@web-ts-toolkit/access-router 0.32.0 → 0.33.0

package/index.mjs

@@ -1,16 +1,16 @@
 // src/index.ts
-import { isPlainObject as isPlainObject14, isString as isString12, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject17, isString as isString10, isUndefined as isUndefined4 } from "@web-ts-toolkit/utils";
 
 // src/middleware.ts
 import JsonRouter2 from "@web-ts-toolkit/express-json-router";
-import { isArray as isArray10, isFunction as isFunction6, isPlainObject as isPlainObject11, isString as isString7 } from "@web-ts-toolkit/utils";
+import { isArray as isArray11, isFunction as isFunction6, isPlainObject as isPlainObject14, isString as isString7 } from "@web-ts-toolkit/utils";
 
 // src/core.ts
 import {
-  castArray as castArray5,
+  castArray as castArray4,
   compact as compact3,
   forEach as forEach7,
-  isArray as isArray9,
+  isArray as isArray10,
   isBoolean as isBoolean5,
   isFunction as isFunction5,
   isString as isString6,
@@ -25,11 +25,11 @@ import {
   addLeadingSlash,
   forEach as forEach2,
   get as get3,
-  isArray as isArray4,
+  isArray as isArray5,
   isBoolean,
   isFunction,
   isNil as isNil2,
-  isPlainObject as isPlainObject7,
+  isPlainObject as isPlainObject9,
   isString as isString4,
   keys
 } from "@web-ts-toolkit/utils";
@@ -52,7 +52,13 @@ import { Document } from "mongoose";
 import { get, isPlainObject as isPlainObject2, pick, set } from "@web-ts-toolkit/utils";
 
 // src/helpers/query.ts
-import { flattenDeep, isNaN, isNil, isPlainObject, isString, reduce } from "@web-ts-toolkit/utils";
+import { flattenDeep, isNil, isPlainObject, isString, reduce } from "@web-ts-toolkit/utils";
+var normalizeSafeInteger = (value, min) => {
+  if (isNil(value)) return null;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < min) return null;
+  return parsed;
+};
 function genPagination({
   skip,
   limit,
@@ -60,13 +66,21 @@ function genPagination({
   pageSize
 }, hardLimit) {
   let _skip = 0;
-  let _limit = Number(limit ?? pageSize);
-  if (isNaN(_limit) || _limit > hardLimit) _limit = hardLimit;
-  if (!isNil(skip)) {
-    _skip = Number(skip);
-  } else if (!isNil(page)) {
-    const npage = Number(page);
-    if (npage > 1) _skip = (npage - 1) * _limit;
+  let _limit = normalizeSafeInteger(limit ?? pageSize, 1) ?? hardLimit;
+  if (!Number.isSafeInteger(_limit) || _limit > hardLimit) _limit = hardLimit;
+  const normalizedSkip = normalizeSafeInteger(skip, 0);
+  const normalizedPage = normalizeSafeInteger(page, 0);
+  if (normalizedSkip !== null) {
+    _skip = normalizedSkip;
+  } else if (normalizedPage !== null) {
+    const npage = normalizedPage;
+    if (npage > 1) {
+      const derivedSkip = (npage - 1) * _limit;
+      _skip = Number.isSafeInteger(derivedSkip) ? derivedSkip : Number.MAX_SAFE_INTEGER;
+    }
+  }
+  if (!Number.isSafeInteger(_skip) || _skip < 0) {
+    return { skip: 0, limit: _limit };
   }
   return { skip: _skip, limit: _limit };
 }
@@ -135,6 +149,7 @@ async function populateDoc(doc, target) {
   if (isPromise(p)) return p;
   return "execPopulate" in p && p.execPopulate?.();
 }
+var normalizeSubPopulate = (populate) => isArray(populate) ? populate.map((item) => isString2(item) ? { path: item } : item) : isString2(populate) ? { path: populate } : populate ?? [];
 var genSubPopulate = (sub, popul) => {
   if (!popul) return [];
   let populate = isArray(popul) ? popul : [popul];
@@ -150,7 +165,7 @@ var genSubPopulate = (sub, popul) => {
 
 // src/helpers/errors.ts
 import JsonRouter from "@web-ts-toolkit/express-json-router";
-var { BadRequestError, ForbiddenError, NotFoundError, UnprocessableEntityError } = JsonRouter.clientErrors;
+var { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError, UnprocessableEntityError } = JsonRouter.clientErrors;
 function mapCodeToMessage(code) {
   switch (code) {
     case "success" /* Success */:
@@ -159,6 +174,8 @@ function mapCodeToMessage(code) {
       return "Created";
     case "bad_request" /* BadRequest */:
       return "Bad Request";
+    case "unauthorized" /* Unauthorized */:
+      return "Unauthorized";
     case "forbidden" /* Forbidden */:
       return "Forbidden";
     case "not_found" /* NotFound */:
@@ -175,6 +192,8 @@ function mapCodeToStatusCode(code) {
       return 201 /* Created */;
     case "bad_request" /* BadRequest */:
       return 400 /* BadRequest */;
+    case "unauthorized" /* Unauthorized */:
+      return 401 /* Unauthorized */;
     case "forbidden" /* Forbidden */:
       return 403 /* Forbidden */;
     case "not_found" /* NotFound */:
@@ -185,11 +204,14 @@ function mapCodeToStatusCode(code) {
 }
 function handleResultError(result) {
   if (result.success) return;
+  if (result.kind !== "error") return;
   const { code, errors = [] } = result;
   const errorOptions = { errors };
   switch (code) {
     case "bad_request" /* BadRequest */:
       throw new BadRequestError("Bad Request", errorOptions);
+    case "unauthorized" /* Unauthorized */:
+      throw new UnauthorizedError("Unauthorized", errorOptions);
     case "forbidden" /* Forbidden */:
       throw new ForbiddenError("Forbidden", errorOptions);
     case "not_found" /* NotFound */:
@@ -516,22 +538,102 @@ function buildOpenApiSpec(routes, options) {
   };
 }
 
+// src/openapi/errors.ts
+var OpenApiCollisionError = class extends Error {
+  constructor(message, details) {
+    super(message);
+    this.name = "OpenApiCollisionError";
+    this.collisionKind = details.collisionKind;
+    this.method = details.method;
+    this.path = details.path;
+    this.operationId = details.operationId;
+    this.existing = details.existing;
+    this.incoming = details.incoming;
+  }
+};
+
 // src/openapi/registry.ts
+var isPlainObject7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var stableKey = (value) => {
+  if (value === null || typeof value === "undefined") return "null";
+  if (typeof value === "function") return "[Function]";
+  if (typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableKey).join(",")}]`;
+  }
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableKey(obj[k])}`).join(",")}}`;
+};
+var descriptorsEqual = (a, b) => {
+  return a.method === b.method && a.path === b.path && (a.operationId ?? "") === (b.operationId ?? "") && (a.acl ?? "") === (b.acl ?? "") && stableKey(a.query) === stableKey(b.query) && stableKey(a.body) === stableKey(b.body) && stableKey(a.pathParams) === stableKey(b.pathParams) && stableKey(a.responses) === stableKey(b.responses) && stableKey(a.tags) === stableKey(b.tags) && (a.summary ?? "") === (b.summary ?? "") && (a.description ?? "") === (b.description ?? "") && Boolean(a.deprecated) === Boolean(b.deprecated);
+};
 var OpenApiRegistry = class {
-  constructor() {
+  constructor(options = {}) {
     this.routes = [];
+    this.options = {
+      rejectConflicts: options.rejectConflicts ?? true,
+      rejectDuplicateOperationIds: options.rejectDuplicateOperationIds ?? true
+    };
   }
   register(route) {
     const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
     if (existingIndex === -1) {
+      this.assertOperationIdAvailable(route);
       this.routes.push(route);
       return;
     }
+    const existing = this.routes[existingIndex];
+    if (route.allowReplace) {
+      this.assertOperationIdAvailable(route, existing);
+      this.routes[existingIndex] = route;
+      return;
+    }
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject7(existing) && existing.idempotent)) {
+      return;
+    }
+    if (this.options.rejectConflicts) {
+      throw new OpenApiCollisionError(
+        `OpenAPI route collision: ${route.method.toUpperCase()} ${route.path} is already registered` + (existing.operationId ? ` as operationId="${existing.operationId}"` : "") + (route.operationId ? `; new registration uses operationId="${route.operationId}"` : "") + ". Set allowReplace:true on the new descriptor to override, or fix the duplicate registration.",
+        {
+          collisionKind: "path",
+          method: route.method,
+          path: route.path,
+          existing,
+          incoming: route
+        }
+      );
+    }
     this.routes[existingIndex] = route;
   }
+  assertOperationIdAvailable(route, replacing) {
+    if (!this.options.rejectDuplicateOperationIds) return;
+    if (!route.operationId) return;
+    const clash = this.routes.find(
+      (item) => item.operationId && item.operationId === route.operationId && item !== replacing
+    );
+    if (clash) {
+      if (route.idempotent && clash.idempotent) return;
+      throw new OpenApiCollisionError(
+        `OpenAPI operationId collision: "${route.operationId}" is already bound to ${clash.method.toUpperCase()} ${clash.path}. Each operationId must be unique across the spec.`,
+        {
+          collisionKind: "operationId",
+          operationId: route.operationId,
+          existing: clash,
+          incoming: route
+        }
+      );
+    }
+  }
   getRoutes() {
     return [...this.routes];
   }
+  clear() {
+    this.routes.length = 0;
+  }
+  setStrictMode(enabled) {
+    this.options.rejectConflicts = enabled;
+    this.options.rejectDuplicateOperationIds = enabled;
+  }
   getSpec(info) {
     return buildOpenApiSpec(this.routes, info);
   }
@@ -553,8 +655,8 @@ var defaultLogger = createLogger({
     format.label({ label: "[WTT]" }),
     format.timestamp(),
     format.printf(({ level, label, message, timestamp, stack, ...meta }) => {
-      const formattedLabel = colorizer.colorize(level, label);
-      const formattedLevel = colorizer.colorize(level, `[${level.toUpperCase()}]`);
+      const formattedLabel = colorizer.colorize(level, String(label));
+      const formattedLevel = colorizer.colorize(level, `[${String(level).toUpperCase()}]`);
       const formattedMessage = colorizer.colorize(level, inspectValue(stack ?? message));
       const formattedMeta = Object.keys(meta).length > 0 ? ` ${inspectValue(meta)}` : "";
       return `${formattedLabel} ${timestamp} ${formattedLevel} ${formattedMessage}${formattedMeta}`;
@@ -589,8 +691,8 @@ var OptionsManager = class {
     this.currentOptions = new Proxy({}, {
       set(target, key, value) {
         const keystr = String(key);
-        const oldvalue = target[key];
-        target[key] = value;
+        const oldvalue = target[keystr];
+        target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
       }
@@ -618,8 +720,116 @@ var OptionsManager = class {
   }
 };
 
