: normalizeSubPopulate(body.populate)
+        });
         handleResultError(result);
         return unwrapServiceData(result);
       }
@@ -4913,7 +5801,7 @@ function setOption(parentKey, optionKey, option) {
   this.runtime.setModelOption(this.modelName, key, value);
   return this;
 }
-var ModelRouter = class {
+var ModelRouter = class _ModelRouter {
   constructor(modelName, initialOptions, runtime = defaultRuntime) {
     /**
      * The maximum limit of the number of documents returned from the `list` operation.
@@ -5067,17 +5955,21 @@ var ModelRouter = class {
     );
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
-    attachRuntimeToModel(modelName, this.runtime);
     this.options = this.runtime.getModelOptions(modelName);
     this.fullBasePath = (0, import_utils25.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router5.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
-    this.model = new model_default(modelName);
+    this.model = new model_default(modelName, this.runtime);
     this.setCollectionRoutes();
     this.setDocumentRoutes();
     this.setSubDocumentRoutes();
     this.logEndpoints();
   }
+  static fromModel(model, initialOptions, runtime = defaultRuntime) {
+    const modelName = String(model.modelName);
+    runtime.registerModelInstance(modelName, model);
+    return new _ModelRouter(modelName, initialOptions, runtime);
+  }
   getRequestSchema(key) {
     return this.runtime.getExactModelOption(
       this.modelName,
@@ -5141,8 +6033,8 @@ var ModelRouter = class {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils25.forEach)(this.router.endpoints, ({ method, path }) => {
-        logger.info(`${(0, import_utils25.padEnd)(method, 6)} ${(0, import_utils25.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils25.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils25.padEnd)(method, 6)} ${(0, import_utils25.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
@@ -5346,16 +6238,19 @@ async function decorateDataSingleResult(svc, result, context = {}) {
 
 // src/routers/root-router.ts
 var clientErrors3 = import_express_json_router6.default.clientErrors;
+var DEFAULT_MAX_BATCH_ENTRIES = 100;
+var DEFAULT_MAX_ORDER_GROUPS = 25;
+var DEFAULT_MAX_CONCURRENT_OPERATIONS = 10;
 var createErrorResult = (code, detail) => ({
   success: false,
+  kind: "error",
   code,
   errors: [{ detail }]
 });
-var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => (0, import_utils26.isString)(item) ? { path: item } : item) : (0, import_utils26.isString)(populate) ? { path: populate } : populate ?? [];
 var RootRouter = class {
   constructor(options = { basePath: "", operationAccess: true }, runtime = defaultRuntime) {
     this.modelOperations = {
-      new: async (req, item) => req.macl.getPublicService(item.name)._new(),
+      new: async (req, item) => req.macl.getPublicService(item.name)._new(item.args, item.options),
       list: async (req, item) => req.macl.getPublicService(item.name)._list(item.filter ?? {}, item.args, item.options),
       read: async (req, item) => {
         const svc = req.macl.getPublicService(item.name);
@@ -5378,7 +6273,7 @@ var RootRouter = class {
       subBulkUpdate: async (req, item) => req.macl.getPublicService(item.name).bulkUpdateSub(item.id, item.sub, item.data),
       subDelete: async (req, item) => req.macl.getPublicService(item.name).deleteSub(item.id, item.sub, item.subId),
       distinct: async (req, item) => req.macl.getPublicService(item.name)._distinct(item.field, { filter: item.filter }),
-      count: async (req, item) => req.macl.getPublicService(item.name)._count(item.filter ?? {}, item.options?.access)
+      count: async (req, item) => req.macl.getPublicService(item.name)._count(item.filter ?? {})
     };
     this.dataOperations = {
       list: async (req, item) => {
@@ -5413,10 +6308,16 @@ var RootRouter = class {
         return decorateDataSingleResult(svc, result, { dataName: item.name });
       }
     };
-    const { basePath, operationAccess } = options;
+    const { basePath, operationAccess, maxBatchEntries, maxOrderGroups, maxConcurrentOperations } = options;
     this.runtime = runtime;
     this.basename = basePath || "";
     this.operationAccess = operationAccess;
+    this.maxBatchEntries = this.normalizePositiveLimit(maxBatchEntries, DEFAULT_MAX_BATCH_ENTRIES);
+    this.maxOrderGroups = this.normalizePositiveLimit(maxOrderGroups, DEFAULT_MAX_ORDER_GROUPS);
+    this.maxConcurrentOperations = this.normalizePositiveLimit(
+      maxConcurrentOperations,
+      DEFAULT_MAX_CONCURRENT_OPERATIONS
