@web-ts-toolkit/access-router 0.45.0 → 0.47.0

package/index.js

@@ -77,14 +77,14 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils30 = require("@web-ts-toolkit/utils");
+var import_utils32 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router2 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils23 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
-var import_utils22 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 
 // src/runtime.ts
 var import_mongoose3 = __toESM(require("mongoose"));
@@ -122,8 +122,12 @@ var mapWithConcurrencyLimit = async (items, limit, iteratee) => {
 };
 var RequestConcurrencyScheduler = class {
   constructor(limit) {
+    this.activeWork = 0;
+    this.waiters = [];
     this.limit = Math.max(1, limit);
   }
+  // Each map bounds its own orchestration workers. Recursive maps never hold
+  // shared work permits while awaiting descendants (including at limit 1).
   async map(items, iteratee) {
     return mapWithConcurrencyLimit(items, this.limit, (item, index) => iteratee(item, index, true));
   }
@@ -131,6 +135,23 @@ var RequestConcurrencyScheduler = class {
     const [result] = await this.map([void 0], () => iteratee(true));
     return result;
   }
+  // Only leaf persistence operations belong here, not service/hook callbacks.
+  // All work calls on this scheduler share a FIFO admission ceiling.
+  async work(operation) {
+    if (this.activeWork >= this.limit) {
+      await new Promise((resolve) => this.waiters.push(resolve));
+    } else {
+      this.activeWork += 1;
+    }
+    try {
+      return await operation();
+    } finally {
+      const next = this.waiters.shift();
+      if (next)
+        next();
+      else this.activeWork -= 1;
+    }
+  }
 };
 
 // src/helpers/document.ts
@@ -355,6 +376,41 @@ function normalizeSortForOrderBy(sort) {
     orders: normalized.fields.map(({ direction }) => direction)
   };
 }
+function sanitizeSortFields(sort, allowedFields) {
+  const { fields, errors } = normalizeSort(sort);
+  if (errors.length > 0) return { sort: void 0, stripped: [], errors };
+  const allowedSet = new Set(allowedFields.concat(["id", "_id"]));
+  const kept = fields.filter(({ field }) => allowedSet.has(field));
+  const stripped = fields.filter(({ field }) => !allowedSet.has(field)).map(({ field }) => field);
+  if (stripped.length === 0) return { sort, stripped, errors: [] };
+  if (kept.length === 0) return { sort: void 0, stripped, errors: [] };
+  if (typeof sort === "string") {
+    return {
+      sort: kept.map(({ field, direction }) => direction === "desc" ? `-${field}` : field).join(" "),
+      stripped,
+      errors: []
+    };
+  }
+  if (sort instanceof Map) {
+    return {
+      sort: new Map(kept.map(({ field, direction }) => [field, direction])),
+      stripped,
+      errors: []
+    };
+  }
+  if (Array.isArray(sort)) {
+    return {
+      sort: kept.map(({ field, direction }) => [field, direction]),
+      stripped,
+      errors: []
+    };
+  }
+  return {
+    sort: Object.fromEntries(kept.map(({ field, direction }) => [field, direction])),
+    stripped,
+    errors: []
+  };
+}
 
 // src/helpers/index.ts
 var import_utils6 = require("@web-ts-toolkit/utils");
@@ -1222,6 +1278,7 @@ var AccessRuntime = class {
     this.modelAtts = {};
     this.modelInstances = {};
     this.openApiRegistry = new OpenApiRegistry();
+    this.openApiPathPrefix = "";
     this.allowGlobalModelLookup = options.allowGlobalModelLookup ?? false;
     ensureMongooseJsonSchemaInitialized();
   }
@@ -1250,7 +1307,24 @@ var AccessRuntime = class {
     return global;
   }
   registerOpenApiRoute(route) {
-    this.openApiRegistry.register(route);
+    this.openApiRegistry.register(
+      this.openApiPathPrefix ? { ...route, path: (0, import_utils11.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+    );
+  }
+  /**
+   * Compose OpenAPI paths while synchronously constructing mounted routers.
+   * Prefixes apply before collision checks; prior descriptors and Express paths
+   * are unchanged. Nested calls compose and the prior scope is restored even on
+   * failure. The callback must finish registration synchronously (no async work).
+   */
+  withOpenApiPathPrefix(prefix, build) {
+    const previous = this.openApiPathPrefix;
+    this.openApiPathPrefix = (0, import_utils11.normalizeUrlPath)(`${previous}/${prefix}`);
+    try {
+      return build();
+    } finally {
+      this.openApiPathPrefix = previous;
+    }
   }
   /**
    * Enable strict OpenAPI collision detection for the remainder of this
@@ -1925,7 +1999,8 @@ function resolveValueNode(template, parent, bare) {
     if (!isParentRefMarker(inner) || typeof inner.$parent !== "string" || (inner.$parent?.length ?? 0) === 0) {
       throw new CorrelatedReferenceError('Invalid $escape payload: expected { "$escape": { "$parent": "<field>" } }');
     }
-    return literalParentRefObject(inner.$parent);
+    const literal = literalParentRefObject(inner.$parent);
+    return bare ? { $eq: literal } : literal;
   }
   if (isParentRefMarker(template)) {
     const path = template.$parent;
@@ -2054,8 +2129,28 @@ function isCorrelatedInclude(value) {
   return (0, import_utils12.isPlainObject)(value) && value.mode === "correlated";
 }
 
+// src/helpers/request-work.ts
+var states = /* @__PURE__ */ new WeakMap();
+function getRequestWorkState(req, runtime) {
+  let owners = states.get(req);
+  if (!owners) {
+    owners = /* @__PURE__ */ new WeakMap();
+    states.set(req, owners);
+  }
+  let state = owners.get(runtime);
+  if (!state) {
+    state = {
+      totalQueries: 0,
+      scheduler: new RequestConcurrencyScheduler(
+        resolveRequestComplexity(runtime.getGlobalOption("requestComplexity")).maxBulkConcurrency
+      )
+    };
+    owners.set(runtime, state);
+  }
+  return state;
+}
+
 // src/services/base.ts
-var correlatedExecStates = /* @__PURE__ */ new WeakMap();
 function getCorrelatedTemplateDepth(includes) {
   let max = 0;
   const visit = (entries, depth) => {
@@ -2105,6 +2200,7 @@ function validateClientFilter(filter2) {
 }
 var Base = class {
   constructor(req, modelName) {
+    this.requestRuntime = getActiveRuntime() ?? defaultRuntime;
     this.req = req;
     this.modelName = modelName;
   }
@@ -2242,6 +2338,7 @@ var Base = class {
       }
       seenCorrelatedPaths.add(entry.path);
     }
+    this.assertIncludeOutputPaths([...legacy, ...correlated]);
     let includeLocalFields = [];
     let includePaths = [];
     (0, import_utils13.forEach)(legacy, (inc) => {
@@ -2258,6 +2355,39 @@ var Base = class {
       correlatedReferenceFields: (0, import_utils13.uniq)((0, import_utils13.compact)(correlatedReferenceFields))
     };
   }
+  validateIncludeOutputPath(path, modelName) {
+    const permissionField = getModelOption(modelName, "documentPermissionField");
+    if ((0, import_utils13.get)((0, import_utils13.set)({}, path, true), permissionField) !== void 0 || (0, import_utils13.get)((0, import_utils13.set)({}, permissionField, true), path) !== void 0) {
+      this.throwClientRequestError(
+        "bad_request" /* BadRequest */,
+        `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
+      );
+    }
+  }
+  assertIncludeOutputPaths(include) {
+    const pending = [{ entries: include, modelName: this.modelName }];
+    const visited = /* @__PURE__ */ new WeakMap();
+    while (pending.length > 0) {
+      const { entries, modelName } = pending.pop();
+      if (modelName !== this.modelName && !getModelNames().includes(modelName)) {
+        this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
+      }
+      for (const entry of entries) {
+        if (!(0, import_utils13.isPlainObject)(entry)) continue;
+        const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
+        if (models.has(modelName)) continue;
+        models.add(modelName);
+        visited.set(entry, models);
+        if (typeof entry.path === "string" && entry.path) {
+          this.validateIncludeOutputPath(entry.path, modelName);
+        }
+        if ((entry.op === "read" || entry.op === "list") && typeof entry.model === "string") {
+          const nested = entry.args?.include;
+          if (nested) pending.push({ entries: (0, import_utils13.compact)((0, import_utils13.castArray)(nested)), modelName: entry.model });
+        }
+      }
+    }
+  }
   getForeignKeyValues(value) {
     return (0, import_utils13.flatten)((0, import_utils13.castArray)(value));
   }
@@ -2392,6 +2522,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "count");
     const localValues = docs.flatMap((doc) => this.getForeignKeyValues((0, import_utils13.get)(doc, localField)));
     const result = await svc.countByFieldValues(foreignField, localValues, _filters ?? {}, "count");
+    if (!result.success && result.code === "bad_request" /* BadRequest */) throw new ClientRequestError(result);
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
@@ -2400,16 +2531,7 @@ var Base = class {
     return docs;
   }
   getCorrelatedExecState() {
-    const key = this.req;
-    let state = correlatedExecStates.get(key);
-    if (!state) {
-      state = {
-        totalQueries: 0,
-        scheduler: new RequestConcurrencyScheduler(this.getRequestComplexity().maxBulkConcurrency)
-      };
-      correlatedExecStates.set(key, state);
-    }
-    return state;
+    return getRequestWorkState(this.req, this.requestRuntime);
   }
   claimCorrelatedQuerySlot() {
     const limits = this.getRequestComplexity();
@@ -2806,10 +2928,30 @@ var Base = class {
 };
 