+// src/request-complexity.ts
+import { isArray as isArray4, isPlainObject as isPlainObject8 } from "@web-ts-toolkit/utils";
+var defaultRequestComplexity = {
+  maxDepth: 8,
+  maxNodes: 500,
+  maxLogicalClauses: 50,
+  maxInValues: 100,
+  maxBulkItems: 100,
+  maxIncludeCount: 10,
+  maxSubQueryCount: 10,
+  maxBulkConcurrency: 10
+};
+var normalizePositiveInteger = (value, fallback) => {
+  return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+};
+var resolveRequestComplexity = (options) => ({
+  maxDepth: normalizePositiveInteger(options?.maxDepth, defaultRequestComplexity.maxDepth),
+  maxNodes: normalizePositiveInteger(options?.maxNodes, defaultRequestComplexity.maxNodes),
+  maxLogicalClauses: normalizePositiveInteger(options?.maxLogicalClauses, defaultRequestComplexity.maxLogicalClauses),
+  maxInValues: normalizePositiveInteger(options?.maxInValues, defaultRequestComplexity.maxInValues),
+  maxBulkItems: normalizePositiveInteger(options?.maxBulkItems, defaultRequestComplexity.maxBulkItems),
+  maxIncludeCount: normalizePositiveInteger(options?.maxIncludeCount, defaultRequestComplexity.maxIncludeCount),
+  maxSubQueryCount: normalizePositiveInteger(options?.maxSubQueryCount, defaultRequestComplexity.maxSubQueryCount),
+  maxBulkConcurrency: normalizePositiveInteger(
+    options?.maxBulkConcurrency,
+    defaultRequestComplexity.maxBulkConcurrency
+  )
+});
+function validateRequestComplexity(value, options, scope = "request") {
+  const limits = resolveRequestComplexity(options);
+  const errors = [];
+  let nodes = 0;
+  let logicalClauses = 0;
+  let includeCount = 0;
+  let subQueryCount = 0;
+  const pointer = (path) => path.length === 0 ? "#" : `#/${path.join("/")}`;
+  const pushError = (detail, path) => {
+    if (errors.length === 0) {
+      errors.push({ detail, pointer: pointer(path) });
+    }
+  };
+  const visit = (current, path, depth, parentKey) => {
+    if (errors.length > 0) return;
+    nodes += 1;
+    if (nodes > limits.maxNodes) {
+      pushError(`Request exceeds maximum node budget of ${limits.maxNodes}`, path);
+      return;
+    }
+    if (depth > limits.maxDepth) {
+      pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
+      return;
+    }
+    if (isArray4(current)) {
+      if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
+        logicalClauses += current.length;
+        if (logicalClauses > limits.maxLogicalClauses) {
+          pushError(`Filter exceeds maximum logical clause budget of ${limits.maxLogicalClauses}`, path);
+          return;
+        }
+      }
+      if (parentKey === "$in") {
+        if (current.length > limits.maxInValues) {
+          pushError(`Filter exceeds maximum $in values of ${limits.maxInValues}`, path);
+          return;
+        }
+      }
+      for (let index = 0; index < current.length; index++) {
+        visit(current[index], path.concat(index), depth + 1, parentKey);
+        if (errors.length > 0) return;
+      }
+      return;
+    }
+    if (!isPlainObject8(current)) return;
+    for (const [key, child] of Object.entries(current)) {
+      if (key === "__proto__" || key === "prototype" || key === "constructor") {
+        pushError(`Unsupported key: ${key}`, path.concat(key));
+        return;
+      }
+      if (scope === "request" && key === "include") {
+        includeCount += isArray4(child) ? child.length : 1;
+        if (includeCount > limits.maxIncludeCount) {
+          pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
+          return;
+        }
+      }
+      if (key === "$$sq") {
+        subQueryCount += 1;
+        if (subQueryCount > limits.maxSubQueryCount) {
+          pushError(`Request exceeds maximum subquery count of ${limits.maxSubQueryCount}`, path.concat(key));
+          return;
+        }
+        visit(child, path.concat(key), depth + 1, key);
+        if (errors.length > 0) return;
+        continue;
+      }
+      visit(child, path.concat(key), depth + 1, key);
+      if (errors.length > 0) return;
+    }
+  };
+  visit(value, [], 0);
+  return errors;
+}
+
 // src/runtime.ts
-mschema2Jsonschema(mongoose);
+var mongooseJsonSchemaInitialized = false;
+var ensureMongooseJsonSchemaInitialized = () => {
+  if (mongooseJsonSchemaInitialized) return;
+  mschema2Jsonschema(mongoose);
+  mongooseJsonSchemaInitialized = true;
+};
 var pluralize = mongoose.pluralize();
 var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
 var defaultModelOptions = {
@@ -628,6 +838,7 @@ var defaultModelOptions = {
 };
 var defaultDataOptions = {
   basePath: null,
+  parentPath: "/",
   queryRouteSegment: "__query"
 };
 var normalizeBasePath = (name, value) => {
@@ -643,9 +854,9 @@ var hasModelPermission = (value, modelPermissionPrefix) => {
   if (isString4(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if (isArray4(value)) {
+  if (isArray5(value)) {
     return value.some((item) => {
-      if (isString4(item) || isArray4(item)) {
+      if (isString4(item) || isArray5(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
@@ -659,13 +870,13 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const modelPermissionKeys = {};
   forEach2(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = isPlainObject7(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = isPlainObject9(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!isArray4(globalPermissionKeys[accessKey])) {
+      if (!isArray5(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!isArray4(modelPermissionKeys[accessKey])) {
+      if (!isArray5(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
       if (isBoolean(value)) {
@@ -690,7 +901,8 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
-      logger: defaultLogger
+      logger: defaultLogger,
+      requestComplexity: defaultRequestComplexity
     }).build();
     this.defaultModelOptions = new OptionsManager({
       listHardLimit: 1e3,
@@ -709,14 +921,50 @@ var AccessRuntime = class {
     this.modelRefs = {};
     this.modelSubs = {};
     this.modelAtts = {};
+    this.modelInstances = {};
     this.openApiRegistry = new OpenApiRegistry();
+    ensureMongooseJsonSchemaInitialized();
+  }
+  registerModelInstance(modelName, model) {
+    if (!modelName || typeof modelName !== "string") {
+      throw new TypeError(`registerModelInstance: modelName must be a non-empty string, received ${typeof modelName}`);
+    }
+    const existing = this.modelInstances[modelName];
+    if (existing && existing !== model) {
+      throw new Error(
+        `Runtime model registry conflict: model "${modelName}" is already registered to a different mongoose.Model instance on this runtime. Use a distinct model name or a separate runtime.`
+      );
+    }
+    this.modelInstances[modelName] = model;
+  }
+  hasModelInstance(modelName) {
+    return modelName in this.modelInstances;
+  }
+  getModelInstance(modelName) {
+    const registered = this.modelInstances[modelName];
+    if (registered) return registered;
+    const global = mongoose.models[modelName];
+    return global ?? null;
   }
   registerOpenApiRoute(route) {
     this.openApiRegistry.register(route);
   }
+  /**
+   * Enable strict OpenAPI collision detection for the remainder of this
+   * runtime's lifetime. After this call, conflicting method/path
+   * registrations and duplicate operationIds throw {@link OpenApiCollisionError}
+   * instead of silently replacing. Existing already-registered routes are
+   * not retroactively re-validated.
+   */
+  enableOpenApiCollisionDetection() {
+    this.openApiRegistry.setStrictMode(true);
+  }
   getOpenApiRoutes() {
     return this.openApiRegistry.getRoutes();
   }
+  clearOpenApiRoutes() {
+    this.openApiRegistry.clear();
+  }
   getOpenApiSpec(info) {
     return this.openApiRegistry.getSpec(info);
   }
@@ -745,7 +993,7 @@ var AccessRuntime = class {
     return this.defaultModelOptions.get(key, defaultValue);
   }
   createModelOptions(modelName) {
-    const model = mongoose.model(modelName);
+    const model = this.getModelInstance(modelName) ?? mongoose.model(modelName);
     const manager = new OptionsManager({
       ...defaultModelOptions,
       modelName
@@ -861,7 +1109,7 @@ var AccessRuntime = class {
     if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
       return;
     }
-    const model = mongoose.models[modelName];
+    const model = this.getModelInstance(modelName);
     if (!model) {
       this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
       this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
@@ -891,8 +1139,6 @@ var defaultRuntime = new AccessRuntime();
 
 // src/runtime-context.ts
 import { AsyncLocalStorage } from "async_hooks";
-import mongoose2 from "mongoose";
-var ACCESS_RUNTIME = /* @__PURE__ */ Symbol("access-runtime");
 var runtimeStorage = new AsyncLocalStorage();
 function runWithRuntime(runtime, callback) {
   return runtimeStorage.run(runtime, callback);
@@ -900,16 +1146,6 @@ function runWithRuntime(runtime, callback) {
 function getActiveRuntime() {
   return runtimeStorage.getStore() ?? null;
 }
-function attachRuntimeToModel(modelName, runtime) {
-  const model = mongoose2.models[modelName];
-  if (model) {
-    model[ACCESS_RUNTIME] = runtime;
-  }
-}
-function getRuntimeForModelName(modelName) {
-  const model = mongoose2.models[modelName];
-  return model?.[ACCESS_RUNTIME] ?? null;
-}
 
 // src/options/global-options.ts
 var getRuntime = () => getActiveRuntime() ?? defaultRuntime;
@@ -927,27 +1163,36 @@ var getGlobalOption = (key, defaultValue) => {
 };
 
 // src/options/model-options.ts
-var getRuntime2 = (modelName) => getRuntimeForModelName(modelName) ?? getActiveRuntime() ?? defaultRuntime;
+var getRuntime2 = () => getActiveRuntime() ?? defaultRuntime;
 var setModelOptions = (modelName, options) => {
-  getRuntime2(modelName).setModelOptions(modelName, options);
+  getRuntime2().setModelOptions(modelName, options);
 };
 var setModelOption = (modelName, key, value) => {
-  getRuntime2(modelName).setModelOption(modelName, key, value);
+  getRuntime2().setModelOption(modelName, key, value);
 };
 var getModelOptions = (modelName) => {
-  return getRuntime2(modelName).getModelOptions(modelName);
+  return getRuntime2().getModelOptions(modelName);
 };
 var getModelOption = (modelName, key, defaultValue) => {
-  return getRuntime2(modelName).getModelOption(modelName, key, defaultValue);
+  return getRuntime2().getModelOption(modelName, key, defaultValue);
 };
 var getExactModelOption = (modelName, key) => {
-  return getRuntime2(modelName).getExactModelOption(modelName, key);
+  return getRuntime2().getExactModelOption(modelName, key);
 };
 var getModelNames = () => {
   return (getActiveRuntime() ?? defaultRuntime).getModelNames();
 };
 var getModelJsonSchema = (modelName) => {
-  return getRuntime2(modelName).getModelJsonSchema(modelName);
+  return getRuntime2().getModelJsonSchema(modelName);
+};
+var registerModelInstance = (modelName, model) => {
+  getRuntime2().registerModelInstance(modelName, model);
+};
+var hasModelInstance = (modelName) => {
+  return getRuntime2().hasModelInstance(modelName);
+};
+var getModelInstance = (modelName) => {
+  return getRuntime2().getModelInstance(modelName);
 };
 
 // src/options/default-model-options.ts
@@ -975,12 +1220,12 @@ var getDataOption = (dataName, key, defaultValue) => {
 };
 
 // src/meta.ts
-var getRuntime5 = (modelName) => getRuntimeForModelName(modelName) ?? getActiveRuntime() ?? defaultRuntime;
+var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
 var getModelRef = (modelName, refPath) => {
-  return getRuntime5(modelName).getModelRef(modelName, refPath);
+  return getRuntime5().getModelRef(modelName, refPath);
 };
 var getModelSub = (modelName) => {
-  return getRuntime5(modelName).getModelSub(modelName);
+  return getRuntime5().getModelSub(modelName);
 };
 
