@web-ts-toolkit/access-router 0.43.0 → 0.45.0

package/advanced.js

@@ -134,6 +134,12 @@ var import_utils8 = require("@web-ts-toolkit/utils");
 var import_utils = require("@web-ts-toolkit/utils");
 var DEFAULT_LIST_HARD_LIMIT = 1e3;
 
+// src/helpers/sort-policy.ts
+var fieldPathPattern = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)*$/;
+function isValidFieldPath(field) {
+  return typeof field === "string" && fieldPathPattern.test(field);
+}
+
 // src/helpers/index.ts
 var import_utils3 = require("@web-ts-toolkit/utils");
 
@@ -557,6 +563,29 @@ var cloneConfigValue = (value) => {
     ])
   );
 };
+var cloneForRead = (value) => {
+  if (Array.isArray(value)) {
+    if (Object.isFrozen(value)) {
+      return value;
+    }
+    return value.map((item) => cloneForRead(item));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) {
+    return value;
+  }
+  if (Object.isFrozen(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([entryKey, entryValue]) => [
+      entryKey,
+      cloneForRead(entryValue)
+    ])
+  );
+};
 var freezeConfigValue = (value) => {
   if (!value || typeof value !== "object") {
     return value;
@@ -572,6 +601,7 @@ var freezeConfigValue = (value) => {
   }
   return value;
 };
+var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -601,6 +631,14 @@ var OptionsManager = class {
         target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
+      },
+      defineProperty(target, key, descriptor) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        const result = Reflect.defineProperty(target, key, descriptor);
+        const newValue = target[keystr];
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, newValue, keystr, target, oldvalue);
+        return result;
       }
     });
   }
@@ -614,18 +652,18 @@ var OptionsManager = class {
   set(key, value) {
     const path = toPath(key);
     if (path.length <= 1) {
-      (0, import_utils6.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneConfigValue(value));
+      (0, import_utils6.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
       return;
     }
     const [rootKey, ...nestedPath] = path;
     const currentRoot = (0, import_utils6.get)(this.currentOptions, [rootKey], void 0);
     const baseRoot = (0, import_utils6.isPlainObject)(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
-    (0, import_utils6.set)(nextRoot, nestedPath, cloneConfigValue(value));
-    (0, import_utils6.set)(this.currentOptions, [rootKey], nextRoot);
+    (0, import_utils6.set)(nextRoot, nestedPath, cloneForRead(value));
+    (0, import_utils6.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
   }
   fetch() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -634,20 +672,20 @@ var OptionsManager = class {
     return freezeConfigValue(cloned);
   }
   assign(options) {
-    const cloned = cloneConfigValue(options);
+    const cloned = cloneForRead(options);
     for (const key of this.preserveKeys) {
       if (key in options) {
         cloned[key] = options[key];
       }
     }
-    (0, import_utils6.assign)(this.currentOptions, cloned);
+    (0, import_utils6.assign)(this.currentOptions, freezeConfigValue(cloned));
   }
   onchange(key, func) {
     (0, import_utils6.set)(this.listeners, key, func);
     return this;
   }
   snapshot() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -663,13 +701,13 @@ var OptionsManager = class {
         delete current[key];
       }
     }
-    const cloned = cloneConfigValue(snap);
+    const cloned = cloneForRead(snap);
     for (const key of this.preserveKeys) {
       if (key in snap) {
         cloned[key] = snap[key];
       }
     }
-    (0, import_utils6.assign)(current, cloned);
+    (0, import_utils6.assign)(current, freezeConfigValue(cloned));
   }
 };
 
@@ -684,7 +722,9 @@ var defaultRequestComplexity = {
   maxIncludeCount: 10,
   maxSubQueryCount: 10,
   maxBulkConcurrency: 10,
-  maxHookConcurrency: 10
+  maxHookConcurrency: 10,
+  maxCorrelatedQueries: 100,
+  maxCorrelatedDepth: 5
 };
 var normalizePositiveInteger = (value, fallback) => {