 // src/services/service.ts
-var import_utils15 = require("@web-ts-toolkit/utils");
+var import_utils17 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
+var import_utils14 = require("@web-ts-toolkit/utils");
+function admitModelPersistence(adapter, scheduler) {
+  return {
+    modelName: adapter.modelName,
+    mongooseModel: adapter.mongooseModel,
+    new: () => adapter.new(),
+    // Mongoose create(array) otherwise starts all document saves at once. Keep
+    // the adapter's array input/output contract, with one permit per item; all
+    // items are submitted even if one rejects, as with unordered create(array).
+    create: (data) => Array.isArray(data) ? Promise.all(data.map((item) => scheduler.work(async () => (await adapter.create([item]))[0]))) : scheduler.work(() => adapter.create(data)),
+    find: (props) => scheduler.work(() => adapter.find(props)),
+    findOne: (props) => scheduler.work(() => adapter.findOne(props)),
+    exists: (filter2) => scheduler.work(() => adapter.exists(filter2)),
+    countDocuments: (filter2) => scheduler.work(() => adapter.countDocuments(filter2)),
+    distinct: (field, conditions) => scheduler.work(() => adapter.distinct(field, conditions)),
+    aggregate: (pipeline) => scheduler.work(() => adapter.aggregate(pipeline)),
+    // Casting builds no persistence work and must not acquire a recursive permit.
+    ...adapter.castFilter ? { castFilter: (filter2) => adapter.castFilter(filter2) } : {}
+  };
+}
 var Model = class {
   constructor(modelName, runtime) {
     this.modelName = modelName;
@@ -2862,6 +3004,11 @@ var Model = class {
   countDocuments(filter2 = {}) {
     return this.mongooseModel.countDocuments(filter2);
   }
+  /** Cast a copy using this model's query schema/setters, without executing query middleware or persistence. */
+  castFilter(filter2) {
+    const query = this.mongooseModel.countDocuments((0, import_utils14.cloneDeep)(filter2));
+    return query.cast(this.mongooseModel);
+  }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
   distinct(field, conditions = {}) {
     return this.mongooseModel.distinct(field, conditions);
@@ -2872,6 +3019,39 @@ var Model = class {
 };
 var model_default = Model;
 
+// src/helpers/apply-update.ts
+var import_utils15 = require("@web-ts-toolkit/utils");
+function applyUpdate(target, data, allowedFields) {
+  const wholeFields = /* @__PURE__ */ new Set();
+  const partialContainers = /* @__PURE__ */ new Set();
+  const collectBoundary = (shape, prefix = "") => {
+    for (const [key, value] of Object.entries(shape)) {
+      const path = prefix ? `${prefix}.${key}` : key;
+      if (value === true) wholeFields.add(path);
+      else {
+        partialContainers.add(path);
+        collectBoundary(value, path);
+      }
+    }
+  };
+  for (const field of allowedFields) {
+    collectBoundary((0, import_utils15.set)({}, field, true));
+  }
+  const apply = (values, prefix = "") => {
+    for (const [key, value] of Object.entries(values)) {
+      const path = prefix ? `${prefix}.${key}` : key;
+      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils15.isPlainObject)(value) || Array.isArray(value))) {
+        apply(value, path);
+      } else if (isDocument2(target)) {
+        target.set(path, value);
+      } else {
+        (0, import_utils15.set)(target, path, value);
+      }
+    }
+  };
+  apply(data ?? {});
+}
+
 // src/logger-helpers.ts
 var SENSITIVE_FILTER_KEYS = /* @__PURE__ */ new Set([
   "password",
@@ -3050,28 +3230,52 @@ var error = (error2) => {
 };
 