 // src/services/base.ts
@@ -991,19 +1236,29 @@ import {
   forEach as forEach3,
   get as get4,
   intersectionBy,
-  isArray as isArray5,
-  isPlainObject as isPlainObject8,
+  isArray as isArray6,
+  isPlainObject as isPlainObject10,
   uniq
 } from "@web-ts-toolkit/utils";
+var ClientRequestError = class extends Error {
+  constructor(result) {
+    super(String(result.code));
+    this.result = result;
+  }
+};
 function validateClientFilter(filter2) {
   const errors = [];
+  const complexityErrors = validateRequestComplexity(filter2, getGlobalOption("requestComplexity"), "filter");
+  if (complexityErrors.length > 0) {
+    return complexityErrors.map((error2) => error2.detail);
+  }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if (isArray5(value)) {
+    if (isArray6(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!isPlainObject8(value)) return;
+    if (!isPlainObject10(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -1097,6 +1352,31 @@ var Base = class {
   validateClientFilter(filter2) {
     return validateClientFilter(filter2);
   }
+  getRequestComplexity() {
+    return resolveRequestComplexity(getGlobalOption("requestComplexity"));
+  }
+  getClientRequestErrorResult(error2) {
+    return error2 instanceof ClientRequestError ? error2.result : null;
+  }
+  throwClientRequestError(code, detail) {
+    throw new ClientRequestError({
+      success: false,
+      kind: "error",
+      code,
+      errors: [{ detail }]
+    });
+  }
+  async getAuthorizedTargetService(modelName, op) {
+    const runtime = getActiveRuntime();
+    if (runtime && !runtime.hasModel(modelName)) {
+      this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
+    }
+    const allowed = await this.req.macl.isAllowed(modelName, op);
+    if (!allowed) {
+      this.throwClientRequestError("unauthorized" /* Unauthorized */, "Unauthorized");
+    }
+    return this.req.macl.getPublicService(modelName);
+  }
   processInclude(include) {
     const includes = compact(castArray(include)).filter(({ model, op, path, localField, foreignField }) => {
       return model && op && path && localField && foreignField;
@@ -1119,65 +1399,73 @@ var Base = class {
     if (!include) return docs;
     const includes = compact(castArray(include));
     if (includes.length === 0) return docs;
-    const isSingle = !isArray5(docs);
-    if (isSingle) docs = [docs];
+    const isSingle = !isArray6(docs);
+    let docList = isSingle ? [docs] : docs;
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
       if (include2.op === "count") {
-        docs = await this.includeDocsCount(docs, include2);
+        docList = await this.includeDocsCount(docList, include2);
       } else {
-        docs = await this.includeDocsList(docs, include2);
+        docList = await this.includeDocsList(docList, include2);
       }
     }
-    return isSingle ? docs[0] : docs;
+    return isSingle ? docList[0] : docList;
   }
   async includeDocsList(docs, include) {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return docs;
+    const svc = await this.getAuthorizedTargetService(model, op);
     const includeLocalValues = [];
     forEach3(docs, (doc, i) => {
       includeLocalValues.push(get4(doc, localField));
     });
     const filter2 = { ..._filters ?? {}, [foreignField]: { $in: flatten(includeLocalValues) } };
-    const result = await svc.find(filter2, args, {
+    const authorizedFilter = await svc.genFilter(op, filter2);
+    const trustedArgs = {
+      ...args,
+      overrides: {
+        filter: authorizedFilter
+      }
+    };
+    const trustedOptions = {
       ...options,
       lean: true,
       includePermissions: false,
       includeCount: false
-    });
-    if (!result.success) return docs;
+    };
+    const trustedResult = await svc.find(filter2, trustedArgs, trustedOptions);
+    if (!trustedResult.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
       const localValue = get4(doc, localField);
       const filterFn = (row) => intersectionBy(castArray(localValue), castArray(get4(row, foreignField)), String).length > 0;
-      const matches = result.data.filter(filterFn);
+      const matches = trustedResult.data.filter(filterFn);
       setDocValue(doc, path, op === "list" ? matches : matches[0]);
     }
     return docs;
   }
   async includeDocsCount(docs, include) {
     const { model, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return docs;
+    const svc = await this.getAuthorizedTargetService(model, "count");
     const includeLocalValues = [];
     forEach3(docs, (doc) => {
       includeLocalValues.push(get4(doc, localField));
     });
     const filter2 = { ..._filters ?? {}, [foreignField]: { $in: flatten(includeLocalValues) } };
-    const result = await svc.find(
-      filter2,
-      {
-        ...args,
-        select: [foreignField]
-      },
-      {
-        ...options,
-        lean: true,
-        includePermissions: false,
-        includeCount: false
+    const authorizedFilter = await svc.genFilter("list", filter2);
+    const trustedArgs = {
+      ...args,
+      select: [foreignField],
+      overrides: {
+        filter: authorizedFilter
       }
-    );
+    };
+    const trustedOptions = {
+      ...options,
+      lean: true,
+      includePermissions: false,
+      includeCount: false
+    };
+    const result = await svc.find(filter2, trustedArgs, trustedOptions);
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
@@ -1202,26 +1490,29 @@ var Base = class {
   }
   async handleSubQuery(sq, key) {
     const { model, op, id, filter: filter2, args, options, sqOptions = {} } = sq;
-    const svc = this.req.macl.getPublicService(model);
-    if (!svc) return null;
     let result;
     if (op === "list") {
-      result = await svc.find(filter2, args, options);
+      const svc = await this.getAuthorizedTargetService(model, "list");
+      result = await svc._list(filter2, args, options);
     } else if (op === "read") {
+      const svc = await this.getAuthorizedTargetService(model, "read");
+      const readOptions = { ...options, tryList: false };
       if (id) {
-        result = await svc.findById(id, args, options);
+        result = await svc._read(id, args, readOptions);
       } else if (filter2) {
-        result = await svc.findOne(filter2, args, options);
+        result = await svc._readFilter(filter2, args, readOptions);
       } else {
-        return null;
+        this.throwClientRequestError("bad_request" /* BadRequest */, `Subquery for field ${key} requires an id or filter`);
       }
     } else {
-      return null;
+      this.throwClientRequestError("bad_request" /* BadRequest */, `Unsupported subquery operation: ${op}`);
+    }
+    if (!result.success) {
+      throw new ClientRequestError(result);
     }
-    if (!result.success) return null;
     let ret = result.data;
     if (sqOptions.path) {
-      ret = isArray5(ret) ? flatten(ret.map((v) => get4(v, sqOptions.path))) : get4(ret, sqOptions.path);
+      ret = isArray6(ret) ? flatten(ret.map((v) => get4(v, sqOptions.path))) : get4(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
       ret = compact(castArray(ret));
@@ -1239,7 +1530,7 @@ var Base = class {
 import {
   castArray as castArray2,
   compact as compact2,
-  isArray as isArray6,
+  isArray as isArray7,
   isBoolean as isBoolean3,
   isFunction as isFunction3,
   omit,
@@ -1250,30 +1541,199 @@ import {
 import { diff } from "just-diff";
 
 // src/model.ts
-import mongoose3 from "mongoose";
+import mongoose2 from "mongoose";
 
-// src/logger.ts
-var passthrough = (level) => (...args) => {
-  const globalLogger = getGlobalOption("logger");
-  const target = globalLogger?.[level] ?? defaultLogger[level];
-  return target.apply(globalLogger ?? defaultLogger, args);
+// src/logger-helpers.ts
+var SENSITIVE_FILTER_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "pwd",
+  "secret",
+  "token",
+  "access_token",
+  "refreshtoken",
+  "api_key",
+  "apikey",
+  "authorization",
+  "authtoken",
+  "credentials",
+  "privatekey",
+  "ssn",
+  "creditcard",
+  "cardnumber",
+  "cvv",
+  "tenantid",
+  "tenant"
+]);
+var SENSITIVE_PAYLOAD_KEYS = new Set(SENSITIVE_FILTER_KEYS);
+var safeReplace = (value, seen) => {
+  if (value === null || typeof value === "undefined") return value;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return value;
+  }
+  if (typeof value === "function") return "[Function]";
+  if (typeof value === "object") {
+    if (seen.has(value)) return "[Circular]";
+    seen.add(value);
+    try {
+      if (Array.isArray(value)) {
+        return value.map((entry) => safeReplace(entry, seen));
+      }
+      const out = {};
+      for (const [k, v] of Object.entries(value)) {
+        out[k] = safeReplace(v, seen);
+      }
+      return out;
+    } finally {
+      seen.delete(value);
+    }
+  }
+  return value;
+};
+var redactObjectKeys = (value, sensitiveKeys, seen) => {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return "[Circular]";
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry) => redactObjectKeys(entry, sensitiveKeys, seen));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const lowered = String(k).toLowerCase();
+      if (sensitiveKeys.has(lowered)) {
+        out[k] = "[REDACTED]";
+      } else {
+        out[k] = redactObjectKeys(v, sensitiveKeys, seen);
+      }
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+};
+var redactFilter = (filter2) => {
+  return redactObjectKeys(filter2, SENSITIVE_FILTER_KEYS, /* @__PURE__ */ new WeakSet());
+};
+var redactPayload = (payload) => {
+  return redactObjectKeys(payload, SENSITIVE_PAYLOAD_KEYS, /* @__PURE__ */ new WeakSet());
+};
+var safeStringify = (value) => {
+  try {
+    return JSON.stringify(safeReplace(value, /* @__PURE__ */ new WeakSet()));
+  } catch {
+    return "[Unserializable]";
+  }
+};
+var countFilterKeys = (filter2) => {
+  if (filter2 === null || typeof filter2 === "undefined") return 0;
+  if (typeof filter2 !== "object") return 0;
+  if (Array.isArray(filter2)) return 0;
+  let count = 0;
+  const stack = [filter2];
+  const seen = /* @__PURE__ */ new WeakSet();
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === null || typeof current !== "object" || Array.isArray(current)) continue;
+    if (seen.has(current)) continue;
+    seen.add(current);
+    for (const [key, value] of Object.entries(current)) {
+      count += 1;
+      if (typeof key === "string" && key.startsWith("$") && value !== null && typeof value === "object") {
+        if (Array.isArray(value)) {
+          for (const entry of value) {
+            if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+              stack.push(entry);
+            }
+          }
+        } else {
+          stack.push(value);
+        }
+      }
+    }
+  }
+  return count;
 };
-var logger = {
-  debug: passthrough("debug"),
-  info: passthrough("info"),
-  warn: passthrough("warn"),
-  error: passthrough("error")
+var summarizeFilter = (filter2) => {
+  return { filterKeyValueCount: countFilterKeys(filter2) };
+};
+var resolveLogger = () => {
+  return getGlobalOption("logger") ?? defaultLogger;
+};
+var isLevelEnabled = (level) => {
+  const target = resolveLogger();
+  const fn = target?.isLevelEnabled;
+  if (typeof fn === "function") {
+    try {
+      return !!fn.call(target, level);
+    } catch {
+      return true;
+    }
+  }
+  return true;
+};
+var buildOpMessage = (ctx) => {
+  const trimmed = { op: ctx.op };
+  if (ctx.modelName) trimmed.modelName = ctx.modelName;
+  if (ctx.dataName) trimmed.dataName = ctx.dataName;
+  if (ctx.page != null) trimmed.page = ctx.page;
+  if (ctx.pageSize != null) trimmed.pageSize = ctx.pageSize;
+  if (ctx.skip != null) trimmed.skip = ctx.skip;
+  if (ctx.limit != null) trimmed.limit = ctx.limit;
+  if (ctx.sort != null) trimmed.sort = ctx.sort;
+  if (ctx.populateCount != null) trimmed.populateCount = ctx.populateCount;
+  if (ctx.selectCount != null) trimmed.selectCount = ctx.selectCount;
+  if (ctx.filterKeyValueCount != null) trimmed.filterKeyValueCount = ctx.filterKeyValueCount;
+  if (ctx.startedAt != null && ctx.durationMs == null) {
+    trimmed.startedAt = ctx.startedAt;
+  }
+  if (ctx.durationMs != null) trimmed.durationMs = ctx.durationMs;
+  if (ctx.resultCode != null) trimmed.resultCode = ctx.resultCode;
+  return safeStringify(trimmed);
+};
+var safeApply = (fn, thisArg, args) => {
+  try {
+    fn.apply(thisArg, args);
+  } catch {
+  }
+};
+var debug = (ctx) => {
+  if (!isLevelEnabled("debug")) return;
+  const target = resolveLogger();
+  const fn = target?.debug ?? defaultLogger.debug;
+  const message = buildOpMessage(ctx);
+  safeApply(fn, target ?? defaultLogger, [message]);
+};
+var warn = (message, meta) => {
+  const target = resolveLogger();
+  const fn = target?.warn ?? defaultLogger.warn;
+  safeApply(fn, target ?? defaultLogger, meta != null ? [message, meta] : [message]);
+};
+var logInfoMessage = (message, ...args) => {
+  const target = resolveLogger();
+  const fn = target?.info ?? defaultLogger.info;
+  const payload = args.length > 0 ? [message, ...args] : [message];
+  safeApply(fn, target ?? defaultLogger, payload);
+};
+var error = (error2) => {
+  const target = resolveLogger();
+  const fn = target?.error ?? defaultLogger.error;
+  safeApply(fn, target ?? defaultLogger, [error2]);
 };
 