   return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
@@ -704,6 +744,14 @@ var resolveRequestComplexity = (options) => ({
   maxHookConcurrency: normalizePositiveInteger(
     options?.maxHookConcurrency,
     defaultRequestComplexity.maxHookConcurrency
+  ),
+  maxCorrelatedQueries: normalizePositiveInteger(
+    options?.maxCorrelatedQueries,
+    defaultRequestComplexity.maxCorrelatedQueries
+  ),
+  maxCorrelatedDepth: normalizePositiveInteger(
+    options?.maxCorrelatedDepth,
+    defaultRequestComplexity.maxCorrelatedDepth
   )
 });
 function validateRequestComplexity(value, options, scope = "request") {
@@ -1139,8 +1187,7 @@ var AccessRuntime = class {
   }
   setDataOptions(dataName, options) {
     const manager = this.getOrCreateDataOptions(dataName);
-    const currentDataOptions = manager.fetch();
-    manager.assign({ ...currentDataOptions, ...options });
+    manager.assign(options);
   }
   setDataOption(dataName, key, value) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1150,6 +1197,11 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  getDataSnapshot(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const snapshot = manager.get("data");
+    return snapshot ?? [];
+  }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
     return getNestedOption(manager, key, defaultValue);
@@ -1208,6 +1260,175 @@ var getGlobalOption = (key, defaultValue) => {
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
+var import_utils10 = require("@web-ts-toolkit/utils");
+
+// src/correlated-includes.ts
+var import_utils9 = require("@web-ts-toolkit/utils");
+var PARENT_MARKER_KEY = "$parent";
+var ESCAPE_WRAPPER_KEY = "$escape";
+var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
+var MARKER_FORBIDDEN_OPERATOR_KEYS = /* @__PURE__ */ new Set(["$text", "$where", "$comment"]);
+var LOGICAL_CLAUSE_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
+var DANGEROUS_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
+var ownKeys = (value) => Object.keys(value);
+function isParentRefMarker(value) {
+  return (0, import_utils9.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+}
+function isEscapedParentRef(value) {
+  return (0, import_utils9.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+}
+function hasMarkerKey(value) {
+  return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
+}
+function isValidParentRefPath(path) {
+  if (typeof path !== "string" || path.length === 0) return false;
+  const segments = path.split(".");
+  return segments.every(
+    (segment) => (FIELD_SEGMENT_PATTERN.test(segment) || ARRAY_INDEX_SEGMENT_PATTERN.test(segment)) && !DANGEROUS_PATH_SEGMENTS.has(segment)
+  );
+}
+function isValidCorrelatedOutputPath(path) {
+  return typeof path === "string" && path.length > 0 && isValidFieldPath(path) && path !== "_id" && !path.startsWith("$");
+}
+function containsParentMarkerShape(value) {
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (current) => {
+    if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
+    if ((0, import_utils9.isArray)(current)) {
+      if (seen.has(current)) return false;
+      seen.add(current);
+      return current.some(visit);
+    }
+    if ((0, import_utils9.isPlainObject)(current)) {
+      if (seen.has(current)) return false;
+      seen.add(current);
+      if (hasMarkerKey(current)) return true;
+      return Object.values(current).some(visit);
+    }
+    return false;
+  };
+  return visit(value);
+}
+function scanTemplateValueNode(value, path, issues) {
+  if (isEscapedParentRef(value)) {
+    const inner = value.$escape;
+    if (!isParentRefMarker(inner) || typeof inner.$parent !== "string" || (inner.$parent?.length ?? 0) === 0) {
+      issues.push({
+        message: 'Invalid $escape payload: expected { "$escape": { "$parent": "<field>" } }',
+        path
+      });
+    }
+    return;
+  }
+  if (isParentRefMarker(value)) {
+    if (!isValidParentRefPath(value.$parent)) {
+      issues.push({
+        message: `Invalid $parent reference path at ${path.length === 0 ? "#" : path.join(".")}`,
+        path