 // src/services/model-subdocument-service.ts
-var import_utils14 = require("@web-ts-toolkit/utils");
+var import_utils16 = require("@web-ts-toolkit/utils");
+async function visibleMutationRows(service, isAllowed, parentId, sub, rows, response) {
+  const accesses = ["read", `subs.${sub}.read`];
+  if (response === "create") accesses.push(`subs.${sub}.list`);
+  const allowed = await Promise.all(accesses.map(isAllowed));
+  if (allowed.some((value) => !value)) return [];
+  const parentFilter = await service.genFilter("read", { _id: parentId });
+  if (parentFilter === false) return [];
+  const parent = await service.findRawParentDoc({
+    filter: { $and: [{ _id: parentId }, parentFilter] },
+    select: "_id",
+    populate: [],
+    lean: true
+  });
+  if (!parent) return [];
+  const targetFilter = response === "create" ? {} : response === "single" ? { _id: rows[0]?._id } : { _id: { $in: rows.map((row) => row._id) } };
+  const [readFilter, listFilter, select] = await Promise.all([
+    service.genFilter(`subs.${sub}.read`, targetFilter),
+    response === "create" ? service.genFilter(`subs.${sub}.list`) : Promise.resolve({}),
+    service.genQuerySelect("read", null, false, [sub, "sub"])
+  ]);
+  if (readFilter === false || listFilter === false) return [];
+  const visible = filterCollection(filterCollection(rows, listFilter), readFilter);
+  return select ? visible.map((row) => (0, import_utils16.pick)(toObject(row), select.concat("_id"))) : visible;
+}
 async function listSub(service, id, sub, options) {
   const { filter: ft, select } = options ?? {};
   const filterErrors = validateClientFilter(ft);
   if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "read" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  let result = (0, import_utils14.get)(parentDoc, sub);
+  let result = (0, import_utils16.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.list`, ft),
     service.genQuerySelect("list", select, false, [sub, "sub"])
   ]);
   if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  if (subSelect) result = result.map((v) => (0, import_utils14.pick)(toObject(v), subSelect.concat("_id")));
+  if (subSelect) result = result.map((v) => (0, import_utils16.pick)(toObject(v), subSelect.concat("_id")));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function readSub(service, id, sub, subId, options) {
   const { select, populate } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, { populate }, { access: "read" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  const result = (0, import_utils14.get)(parentDoc, sub);
+  const result = (0, import_utils16.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.read`, { _id: subId }),
     service.genQuerySelect("read", select, false, [sub, "sub"])
@@ -3079,28 +3283,27 @@ async function readSub(service, id, sub, subId, options) {
   if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  if (subSelect) subdoc = (0, import_utils14.pick)(toObject(subdoc), subSelect.concat(["_id"]));
+  if (subSelect) subdoc = (0, import_utils16.pick)(toObject(subdoc), subSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
-async function updateSub(service, id, sub, subId, data) {
+async function updateSub(service, persist, isAllowed, id, sub, subId, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  const result = (0, import_utils14.get)(parentDoc, sub);
-  const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
+  const result = (0, import_utils16.get)(parentDoc, sub);
+  const [subFilter, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: subId }),
-    service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
   if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
-  let subdoc = findElement(result, subFilter);
+  const subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  const allowedData = (0, import_utils14.pick)(data, subUpdateSelect);
-  Object.assign(subdoc, allowedData);
-  await parentDoc.save();
-  if (subReadSelect) subdoc = (0, import_utils14.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
-  return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
+  const allowedData = (0, import_utils16.pick)(data, subUpdateSelect);
+  applyUpdate(subdoc, allowedData, subUpdateSelect);
+  await persist(() => parentDoc.save());
+  const visible = await visibleMutationRows(service, isAllowed, parentDoc._id, sub, [subdoc], "single");
+  return { success: true, kind: "single", code: "success" /* Success */, data: visible[0] ?? null };
 }
-async function bulkUpdateSub(service, id, sub, data) {
+async function bulkUpdateSub(service, persist, isAllowed, id, sub, data) {
   const { maxBulkItems } = service.getRequestComplexity();
   if (data.length > maxBulkItems) {
     return {
@@ -3112,25 +3315,24 @@ async function bulkUpdateSub(service, id, sub, data) {
   }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  let result = (0, import_utils14.get)(parentDoc, sub);
-  const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
+  let result = (0, import_utils16.get)(parentDoc, sub);
+  const [subFilter, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
-    service.genQuerySelect("read", null, false, [sub, "sub"]),
     service.genQuerySelect("update", null, false, [sub, "sub"])
   ]);
   if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
-  result = filterCollection(result, subFilter);
-  (0, import_utils14.forEach)(result, (subdoc) => {
+  result = filterCollection(result, subFilter).filter((subdoc) => findElementById(data, subdoc._id));
+  (0, import_utils16.forEach)(result, (subdoc) => {
     const tdata = findElementById(data, subdoc._id);
     if (!tdata) return;
-    const allowedData = (0, import_utils14.pick)(tdata, subUpdateSelect);
-    Object.assign(subdoc, allowedData);
+    const allowedData = (0, import_utils16.pick)(tdata, subUpdateSelect);
+    applyUpdate(subdoc, allowedData, subUpdateSelect);
   });
-  await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils14.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  await persist(() => parentDoc.save());
+  result = await visibleMutationRows(service, isAllowed, parentDoc._id, sub, result, "bulk");
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
-async function createSub(service, id, sub, data, options) {
+async function createSub(service, persist, isAllowed, id, sub, data, options) {
   const { addFirst } = options ?? {};
   const { maxBulkItems } = service.getRequestComplexity();
   if (Array.isArray(data) && data.length > maxBulkItems) {
@@ -3143,31 +3345,28 @@ async function createSub(service, id, sub, data, options) {
   }
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  let result = (0, import_utils14.get)(parentDoc, sub);
-  const [subCreateSelect, subReadSelect] = await Promise.all([
-    service.genQuerySelect("create", null, false, [sub, "sub"]),
-    service.genQuerySelect("read", null, false, [sub, "sub"])
-  ]);
-  const allowedData = Array.isArray(data) ? data.map((row) => (0, import_utils14.pick)(row, subCreateSelect)) : (0, import_utils14.pick)(data, subCreateSelect);
+  let result = (0, import_utils16.get)(parentDoc, sub);
+  const subCreateSelect = await service.genQuerySelect("create", null, false, [sub, "sub"]);
+  const allowedData = Array.isArray(data) ? data.map((row) => (0, import_utils16.pick)(row, subCreateSelect)) : (0, import_utils16.pick)(data, subCreateSelect);
   if (Array.isArray(allowedData)) {
     addFirst === true ? result.unshift(...allowedData) : result.push(...allowedData);
   } else {
     addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
   }
-  await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils14.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  await persist(() => parentDoc.save());
+  result = await visibleMutationRows(service, isAllowed, parentDoc._id, sub, result, "create");
   return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
 }
-async function deleteSub(service, id, sub, subId) {
+async function deleteSub(service, persist, id, sub, subId) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
-  const result = (0, import_utils14.get)(parentDoc, sub);
+  const result = (0, import_utils16.get)(parentDoc, sub);
   const subFilter = await service.genFilter(`subs.${sub}.delete`, { _id: subId });
   if (subFilter === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */ };
   const subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, kind: "error", code: "not_found" /* NotFound */ };
   await ("deleteOne" in subdoc ? subdoc.deleteOne?.() : subdoc.remove?.());
-  await parentDoc.save();
+  await persist(() => parentDoc.save());
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc._id };
 }
 async function getParentDoc(service, id, sub, args, options) {
@@ -3326,6 +3525,15 @@ var shouldKeepCorrelatedRef = (ref, keep) => {
   return false;
 };
 var Service = class extends Base {
+  constructor(req, modelName) {
+    super(req, modelName);
+    this.persist = (operation) => this.getCorrelatedExecState().scheduler.work(operation);
+    this.model = admitModelPersistence(this.createModelAdapter(modelName), this.getCorrelatedExecState().scheduler);
+    this.options = this.getModelRouterOptions(modelName);
+    this.defaults = this.options.defaults || {};
+    this.baseFields = ["_id"];
+    this.baseFieldsExt = this.baseFields.concat(this.options.documentPermissionField);
+  }
   findRawParentDoc(args) {
     return this.model.findOne({
       ...args,
@@ -3342,6 +3550,10 @@ var Service = class extends Base {
   asServiceHookContext(context) {
     return context;
   }
+  getEffectiveAllowedSortFields(allowedSortFields) {
+    const extra = this.options?.sortableFields ?? [];
+    return extra.length > 0 ? [...allowedSortFields, ...extra] : allowedSortFields;
+  }
   beginOp(op, filter2, extra) {
     const startedAt = Date.now();
     debug({
@@ -3363,14 +3575,6 @@ var Service = class extends Base {
       ...extra ?? {}
     });
   }
-  constructor(req, modelName) {
-    super(req, modelName);
-    this.model = this.createModelAdapter(modelName);
-    this.options = this.getModelRouterOptions(modelName);
-    this.defaults = this.options.defaults || {};
-    this.baseFields = ["_id"];
-    this.baseFieldsExt = this.baseFields.concat(this.options.documentPermissionField);
-  }
   async findOne(filter2, args, options) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
@@ -3378,30 +3582,36 @@ var Service = class extends Base {
     const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
+    let processedInclude;
     try {
-      parsedFilter = await this.parseClientData(filter2);
+      processedInclude = this.processInclude(include);
+      parsedFilter = overrideFilter === false ? false : await this.parseClientData(filter2);
     } catch (error2) {
       const result = this.getClientRequestErrorResult(error2);
       if (result) return result;
       throw error2;
     }
     let [_filter, _select, _populate, allowedSortFields] = await Promise.all([
-      overrideFilter || this.genFilter(access, parsedFilter),
+      overrideFilter ?? this.genFilter(access, parsedFilter),
       overrideSelect || this.genQuerySelect(access, select),
       overridePopulate || this.genPopulate(populateAccess || access, populate),
       this.genAllowedFields({}, access, this.baseFieldsExt)
     ]);
-    const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = this.processInclude(include);
+    const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
     const finalSelect = normalizeSelect(_select).concat(includeLocalFields, correlatedReferenceFields);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect,
-      sort,
+      sort: effectiveSort,
       populate: _populate
     };
     const startedAt = this.beginOp("findOne", _filter, {
-      sort,
+      sort: effectiveSort,
       selectCount: finalSelect.length,
       populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
     });
@@ -3409,10 +3619,17 @@ var Service = class extends Base {
       this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let doc = await this.model.findOne({ ...query, lean });
     if (!doc) {
@@ -3426,7 +3643,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    const correlatedSnapshots = [(0, import_utils15.cloneDeep)(toObject(doc))];
+    const correlatedSnapshots = [(0, import_utils17.cloneDeep)(toObject(doc))];
     try {
       doc = await this.includeDocs(doc, includes);
       if (correlatedIncludes.length > 0) {
@@ -3473,7 +3690,8 @@ var Service = class extends Base {
     const { select, populate, include, overrides } = this.resolveFindByIdArgs(args);
     const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
     const { select: overrideSelect, populate: overridePopulate, idFilter: overrideIdFilter } = overrides ?? {};
-    const filter2 = overrideIdFilter || await this.genIDFilter(id);
+    const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
     return this.findOne(
       filter2,
       {
@@ -3495,33 +3713,39 @@ var Service = class extends Base {
     const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
+    let processedInclude;
     try {
-      parsedFilter = await this.parseClientData(filter2);
+      processedInclude = this.processInclude(include);
+      parsedFilter = overrideFilter === false ? false : await this.parseClientData(filter2);
     } catch (error2) {
       const result = this.getClientRequestErrorResult(error2);
       if (result) return result;
       throw error2;
     }
     const [_filter, _select, _populate, pagination, allowedSortFields] = await Promise.all([
-      overrideFilter || this.genFilter("list", parsedFilter),
+      overrideFilter ?? this.genFilter("list", parsedFilter),
       overrideSelect || this.genQuerySelect("list", select),
       overridePopulate || this.genPopulate(populateAccess, populate),
       genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit),
       this.genAllowedFields({}, "list", this.baseFieldsExt)
     ]);
     const finalSelect = normalizeSelect(_select);
-    const filteredPopulate = (0, import_utils15.isArray)(finalSelect) && (0, import_utils15.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
-    const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = this.processInclude(include);
+    const filteredPopulate = (0, import_utils17.isArray)(finalSelect) && (0, import_utils17.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect.concat(includeLocalFields, correlatedReferenceFields),