 // src/model.ts
+var safeSortLogError = (msg, ...args) => {
+  const message = args.length > 0 ? `${msg} ${safeStringify(args.length === 1 ? args[0] : args)}` : msg;
+  error(message);
+};
 var Model = class {
-  constructor(modelName) {
+  constructor(modelName, runtime) {
     this.modelName = modelName;
-    this.model = mongoose3.model(modelName);
+    this.runtime = runtime ?? null;
+    const resolvedRuntime = runtime ?? getActiveRuntime();
+    const registered = resolvedRuntime?.getModelInstance(modelName) ?? null;
+    const global = mongoose2.models[modelName];
+    this.model = registered ?? global ?? mongoose2.model(modelName);
     if (!this.model) return;
-    this.model.schema.set("optimisticConcurrency", true);
-    const currVersionKey = this.model.schema.get("versionKey");
-    if (!currVersionKey) this.model.schema.set("versionKey", "__v");
   }
   new() {
     const doc = new this.model();
@@ -1282,20 +1742,25 @@ var Model = class {
   create(data) {
     return this.model.create(data);
   }
-  find({ filter: filter2, select, sort, populate, limit, skip, lean }) {
+  find({ filter: filter2, select, sort, populate, limit, hardLimit, skip, lean }) {
     if (!this.validateSort(sort)) {
       sort = null;
     }
     const builder = this.model.find(filter2);
     if (select) builder.select(select);
     if (skip) builder.skip(Number(skip));
-    if (limit) builder.limit(Number(limit));
+    const normalizedLimit = Number(limit);
+    if (Number.isSafeInteger(normalizedLimit) && normalizedLimit > 0) {
+      builder.limit(normalizedLimit);
+    } else if (Number.isSafeInteger(hardLimit) && Number(hardLimit) > 0) {
+      builder.limit(Number(hardLimit));
+    }
     if (sort) builder.sort(sort);
     if (populate) builder.populate(populate);
     if (lean) builder.lean();
     return builder;
   }
-  validateSort(sort, logError = logger.error) {
+  validateSort(sort, logError = safeSortLogError) {
     const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
     const fieldPathPattern = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
     const isValidFieldPath = (field) => fieldPathPattern.test(field);
@@ -1372,7 +1837,7 @@ var Model = class {
   }
   exists(filter2) {
     if (!filter2) return null;
-    return this.findOne(filter2).select("_id").lean();
+    return this.findOne({ filter: filter2 }).select("_id").lean();
   }
   // see https://mongoosejs.com/docs/api.html#query_Query-countDocuments
   countDocuments(filter2 = {}) {
@@ -1389,14 +1854,16 @@ var model_default = Model;
 import { forEach as forEach4, get as get5, pick as pick3 } from "@web-ts-toolkit/utils";
 async function listSub(service, id, sub, options) {
   const { filter: ft, select } = options ?? {};
+  const filterErrors = validateClientFilter(ft);
+  if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "read" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   let result = get5(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.list`, ft),
     service.genQuerySelect("list", select, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
   if (subSelect) result = result.map((v) => pick3(toObject(v), subSelect.concat("_id")));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
@@ -1404,30 +1871,30 @@ async function listSub(service, id, sub, options) {
 async function readSub(service, id, sub, subId, options) {
   const { select, populate } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, { populate }, { access: "read" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   const result = get5(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.read`, { _id: subId }),
     service.genQuerySelect("read", select, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   if (subSelect) subdoc = pick3(toObject(subdoc), subSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function updateSub(service, id, sub, subId, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   const result = get5(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: subId }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   const allowedData = pick3(data, subUpdateSelect);
   Object.assign(subdoc, allowedData);
   await parentDoc.save();
@@ -1435,15 +1902,24 @@ async function updateSub(service, id, sub, subId, data) {
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function bulkUpdateSub(service, id, sub, data) {
+  const { maxBulkItems } = service.getRequestComplexity();
+  if (data.length > maxBulkItems) {
+    return {
+      success: false,
+      kind: "error",
+      code: "bad_request" /* BadRequest */,
+      errors: [{ detail: `Bulk subdocument update exceeds maximum item count of ${maxBulkItems}` }]
+    };
+  }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   let result = get5(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
   forEach4(result, (subdoc) => {
     const tdata = findElementById(data, subdoc._id);
@@ -1457,27 +1933,40 @@ async function bulkUpdateSub(service, id, sub, data) {
 }
 async function createSub(service, id, sub, data, options) {
   const { addFirst } = options ?? {};
+  const { maxBulkItems } = service.getRequestComplexity();
+  if (Array.isArray(data) && data.length > maxBulkItems) {
+    return {
+      success: false,
+      kind: "error",
+      code: "bad_request" /* BadRequest */,
+      errors: [{ detail: `Bulk subdocument create exceeds maximum item count of ${maxBulkItems}` }]
+    };
+  }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   let result = get5(parentDoc, sub);
   const [subCreateSelect, subReadSelect] = await Promise.all([
     service.genQuerySelect("create", null, false, [sub, "sub"]),
     service.genQuerySelect("read", null, false, [sub, "sub"])
   ]);
-  const allowedData = pick3(data, subCreateSelect);
-  addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
+  const allowedData = Array.isArray(data) ? data.map((row) => pick3(row, subCreateSelect)) : pick3(data, subCreateSelect);
+  if (Array.isArray(allowedData)) {
+    addFirst === true ? result.unshift(...allowedData) : result.push(...allowedData);
+  } else {
+    addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
+  }
   await parentDoc.save();
   if (subReadSelect) result = result.map((v) => pick3(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
 }
 async function deleteSub(service, id, sub, subId) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
-  if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   const result = get5(parentDoc, sub);
   const subFilter = await service.genFilter(`subs.${sub}.delete`, { _id: subId });
-  if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
+  if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   const subdoc = findElement(result, subFilter);
-  if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
+  if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   await ("deleteOne" in subdoc ? subdoc.deleteOne?.() : subdoc.remove?.());
   await parentDoc.save();
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc._id };
@@ -1487,7 +1976,7 @@ async function getParentDoc(service, id, sub, args, options) {
   const { access = "read", lean = false } = options ?? {};
   const parentFilter = await service.genFilter(access, await service.genIDFilter(id));
   if (parentFilter === false) return null;
-  return service.model.findOne({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
+  return service.findRawParentDoc({ filter: parentFilter, select: sub, populate: genSubPopulate(sub, populate), lean });
 }
 