+      });
+    }
+    return;
+  }
+  if ((0, import_utils9.isPlainObject)(value)) {
+    if (hasMarkerKey(value)) {
+      issues.push({
+        message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
+        path
+      });
+      return;
+    }
+    scanTemplateObjectEntries(value, path, issues);
+    return;
+  }
+  if ((0, import_utils9.isArray)(value)) {
+    value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
+  }
+}
+function scanTemplateObjectEntries(obj, basePath, issues) {
+  for (const [key, child] of Object.entries(obj)) {
+    const childPath = [...basePath, key];
+    if (key === PARENT_MARKER_KEY) {
+      issues.push({ message: "$parent is never a field name in correlated templates", path: childPath });
+      continue;
+    }
+    if (SUBQUERY_PAYLOAD_KEYS.has(key)) {
+      if (containsParentMarkerShape(child)) {
+        issues.push({
+          message: `Unsupported $parent reference inside ${key}: markers are not resolved in subquery payloads`,
+          path: childPath
+        });
+      }
+      continue;
+    }
+    if (MARKER_FORBIDDEN_OPERATOR_KEYS.has(key)) {
+      if (containsParentMarkerShape(child)) {
+        issues.push({
+          message: `Unsupported $parent reference inside ${key}: markers are not resolved in ${key} values`,
+          path: childPath
+        });
+      }
+      continue;
+    }
+    if (key === "$elemMatch") {
+      if (isParentRefMarker(child) || isEscapedParentRef(child)) {
+        issues.push({
+          message: "Unsupported $parent reference as a direct $elemMatch value",
+          path: childPath
+        });
+        continue;
+      }
+      scanTemplateValueNode(child, childPath, issues);
+      continue;
+    }
+    if (LOGICAL_CLAUSE_KEYS.has(key)) {
+      if (!(0, import_utils9.isArray)(child)) {
+        scanTemplateValueNode(child, childPath, issues);
+        continue;
+      }
+      child.forEach((clause, index) => {
+        const clausePath = [...childPath, index];
+        if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
+          issues.push({
+            message: `Unsupported $parent reference as a direct ${key} clause: clauses must be filter objects`,
+            path: clausePath
+          });
+          return;
+        }
+        if ((0, import_utils9.isPlainObject)(clause)) {
+          scanTemplateObjectEntries(clause, clausePath, issues);
+        }
+      });
+      continue;
+    }
+    scanTemplateValueNode(child, childPath, issues);
+  }
+}
+function validateCorrelatedFilterTemplate(filter) {
+  const issues = [];
+  if (!(0, import_utils9.isPlainObject)(filter)) {
+    issues.push({ message: "Correlated include filter must be an object", path: [] });
+    return issues;
+  }
+  if (isParentRefMarker(filter) || isEscapedParentRef(filter)) {
+    issues.push({ message: "Correlated include filter must not itself be a $parent reference", path: [] });
+    return issues;
+  }
+  scanTemplateObjectEntries(filter, [], issues);
+  return issues;
+}
+function findArgsMarkerIssue(value, where) {
+  if (value !== void 0 && containsParentMarkerShape(value)) {
+    return {
+      message: `Unsupported $parent reference in ${where}: references are only supported in filter and id positions`,
+      path: []
+    };
+  }
+  return null;
+}
+
+// src/validation/common.ts
 var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
 var safeIntegerString = (min, message) => import_zod2.z.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
 var queryBooleanString = import_zod2.z.enum(["true", "false"]);
@@ -1268,7 +1489,8 @@ var subPopulateSchema = import_zod2.z.union([
     select: projectionSchema.optional()
   }).passthrough()
 ]);
-var includeItemSchema = import_zod2.z.object({
+var legacyIncludeItemSchema = import_zod2.z.object({
+  mode: import_zod2.z.enum(["legacy"]).optional(),
   model: import_zod2.z.string().min(1),
   op: import_zod2.z.enum(["list", "read", "count"]),
   path: import_zod2.z.string().min(1),
@@ -1277,8 +1499,139 @@ var includeItemSchema = import_zod2.z.object({