       populate: filteredPopulate,
-      sort,
+      sort: effectiveSort,
       ...pagination
     };
     const startedAt = this.beginOp("find", _filter, {
-      sort,
+      sort: effectiveSort,
       skip: pagination.skip,
       limit: pagination.limit,
       selectCount: finalSelect.concat(includeLocalFields, correlatedReferenceFields).length,
@@ -3531,10 +3755,17 @@ var Service = class extends Base {
       this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let docs = await this.model.find({
       ...query,
@@ -3548,8 +3779,8 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     }));
-    const _decorate = (0, import_utils15.isFunction)(decorate) ? decorate : (v) => v;
-    const correlatedSnapshots = docs.map((doc) => (0, import_utils15.cloneDeep)(toObject(doc)));
+    const _decorate = (0, import_utils17.isFunction)(decorate) ? decorate : (v) => v;
+    const correlatedSnapshots = docs.map((doc) => (0, import_utils17.cloneDeep)(toObject(doc)));
     try {
       docs = await this.includeDocs(docs, includes);
       if (correlatedIncludes.length > 0) {
@@ -3665,16 +3896,16 @@ var Service = class extends Base {
         resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
       };
       const allowedFields = await this.genAllowedFields(item, "create");
-      const allowedData = (0, import_utils15.pick)(item, allowedFields);
+      const allowedData = (0, import_utils17.pick)(item, allowedFields);
       context.allowedFields = allowedFields;
       context.allowedData = allowedData;
       const validated = await this.validate(allowedData, "create", context);
-      if ((0, import_utils15.isBoolean)(validated)) {
+      if ((0, import_utils17.isBoolean)(validated)) {
         if (!validated) {
           validationErrors.push({ index, errors: [] });
           return void 0;
         }
-      } else if ((0, import_utils15.isArray)(validated)) {
+      } else if ((0, import_utils17.isArray)(validated)) {
         if (validated.length > 0) {
           validationErrors.push({
             index,
@@ -3704,7 +3935,7 @@ var Service = class extends Base {
       contexts[index].preparedData = preparedData;
       return preparedData;
     });
-    const _decorate = (0, import_utils15.isFunction)(decorate) ? decorate : (v) => v;
+    const _decorate = (0, import_utils17.isFunction)(decorate) ? decorate : (v) => v;
     const createdDocs = await this.model.create(items);
     const docs = await mapWithConcurrencyLimit(createdDocs, maxBulkConcurrency, async (doc, index) => {
       contexts[index].currentDocument = doc;
@@ -3721,7 +3952,7 @@ var Service = class extends Base {
       }
       if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
       if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
-      if (resolvedPopulate.length > 0) await populateDoc(doc, resolvedPopulate);
+      if (resolvedPopulate.length > 0) await this.persist(() => populateDoc(doc, resolvedPopulate));
       doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
       let outputDoc = await _decorate(doc, contexts[index]);
       if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
@@ -3777,6 +4008,13 @@ var Service = class extends Base {
       data: doc
     };
   }
+  /**
+   * Update at authorized policy paths: admitted leaves preserve omitted siblings;
+   * whole-authorized objects/arrays replace. Shared by updateById and existing-row
+   * upsert. Validation precedes trusted prepare output (not re-filtered); partial
+   * prepare containers preserve omissions. Transform retains explicit document-setter
+   * replacement authority. Send nested client JSON, not literal dotted update keys.
+   */
   async updateOne(filter2, data, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
@@ -3784,7 +4022,7 @@ var Service = class extends Base {
     const { skim, includePermissions, populateAccess } = this.resolveUpdateOneOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const [_filter, _populate] = await Promise.all([
-      overrideFilter || this.genFilter("update", filter2),
+      overrideFilter ?? this.genFilter("update", filter2),
       overridePopulate || this.genPopulate(populateAccess, populate)
     ]);
     const query = { filter: _filter, populate: _populate };
@@ -3822,16 +4060,16 @@ var Service = class extends Base {
     context.docPermissions = this.getDocPermissions(doc);
     context.currentDocument = doc;
     const allowedFields = await this.genAllowedFields(doc, "update");
-    const allowedData = (0, import_utils15.pick)(data, allowedFields);
+    const allowedData = (0, import_utils17.pick)(data, allowedFields);
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils15.isBoolean)(validated)) {
+    if ((0, import_utils17.isBoolean)(validated)) {
       if (!validated) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
       }
-    } else if ((0, import_utils15.isArray)(validated)) {
+    } else if ((0, import_utils17.isArray)(validated)) {
       if (validated.length > 0) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
@@ -3839,18 +4077,18 @@ var Service = class extends Base {
     }
     const prepared = await this.prepare(allowedData, "update", context);
     context.preparedData = prepared;
-    Object.assign(doc, prepared);
+    applyUpdate(doc, prepared, allowedFields);
     context.modifiedPaths = doc.modifiedPaths();
     doc = assertModelDocument(await this.transform(doc, "update", context), this.modelName, "transform");
     context.currentDocument = doc;
-    doc = await doc.save();
+    doc = await this.persist(() => doc.save());
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils15.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils15.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils17.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils17.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils15.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils17.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -3863,10 +4101,10 @@ var Service = class extends Base {
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, "update", context);
     if (includePermissions) doc = await this.addFieldPermissions(doc, "update", context);
-    if (_populate) await populateDoc(doc, _populate);
+    if (_populate) await this.persist(() => populateDoc(doc, _populate));
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
-    if ((0, import_utils15.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
+    if ((0, import_utils17.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
     if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
     this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
@@ -3875,7 +4113,8 @@ var Service = class extends Base {
     const { populate, overrides } = this.resolveUpdateByIdArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpdateByIdOptions(options);
     const { populate: overridePopulate, idFilter: overrideIdFilter } = overrides;
-    const filter2 = overrideIdFilter || await this.genIDFilter(id);
+    const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
     return this.updateOne(
       filter2,
       data,
@@ -3895,7 +4134,7 @@ var Service = class extends Base {
     const { populate, overrides } = this.resolveUpsertArgs(args);
     const { skim, includePermissions, populateAccess } = this.resolveUpsertOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
-    const _filter = await (overrideFilter || this.genFilter("update", filter2));
+    const _filter = await (overrideFilter ?? this.genFilter("update", filter2));
     const query = { filter: _filter };
     const startedAt = this.beginOp("upsert", _filter);
     if (_filter === false) {
@@ -3955,7 +4194,9 @@ var Service = class extends Base {
       resolvedQuery: query
     };
     await this.beforeDelete(doc, context);
-    await ("deleteOne" in doc ? doc.deleteOne() : doc.remove());
+    await this.persist(
+      () => "deleteOne" in doc ? doc.deleteOne() : doc.remove()
+    );
     context.finalDocumentSnapshot = toObject(doc);
     await this.afterDelete(doc, context);
     this.completeOp("delete", startedAt, "success" /* Success */, filter2);
@@ -3966,6 +4207,7 @@ var Service = class extends Base {
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { access, includeId } = this.resolveExistsOptions(options);
     filter2 = await this.genFilter(access, filter2);
+    if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
     const result = await this.model.exists(filter2);
     return {
       success: true,
@@ -4035,6 +4277,13 @@ var Service = class extends Base {
       query
     };
   }
+  /**
+   * Group target document IDs by original parent-key aliases using one aggregate.
+   * Resolves the requested row policy (legacy count includes pass `count`), casts
+   * authorized filters/foreign operands with the target schema, and deduplicates IDs
+   * independently of pagination. Cast failures return BadRequest; false policy returns
+   * Forbidden. Casting does not execute countDocuments middleware/plugins.
+   */
   async countByFieldValues(foreignField, values, filter2 = {}, access = "list") {
     if (!isValidFieldPath(foreignField)) {
       return {
@@ -4046,14 +4295,32 @@ var Service = class extends Base {
     }
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
-    const uniqueValues = (0, import_utils15.uniqBy)(values, (value) => String(value));
+    const uniqueValues = (0, import_utils17.uniqBy)(values, (value) => String(value));
     filter2 = await this.genFilter(access, {
       ...filter2,
       [foreignField]: { $in: uniqueValues }
     });
     const query = { filter: filter2 };
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
-    const matchFilter = filter2;
+    let matchFilter = filter2;
+    let castValues = uniqueValues;
+    try {
+      if (this.model.castFilter) {
+        matchFilter = this.model.castFilter(matchFilter);
+        const foreignFilter = this.model.castFilter({ [foreignField]: { $in: uniqueValues } });
+        castValues = foreignFilter[foreignField]?.$in;
+        if (!Array.isArray(castValues) || castValues.length !== uniqueValues.length) {
+          throw new Error("Foreign field query casting must retain the join operands");
+        }
+      }
+    } catch {
+      return {
+        success: false,
+        kind: "error",
+        code: "bad_request" /* BadRequest */,
+        errors: [{ detail: "Invalid grouped include count filter or foreign-key value" }]
+      };
+    }
     const rows = await this.model.aggregate([
       { $match: matchFilter },
       {
@@ -4064,12 +4331,20 @@ var Service = class extends Base {
         }
       },
       { $unwind: "$foreignValues" },
-      { $match: { foreignValues: { $in: uniqueValues } } },
+      { $match: { foreignValues: { $in: castValues } } },
       { $group: { _id: "$foreignValues", documentIds: { $addToSet: "$_id" } } }
     ]);
-    const counts = /* @__PURE__ */ new Map();
+    const grouped = /* @__PURE__ */ new Map();
     for (const row of rows) {
-      counts.set(String(row._id), new Set(row.documentIds.map((id) => String(id))));
+      const key = String(row._id);
+      const ids = grouped.get(key) ?? /* @__PURE__ */ new Set();
+      for (const id of row.documentIds) ids.add(String(id));
+      grouped.set(key, ids);
+    }
+    const counts = /* @__PURE__ */ new Map();
+    for (let i = 0; i < uniqueValues.length; i++) {
+      const ids = grouped.get(String(castValues[i]));
+      if (ids) counts.set(String(uniqueValues[i]), ids);
     }
     return { success: true, kind: "single", code: "success" /* Success */, data: counts, query };
   }
@@ -4122,7 +4397,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils15.compact)((0, import_utils15.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils17.compact)((0, import_utils17.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -4148,17 +4423,60 @@ var Service = class extends Base {
   async readSub(id, sub, subId, options) {
     return readSub(this, id, sub, subId, options);
   }
+  /**
+   * Apply authorized policy-path updates, preserving protected siblings, then save.
+   * Output requires post-save parent read and subdocument read operation/row access;
+   * hidden output is successful `data: null` (direct/root-entry 200), not a failed write.
+   * Visible output uses read fields plus `_id`. Do not retry solely for null output.
+   */
   async updateSub(id, sub, subId, data) {
-    return updateSub(this, id, sub, subId, data);
+    return updateSub(
+      this,
+      this.persist,
+      (access) => this.req.macl.isAllowed(this.modelName, access),
+      id,
+      sub,
+      subId,
+      data
+    );
   }
+  /**
+   * Save authorized targeted updates, then return readable targets in stored order.
+   * Requires parent/subdocument read access for output, not subdocument list access;
+   * uses read fields plus `_id`. Hidden output succeeds with `data: [], count: 0`
+   * (direct/root-entry 200); count measures visible rows, not all updated rows.
+   */
   async bulkUpdateSub(id, sub, data) {
-    return bulkUpdateSub(this, id, sub, (0, import_utils15.castArray)(data));
+    return bulkUpdateSub(
+      this,
+      this.persist,
+      (access) => this.req.macl.isAllowed(this.modelName, access),
+      id,
+      sub,
+      (0, import_utils17.castArray)(data)
+    );
   }
+  /**
+   * Append/prepend admitted rows, then return the visible full array (including when
+   * input is empty). Output requires post-save parent read and subdocument list AND
+   * read guards/row filters; fields use read projection plus `_id`.
+   * Hidden output succeeds with code `created`, `data: [], count: 0`
+   * (direct/root-entry 201). Visible count/order follow filtered stored rows.
+   * Empty output does not mean the write failed; addFirst is a service option.
+   */
   async createSub(id, sub, data, options) {
-    return createSub(this, id, sub, data, options);
+    return createSub(
+      this,
+      this.persist,
+      (access) => this.req.macl.isAllowed(this.modelName, access),
+      id,
+      sub,
+      data,
+      options
+    );
   }
   async deleteSub(id, sub, subId) {
-    return deleteSub(this, id, sub, subId);
+    return deleteSub(this, this.persist, id, sub, subId);
   }
   async getParentDoc(id, sub, args, options) {
     return getParentDoc(this, id, sub, args, options);
@@ -4166,7 +4484,7 @@ var Service = class extends Base {
 };
 