 // src/services/model-service-defaults.ts
@@ -1613,10 +2102,53 @@ var assertModelDocument = (value, modelName, hookName) => {
   }
   throw new Error(`${hookName} hook for model=${modelName} must return a Mongoose document instance`);
 };
+var mapWithConcurrencyLimit = async (items, limit, iteratee) => {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workerCount = Math.min(Math.max(limit, 1), items.length || 1);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor < items.length) {
+        const current = cursor;
+        cursor += 1;
+        results[current] = await iteratee(items[current], current);
+      }
+    })
+  );
+  return results;
+};
 var Service = class extends Base {
+  findRawParentDoc(args) {
+    return this.model.findOne({
+      ...args,
+      filter: args.filter,
+      populate: args.populate
+    });
+  }
   asServiceHookContext(context) {
     return context;
   }
+  beginOp(op, filter2, extra) {
+    const startedAt = Date.now();
+    debug({
+      op,
+      modelName: this.modelName,
+      filterKeyValueCount: summarizeFilter(filter2).filterKeyValueCount,
+      startedAt,
+      ...extra ?? {}
+    });
+    return startedAt;
+  }
+  completeOp(op, startedAt, resultCode, filter2, extra) {
+    debug({
+      op,
+      modelName: this.modelName,
+      filterKeyValueCount: summarizeFilter(filter2).filterKeyValueCount,
+      durationMs: Date.now() - startedAt,
+      resultCode,
+      ...extra ?? {}
+    });
+  }
   constructor(req, modelName) {
     super(req, modelName);
     this.model = new model_default(modelName);
@@ -1627,12 +2159,20 @@ var Service = class extends Base {
   }
   async findOne(filter2, args, options) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
     const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    let parsedFilter;
+    try {
+      parsedFilter = await this.parseClientData(filter2);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     let [_filter, _select, _populate] = await Promise.all([
-      overrideFilter || this.genFilter(access, await this.parseClientData(filter2)),
+      overrideFilter || this.genFilter(access, parsedFilter),
       overrideSelect || this.genQuerySelect(access, select),
       overridePopulate || this.genPopulate(populateAccess || access, populate)
     ]);
@@ -1644,10 +2184,20 @@ var Service = class extends Base {
       sort,
       populate: _populate
     };
-    logger.debug(JSON.stringify({ op: "findOne", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("findOne", _filter, {
+      sort,
+      selectCount: finalSelect.length,
+      populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ ...query, lean });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("findOne", startedAt, "not_found" /* NotFound */, _filter);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
@@ -1655,7 +2205,16 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    doc = await this.includeDocs(doc, includes);
+    try {
+      doc = await this.includeDocs(doc, includes);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("findOne", startedAt, result.code, _filter);
+        return { ...result, query };
+      }
+      throw error2;
+    }
     let includeDocPermissions = includePermissions;
     if (!includeDocPermissions && !skim) {
       includeDocPermissions = this.checkIfModelPermissionExists([access, "read", "update"]);
@@ -1668,6 +2227,7 @@ var Service = class extends Base {
       this.baseFieldsExt.concat(includePaths, normalizeSelect(overrideSelect))
     );
     if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    this.completeOp("findOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query, context };
   }
   async findById(id, args, options) {
@@ -1691,18 +2251,26 @@ var Service = class extends Base {
   }
   async find(filter2, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, populate, include, sort, skip, limit, page, pageSize, overrides } = this.resolveFindArgs(args);
     const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
+    let parsedFilter;
+    try {
+      parsedFilter = await this.parseClientData(filter2);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     const [_filter, _select, _populate, pagination] = await Promise.all([
-      overrideFilter || this.genFilter("list", await this.parseClientData(filter2)),
+      overrideFilter || this.genFilter("list", parsedFilter),
       overrideSelect || this.genQuerySelect("list", select),
       overridePopulate || this.genPopulate(populateAccess, populate),
       genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
     ]);
     const finalSelect = normalizeSelect(_select);
-    const filteredPopulate = isArray6(finalSelect) && isArray6(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const filteredPopulate = isArray7(finalSelect) && isArray7(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, includeLocalFields, includePaths } = this.processInclude(include);
     const query = {
       filter: _filter,
@@ -1711,10 +2279,20 @@ var Service = class extends Base {
       sort,
       ...pagination
     };
-    logger.debug(JSON.stringify({ op: "find", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("find", _filter, {
+      sort,
+      skip: pagination.skip,
+      limit: pagination.limit,
+      selectCount: finalSelect.concat(includeLocalFields).length,
+      populateCount: Array.isArray(filteredPopulate) ? filteredPopulate.length : filteredPopulate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let docs = await this.model.find({
       ...query,
+      hardLimit: this.options.listHardLimit,
       lean
     });
     const contexts = docs.map((doc) => ({
@@ -1725,7 +2303,16 @@ var Service = class extends Base {
       resolvedQuery: query
     }));
     const _decorate = isFunction3(decorate) ? decorate : (v) => v;
-    docs = await this.includeDocs(docs, includes);
+    try {
+      docs = await this.includeDocs(docs, includes);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("find", startedAt, result.code, _filter);
+        return { ...result, query };
+      }
+      throw error2;
+    }
     const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
       docs.map(async (doc, i) => {
@@ -1746,6 +2333,7 @@ var Service = class extends Base {
         return doc;
       })
     );
+    this.completeOp("find", startedAt, "success" /* Success */, _filter);
     return {
       success: true,
       kind: "list",
@@ -1762,67 +2350,96 @@ var Service = class extends Base {
     const { skim, includePermissions, populateAccess } = this.resolveCreateOptions(options);
     const isArr = Array.isArray(data);
     let dataArr = isArr ? data : [data];
-    dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+    const { maxBulkItems, maxBulkConcurrency } = this.getRequestComplexity();
+    if (dataArr.length > maxBulkItems) {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: `Bulk create exceeds maximum item count of ${maxBulkItems}` }]
+      };
+    }
+    try {
+      dataArr = await Promise.all(dataArr.map((d) => this.parseClientData(d)));
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) return result;
+      throw error2;
+    }
     const resolvedPopulate = populate ? await this.genPopulate(populateAccess, populate) : [];
     const contexts = [];
-    let validationError = null;
-    const items = await Promise.all(
-      dataArr.map(async (item, index) => {
-        const context = {
-          mongooseModel: this.model.model,
-          modelName: this.modelName,
-          operation: "create",
-          originalData: item,
-          resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
-        };
-        const allowedFields = await this.genAllowedFields(item, "create");
-        const allowedData = pick4(item, allowedFields);
-        context.allowedFields = allowedFields;
-        context.allowedData = allowedData;
-        const validated = await this.validate(allowedData, "create", context);
-        if (isBoolean3(validated)) {
-          if (!validated) {
-            validationError = { success: false, code: "bad_request" /* BadRequest */ };
-            return;
-          }
-        } else if (isArray6(validated)) {
-          if (validated.length > 0) {
-            validationError = { success: false, code: "bad_request" /* BadRequest */, errors: validated };
-            return;
-          }
+    const validationErrors = [];
+    const validationItems = await mapWithConcurrencyLimit(dataArr, maxBulkConcurrency, async (item, index) => {
+      const context = {
+        mongooseModel: this.model.model,
+        modelName: this.modelName,
+        operation: "create",
+        originalData: item,
+        resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
+      };
+      const allowedFields = await this.genAllowedFields(item, "create");
+      const allowedData = pick4(item, allowedFields);
+      context.allowedFields = allowedFields;
+      context.allowedData = allowedData;
+      const validated = await this.validate(allowedData, "create", context);
+      if (isBoolean3(validated)) {
+        if (!validated) {
+          validationErrors.push({ index, errors: [] });
+          return void 0;
         }
-        const preparedData = await this.prepare(allowedData, "create", context);
-        context.preparedData = preparedData;
-        contexts[index] = context;
-        return preparedData;
-      })
-    );
-    if (validationError) return validationError;
+      } else if (isArray7(validated)) {
+        if (validated.length > 0) {
+          validationErrors.push({
+            index,
+            errors: isArr ? validated.map((issue) => this.formatBulkValidationIssue(issue, index)) : validated
+          });
+          return void 0;
+        }
+      }
+      contexts[index] = context;
+      return allowedData;
+    });
+    if (validationErrors.length > 0) {
+      const aggregate = validationErrors.slice().sort((a, b) => a.index - b.index).flatMap((entry) => entry.errors);
+      if (isArr) {
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: aggregate };
+      }
+      const single = validationErrors[0];
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: single?.errors ?? []
+      };
+    }
+    const items = await mapWithConcurrencyLimit(validationItems, maxBulkConcurrency, async (allowedData, index) => {
+      const preparedData = await this.prepare(allowedData, "create", contexts[index]);
+      contexts[index].preparedData = preparedData;
+      return preparedData;
+    });
     const _decorate = isFunction3(decorate) ? decorate : (v) => v;
     const createdDocs = await this.model.create(items);
-    const docs = await Promise.all(
-      createdDocs.map(async (doc, index) => {
-        contexts[index].currentDocument = doc;
-        doc = assertModelDocument(
-          await this.afterPersist(doc, "create", contexts[index]),
-          this.modelName,
-          "afterPersist"
-        );
-        contexts[index].currentDocument = doc;
-        contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
-        let includeDocPermissions = includePermissions;
-        if (!includeDocPermissions && !skim) {
-          includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
-        }
-        if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
-        if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
-        if (resolvedPopulate.length > 0) await populateDoc(doc, resolvedPopulate);
-        doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
-        let outputDoc = await _decorate(doc, contexts[index]);
-        if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
-        return outputDoc;
-      })
-    );
+    const docs = await mapWithConcurrencyLimit(createdDocs, maxBulkConcurrency, async (doc, index) => {
+      contexts[index].currentDocument = doc;
+      doc = assertModelDocument(
+        await this.afterPersist(doc, "create", contexts[index]),
+        this.modelName,
+        "afterPersist"
+      );
+      contexts[index].currentDocument = doc;
+      contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
+      let includeDocPermissions = includePermissions;
+      if (!includeDocPermissions && !skim) {
+        includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+      }
+      if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
+      if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
+      if (resolvedPopulate.length > 0) await populateDoc(doc, resolvedPopulate);
+      doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
+      let outputDoc = await _decorate(doc, contexts[index]);
+      if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      return outputDoc;
+    });
     return {
       success: true,
       kind: "list",
@@ -1832,18 +2449,50 @@ var Service = class extends Base {
       count: docs.length
     };
   }
-  async new() {
+  formatBulkValidationIssue(issue, index) {
+    if (!issue || typeof issue !== "object") {
+      return {
+        detail: typeof issue === "string" && issue.length > 0 ? issue : "Bad Request",
+        ...index === null ? {} : { pointer: `#/${index}` }
+      };
+    }
+    const typedIssue = issue;
+    const detail = typedIssue.detail ?? typedIssue.message ?? "Bad Request";
+    if (index === null) {
+      return typedIssue.pointer || typedIssue.path ? {
+        detail,
+        ...typedIssue.pointer ? { pointer: typedIssue.pointer } : {}
+      } : { detail };
+    }
+    if (typedIssue.pointer?.startsWith("#/")) {
+      return { ...typedIssue, detail, pointer: `#/${index}${typedIssue.pointer.slice(1)}` };
+    }
+    if (typedIssue.path) {
+      return { ...typedIssue, detail, pointer: `#/${[index, ...typedIssue.path].join("/")}` };
+    }
+    return { ...typedIssue, detail, pointer: `#/${index}` };
+  }
+  async new(args, options) {
+    const { skim, includePermissions } = options ?? {};
     const data = await this.model.new();
+    let doc = data;
+    doc = await this.trimOutputFields(doc, "create", this.baseFieldsExt);
+    let includeDocPermissions = includePermissions;
+    if (!includeDocPermissions && !skim) {
+      includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
+    }
+    if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", {});
+    if (!includePermissions) doc = this.addEmptyPermissions(doc);
     return {
       success: true,
       kind: "single",
       code: "success" /* Success */,
-      data
+      data: doc
     };
   }
   async updateOne(filter2, data, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpdateOneArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpdateOneOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
@@ -1852,17 +2501,34 @@ var Service = class extends Base {
       overridePopulate || this.genPopulate(populateAccess, populate)
     ]);
     const query = { filter: _filter, populate: _populate };
-    logger.debug(JSON.stringify({ op: "updateOne", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("updateOne", _filter, {
+      populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
+    });
+    if (_filter === false) {
+      this.completeOp("updateOne", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ filter: _filter });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("updateOne", startedAt, "not_found" /* NotFound */, _filter);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
       operation: "update",
       resolvedQuery: query
     };
-    data = await this.parseClientData(data);
+    try {
+      data = await this.parseClientData(data);
+    } catch (error2) {
+      const result = this.getClientRequestErrorResult(error2);
+      if (result) {
+        this.completeOp("updateOne", startedAt, result.code, _filter);
+        return result;
+      }
+      throw error2;
+    }
     context.originalDocumentSnapshot = doc.toObject({ virtuals: false });
     context.originalData = data;
     doc = await this.addDocPermissions(doc, "update", context);
@@ -1874,9 +2540,15 @@ var Service = class extends Base {
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
     if (isBoolean3(validated)) {
-      if (!validated) return { success: false, code: "bad_request" /* BadRequest */ };
-    } else if (isArray6(validated)) {
-      if (validated.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: validated };
+      if (!validated) {
+        this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
+      }
+    } else if (isArray7(validated)) {
+      if (validated.length > 0) {
+        this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
+      }
     }
     const prepared = await this.prepare(allowedData, "update", context);
     context.preparedData = prepared;
@@ -1909,6 +2581,7 @@ var Service = class extends Base {
     let outputDoc = doc;
     if (isFunction3(decorate)) outputDoc = await decorate(outputDoc, context);
     if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+    this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
   async updateById(id, data, args = {}, options = {}, decorate) {
@@ -1931,17 +2604,21 @@ var Service = class extends Base {
   }
   async upsert(filter2, data, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpsertArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpsertOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const _filter = await (overrideFilter || this.genFilter("update", filter2));
     const query = { filter: _filter };
-    logger.debug(JSON.stringify({ op: "upsert", query }));
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("upsert", _filter);
+    if (_filter === false) {
+      this.completeOp("upsert", startedAt, "forbidden" /* Forbidden */, _filter);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     const theone = await this.model.findOne({ filter: _filter });
+    let result;
     if (theone) {
-      return this.updateOne(
+      result = await this.updateOne(
         null,
         data,
         {
@@ -1955,7 +2632,7 @@ var Service = class extends Base {
         decorate
       );
     } else {
-      return this.create(
+      result = await this.create(
         data,
         { populate },
         {
@@ -1966,14 +2643,22 @@ var Service = class extends Base {
         decorate
       );
     }
+    this.completeOp("upsert", startedAt, result.code, _filter);
+    return result;
   }
   async delete(id) {
     const filter2 = await this.genFilter("delete", await this.genIDFilter(id));
     const query = { filter: filter2 };
-    logger.debug(JSON.stringify({ op: "delete", query }));
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    const startedAt = this.beginOp("delete", filter2);
+    if (filter2 === false) {
+      this.completeOp("delete", startedAt, "forbidden" /* Forbidden */, filter2);
+      return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    }
     let doc = await this.model.findOne({ filter: filter2 });
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) {
+      this.completeOp("delete", startedAt, "not_found" /* NotFound */, filter2);
+      return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
+    }
     const context = {
       mongooseModel: this.model.model,
       modelName: this.modelName,
@@ -1986,11 +2671,12 @@ var Service = class extends Base {
     await ("deleteOne" in doc ? doc.deleteOne() : doc.remove());
     context.finalDocumentSnapshot = toObject(doc);
     await this.afterDelete(doc, context);
+    this.completeOp("delete", startedAt, "success" /* Success */, filter2);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc._id, query };
   }
   async exists(filter2, options) {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { access, includeId } = this.resolveExistsOptions(options);
     filter2 = await this.genFilter(access, filter2);
     const result = await this.model.exists(filter2);
@@ -2002,22 +2688,58 @@ var Service = class extends Base {
       query: { filter: filter2 }
     };
   }
+  isValidDistinctFieldName(field) {
+    if (typeof field !== "string" || field.length === 0) return false;
+    if (field.includes("$")) return false;
+    if (field.includes("..")) return false;
+    if (field.startsWith(".") || field.endsWith(".")) return false;
+    if (/\s/.test(field)) return false;
+    return true;
+  }
+  async authorizeDistinctField(field) {
+    const allowedFields = await this.genAllowedFields(null, "read");
+    const isAllowed = allowedFields.some((allowed) => {
+      if (allowed === field) return true;
+      if (allowed.startsWith(`${field}.`)) return true;
+      if (field.startsWith(`${allowed}.`)) return true;
+      return false;
+    });
+    if (!isAllowed) {
+      return {
+        success: false,
+        kind: "error",
+        code: "forbidden" /* Forbidden */,
+        errors: [{ detail: `Distinct field not allowed: ${field}` }]
+      };
+    }
+    return null;
+  }
   async distinct(field, args) {
+    if (!this.isValidDistinctFieldName(field)) {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: `Invalid distinct field: ${field}` }]
+      };
+    }
+    const fieldError = await this.authorizeDistinctField(field);
+    if (fieldError) return fieldError;
     let { filter: filter2 } = args ?? {};
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     filter2 = await this.genFilter("read", filter2);
     const query = { filter: filter2 };
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     const result = await this.model.distinct(field, filter2);
     return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length, query };
   }
   async count(filter2, access = "list") {
     const filterErrors = this.validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     filter2 = await this.genFilter(access, filter2);
     const query = { filter: filter2 };
-    if (filter2 === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     return { success: true, kind: "single", code: "success" /* Success */, data: await this.model.countDocuments(filter2), query };
   }
   getDocPermissions(doc) {
@@ -2149,11 +2871,11 @@ var PublicService = class extends Service {
       { populate },
       { skim, includePermissions, populateAccess },
       async (doc, context) => {
-        doc = toObject(doc);
-        doc = await this.decorate(doc, "create", context);
-        doc = this.runTasks(doc, tasks);
-        if (select) doc = pick5(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        return doc;
+        let d = toObject(doc);
+        d = await this.decorate(d, "create", context);
+        d = this.runTasks(d, tasks);
+        if (select) d = pick5(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        return d;
       }
     );
     if (!result.success) {
@@ -2161,8 +2883,8 @@ var PublicService = class extends Service {
     }
     return result;
   }
-  async _new() {
-    return this.new();
+  async _new(args, options) {
+    return this.new(args, options);
   }
   async _read(id, args, options) {
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
@@ -2244,12 +2966,12 @@ var PublicService = class extends Service {
       { populate },
       { skim, includePermissions, populateAccess },
       async (doc, context) => {
-        doc = toObject(doc);
-        doc = await this.decorate(doc, "update", context);
-        doc = this.runTasks(doc, tasks);
-        if (select) doc = pick5(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) doc = pick5(doc, [...Object.keys(data), "_id"]);
-        return doc;
+        let d = toObject(doc);
+        d = await this.decorate(d, "update", context);
+        d = this.runTasks(d, tasks);
+        if (select) d = pick5(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) d = pick5(d, [...Object.keys(data), "_id"]);
+        return d;
       }
     );
     if (!result.success) {
@@ -2260,7 +2982,7 @@ var PublicService = class extends Service {
   async _upsert(data, args, options) {
     const idKey = this.getIdentifier();
     if (idKey !== "_id") {
-      return { success: false, code: "bad_request" /* BadRequest */, errors: ["not supported custom id field"] };
+      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: ["not supported custom id field"] };
     }
     const { [idKey]: idVal, ...otherData } = data;
     const upsertId = typeof idVal === "string" ? idVal : void 0;
@@ -2270,7 +2992,7 @@ var PublicService = class extends Service {
         return existing;
       }
       if (!existing.data) {
-        return { success: false, code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
       }
       return this._update(upsertId, otherData, args, options);
     }
@@ -2380,7 +3102,7 @@ var DataService = class {
   }
   async findOne(filter2, args, options) {
     const filterErrors = validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select } = args ?? {};
     const { access = "read" } = options ?? {};
     let [_filter, _select] = await Promise.all([this.genFilter(access, filter2), this.genQuerySelect(access, select)]);
@@ -2388,9 +3110,9 @@ var DataService = class {
       filter: _filter,
       select: _select
     };
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (_filter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     let doc = await findElement(this.data, _filter);
-    if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
+    if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
     if (_select.length > 0) doc = pick6(doc, _select);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
@@ -2409,7 +3131,7 @@ var DataService = class {
   }
   async find(filter2, args, options) {
     const filterErrors = validateClientFilter(filter2);
-    if (filterErrors.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: filterErrors };
+    if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { select, sort, skip, limit, page, pageSize } = args ?? {};
     const [_filter, _select, pagination] = await Promise.all([
       this.genFilter("list", filter2),
@@ -2422,27 +3144,33 @@ var DataService = class {
       sort,
       ...pagination
     };
-    if (_filter === false) return { success: false, code: "forbidden" /* Forbidden */, query };
+    if (_filter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
+    if (sort) {
+      const sortFieldErrors = await this.validateSortFields(sort, "list");
+      if (sortFieldErrors.length > 0) {
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortFieldErrors, query };
+      }
+    }
     let docs = await filterCollection(this.data, _filter);
     const totalCount = docs.length;
-    docs = await Promise.all(
-      docs.map(async (doc) => {
+    if (sort) {
+      const { sortKey, sortOrder } = parseSortString(sort);
+      docs = orderBy(docs, [sortKey], [sortOrder]);
+    }
+    const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
+    const trimmed = await Promise.all(
+      pagedDocs.map(async (doc) => {
         doc = await this.trimOutputFields(doc, "list");
         if (_select.length > 0) doc = pick6(doc, _select);
         return doc;
       })
     );
-    if (sort) {
-      const { sortKey, sortOrder } = parseSortString(sort);
-      docs = orderBy(docs, [sortKey], [sortOrder]);
-    }
-    docs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     return {
       success: true,
       kind: "list",
       code: "success" /* Success */,
-      data: docs,
-      count: docs.length,
+      data: trimmed,
+      count: trimmed.length,
       totalCount,
       query
     };
@@ -2474,33 +3202,101 @@ var DataService = class {
   trimOutputFields(doc, access, baseFields) {
     return this.pickAllowedFields(doc, access, baseFields);
   }
+  async validateSortFields(sort, access) {
+    const fieldPathPattern = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)*$/;
+    const fields = sort.trim().split(/\s+/).filter(Boolean).map((field) => ({
+      raw: field,
+      name: field.startsWith("-") ? field.slice(1) : field
+    }));
+    const errors = [];
+    for (const { raw, name } of fields) {
+      if (!fieldPathPattern.test(name)) {
+        errors.push({ detail: `Invalid sort field: ${raw}`, pointer: `#/sort` });
+        continue;
+      }
+      if (name === "id" || name === "_id") continue;
+      const allowed = await this.genAllowedFields({}, access);
+      if (!allowed.includes(name)) {
+        errors.push({ detail: `Sort field is not allowed: ${name}`, pointer: `#/sort` });
+      }
+    }
+    return errors;
+  }
 };
 