+    );
     this.router = new import_express_json_router6.default(
       this.basename,
       [createSetCore(this.runtime), createSetDataCore(this.runtime)],
@@ -5433,7 +6334,7 @@ var RootRouter = class {
       target: item.target,
       name: item.name,
       op: item.op,
-      result,
+      result: toPublicServiceResult(result),
       message: mapCodeToMessage(result.code),
       statusCode: mapCodeToStatusCode(result.code)
     };
@@ -5484,17 +6385,63 @@ var RootRouter = class {
     return this.wrapResult(index, item, await handler(req, item));
   }
   groupItemsByOrder(items) {
-    return items.reduce((acc, item, index) => {
-      let order = 0;
-      if ((0, import_utils26.isNumber)(item.order)) {
-        order = item.order < 0 ? 0 : item.order;
+    const groups = /* @__PURE__ */ new Map();
+    items.forEach((item, index) => {
+      const order = (0, import_utils26.isNumber)(item.order) ? item.order : 0;
+      const group = groups.get(order);
+      if (group) {
+        group.push({ index, item });
+        return;
+      }
+      groups.set(order, [{ index, item }]);
+    });
+    return Array.from(groups.entries()).sort(([leftOrder], [rightOrder]) => leftOrder - rightOrder).map(([, group]) => group);
+  }
+  normalizePositiveLimit(value, fallback) {
+    return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+  }
+  validateBatch(items) {
+    if (items.length > this.maxBatchEntries) {
+      throw new clientErrors3.BadRequestError("Bad Request", {
+        errors: [{ detail: `Root batch exceeds maximum size of ${this.maxBatchEntries}` }]
+      });
+    }
+    const orders = /* @__PURE__ */ new Set();
+    for (const item of items) {
+      const order = item.order ?? 0;
+      if (!Number.isSafeInteger(order) || order < 0) {
+        throw new clientErrors3.BadRequestError("Bad Request", {
+          errors: [{ detail: "Root batch order must be a non-negative safe integer" }]
+        });
       }
-      if (!acc[order]) {
-        acc[order] = [];
+      if (order > this.maxOrderGroups) {
+        throw new clientErrors3.BadRequestError("Bad Request", {
+          errors: [{ detail: `Root batch order exceeds maximum group index of ${this.maxOrderGroups}` }]
+        });
       }
-      acc[order].push({ index, item });
-      return acc;
-    }, []);
+      orders.add(order);
+    }
+    if (orders.size > this.maxOrderGroups) {
+      throw new clientErrors3.BadRequestError("Bad Request", {
+        errors: [{ detail: `Root batch exceeds maximum order groups of ${this.maxOrderGroups}` }]
+      });
+    }
+  }
+  async runGroup(req, entries) {
+    const results = new Array(entries.length);
+    let cursor = 0;
+    const workerCount = Math.min(this.maxConcurrentOperations, entries.length);
+    await Promise.all(
+      Array.from({ length: workerCount }, async () => {
+        while (cursor < entries.length) {
+          const current = cursor;
+          cursor += 1;
+          const { item, index } = entries[current];
+          results[current] = await this.processOp(req, item, index);
+        }
+      })
+    );
+    return results;
   }
   async assertAllowed(req) {
     const allowed = await req.macl.canActivate(this.operationAccess);
@@ -5504,10 +6451,11 @@ var RootRouter = class {
     this.router.post("", async (req) => {
       await this.assertAllowed(req);
       const items = parseBody(rootQuerySchema, req.body);
+      this.validateBatch(items);
       const groupedItems = this.groupItemsByOrder(items);
       const results = [];
       for (let x = 0; x < groupedItems.length; x++) {
-        const arrResult = await Promise.all(groupedItems[x].map(({ item, index }) => this.processOp(req, item, index)));
+        const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
       return (0, import_utils26.orderBy)(results, ["index"], ["asc"]);
@@ -5517,7 +6465,8 @@ var RootRouter = class {
       path: "",
       operationId: "root.query",
       summary: "Execute batched model and data operations",
-      body: rootQuerySchema
+      body: rootQuerySchema,
+      idempotent: true
     });
   }
   get routes() {
@@ -5600,8 +6549,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils22.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils22.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils23.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils23.parseBooleanString)(include_extra_headers);
       const result = await svc.find(
         {},
         { skip, limit, page, pageSize: page_size },
@@ -5664,7 +6613,7 @@ var DataRouter = class {