 // src/services/public-service.ts
-var import_utils16 = require("@web-ts-toolkit/utils");
+var import_utils18 = require("@web-ts-toolkit/utils");
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
@@ -4205,7 +4523,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = (0, import_utils16.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        if (select) d = (0, import_utils18.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
         return d;
       }
     );
@@ -4232,6 +4550,7 @@ var PublicService = class extends Service {
       },
       { skim, includePermissions, access, populateAccess, lean }
     );
+    if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
       const listAllowed = await this.req.macl.isAllowed(this.modelName, "list");
       if (!listAllowed) {
@@ -4272,6 +4591,7 @@ var PublicService = class extends Service {
       },
       { skim, includePermissions, access, populateAccess, lean }
     );
+    if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
       const listAllowed = await this.req.macl.isAllowed(this.modelName, "list");
       if (!listAllowed) {
@@ -4310,8 +4630,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = (0, import_utils16.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) d = (0, import_utils16.pick)(d, [...Object.keys(data), "_id"]);
+        if (select) d = (0, import_utils18.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) d = (0, import_utils18.pick)(d, [...Object.keys(data), "_id"]);
         return d;
       }
     );
@@ -4320,6 +4640,11 @@ var PublicService = class extends Service {
     }
     return result;
   }
+  /**
+   * With an _id, check update-policy existence then update: terminal denial returns
+   * Forbidden, an allowed miss remains Unauthorized, and neither creates a row.
+   * Without an _id, use the create path.
+   */
   async _upsert(data, args, options) {
     const idKey = this.getIdentifier();
     if (idKey !== "_id") {
@@ -4433,7 +4758,7 @@ var PublicService = class extends Service {
 };
 