 // src/processors.ts
-import { castArray as castArray3, cloneDeep, forEach as forEach6, get as get7, isArray as isArray7, map as map2, set as set5 } from "@web-ts-toolkit/utils";
+import { cloneDeep, forEach as forEach6, get as get7, isArray as isArray8, isPlainObject as isPlainObject12, map as map2, set as set5 } from "@web-ts-toolkit/utils";
+var UNSAFE_PATH_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function failUnsafeSegment(path) {
+  throw new Error(
+    `copyAndDepopulate: refusing path '${path}' because it contains an unsafe segment (__proto__, prototype, or constructor).`
+  );
+}
+function failMissingId(path) {
+  throw new Error(`copyAndDepopulate: path '${path}' resolved to a record missing the configured id field.`);
+}
+function assertSafePath(path) {
+  const segs = path.split(".");
+  for (const seg of segs) {
+    if (seg.length === 0) continue;
+    if (UNSAFE_PATH_KEYS.has(seg)) {
+      failUnsafeSegment(path);
+    }
+  }
+}
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
-  const obj = get7(options, "mutable", true) ? docObject : cloneDeep(docObject);
-  const idField = get7(options, "idField", "_id");
-  forEach6(castArray3(operations), (op) => {
-    if (!op.src || !op.dest) return;
+  const mutable = options.mutable !== false;
+  const idField = options.idField ?? "_id";
+  const obj = mutable ? docObject : cloneDeep(docObject);
+  forEach6(Array.isArray(operations) ? operations : [], (op) => {
+    if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
+    const src = op.src;
+    const dest = op.dest;
+    if (src.length === 0 || dest.length === 0) return;
+    assertSafePath(src);
+    assertSafePath(dest);
     let targets = [obj];
-    const segs = op.src.split(".");
+    const segs = src.split(".");
     forEach6(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
         forEach6(targets, (target) => {
+          if (!isPlainObject12(target)) return;
           const targetObject = target;
-          set5(targetObject, op.dest, get7(targetObject, seg));
-          set5(
-            targetObject,
-            seg,
-            isArray7(targetObject[seg]) ? map2(targetObject[seg], idField) : get7(targetObject, `${seg}.${idField}`)
-          );
+          const leaf = targetObject[seg];
+          const sourceForDest = leaf;
+          let depopulated;
+          if (isArray8(leaf)) {
+            if (leaf.length === 0) {
+              depopulated = [];
+            } else if (leaf.every((item) => isPlainObject12(item))) {
+              depopulated = map2(leaf, idField).map((id, i) => {
+                if (id === void 0) {
+                  failMissingId(`${src}[${i}]`);
+                }
+                return id;
+              });
+            } else {
+              return;
+            }
+          } else if (isPlainObject12(leaf)) {
+            const id = get7(leaf, idField);
+            if (id === void 0) {
+              failMissingId(src);
+            }
+            depopulated = id;
+          } else {
+            return;
+          }
+          set5(targetObject, dest, sourceForDest);
+          set5(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
+          if (!isPlainObject12(target)) return ret;
           const targetObject = target;
-          if (isArray7(targetObject[seg])) ret.push(...targetObject[seg]);
-          else ret.push(targetObject[seg]);
+          const next = targetObject[seg];
+          if (isArray8(next)) ret.push(...next);
+          else if (next !== null && next !== void 0) ret.push(next);
           return ret;
         }, []);
       }
@@ -2548,15 +3344,15 @@ var Cache = class {
 
 // src/core-shared.ts
 import {
-  castArray as castArray4,
+  castArray as castArray3,
   arrayToRecord,
   hasOwn as hasOwn2,
-  isArray as isArray8,
+  isArray as isArray9,
   isBoolean as isBoolean4,
   isEmpty as isEmpty2,
   isEqual,
   isFunction as isFunction4,
-  isPlainObject as isPlainObject10,
+  isPlainObject as isPlainObject13,
   isString as isString5
 } from "@web-ts-toolkit/utils";
 
@@ -2597,10 +3393,10 @@ var permission_default = Permission;
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && isPlainObject10(filter2) && Object.keys(filter2).length === 1 && isArray8(filter2.$and);
+  return !!filter2 && isPlainObject13(filter2) && Object.keys(filter2).length === 1 && isArray9(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && isPlainObject10(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && isPlainObject13(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -2614,9 +3410,24 @@ function optimizeAndFilter(clausesInput) {
       clauses.push(clause);
     }
   }
-  const dedupedClauses = clauses.filter(
-    (clause, index) => clauses.findIndex((item) => isEqual(item, clause)) === index
-  );
+  const dedupeKey = (value) => {
+    if (isArray9(value)) {
+      return `[${value.map(dedupeKey).join(",")}]`;
+    }
+    if (isPlainObject13(value)) {
+      return `{${Object.keys(value).sort().map((key) => `${key}:${dedupeKey(value[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+  };
+  const dedupedClauses = [];
+  const seenClauses = /* @__PURE__ */ new Set();
+  for (let x = 0; x < clauses.length; x++) {
+    const clause = clauses[x];
+    const key = dedupeKey(clause);
+    if (seenClauses.has(key)) continue;
+    seenClauses.add(key);
+    dedupedClauses.push(clause);
+  }
   const mergedClause = {};
   const remainingClauses = [];
   for (let x = 0; x < dedupedClauses.length; x++) {
@@ -2645,7 +3456,7 @@ function optimizeAndFilter(clausesInput) {
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !isPlainObject10(filter2) || isEmpty2(filter2)) return null;
+  if (!filter2 || !isPlainObject13(filter2) || isEmpty2(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
@@ -2697,8 +3508,8 @@ async function setRequestPermissions(req) {
   const globalPermissions = getGlobalOption("globalPermissions");
   if (!isFunction4(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
-  if (isPlainObject10(permissions)) req[requestPermissionField] = permissions;
-  else if (isArray8(permissions)) req[requestPermissionField] = arrayToRecord(permissions);
+  if (isPlainObject13(permissions)) req[requestPermissionField] = permissions;
+  else if (isArray9(permissions)) req[requestPermissionField] = arrayToRecord(permissions);
   else if (isString5(permissions)) req[requestPermissionField] = { [permissions]: true };
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
@@ -2710,7 +3521,7 @@ async function evaluateRouteGuard(req, permissions, routeGuard) {
   if (isString5(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if (isArray8(routeGuard)) {
+  if (isArray9(routeGuard)) {
     return arrayHandler(routeGuard);
   }
   if (isFunction4(routeGuard)) {
@@ -2719,7 +3530,7 @@ async function evaluateRouteGuard(req, permissions, routeGuard) {
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = castArray4(hook);
+  const hooks = castArray3(hook);
   for (let x = 0; x < hooks.length; x++) {
     if (isFunction4(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
@@ -2748,7 +3559,7 @@ async function collectSchemaFields({
       if (value) fields.push(key);
     } else if (isString5(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if (isArray8(value)) {
+    } else if (isArray9(value)) {
       if (arrayHandler(value)) fields.push(key);
     } else if (isFunction4(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
@@ -2784,7 +3595,7 @@ async function initializeAclRequest({
   await core.setPermissions();
   assignCore(core);
   req[PERMISSIONS] = core.getPermissions();
-  req[PERMISSION_KEYS] = req[PERMISSIONS].keys;
+  req[PERMISSION_KEYS] = [...req[PERMISSIONS].keys];
   req[flag] = true;
   return core;
 }
@@ -3028,6 +3839,14 @@ var Core = class {
           if (!allowedParentPaths.includes(parentPath)) return null;
           const refModelName = getModelRef(modelName, ret.path);
           if (!refModelName) return null;
+          const runtime = getActiveRuntime();
+          if (runtime && !runtime.hasModel(refModelName)) {
+            return null;
+          }
+          const allowedTargetOperation = await this.req.macl.isAllowed(refModelName, populateAccess);
+          if (!allowedTargetOperation) {
+            return null;
+          }
           ret.select = await this.genSelect(refModelName, populateAccess, ret.select, false);
           const filter2 = await this.genFilter(refModelName, populateAccess, null);
           if (filter2 === false) return null;
@@ -3043,7 +3862,7 @@ var Core = class {
     if (isFunction5(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if (isBoolean5(validate) || isArray9(validate)) {
+    } else if (isBoolean5(validate) || isArray10(validate)) {
       return validate;
     } else {
       return true;
@@ -3096,10 +3915,13 @@ var Core = class {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
-      } catch (error) {
-        logger.warn(
-          `docPermissions hook failed for model=${modelName} access=${access}: ${error instanceof Error ? error.message : String(error)}`
-        );
+      } catch (error2) {
+        warn("docPermissions hook failed; applying empty document permissions", {
+          modelName,
+          access,
+          operation: context.operation,
+          error: error2 instanceof Error ? error2.message : String(error2)
+        });
       }
     }
     return docPermissions;
@@ -3172,7 +3994,7 @@ var Core = class {
     return runDecorateAllHook({ req: this.req, hook: decorateAll, docs, permissions, context });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = compact3(castArray5(task));
+    const tasks = compact3(castArray4(task));
     if (tasks.length === 0) return docObject;
     forEach7(tasks, (task2) => {
       const { type, args, options } = task2;
@@ -3257,19 +4079,19 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if (isPlainObject11(condition)) {
+    if (isPlainObject14(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
       let _id = isString7(id) ? id : null;
-      if (isPlainObject11(id)) {
+      if (isPlainObject14(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = isArray10(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = isArray11(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if (isArray10(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if (isArray11(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
@@ -3289,7 +4111,7 @@ function guard(condition) {
     const { stringHandler, arrayHandler } = createValidator(phas);
     if (isString7(cond)) {
       if (stringHandler(cond)) return next();
-    } else if (isArray10(cond)) {
+    } else if (isArray11(cond)) {
       if (arrayHandler(cond)) return next();
     } else if (isFunction6(cond)) {
       const result = await cond.call(req, permissions);
@@ -3304,7 +4126,7 @@ import express2 from "express";
 
 // src/routers/model-router.ts
 import JsonRouter5 from "@web-ts-toolkit/express-json-router";
-import { forEach as forEach8, isPlainObject as isPlainObject12, isString as isString9, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath2, padEnd } from "@web-ts-toolkit/utils";
+import { forEach as forEach8, isPlainObject as isPlainObject15, isString as isString8, isUndefined as isUndefined2, normalizeUrlPath as normalizeUrlPath2, padEnd } from "@web-ts-toolkit/utils";
 
 // src/routers/router-mutation.ts
 var MODEL_BUILD_TIME_OPTION_KEYS = /* @__PURE__ */ new Set([
@@ -3334,9 +4156,37 @@ function assertMutableRouterOptions(kind, options) {
 // src/http/response-pipelines/model-response.ts
 import JsonRouter3 from "@web-ts-toolkit/express-json-router";
 
+// src/http/response-pipelines/service-result.ts
+var toPublicErrorResult = (result) => ({
+  success: false,
+  code: result.code,
+  errors: result.errors
+});
+var toPublicSingleResult = (result) => ({
+  success: true,
+  kind: "single",
+  code: result.code,
+  data: result.data
+});
+var toPublicListResult = (result) => ({
+  success: true,
+  kind: "list",
+  code: result.code,
+  data: result.data,
+  count: result.count,
+  totalCount: result.totalCount ?? null
+});
+var toPublicServiceResult = (result) => {
+  if (result.kind === "error") {
+    return toPublicErrorResult(result);
+  }
+  return result.kind === "list" ? toPublicListResult(result) : toPublicSingleResult(result);
+};
+
 // src/http/response-pipelines/list-response.ts
 var formatListResponse = (req, result, includeCount, includeExtraHeaders) => {
-  const { data, count: returnedCount, totalCount } = result;
+  const publicResult = toPublicListResult(result);
+  const { data, count: returnedCount, totalCount } = publicResult;
   const query = result.query ?? {};
   const rawLimit = Number(query.limit ?? 0);
   const skip = Number(query.skip ?? 0);
@@ -3371,16 +4221,18 @@ var formatListResponse = (req, result, includeCount, includeExtraHeaders) => {
   return { data, meta };
 };
 var formatCreatedData = (result) => {
-  return result.count === 1 ? result.data[0] : result.data;
+  const publicResult = toPublicListResult(result);
+  return publicResult.count === 1 ? publicResult.data[0] : publicResult.data;
 };
 var formatUpsertCreatedData = (result) => {
-  return result.data.length > 0 ? result.data[0] : null;
+  const publicResult = toPublicListResult(result);
+  return publicResult.data.length > 0 ? publicResult.data[0] : null;
 };
 