   foreignField: import_zod2.z.string().min(1),
   args: import_zod2.z.unknown().optional().describe("Forwarded to list/read includes. Count includes ignore pagination fields so counts remain exact."),
   options: import_zod2.z.unknown().optional()
-}).passthrough();
-var includeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
+}).passthrough().superRefine((entry, ctx) => {
+  if (entry.filter !== void 0 && containsParentMarkerShape(entry.filter)) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      message: 'Legacy includes must not contain $parent markers; use a correlated include (mode: "correlated")',
+      path: ["filter"]
+    });
+  }
+});
+var parentRefSchema = import_zod2.z.object({ $parent: import_zod2.z.string().min(1) }).strict().superRefine((value, ctx) => {
+  if (!isValidParentRefPath(value.$parent)) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      message: `Invalid $parent reference path: ${value.$parent}`,
+      path: ["$parent"]
+    });
+  }
+});
+var correlatedIdSchema = import_zod2.z.union([import_zod2.z.string().min(1), parentRefSchema]);
+var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).superRefine((filter, ctx) => {
+  for (const issue of validateCorrelatedFilterTemplate(filter)) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      message: issue.message,
+      path: issue.path.map(String)
+    });
+  }
+});
+var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
+  (value) => value === void 0 || (0, import_utils10.isPlainObject)(value) && Object.keys(value).length === 0,
+  "Correlated include options must be absent or empty"
+).optional();
+var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
+  if (!isValidCorrelatedOutputPath(path)) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      message: `Invalid correlated include output path: ${path}`,
+      path: []
+    });
+  }
+});
+var checkArgsMarkers = (select, sort, ctx) => {
+  const selectIssue = findArgsMarkerIssue(select, "args.select");
+  if (selectIssue) {
+    ctx.addIssue({ code: import_zod2.z.ZodIssueCode.custom, message: selectIssue.message, path: ["select"] });
+  }
+  const sortIssue = findArgsMarkerIssue(sort, "args.sort");
+  if (sortIssue) {
+    ctx.addIssue({ code: import_zod2.z.ZodIssueCode.custom, message: sortIssue.message, path: ["sort"] });
+  }
+};
+var correlatedReadArgsSchema = import_zod2.z.object({
+  select: projectionSchema.optional(),
+  sort: sortSchema.optional(),
+  include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
+}).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
+var correlatedListArgsSchema = import_zod2.z.object({
+  select: projectionSchema.optional(),
+  sort: sortSchema.optional(),
+  skip: import_zod2.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod2.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod2.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod2.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
+}).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
+var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
+  (value) => value === void 0 || (0, import_utils10.isPlainObject)(value) && Object.keys(value).length === 0,
+  "Count includes accept no args"
+).optional();
+var correlatedReadByIdSchema = import_zod2.z.object({
+  mode: import_zod2.z.literal("correlated"),
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.literal("read"),
+  path: correlatedPathSchema,
+  id: correlatedIdSchema,
+  args: correlatedReadArgsSchema.optional(),
+  options: correlatedEmptyOptionsSchema
+}).strict();
+var correlatedReadByFilterSchema = import_zod2.z.object({
+  mode: import_zod2.z.literal("correlated"),
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.literal("read"),
+  path: correlatedPathSchema,
+  filter: correlatedFilterSchema,
+  args: correlatedReadArgsSchema.optional(),
+  options: correlatedEmptyOptionsSchema
+}).strict();
+var correlatedListSchema = import_zod2.z.object({
+  mode: import_zod2.z.literal("correlated"),
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.literal("list"),
+  path: correlatedPathSchema,