 // src/services/data-service.ts
-var import_utils17 = require("@web-ts-toolkit/utils");
+var import_utils19 = require("@web-ts-toolkit/utils");
 var DataService = class {
   constructor(req, dataName) {
     this.req = req;
@@ -4455,7 +4780,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils17.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils19.pick)(doc, _select);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
   }
   async findById(id, args, options) {
@@ -4495,13 +4820,13 @@ var DataService = class {
     const totalCount = docs.length;
     if (sort) {
       const normalizedSort = normalizeSortForOrderBy(sort);
-      docs = (0, import_utils17.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
+      docs = (0, import_utils19.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     const { maxHookConcurrency } = this.getRequestComplexity();
     const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
       doc = await this.trimOutputFields(doc, "list");
-      if (_select.length > 0) doc = (0, import_utils17.pick)(doc, _select);
+      if (_select.length > 0) doc = (0, import_utils19.pick)(doc, _select);
       return doc;
     });
     if (!hasExplicitLimit && trimmed.length === totalCount) {
@@ -4550,7 +4875,7 @@ var DataService = class {
 };
 
 // src/processors.ts
-var import_utils18 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 var UNSAFE_PATH_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var DEFAULT_MAX_SLICE = 1e3;
 var DEFAULT_MASK_REPLACEMENT = "***";
@@ -4585,10 +4910,10 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!(0, import_utils18.isPlainObject)(target)) return ret;
+      if (!(0, import_utils20.isPlainObject)(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
-      if ((0, import_utils18.isArray)(next)) {
+      if ((0, import_utils20.isArray)(next)) {
         for (const item of next) {
           ret.push(item);
         }
@@ -4598,8 +4923,8 @@ function resolveLeafParents(obj, src) {
   }
   const leaf = segs[segs.length - 1];
   const pairs = [];
-  (0, import_utils18.forEach)(targets, (target) => {
-    if (!(0, import_utils18.isPlainObject)(target)) return;
+  (0, import_utils20.forEach)(targets, (target) => {
+    if (!(0, import_utils20.isPlainObject)(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -4607,8 +4932,8 @@ function resolveLeafParents(obj, src) {
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -4617,19 +4942,19 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     assertSafePath(dest);
     let targets = [obj];
     const segs = src.split(".");
-    (0, import_utils18.forEach)(segs, (seg, ind) => {
+    (0, import_utils20.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils18.forEach)(targets, (target) => {
-          if (!(0, import_utils18.isPlainObject)(target)) return;
+        (0, import_utils20.forEach)(targets, (target) => {
+          if (!(0, import_utils20.isPlainObject)(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
           let depopulated;
-          if ((0, import_utils18.isArray)(leaf)) {
+          if ((0, import_utils20.isArray)(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => (0, import_utils18.isPlainObject)(item))) {
-              depopulated = (0, import_utils18.map)(leaf, idField).map((id, i) => {
+            } else if (leaf.every((item) => (0, import_utils20.isPlainObject)(item))) {
+              depopulated = (0, import_utils20.map)(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
                 }
@@ -4638,8 +4963,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if ((0, import_utils18.isPlainObject)(leaf)) {
-            const id = (0, import_utils18.get)(leaf, idField);
+          } else if ((0, import_utils20.isPlainObject)(leaf)) {
+            const id = (0, import_utils20.get)(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -4647,15 +4972,15 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           } else {
             return;
           }
-          (0, import_utils18.set)(targetObject, dest, sourceForDest);
-          (0, import_utils18.set)(targetObject, seg, depopulated);
+          (0, import_utils20.set)(targetObject, dest, sourceForDest);
+          (0, import_utils20.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!(0, import_utils18.isPlainObject)(target)) return ret;
+          if (!(0, import_utils20.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils18.isArray)(next)) {
+          if ((0, import_utils20.isArray)(next)) {
             for (const item of next) {
               ret.push(item);
             }
@@ -4669,8 +4994,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 };
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -4678,17 +5003,17 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "copyPaths");
     assertSafePath(dest, "copyPaths");
     if (src === dest) return;
-    (0, import_utils18.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils18.hasOwn)(parent, leaf)) return;
-      (0, import_utils18.set)(parent, dest, (0, import_utils18.cloneDeep)(parent[leaf]));
+    (0, import_utils20.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils20.hasOwn)(parent, leaf)) return;
+      (0, import_utils20.set)(parent, dest, (0, import_utils20.cloneDeep)(parent[leaf]));
     });
   });
   return obj;
 };
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -4696,10 +5021,10 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "movePaths");
     assertSafePath(dest, "movePaths");
     if (src === dest) return;
-    (0, import_utils18.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils18.hasOwn)(parent, leaf)) return;
-      const value = (0, import_utils18.cloneDeep)(parent[leaf]);
-      (0, import_utils18.set)(parent, dest, value);
+    (0, import_utils20.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils20.hasOwn)(parent, leaf)) return;
+      const value = (0, import_utils20.cloneDeep)(parent[leaf]);
+      (0, import_utils20.set)(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
     });
@@ -4710,8 +5035,8 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const mutable = options.mutable !== false;
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
@@ -4728,15 +5053,15 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
       assertNonNegativeSafeInteger(op.limit, "limit", "sliceArrays");
       limit = Math.min(op.limit, maxSlice);
     }
-    (0, import_utils18.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+    (0, import_utils20.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       const leafValue = parent[leaf];
-      if (!(0, import_utils18.isArray)(leafValue)) return;
+      if (!(0, import_utils20.isArray)(leafValue)) return;
       const end = typeof limit === "undefined" ? void 0 : skip + limit;
       const window = leafValue.slice(skip, end);
       if (typeof rawDest === "undefined") {
-        (0, import_utils18.set)(parent, leaf, window);
+        (0, import_utils20.set)(parent, leaf, window);
       } else {
-        (0, import_utils18.set)(parent, rawDest, window);
+        (0, import_utils20.set)(parent, rawDest, window);
       }
     });
   });
@@ -4744,44 +5069,44 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 };
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
     if (src.length === 0 || dest.length === 0) return;
     assertSafePath(src, "countPaths");
     assertSafePath(dest, "countPaths");
-    (0, import_utils18.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils18.hasOwn)(parent, leaf)) return;
+    (0, import_utils20.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils20.hasOwn)(parent, leaf)) return;
       const leafValue = parent[leaf];
       let count;
-      if ((0, import_utils18.isArray)(leafValue)) {
+      if ((0, import_utils20.isArray)(leafValue)) {
         count = leafValue.length;
-      } else if ((0, import_utils18.isPlainObject)(leafValue)) {
+      } else if ((0, import_utils20.isPlainObject)(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
       } else {
         count = 1;
       }
-      (0, import_utils18.set)(parent, dest, count);
+      (0, import_utils20.set)(parent, dest, count);
     });
   });
   return obj;
 };
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils18.cloneDeep)(docObject);
-  (0, import_utils18.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : (0, import_utils20.cloneDeep)(docObject);
+  (0, import_utils20.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
     assertSafePath(src, "maskPaths");
     const replacement = Object.prototype.hasOwnProperty.call(op, "replacement") ? op.replacement : DEFAULT_MASK_REPLACEMENT;
-    (0, import_utils18.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils18.hasOwn)(parent, leaf)) return;
-      (0, import_utils18.set)(parent, leaf, replacement);
+    (0, import_utils20.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils20.hasOwn)(parent, leaf)) return;
+      (0, import_utils20.set)(parent, leaf, replacement);
     });
   });
   return obj;
@@ -4825,10 +5150,10 @@ var Cache = class {
 };
 
 // src/core-shared.ts
-var import_utils20 = require("@web-ts-toolkit/utils");
+var import_utils22 = require("@web-ts-toolkit/utils");
 