 // src/http/response-pipelines/model-response.ts
 var success = JsonRouter3.success;
 function unwrapServiceData(result) {
-  return result.data;
+  return result.kind === "list" ? toPublicListResult(result).data : toPublicSingleResult(result).data;
 }
 function formatModelListResponse(req, result, includeCount, includeExtraHeaders) {
   return formatListResponse(req, result, includeCount, includeExtraHeaders);
@@ -3389,7 +4241,13 @@ function formatModelCreatedResponse(result) {
   return new success.Created(formatCreatedData(result));
 }
 function formatModelUpsertResponse(result) {
-  return result.kind === "list" ? new success.Created(formatUpsertCreatedData(result)) : result.data;
+  if (result.kind === "list") {
+    return new success.Created(formatUpsertCreatedData(result));
+  }
+  if (result.kind === "single") {
+    return toPublicSingleResult(result).data;
+  }
+  throw new Error(`Unexpected ServiceResult kind: ${String(result.kind)}`);
 }
 
 // src/validation/parsers.ts
@@ -3398,9 +4256,12 @@ import JsonRouter4 from "@web-ts-toolkit/express-json-router";
 // src/validation/common.ts
 import { z as z2 } from "zod";
 var stringOrStringArray = z2.union([z2.string(), z2.array(z2.string())]);
+var safeIntegerString = (min, message) => z2.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
 var queryBooleanString = z2.enum(["true", "false"]);
-var positiveIntegerString = z2.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = z2.number().int().min(0);
+var nonNegativeIntegerString = safeIntegerString(0, "Expected a non-negative integer");
+var positiveIntegerString = safeIntegerString(1, "Expected a positive integer");
+var nonNegativeIntegerSchema = z2.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var positiveIntegerSchema = z2.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
 var unknownRecord = z2.record(z2.string(), z2.unknown());
 var projectionObjectSchema = z2.record(z2.string(), z2.union([z2.literal(1), z2.literal(-1)]));
 var projectionSchema = z2.union([z2.string(), z2.array(z2.string()), projectionObjectSchema]);
@@ -3501,6 +4362,10 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value);
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "parameter");
@@ -3508,6 +4373,10 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value ?? {});
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "pointer");
@@ -3610,10 +4479,10 @@ function fromYup(schema) {
         success: true,
         data
       };
-    } catch (error) {
+    } catch (error2) {
       return {
         success: false,
-        issues: normalizeYupIssues(error)
+        issues: normalizeYupIssues(error2)
       };
     }
   };
@@ -3716,10 +4585,10 @@ function fromVine(validator) {
         success: true,
         data: output
       };
-    } catch (error) {
+    } catch (error2) {
       return {
         success: false,
-        issues: normalizeVineError(error)
+        issues: normalizeVineError(error2)
       };
     }
   };
@@ -3740,11 +4609,11 @@ function normalizePathSegment(segment) {
 function isStandardSchemaPathSegment(segment) {
   return typeof segment === "object" && segment !== null && "key" in segment;
 }
-function normalizeYupIssues(error) {
-  if (!isYupValidationError(error)) {
+function normalizeYupIssues(error2) {
+  if (!isYupValidationError(error2)) {
     return [{ message: "Validation failed" }];
   }
-  const issues = error.inner?.length ? error.inner : [error];
+  const issues = error2.inner?.length ? error2.inner : [error2];
   return issues.map((issue) => ({
     message: issue.message,
     path: parsePathString(issue.path)
@@ -3795,11 +4664,11 @@ function normalizeSuperstructPath(failure) {
   if (typeof failure.key === "string" || typeof failure.key === "number") return [failure.key];
   return void 0;
 }
-function normalizeVineError(error) {
-  if (!isVineValidationError(error)) {
+function normalizeVineError(error2) {
+  if (!isVineValidationError(error2)) {
     return [{ message: "Validation failed" }];
   }
-  return error.messages.map((message) => ({
+  return error2.messages.map((message) => ({
     message: message.message,
     path: normalizeVineField(message)
   }));
@@ -3822,14 +4691,14 @@ function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
-function isYupValidationError(error) {
-  return typeof error === "object" && error !== null && "message" in error;
+function isYupValidationError(error2) {
+  return typeof error2 === "object" && error2 !== null && "message" in error2;
 }
 function isArkTypeErrors(value) {
   return Array.isArray(value);
 }
-function isVineValidationError(error) {
-  return typeof error === "object" && error !== null && "messages" in error && Array.isArray(error.messages);
+function isVineValidationError(error2) {
+  return typeof error2 === "object" && error2 !== null && "messages" in error2 && Array.isArray(error2.messages);
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -3852,9 +4721,9 @@ function buildPointer(path) {
 // src/validation/model-router.ts
 import { z as z3 } from "zod";
 var listQuerySchema = z3.object({
-  skip: positiveIntegerString.optional(),
+  skip: nonNegativeIntegerString.optional(),
   limit: positiveIntegerString.optional(),
-  page: positiveIntegerString.optional(),
+  page: nonNegativeIntegerString.optional(),
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
@@ -3883,10 +4752,10 @@ var listBodySchema = z3.object({
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z3.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
@@ -3896,11 +4765,8 @@ var listBodySchema = z3.object({
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
 var countBodySchema = z3.object({
-  filter: objectOrArraySchema.optional(),
-  options: z3.object({
-    access: z3.unknown().optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
+  filter: objectOrArraySchema.optional()
+}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options"]));
 var readFilterBodySchema = z3.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
@@ -3994,10 +4860,10 @@ var dataListBodySchema = z4.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: z4.string().optional(),
-  skip: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z4.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: z4.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z4.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z4.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z4.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   options: z4.object({
     includeCount: z4.boolean().optional(),
     includeExtraHeaders: z4.boolean().optional()
@@ -4016,17 +4882,17 @@ import { z as z5 } from "zod";
 var rootEntryBaseSchema = {
   target: z5.enum(["model", "data"]),
   name: z5.string().min(1),
-  order: z5.number().int().optional()
+  order: nonNegativeIntegerSchema.optional()
 };
 var rootModelListArgsSchema = z5.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
 var rootModelListOptionsSchema = z5.object({
@@ -4082,16 +4948,14 @@ var rootModelSubReadArgsSchema = z5.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = z5.object({
-  access: z5.unknown().optional()
-}).passthrough();
+var rootModelCountOptionsSchema = z5.object({}).strict().optional();
 var rootDataListArgsSchema = z5.object({
   select: projectionSchema.optional(),
   sort: z5.string().optional(),
-  skip: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: z5.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  skip: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: z5.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: z5.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: z5.union([positiveIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
 var rootDataListOptionsSchema = z5.object({
   includeCount: z5.boolean().optional()
@@ -4099,8 +4963,21 @@ var rootDataListOptionsSchema = z5.object({
 var rootDataReadArgsSchema = z5.object({
   select: projectionSchema.optional()
 }).passthrough();
+var rootModelNewArgsSchema = z5.object({
+  select: projectionSchema.optional()
+}).passthrough();
+var rootModelNewOptionsSchema = z5.object({
+  skim: z5.boolean().optional(),
+  includePermissions: z5.boolean().optional()
+}).passthrough();
 var rootModelQueryEntrySchema = z5.union([
-  z5.object({ ...rootEntryBaseSchema, target: z5.literal("model"), op: z5.literal("new") }).passthrough(),
+  z5.object({
+    ...rootEntryBaseSchema,
+    target: z5.literal("model"),
+    op: z5.literal("new"),
+    args: rootModelNewArgsSchema.optional(),
+    options: rootModelNewOptionsSchema.optional()
+  }).passthrough(),
   z5.object({
     ...rootEntryBaseSchema,
     target: z5.literal("model"),
@@ -4215,7 +5092,7 @@ var rootModelQueryEntrySchema = z5.union([
     op: z5.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
-  }).passthrough()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["access"]))
 ]);
 var rootDataQueryEntrySchema = z5.union([
   z5.object({
@@ -4374,8 +5251,9 @@ function setModelCollectionRoutes(context) {
     body: defineOpenApiSchemaResolver(getAdvancedCreateOpenApiBody)
   });
   router.get("/new", async (req) => {
+    await context.assertAllowed(req, "new");
     const svc = context.getPublicService(req);
-    const result = await svc._new();
+    const result = await svc._new({}, { includePermissions: false });
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -4423,16 +5301,13 @@ function setModelDocumentRoutes(context) {
   });
   router.post("/count", async (req) => {
     await context.assertAllowed(req, "count");
-    const { filter: filter2, options: countOptions = {} } = await parseBodyWithSchema(
+    const { filter: filter2 } = await parseBodyWithSchema(
       countBodySchema,
       req.body,
       context.getRequestSchema("requestSchemas.count")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._count(
-      filter2 ?? {},
-      countOptions.access
-    );
+    const result = await svc._count(filter2 ?? {});
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -4710,7 +5585,6 @@ function setModelDocumentRoutes(context) {
 }
 
 // src/routers/model-router-subdocument-routes.ts
-import { isString as isString8 } from "@web-ts-toolkit/utils";
 function setModelSubDocumentRoutes(context) {
   const subs = getModelSub(context.modelName);
   for (let x = 0; x < subs.length; x++) {
@@ -4740,7 +5614,10 @@ function setModelSubDocumentRoutes(context) {
           context.getRequestSchema("requestSchemas.subList")
         );
         const svc = context.getPublicService(req);
-        const result = await svc.listSub(id, sub, { filter: body.filter ?? {}, select: body.select ?? [] });
+        const result = await svc.listSub(id, sub, {
+          filter: body.filter ?? {},
+          select: body.select ?? []
+        });
         handleResultError(result);
         return unwrapServiceData(result);
       }
@@ -4800,10 +5677,11 @@ function setModelSubDocumentRoutes(context) {
           req.body,
           context.getRequestSchema("requestSchemas.subRead")
         );
-        const populate = body.populate;
-        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => isString8(item) ? { path: item } : item) : isString8(populate) ? { path: populate } : populate ?? [];
         const svc = context.getPublicService(req);
-        const result = await svc.readSub(id, sub, subId, { select: body.select ?? [], populate: normalizedPopulate });
+        const result = await svc.readSub(id, sub, subId, {
+          select: body.select ?? [],
+          populate: normalizeSubPopulate(body.populate)
+        });
         handleResultError(result);
         return unwrapServiceData(result);
       }
@@ -4897,7 +5775,7 @@ function setOption(parentKey, optionKey, option) {
   this.runtime.setModelOption(this.modelName, key, value);
   return this;
 }
-var ModelRouter = class {
+var ModelRouter = class _ModelRouter {
   constructor(modelName, initialOptions, runtime = defaultRuntime) {
     /**
      * The maximum limit of the number of documents returned from the `list` operation.
@@ -5051,17 +5929,21 @@ var ModelRouter = class {
     );
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
-    attachRuntimeToModel(modelName, this.runtime);
     this.options = this.runtime.getModelOptions(modelName);
     this.fullBasePath = normalizeUrlPath2(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new JsonRouter5(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
-    this.model = new model_default(modelName);
+    this.model = new model_default(modelName, this.runtime);
     this.setCollectionRoutes();
     this.setDocumentRoutes();
     this.setSubDocumentRoutes();
     this.logEndpoints();
   }
+  static fromModel(model, initialOptions, runtime = defaultRuntime) {
+    const modelName = String(model.modelName);
+    runtime.registerModelInstance(modelName, model);
+    return new _ModelRouter(modelName, initialOptions, runtime);
+  }
   getRequestSchema(key) {
     return this.runtime.getExactModelOption(
       this.modelName,
@@ -5125,13 +6007,13 @@ var ModelRouter = class {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      forEach8(this.router.endpoints, ({ method, path }) => {
-        logger.info(`${padEnd(method, 6)} ${normalizeUrlPath2(this.options.parentPath + path)}`);
+      forEach8(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${padEnd(method, 6)} ${normalizeUrlPath2(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && isString9(keyOrOptions)) {
+    if (arguments.length === 2 && isString8(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -5139,7 +6021,7 @@ var ModelRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && isPlainObject12(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject15(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(this.modelName, keyOrOptions);
     }
@@ -5162,7 +6044,7 @@ var ModelRouter = class {
 