+  filter: correlatedFilterSchema,
+  args: correlatedListArgsSchema.optional(),
+  options: correlatedEmptyOptionsSchema
+}).strict();
+var correlatedCountSchema = import_zod2.z.object({
+  mode: import_zod2.z.literal("correlated"),
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.literal("count"),
+  path: correlatedPathSchema,
+  filter: correlatedFilterSchema,
+  args: correlatedCountArgsSchema,
+  options: correlatedEmptyOptionsSchema
+}).strict();
+var includeItemSchema = import_zod2.z.union([
+  legacyIncludeItemSchema,
+  correlatedReadByIdSchema,
+  correlatedReadByFilterSchema,
+  correlatedListSchema,
+  correlatedCountSchema
+]);
+var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
+var rejectDuplicateCorrelatedPaths = (items, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  items.forEach((item, index) => {
+    if ((0, import_utils10.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+      if (seen.has(item.path)) {
+        ctx.addIssue({
+          code: import_zod2.z.ZodIssueCode.custom,
+          message: `Duplicate correlated include output path: ${item.path}`,
+          path: [index, "path"]
+        });
+      } else {
+        seen.add(item.path);
+      }
+    }
+  });
+};
+var includeSchema = import_zod2.z.union([
+  includeItemSchema,
+  import_zod2.z.array(includeItemSchema).superRefine(rejectDuplicateCorrelatedPaths)
+]);
 var fieldsSchema = import_zod2.z.array(import_zod2.z.string().min(1));
 var taskSchema = import_zod2.z.object({
   type: import_zod2.z.string().min(1),
@@ -1395,8 +1748,9 @@ function defineRequestSchema(validator, options = {}) {
   };
 }
 function fromZod(schema) {
-  return (value) => {
-    const result = schema.safeParse(value);
+  return async (value) => {
+    const candidate = schema;
+    const result = typeof candidate.safeParseAsync === "function" ? await candidate.safeParseAsync.call(schema, value) : schema.safeParse(value);
     if (result.success) {
       return {
         success: true,
@@ -1433,6 +1787,9 @@ function fromYup(schema) {
         data
       };
     } catch (error) {
+      if (!isYupValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeYupIssues(error)
@@ -1457,8 +1814,32 @@ function fromJoi(schema) {
 }
 function fromAjv(validator) {
   return async (value) => {
-    const valid = await validator(value);
-    if (valid) {
+    const outcome = validator(value);
+    if (isThenable(outcome)) {
+      try {
+        const data = await outcome;
+        if (data === false) {
+          return {
+            success: false,
+            issues: normalizeAjvIssues(validator.errors ?? [])
+          };
+        }
+        return {
+          success: true,
+          data: data === true ? value : data
+        };
+      } catch (error) {
+        if (!isAjvValidationError(error)) {
+          throw error;
+        }
+        return {
+          success: false,
+          issues: normalizeAjvIssues(error.errors ?? [])
+        };
+      }
+    }
+    const errorsSnapshot = validator.errors ? [...validator.errors] : [];
+    if (outcome) {
       return {
         success: true,
         data: value
@@ -1466,7 +1847,7 @@ function fromAjv(validator) {
     }
     return {
       success: false,
-      issues: normalizeAjvIssues(validator.errors ?? [])
+      issues: normalizeAjvIssues(errorsSnapshot)
     };
   };
 }
@@ -1487,6 +1868,25 @@ function fromValibot(schema, safeParse) {
 }
 function fromArkType(type) {
   return async (value) => {
+    if (isStandardSchema(type)) {
+      const result2 = await type["~standard"].validate(value);
+      if (isArkTypeErrors(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeIssues(result2)
+        };
+      }
+      if (isStandardSchemaFailure(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeStandardIssues(result2.issues)
+        };
+      }
+      return {
+        success: true,
+        data: result2.value
+      };
+    }
     const result = await type(value);
     if (!isArkTypeErrors(result)) {
       return {
@@ -1539,6 +1939,9 @@ function fromVine(validator) {