       const result = await svc.findById(id, {}, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "get",
@@ -5683,7 +6632,7 @@ var DataRouter = class {
       const result = await svc.findOne(filter2 ?? {}, { select }, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -5706,7 +6655,7 @@ var DataRouter = class {
       const result = await svc.findById(id, { select }, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -5751,6 +6700,9 @@ var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-
 var import_express = __toESM(require("express"));
 var import_node_path = require("path");
 var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+var escapeInlineScriptJson = (value) => {
+  return value.replace(/<\/script/gi, "<\\/script").replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+};
 var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
 <html lang="en">
 <head>
@@ -5764,7 +6716,7 @@ var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
   <script src="${escapeHtml(bundleUrl)}"></script>
   <script>
     window.ui = SwaggerUIBundle({
-      url: ${JSON.stringify(specPath)},
+      url: ${escapeInlineScriptJson(JSON.stringify(specPath))},
       dom_id: '#swagger-ui',
       deepLinking: true,
       presets: [SwaggerUIBundle.presets.apis],
@@ -5819,10 +6771,10 @@ var accessRouterResponseHandler = import_express_json_router8.default.createHand
   errorFormat: import_express_json_router8.default.ErrorFormats.rfc9457,
   rfc9457ContentType: "application/problem+json"
 });
-accessRouterResponseHandler.errorMessageProvider = function(error) {
-  const errorLike = error;
-  logger.error(error);
-  return errorLike.message || errorLike._message || String(error);
+accessRouterResponseHandler.errorMessageProvider = function(error2) {
+  const errorLike = error2;
+  error(error2);
+  return errorLike.message || errorLike._message || String(error2);
 };
 
 // src/plugins.ts
@@ -5835,6 +6787,7 @@ function permissionsPlugin(schema, options) {
 }
 
 // src/index.ts
+var isMongooseModel = (value) => typeof value === "function" && value !== null && "modelName" in value && "schema" in value;
 function createRuntimeApi(runtime) {
   const runtimeMiddleware = function() {
     return createSetCore(runtime);
@@ -5842,8 +6795,18 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    const resolvedModelName = typeof modelName === "string" ? modelName : modelName && "modelName" in modelName ? modelName.modelName : modelName;
-    return (0, import_utils28.isUndefined)(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
+    if ((0, import_utils28.isUndefined)(options)) {
+      return new RootRouter(modelName, runtime);
+    }
+    if (typeof modelName === "string") {
+      return new ModelRouter(modelName, options, runtime);
+    }
+    if (isMongooseModel(modelName)) {
+      const name = String(modelName.modelName);
+      runtime.registerModelInstance(name, modelName);
+      return ModelRouter.fromModel(modelName, options, runtime);
+    }
+    throw new TypeError(`createRouter: unsupported first argument type: ${typeof modelName}`);
   };
   wtt2.createDataRouter = function(dataName, options) {
     return new DataRouter(dataName, options, runtime);
@@ -5874,6 +6837,9 @@ function createRuntimeApi(runtime) {
   wtt2.setDefaultModelOption = runtime.setDefaultModelOption.bind(runtime);
   wtt2.getDefaultModelOptions = runtime.getDefaultModelOptions.bind(runtime);
   wtt2.getDefaultModelOption = runtime.getDefaultModelOption.bind(runtime);
+  wtt2.registerModelInstance = runtime.registerModelInstance.bind(runtime);
+  wtt2.hasModelInstance = runtime.hasModelInstance.bind(runtime);
+  wtt2.getModelInstance = runtime.getModelInstance.bind(runtime);
   wtt2.RootRouter = RootRouter;
   wtt2.ModelRouter = ModelRouter;
   wtt2.DataRouter = DataRouter;
@@ -5890,11 +6856,14 @@ var index_default = acl;
   AccessRuntime,
   DataRouter,
   ModelRouter,
+  OpenApiCollisionError,
+  OpenApiRegistry,
   RootRouter,
   acl,
   combineRoutes,
   createAccessRuntime,
   createOpenApiRouter,
+  defaultRuntime,
   defineRequestSchema,
   fromAjv,
   fromArkType,
@@ -5910,12 +6879,19 @@ var index_default = acl;
   getDefaultModelOptions,
   getGlobalOption,
   getGlobalOptions,
+  getModelInstance,
   getModelJsonSchema,
   getModelNames,
   getModelOption,
   getModelOptions,
   guard,
+  hasModelInstance,
+  isLevelEnabled,
   permissionsPlugin,
+  redactFilter,
+  redactPayload,
+  registerModelInstance,
+  safeStringify,
   setDefaultModelOption,
   setDefaultModelOptions,
   setGlobalOption,