 // src/permission.ts
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils21 = require("@web-ts-toolkit/utils");
 var Permission = class {
   constructor(permissions) {
     this.permissions = { ...permissions };
@@ -4844,7 +5169,7 @@ var Permission = class {
     return [permissionOrPermissions].concat(permissions);
   }
   hasKey(permission) {
-    return (0, import_utils19.hasOwn)(this.permissions, permission);
+    return (0, import_utils21.hasOwn)(this.permissions, permission);
   }
   has(permission) {
     return this.permissions[permission] === true;
@@ -4864,10 +5189,10 @@ var permission_default = Permission;
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils20.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils20.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils22.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils20.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils22.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4882,10 +5207,10 @@ function optimizeAndFilter(clausesInput) {
     }
   }
   const dedupeKey = (value) => {
-    if ((0, import_utils20.isArray)(value)) {
+    if ((0, import_utils22.isArray)(value)) {
       return `[${value.map(dedupeKey).join(",")}]`;
     }
-    if ((0, import_utils20.isPlainObject)(value)) {
+    if ((0, import_utils22.isPlainObject)(value)) {
       return `{${Object.keys(value).sort().map((key) => `${key}:${dedupeKey(value[key])}`).join(",")}}`;
     }
     return JSON.stringify(value);
@@ -4909,7 +5234,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils20.hasOwn)(mergedClause, key) && !(0, import_utils20.isEqual)(mergedClause[key], value)) {
+      if ((0, import_utils22.hasOwn)(mergedClause, key) && !(0, import_utils22.isEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -4920,24 +5245,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils20.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils22.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils20.isPlainObject)(filter2) || (0, import_utils20.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils22.isPlainObject)(filter2) || (0, import_utils22.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils20.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils22.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils20.isString)(idField)) {
+  if ((0, import_utils22.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -4953,12 +5278,12 @@ async function resolveAccessFilter({
 }) {
   let nextFilter = normalizeFilter(filter2);
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
-  if (nextFilter !== false && (0, import_utils20.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils22.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   if (nextFilter === false) return false;
   const baseFilterFn = getOption(`baseFilter.${access}`, null);
-  if (!(0, import_utils20.isFunction)(baseFilterFn)) return nextFilter ?? {};
+  if (!(0, import_utils22.isFunction)(baseFilterFn)) return nextFilter ?? {};
   const baseFilter = normalizeFilter(
     cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
   );
@@ -4992,34 +5317,34 @@ async function setRequestPermissions(req) {
   if (owner === activeRuntime) return;
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  if (!(0, import_utils20.isFunction)(globalPermissions)) return;
+  if (!(0, import_utils22.isFunction)(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
-  if ((0, import_utils20.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils20.isArray)(permissions)) req[requestPermissionField] = (0, import_utils20.arrayToRecord)(permissions);
-  else if ((0, import_utils20.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  if ((0, import_utils22.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils22.isArray)(permissions)) req[requestPermissionField] = (0, import_utils22.arrayToRecord)(permissions);
+  else if ((0, import_utils22.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
   owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils20.isBoolean)(routeGuard)) {
+  if ((0, import_utils22.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils20.isString)(routeGuard)) {
+  if ((0, import_utils22.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils20.isArray)(routeGuard)) {
+  if ((0, import_utils22.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils20.isFunction)(routeGuard)) {
+  if ((0, import_utils22.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils20.castArray)(hook);
+  const hooks = (0, import_utils22.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils20.isFunction)(hooks[x])) {
+    if ((0, import_utils22.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -5042,13 +5367,13 @@ async function collectSchemaFields({
     if (baseFields.includes(key)) continue;
     const val = permissionSchema[key];
     const value = val && val[access] || val;
-    if ((0, import_utils20.isBoolean)(value)) {
+    if ((0, import_utils22.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils20.isString)(value)) {
+    } else if ((0, import_utils22.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils20.isArray)(value)) {
+    } else if ((0, import_utils22.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils20.isFunction)(value)) {
+    } else if ((0, import_utils22.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
@@ -5134,7 +5459,7 @@ async function runDecorateAllHook({
 }
 
 // src/acl/select-resolution.ts
-var import_utils21 = require("@web-ts-toolkit/utils");
+var import_utils23 = require("@web-ts-toolkit/utils");
 async function collectAllowedFieldsForRequest({
   req,
   permissionSchema,
@@ -5202,18 +5527,19 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils21.difference)(fields, normalizedSelect);
+        fields = (0, import_utils23.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils21.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils23.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(alwaysSelectFields);
   }
-  return (0, import_utils21.intersection)(normalizedSelect, fields);
+  return (0, import_utils23.intersection)(normalizedSelect, fields);
 }
 
 // src/core.ts
+var emptyPermissionLeaf = () => ({ $: "_" });
 var Core = class {
   constructor(req) {
     this.cachedPermissions = null;
@@ -5225,10 +5551,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils22.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils24.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils22.isString)(idField)) {
+    if ((0, import_utils24.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -5306,11 +5632,11 @@ var Core = class {
   async genPopulate(modelName, access = "read", _populate = null, subPaths = []) {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
-    populate = (0, import_utils22.compact)(
+    populate = (0, import_utils24.compact)(
       await Promise.all(
         populate.map(async (p) => {
-          const populateAccess = !(0, import_utils22.isString)(p) && p.access ? p.access : access;
-          const ret = (0, import_utils22.isString)(p) ? { path: p } : {
+          const populateAccess = !(0, import_utils24.isString)(p) && p.access ? p.access : access;
+          const ret = (0, import_utils24.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -5348,10 +5674,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils22.isFunction)(validate)) {
+    if ((0, import_utils24.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils22.isBoolean)(validate) || (0, import_utils22.isArray)(validate)) {
+    } else if ((0, import_utils24.isBoolean)(validate) || (0, import_utils24.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -5376,7 +5702,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils22.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils24.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -5400,7 +5726,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils22.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils24.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
@@ -5417,7 +5743,7 @@ var Core = class {
   }
   addEmptyPermissions(modelName, doc) {
     const docPermissionField = getModelOption(modelName, "documentPermissionField");
-    setDocValue(doc, docPermissionField, { _view: { $: "_" }, _edit: { $: "_" } });
+    setDocValue(doc, docPermissionField, { _view: emptyPermissionLeaf(), _edit: emptyPermissionLeaf() });
     return doc;
   }
   async addDocPermissions(modelName, doc, access, context) {
@@ -5451,7 +5777,7 @@ var Core = class {
       readExists ? this.genAllowedFields(modelName, doc, "read") : [],
       updateExists ? this.genAllowedFields(modelName, doc, "update") : []
     ]);
-    const viewObj = (0, import_utils22.reduce)(
+    const viewObj = (0, import_utils24.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -5459,7 +5785,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils22.reduce)(
+    const editObj = (0, import_utils24.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -5467,8 +5793,8 @@ var Core = class {
       },
       {}
     );
-    setDocValue(doc, `${docPermissionField}._view`, viewObj);
-    setDocValue(doc, `${docPermissionField}._edit`, editObj);
+    setDocValue(doc, `${docPermissionField}._view`, Object.keys(viewObj).length > 0 ? viewObj : emptyPermissionLeaf());
+    setDocValue(doc, `${docPermissionField}._edit`, Object.keys(editObj).length > 0 ? editObj : emptyPermissionLeaf());
     return doc;
   }
   async decorate(modelName, doc, access, context) {
@@ -5483,9 +5809,9 @@ var Core = class {
     return runDecorateAllHook({ req: this.req, hook: decorateAll, docs, permissions, context });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils22.compact)((0, import_utils22.castArray)(task));
+    const tasks = (0, import_utils24.compact)((0, import_utils24.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils22.forEach)(tasks, (task2) => {
+    (0, import_utils24.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -5553,9 +5879,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils22.isUndefined)(subOption)) {
+      if ((0, import_utils24.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils22.isUndefined)(subFieldOption)) {
+        if ((0, import_utils24.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -5607,25 +5933,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils23.isPlainObject)(condition)) {
+    if ((0, import_utils25.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils23.isString)(id) ? id : null;
-      if ((0, import_utils23.isPlainObject)(id)) {
+      let _id = (0, import_utils25.isString)(id) ? id : null;
+      if ((0, import_utils25.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils23.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils25.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils23.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils25.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils23.isString)(_id) || !_id) {
+      if (!(0, import_utils25.isString)(_id) || !_id) {
         return next(new import_express_json_router2.default.clientErrors.BadRequestError());
       }
       const result = await svc._read(_id, { select });
@@ -5637,11 +5963,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils23.isString)(cond)) {
+    if ((0, import_utils25.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils23.isArray)(cond)) {
+    } else if ((0, import_utils25.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils23.isFunction)(cond)) {
+    } else if ((0, import_utils25.isFunction)(cond)) {
       const result = await cond.call(req, permissions);
       if (!!result) return next();
     }
@@ -5654,7 +5980,7 @@ var import_express2 = __toESM(require("express"));
 
 // src/routers/model-router.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils27 = require("@web-ts-toolkit/utils");
+var import_utils29 = require("@web-ts-toolkit/utils");
 