 // src/routers/root-router.ts
 import JsonRouter6 from "@web-ts-toolkit/express-json-router";
-import { isNumber as _isNumber, isString as isString10, normalizeUrlPath as normalizeUrlPath3, orderBy as _orderBy } from "@web-ts-toolkit/utils";
+import { isNumber as _isNumber, normalizeUrlPath as normalizeUrlPath3, orderBy as _orderBy } from "@web-ts-toolkit/utils";
 
 // src/core-data.ts
 var DataCore = class {
@@ -5330,16 +6212,19 @@ async function decorateDataSingleResult(svc, result, context = {}) {
 
 // src/routers/root-router.ts
 var clientErrors3 = JsonRouter6.clientErrors;
+var DEFAULT_MAX_BATCH_ENTRIES = 100;
+var DEFAULT_MAX_ORDER_GROUPS = 25;
+var DEFAULT_MAX_CONCURRENT_OPERATIONS = 10;
 var createErrorResult = (code, detail) => ({
   success: false,
+  kind: "error",
   code,
   errors: [{ detail }]
 });
-var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => isString10(item) ? { path: item } : item) : isString10(populate) ? { path: populate } : populate ?? [];
 var RootRouter = class {
   constructor(options = { basePath: "", operationAccess: true }, runtime = defaultRuntime) {
     this.modelOperations = {
-      new: async (req, item) => req.macl.getPublicService(item.name)._new(),
+      new: async (req, item) => req.macl.getPublicService(item.name)._new(item.args, item.options),
       list: async (req, item) => req.macl.getPublicService(item.name)._list(item.filter ?? {}, item.args, item.options),
       read: async (req, item) => {
         const svc = req.macl.getPublicService(item.name);
@@ -5362,7 +6247,7 @@ var RootRouter = class {
       subBulkUpdate: async (req, item) => req.macl.getPublicService(item.name).bulkUpdateSub(item.id, item.sub, item.data),
       subDelete: async (req, item) => req.macl.getPublicService(item.name).deleteSub(item.id, item.sub, item.subId),
       distinct: async (req, item) => req.macl.getPublicService(item.name)._distinct(item.field, { filter: item.filter }),
-      count: async (req, item) => req.macl.getPublicService(item.name)._count(item.filter ?? {}, item.options?.access)
+      count: async (req, item) => req.macl.getPublicService(item.name)._count(item.filter ?? {})
     };
     this.dataOperations = {
       list: async (req, item) => {
@@ -5397,10 +6282,16 @@ var RootRouter = class {
         return decorateDataSingleResult(svc, result, { dataName: item.name });
       }
     };
-    const { basePath, operationAccess } = options;
+    const { basePath, operationAccess, maxBatchEntries, maxOrderGroups, maxConcurrentOperations } = options;
     this.runtime = runtime;
     this.basename = basePath || "";
     this.operationAccess = operationAccess;
+    this.maxBatchEntries = this.normalizePositiveLimit(maxBatchEntries, DEFAULT_MAX_BATCH_ENTRIES);
+    this.maxOrderGroups = this.normalizePositiveLimit(maxOrderGroups, DEFAULT_MAX_ORDER_GROUPS);
+    this.maxConcurrentOperations = this.normalizePositiveLimit(
+      maxConcurrentOperations,
+      DEFAULT_MAX_CONCURRENT_OPERATIONS
+    );
     this.router = new JsonRouter6(
       this.basename,
       [createSetCore(this.runtime), createSetDataCore(this.runtime)],
@@ -5417,7 +6308,7 @@ var RootRouter = class {
       target: item.target,
       name: item.name,
       op: item.op,
-      result,
+      result: toPublicServiceResult(result),
       message: mapCodeToMessage(result.code),
       statusCode: mapCodeToStatusCode(result.code)
     };
@@ -5468,17 +6359,63 @@ var RootRouter = class {
     return this.wrapResult(index, item, await handler(req, item));
   }
   groupItemsByOrder(items) {
-    return items.reduce((acc, item, index) => {
-      let order = 0;
-      if (_isNumber(item.order)) {
-        order = item.order < 0 ? 0 : item.order;
+    const groups = /* @__PURE__ */ new Map();
+    items.forEach((item, index) => {
+      const order = _isNumber(item.order) ? item.order : 0;
+      const group = groups.get(order);
+      if (group) {
+        group.push({ index, item });
+        return;
       }
-      if (!acc[order]) {
-        acc[order] = [];
+      groups.set(order, [{ index, item }]);
+    });
+    return Array.from(groups.entries()).sort(([leftOrder], [rightOrder]) => leftOrder - rightOrder).map(([, group]) => group);
+  }
+  normalizePositiveLimit(value, fallback) {
+    return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+  }
+  validateBatch(items) {
+    if (items.length > this.maxBatchEntries) {
+      throw new clientErrors3.BadRequestError("Bad Request", {
+        errors: [{ detail: `Root batch exceeds maximum size of ${this.maxBatchEntries}` }]
+      });
+    }
+    const orders = /* @__PURE__ */ new Set();
+    for (const item of items) {
+      const order = item.order ?? 0;
+      if (!Number.isSafeInteger(order) || order < 0) {
+        throw new clientErrors3.BadRequestError("Bad Request", {
+          errors: [{ detail: "Root batch order must be a non-negative safe integer" }]
+        });
       }
-      acc[order].push({ index, item });
-      return acc;
-    }, []);
+      if (order > this.maxOrderGroups) {
+        throw new clientErrors3.BadRequestError("Bad Request", {
+          errors: [{ detail: `Root batch order exceeds maximum group index of ${this.maxOrderGroups}` }]
+        });
+      }
+      orders.add(order);
+    }
+    if (orders.size > this.maxOrderGroups) {
+      throw new clientErrors3.BadRequestError("Bad Request", {
+        errors: [{ detail: `Root batch exceeds maximum order groups of ${this.maxOrderGroups}` }]
+      });
+    }
+  }
+  async runGroup(req, entries) {
+    const results = new Array(entries.length);
+    let cursor = 0;
+    const workerCount = Math.min(this.maxConcurrentOperations, entries.length);
+    await Promise.all(
+      Array.from({ length: workerCount }, async () => {
+        while (cursor < entries.length) {
+          const current = cursor;
+          cursor += 1;
+          const { item, index } = entries[current];
+          results[current] = await this.processOp(req, item, index);
+        }
+      })
+    );
+    return results;
   }
   async assertAllowed(req) {
     const allowed = await req.macl.canActivate(this.operationAccess);
@@ -5488,10 +6425,11 @@ var RootRouter = class {
     this.router.post("", async (req) => {
       await this.assertAllowed(req);
       const items = parseBody(rootQuerySchema, req.body);
+      this.validateBatch(items);
       const groupedItems = this.groupItemsByOrder(items);
       const results = [];
       for (let x = 0; x < groupedItems.length; x++) {
-        const arrResult = await Promise.all(groupedItems[x].map(({ item, index }) => this.processOp(req, item, index)));
+        const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
       return _orderBy(results, ["index"], ["asc"]);
@@ -5501,7 +6439,8 @@ var RootRouter = class {
       path: "",
       operationId: "root.query",
       summary: "Execute batched model and data operations",
-      body: rootQuerySchema
+      body: rootQuerySchema,
+      idempotent: true
     });
   }
   get routes() {
@@ -5511,7 +6450,7 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 import JsonRouter7 from "@web-ts-toolkit/express-json-router";
-import { isPlainObject as isPlainObject13, isString as isString11, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath4 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject16, isString as isString9, isUndefined as isUndefined3, normalizeUrlPath as normalizeUrlPath4 } from "@web-ts-toolkit/utils";
 var clientErrors4 = JsonRouter7.clientErrors;
 function setOption2(parentKey, optionKey, option) {
   const key = isUndefined3(option) ? parentKey : `${parentKey}.${optionKey}`;
@@ -5648,7 +6587,7 @@ var DataRouter = class {
       const result = await svc.findById(id, {}, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "get",
@@ -5667,7 +6606,7 @@ var DataRouter = class {
       const result = await svc.findOne(filter2 ?? {}, { select }, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -5690,7 +6629,7 @@ var DataRouter = class {
       const result = await svc.findById(id, { select }, {});
       handleResultError(result);
       const decoratedResult = await decorateDataSingleResult(svc, result);
-      return decoratedResult.data;
+      return unwrapServiceData(decoratedResult);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -5703,11 +6642,11 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && isString11(keyOrOptions)) {
+    if (arguments.length === 2 && isString9(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(this.dataName, keyOrOptions, value);
     }
-    if (arguments.length === 1 && isPlainObject13(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject16(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -5735,6 +6674,9 @@ import JsonRouter8 from "@web-ts-toolkit/express-json-router";
 import express from "express";
 import { posix } from "path";
 var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+var escapeInlineScriptJson = (value) => {
+  return value.replace(/<\/script/gi, "<\\/script").replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+};
 var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
 <html lang="en">
 <head>
@@ -5748,7 +6690,7 @@ var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
   <script src="${escapeHtml(bundleUrl)}"></script>
   <script>
     window.ui = SwaggerUIBundle({
-      url: ${JSON.stringify(specPath)},
+      url: ${escapeInlineScriptJson(JSON.stringify(specPath))},
       dom_id: '#swagger-ui',
       deepLinking: true,
       presets: [SwaggerUIBundle.presets.apis],
@@ -5803,10 +6745,10 @@ var accessRouterResponseHandler = JsonRouter8.createHandler({
   errorFormat: JsonRouter8.ErrorFormats.rfc9457,
   rfc9457ContentType: "application/problem+json"
 });
-accessRouterResponseHandler.errorMessageProvider = function(error) {
-  const errorLike = error;
-  logger.error(error);
-  return errorLike.message || errorLike._message || String(error);
+accessRouterResponseHandler.errorMessageProvider = function(error2) {
+  const errorLike = error2;
+  error(error2);
+  return errorLike.message || errorLike._message || String(error2);
 };
 
 // src/plugins.ts
@@ -5819,6 +6761,7 @@ function permissionsPlugin(schema, options) {
 }
 
 // src/index.ts
+var isMongooseModel = (value) => typeof value === "function" && value !== null && "modelName" in value && "schema" in value;
 function createRuntimeApi(runtime) {
   const runtimeMiddleware = function() {
     return createSetCore(runtime);
@@ -5826,8 +6769,18 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    const resolvedModelName = typeof modelName === "string" ? modelName : modelName && "modelName" in modelName ? modelName.modelName : modelName;
-    return isUndefined4(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
+    if (isUndefined4(options)) {
+      return new RootRouter(modelName, runtime);
+    }
+    if (typeof modelName === "string") {
+      return new ModelRouter(modelName, options, runtime);
+    }
+    if (isMongooseModel(modelName)) {
+      const name = String(modelName.modelName);
+      runtime.registerModelInstance(name, modelName);
+      return ModelRouter.fromModel(modelName, options, runtime);
+    }
+    throw new TypeError(`createRouter: unsupported first argument type: ${typeof modelName}`);
   };
   wtt2.createDataRouter = function(dataName, options) {
     return new DataRouter(dataName, options, runtime);
@@ -5837,10 +6790,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && isString12(keyOrOptions)) {
+    if (arguments.length === 2 && isString10(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && isPlainObject14(keyOrOptions)) {
+    if (arguments.length === 1 && isPlainObject17(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };
@@ -5858,6 +6811,9 @@ function createRuntimeApi(runtime) {
   wtt2.setDefaultModelOption = runtime.setDefaultModelOption.bind(runtime);
   wtt2.getDefaultModelOptions = runtime.getDefaultModelOptions.bind(runtime);
   wtt2.getDefaultModelOption = runtime.getDefaultModelOption.bind(runtime);
+  wtt2.registerModelInstance = runtime.registerModelInstance.bind(runtime);
+  wtt2.hasModelInstance = runtime.hasModelInstance.bind(runtime);
+  wtt2.getModelInstance = runtime.getModelInstance.bind(runtime);
   wtt2.RootRouter = RootRouter;
   wtt2.ModelRouter = ModelRouter;
   wtt2.DataRouter = DataRouter;
@@ -5873,12 +6829,15 @@ export {
   AccessRuntime,
   DataRouter,
   ModelRouter,
+  OpenApiCollisionError,
+  OpenApiRegistry,
   RootRouter,
   acl,
   combineRoutes,
   createAccessRuntime,
   createOpenApiRouter,
   index_default as default,
+  defaultRuntime,
   defineRequestSchema,
   fromAjv,
   fromArkType,
@@ -5894,12 +6853,19 @@ export {
   getDefaultModelOptions,
   getGlobalOption,
   getGlobalOptions,
+  getModelInstance,
   getModelJsonSchema,
   getModelNames,
   getModelOption,
   getModelOptions,
   guard,
+  hasModelInstance,
+  isLevelEnabled,
   permissionsPlugin,
+  redactFilter,
+  redactPayload,
+  registerModelInstance,
+  safeStringify,
   setDefaultModelOption,
   setDefaultModelOptions,
   setGlobalOption,