         data: output
       };
     } catch (error) {
+      if (!isVineValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeVineError(error)
@@ -1599,6 +2002,13 @@ function normalizeArkTypeIssues(issues) {
   }));
   return normalized.length ? normalized : [{ message: issues.summary ?? "Validation failed" }];
 }
+function normalizeArkTypeStandardIssues(issues) {
+  const normalized = issues.map((issue) => ({
+    message: issue.message ?? issue.problem ?? "Validation failed",
+    path: issue.path?.flatMap((segment) => normalizePathSegment(segment))
+  }));
+  return normalized.length ? normalized : [{ message: "Validation failed" }];
+}
 function normalizeIoTsIssues(issues) {
   return issues.map((issue) => ({
     message: issue.message ?? "Validation failed",
@@ -1633,25 +2043,64 @@ function normalizeVineField(message) {
   }
   return path.length ? path : void 0;
 }
+function decodeAjvSegment(segment) {
+  return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function encodePointerSegment(segment) {
+  return encodeURIComponent(segment.replace(/~/g, "~0").replace(/\//g, "~1"));
+}
 function parseAjvPath(issue) {
-  const path = issue.instancePath?.split("/").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
-  if (issue.params?.missingProperty) {
-    return (path ?? []).concat(issue.params.missingProperty);
+  const raw = issue.instancePath;
+  const base = raw == null || raw === "" ? [] : (raw.startsWith("/") ? raw.slice(1) : raw).split("/").map(decodeAjvSegment);
+  const missing = issue.params?.missingProperty;
+  if (typeof missing === "string") {
+    return [...base, missing];
   }
-  return path;
+  return base;
 }
 function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
 function isYupValidationError(error) {
-  return typeof error === "object" && error !== null && "message" in error;
+  if (typeof error !== "object" || error === null || !("message" in error)) {
+    return false;
+  }
+  const candidate = error;
+  return candidate.name === "ValidationError" && typeof candidate.message === "string" && Array.isArray(candidate.errors) && Array.isArray(candidate.inner);
 }
 function isArkTypeErrors(value) {
-  return Array.isArray(value);
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return record.arkKind === "errors" || record[" arkKind"] === "errors";
+}
+function isThenable(value) {
+  return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function isAjvValidationError(error) {
+  if (typeof error !== "object" || error === null || !("errors" in error)) {
+    return false;
+  }
+  const errors = error.errors;
+  return errors == null || Array.isArray(errors);
 }
 function isVineValidationError(error) {
-  return typeof error === "object" && error !== null && "messages" in error && Array.isArray(error.messages);
+  if (typeof error !== "object" || error === null || !("messages" in error)) {
+    return false;
+  }
+  const candidate = error;
+  if (!Array.isArray(candidate.messages) || candidate.messages.length === 0) {
+    return false;
+  }
+  const hasDiscriminator = candidate.code === "E_VALIDATION_ERROR" || candidate.name === "ValidationError";
+  if (!hasDiscriminator) {
+    return false;
+  }
+  return candidate.messages.every(
+    (message) => typeof message === "object" && message !== null && typeof message.message === "string" && typeof message.field === "string"
+  );
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -1668,7 +2117,7 @@ function formatIssue(issue, key, location = "pointer") {
   };
 }
 function buildPointer(path) {
-  return path.length === 0 ? "#" : `#/${path.join("/")}`;
+  return path.length === 0 ? "#" : `#/${path.map(encodePointerSegment).join("/")}`;
 }
 
 // src/validation/model-router.ts
@@ -1719,7 +2168,7 @@ var listBodySchema = import_zod3.z.object({
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
 var countBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options"]));
+}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options", "include"]));
 var readFilterBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),