 // src/routers/router-mutation.ts
 var MODEL_BUILD_TIME_OPTION_KEYS = /* @__PURE__ */ new Set([
@@ -5783,7 +6109,7 @@ var import_express_json_router4 = __toESM(require("@web-ts-toolkit/express-json-
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils24 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
 var safeIntegerString = (min, message) => import_zod2.z.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
 var queryBooleanString = import_zod2.z.enum(["true", "false"]);
@@ -5883,7 +6209,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils24.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils26.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -5920,7 +6246,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils24.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils26.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -5970,7 +6296,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils24.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils26.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -6169,19 +6495,12 @@ function fromJoi(schema) {
 }
 function fromAjv(validator) {
   return async (value) => {
-    const outcome = validator(value);
-    if (isThenable(outcome)) {
+    if (validator.$async === true) {
       try {
-        const data = await outcome;
-        if (data === false) {
-          return {
-            success: false,
-            issues: normalizeAjvIssues(validator.errors ?? [])
-          };
-        }
+        const data = await validator(value);
         return {
           success: true,
-          data: data === true ? value : data
+          data
         };
       } catch (error2) {
         if (!isAjvValidationError(error2)) {
@@ -6189,11 +6508,21 @@ function fromAjv(validator) {
         }
         return {
           success: false,
-          issues: normalizeAjvIssues(error2.errors ?? [])
+          issues: normalizeAjvIssues(error2.errors)
         };
       }
     }
-    const errorsSnapshot = validator.errors ? [...validator.errors] : [];
+    const outcome = validator(value);
+    if (isThenable(outcome)) {
+      void Promise.resolve(outcome).catch(() => {
+      });
+      throw new TypeError(
+        "fromAjv: promise/thenable validators must declare $async: true and resolve with validated data"
+      );
+    }
+    if (typeof outcome !== "boolean") {
+      throw new TypeError("fromAjv: synchronous validators must return a boolean verdict");
+    }
     if (outcome) {
       return {
         success: true,
@@ -6202,7 +6531,9 @@ function fromAjv(validator) {
     }
     return {
       success: false,
-      issues: normalizeAjvIssues(errorsSnapshot)
+      // Normalize immediately, copying message/path before another call can
+      // replace the errors array or mutate its entries.
+      issues: normalizeAjvIssues(validator.errors ?? [])
     };
   };
 }
@@ -6432,14 +6763,14 @@ function isArkTypeErrors(value) {
   return record.arkKind === "errors" || record[" arkKind"] === "errors";
 }
 function isThenable(value) {
-  return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+  return (typeof value === "object" || typeof value === "function") && value !== null && "then" in value && typeof value.then === "function";
 }
 function isAjvValidationError(error2) {
   if (typeof error2 !== "object" || error2 === null || !("errors" in error2)) {
     return false;
   }
-  const errors = error2.errors;
-  return errors == null || Array.isArray(errors);
+  const candidate = error2;
+  return candidate.ajv === true && candidate.validation === true && Array.isArray(candidate.errors);
 }
 function isVineValidationError(error2) {
   if (typeof error2 !== "object" || error2 === null || !("messages" in error2)) {
@@ -6878,7 +7209,7 @@ var rootDataQueryEntrySchema = import_zod5.z.union([
 var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 
 // src/routers/shared.ts
-var import_utils25 = require("@web-ts-toolkit/utils");
+var import_utils27 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 function setModelCollectionRoutes(context) {
@@ -6896,14 +7227,14 @@ function setModelCollectionRoutes(context) {
     await context.assertAllowed(req, "list");
     const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils25.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils25.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils27.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils27.parseBooleanString)(include_extra_headers);
     const result = await svc._list(
       {},
       { skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils25.parseBooleanString)(skim),
-        includePermissions: (0, import_utils25.parseBooleanString)(include_permissions),
+        skim: (0, import_utils27.parseBooleanString)(skim),
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
         includeCount
       }
     );
@@ -6958,7 +7289,7 @@ function setModelCollectionRoutes(context) {
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: (0, import_utils25.parseBooleanString)(include_permissions) });
+    const result = await svc._create(data, {}, { includePermissions: (0, import_utils27.parseBooleanString)(include_permissions) });
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
@@ -6994,7 +7325,7 @@ function setModelCollectionRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils25.parseBooleanString)(include_permissions),
+        includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -7086,8 +7417,8 @@ function setModelDocumentRoutes(context) {
       id,
       {},
       {
-        includePermissions: (0, import_utils25.parseBooleanString)(include_permissions),
-        tryList: (0, import_utils25.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        tryList: (0, import_utils27.parseBooleanString)(try_list)
       }
     );
     handleResultError(result);
@@ -7172,8 +7503,8 @@ function setModelDocumentRoutes(context) {
       data,
       {},
       {
-        returningAll: (0, import_utils25.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils25.parseBooleanString)(include_permissions)
+        returningAll: (0, import_utils27.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
@@ -7219,8 +7550,8 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils25.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils25.parseBooleanString)(include_permissions),
+        returningAll: returningAll ?? (0, import_utils27.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -7248,8 +7579,8 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils25.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils25.parseBooleanString)(include_permissions)
+        returningAll: (0, import_utils27.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
@@ -7293,8 +7624,8 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils25.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils25.parseBooleanString)(include_permissions),
+        returningAll: returningAll ?? (0, import_utils27.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
@@ -7532,11 +7863,11 @@ function setModelSubDocumentRoutes(context) {
 }
 
 // src/openapi/route-registration.ts
-var import_utils26 = require("@web-ts-toolkit/utils");
+var import_utils28 = require("@web-ts-toolkit/utils");
 function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
   runtime.registerOpenApiRoute({
     ...route,
-    path: (0, import_utils26.normalizeUrlPath)(basePath + route.path),
+    path: (0, import_utils28.normalizeUrlPath)(basePath + route.path),
     tags: route.tags ?? [defaultTag]
   });
 }
@@ -7544,8 +7875,8 @@ function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router5.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils27.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils27.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils29.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils29.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(this.modelName, key, value);
   return this;
@@ -7707,7 +8038,7 @@ var ModelRouter = class _ModelRouter {
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils27.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils29.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router5.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName, this.runtime);
@@ -7787,13 +8118,13 @@ var ModelRouter = class _ModelRouter {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils27.forEach)(this.router.getEndpoints(), ({ method, path }) => {
-        logInfoMessage(`${(0, import_utils27.padEnd)(method, 6)} ${(0, import_utils27.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils29.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils29.padEnd)(method, 6)} ${(0, import_utils29.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils27.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils29.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -7801,7 +8132,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils27.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils29.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(this.modelName, keyOrOptions);
     }
@@ -7824,7 +8155,7 @@ var ModelRouter = class _ModelRouter {
 
 // src/routers/root-router.ts
 var import_express_json_router6 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils28 = require("@web-ts-toolkit/utils");
+var import_utils30 = require("@web-ts-toolkit/utils");
 
 // src/core-data.ts
 var DataCore = class {
@@ -8090,7 +8421,7 @@ var RootRouter = class {
     this.setRoutes();
   }
   registerOpenApiRoute(route) {
-    registerOpenApiRoute(this.runtime, (0, import_utils28.normalizeUrlPath)(this.basename), "root", route);
+    registerOpenApiRoute(this.runtime, (0, import_utils30.normalizeUrlPath)(this.basename), "root", route);
   }
   wrapResult(index, item, result) {
     return {
@@ -8151,7 +8482,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     const groups = /* @__PURE__ */ new Map();
     items.forEach((item, index) => {
-      const order = (0, import_utils28.isNumber)(item.order) ? item.order : 0;
+      const order = (0, import_utils30.isNumber)(item.order) ? item.order : 0;
       const group = groups.get(order);
       if (group) {
         group.push({ index, item });
@@ -8222,7 +8553,7 @@ var RootRouter = class {
         const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
-      return (0, import_utils28.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils30.orderBy)(results, ["index"], ["asc"]);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -8240,11 +8571,11 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 var import_express_json_router7 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils29 = require("@web-ts-toolkit/utils");
+var import_utils31 = require("@web-ts-toolkit/utils");
 var clientErrors4 = import_express_json_router7.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils29.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils29.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils31.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils31.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -8285,7 +8616,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils29.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils31.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router7.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -8318,8 +8649,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils25.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils25.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils27.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils27.parseBooleanString)(include_extra_headers);
       const result = await svc.find(
         {},
         { skip, limit, page, pageSize: page_size },
@@ -8437,11 +8768,11 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils29.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils31.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(this.dataName, keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils29.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils31.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -8564,7 +8895,7 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    if ((0, import_utils30.isUndefined)(options)) {
+    if ((0, import_utils32.isUndefined)(options)) {
       return new RootRouter(modelName, runtime);
     }
     if (typeof modelName === "string") {
@@ -8585,10 +8916,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils30.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils32.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils30.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils32.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };