@web-ts-toolkit/access-router 0.46.0 → 0.47.0

package/advanced.d.mts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CorrelatedCountInclude, t as CorrelatedFilter, u as CorrelatedInclude, v as CorrelatedIncludeArgs, w as CorrelatedListInclude, x as CorrelatedReadByFilterInclude, y as CorrelatedReadByIdInclude, z as CountBody, D as CreateArgs, E as CreateOptions, F as CreateQueryInput, G as CustomHeaders, H as DATA_MIDDLEWARE, I as DataBaseFilterHook, J as DataFilter, K as DataFindArgs, L as DataFindOneArgs, M as DataFindOneOptions, N as DataFindOptions, O as DataHook, P as DataHookContext, Q as DataIdentifierHook, R as DataListHook, S as DataOverrideFilterHook, T as DataRequest, U as DataRequestSchemas, V as DataRouterOptions, W as DecorateAccess, X as DecorateAllAccess, Y as DeepFieldPath, Z as DefaultModelRouterOptions, _ as Defaults, $ as DistinctArgs, a0 as DistinctBody, a1 as DocPermissionsAccess, a2 as ErrorResult, a3 as ExistsOptions, a4 as ExtendedDataRouterOptions, a5 as ExtendedDefaultModelRouterOptions, a6 as ExtendedModelRouterOptions, a7 as Filter, a8 as FilterOperator, a9 as FindAccess, aa as FindArgs, ab as FindByIdArgs, ac as FindByIdOptions, ad as FindOneArgs, ae as FindOneOptions, af as FindOptions, ag as GlobalOptions, ah as GlobalPermissionValue, ai as GuardHook, aj as IdentifierHook, ak as Include, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, aq as KeyValueProjection, ar as LegacyInclude, as as ListQueryInput, at as ListResult, au as MIDDLEWARE, av as MaybePromise, aw as ModelBaseFilterHook, ax as ModelChangeHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aA as ModelDocument, aB as ModelDocumentHook, aC as ModelHook, aD as ModelHookContext, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aH as ModelRequest, aI as ModelRouterOptions, aJ as ModelValidateHook, aK as PERMISSIONS, aL as PERMISSION_KEYS, aM as ParentRef, aN as PathValue, aO as PermissionSchema, aP as Populate, aQ as PopulateAccess, aR as PrepareAccess, aS as Projection, aT as PublicCreateArgs, aU as PublicCreateOptions, aV as PublicErrorResult, aW as PublicListArgs, aX as PublicListOptions, aY as PublicListResult, aZ as PublicOutput, a_ as PublicReadArgs, a$ as PublicReadOptions, b0 as PublicServiceResult, b1 as PublicSingleResult, b2 as PublicUpdateArgs, b3 as PublicUpdateOptions, b4 as PublicUpsertArgs, b5 as PublicUpsertOptions, b6 as ReadQueryInput, b7 as Request, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bg as RequestSchemas, bh as RootDataListQueryEntry, bi as RootDataOperation, bj as RootDataReadByFilterQueryEntry, bk as RootDataReadByIdQueryEntry, bl as RootModelCountQueryEntry, bm as RootModelCreateQueryEntry, bn as RootModelDeleteQueryEntry, bo as RootModelDistinctQueryEntry, bp as RootModelListQueryEntry, bq as RootModelNewQueryEntry, br as RootModelOperation, bs as RootModelReadByFilterQueryEntry, bt as RootModelReadByIdQueryEntry, bu as RootModelSubBulkUpdateQueryEntry, bv as RootModelSubCreateQueryEntry, bw as RootModelSubDeleteQueryEntry, bx as RootModelSubListQueryEntry, by as RootModelSubReadQueryEntry, bz as RootModelSubUpdateQueryEntry, bA as RootModelUpdateQueryEntry, bB as RootModelUpsertQueryEntry, bC as RootOperationResult, bD as RootQueryEntry, bE as RootRouterOptions, bF as RootSubOperation, bG as RootTarget, bH as RouteGuardAccess, bI as SelectAccess, bJ as SelectedPopulatedPublicOutput, bK as SelectedPublicOutput, bL as ServiceResult, bM as SingleResult, bN as Sort, bO as SortOrder, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, bW as StatusCodes, bX as SubListBody, bY as SubPopulate, bZ as SubQueryEntry, b_ as SubReadBody, b$ as SubdocumentBulkRecord, c0 as SubdocumentBulkUpdateInput, c1 as SubdocumentCreateInput, c2 as SubdocumentCreateOptions, c3 as SubdocumentId, c4 as SubdocumentListOptions, c5 as SubdocumentName, c6 as SubdocumentParentArgs, c7 as SubdocumentParentOptions, c8 as SubdocumentReadOptions, c9 as SubdocumentRecord, ca as SuperstructFailureLike, cb as SuperstructValidateLike, cc as Task, cd as TaskType, ce as TransformAccess, cf as TypedFilter, cg as UpdateByIdArgs, ch as UpdateByIdOptions, ci as UpdateOneArgs, cj as UpdateOneOptions, ck as UpdateQueryInput, cl as UpsertArgs, cm as UpsertOptions, cn as UpsertQueryInput, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cs as ValidateAccess, ct as ValidateRule, cu as Validation, cv as ValidationError, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod, cM as parseBody, cN as parseBodyWithSchema, cO as parseNestedBodyWithSchema, cP as parsePathParam, cQ as parseQuery } from './parsers-BKF7VX2-.mjs';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CorrelatedCountInclude, t as CorrelatedFilter, u as CorrelatedInclude, v as CorrelatedIncludeArgs, w as CorrelatedListInclude, x as CorrelatedReadByFilterInclude, y as CorrelatedReadByIdInclude, z as CountBody, D as CreateArgs, E as CreateOptions, F as CreateQueryInput, G as CustomHeaders, H as DATA_MIDDLEWARE, I as DataBaseFilterHook, J as DataFilter, K as DataFindArgs, L as DataFindOneArgs, M as DataFindOneOptions, N as DataFindOptions, O as DataHook, P as DataHookContext, Q as DataIdentifierHook, R as DataListHook, S as DataOverrideFilterHook, T as DataRequest, U as DataRequestSchemas, V as DataRouterOptions, W as DecorateAccess, X as DecorateAllAccess, Y as DeepFieldPath, Z as DefaultModelRouterOptions, _ as Defaults, $ as DistinctArgs, a0 as DistinctBody, a1 as DocPermissionsAccess, a2 as ErrorResult, a3 as ExistsOptions, a4 as ExtendedDataRouterOptions, a5 as ExtendedDefaultModelRouterOptions, a6 as ExtendedModelRouterOptions, a7 as Filter, a8 as FilterOperator, a9 as FindAccess, aa as FindArgs, ab as FindByIdArgs, ac as FindByIdOptions, ad as FindOneArgs, ae as FindOneOptions, af as FindOptions, ag as GlobalOptions, ah as GlobalPermissionValue, ai as GuardHook, aj as IdentifierHook, ak as Include, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, aq as KeyValueProjection, ar as LegacyInclude, as as ListQueryInput, at as ListResult, au as MIDDLEWARE, av as MaybePromise, aw as ModelBaseFilterHook, ax as ModelChangeHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aA as ModelDocument, aB as ModelDocumentHook, aC as ModelHook, aD as ModelHookContext, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aH as ModelRequest, aI as ModelRouterOptions, aJ as ModelValidateHook, aK as PERMISSIONS, aL as PERMISSION_KEYS, aM as ParentRef, aN as PathValue, aO as PermissionSchema, aP as Populate, aQ as PopulateAccess, aR as PrepareAccess, aS as Projection, aT as PublicCreateArgs, aU as PublicCreateOptions, aV as PublicErrorResult, aW as PublicListArgs, aX as PublicListOptions, aY as PublicListResult, aZ as PublicOutput, a_ as PublicReadArgs, a$ as PublicReadOptions, b0 as PublicServiceResult, b1 as PublicSingleResult, b2 as PublicUpdateArgs, b3 as PublicUpdateOptions, b4 as PublicUpsertArgs, b5 as PublicUpsertOptions, b6 as ReadQueryInput, b7 as Request, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bg as RequestSchemas, bh as RootDataListQueryEntry, bi as RootDataOperation, bj as RootDataReadByFilterQueryEntry, bk as RootDataReadByIdQueryEntry, bl as RootModelCountQueryEntry, bm as RootModelCreateQueryEntry, bn as RootModelDeleteQueryEntry, bo as RootModelDistinctQueryEntry, bp as RootModelListQueryEntry, bq as RootModelNewQueryEntry, br as RootModelOperation, bs as RootModelReadByFilterQueryEntry, bt as RootModelReadByIdQueryEntry, bu as RootModelSubBulkUpdateQueryEntry, bv as RootModelSubCreateQueryEntry, bw as RootModelSubDeleteQueryEntry, bx as RootModelSubListQueryEntry, by as RootModelSubReadQueryEntry, bz as RootModelSubUpdateQueryEntry, bA as RootModelUpdateQueryEntry, bB as RootModelUpsertQueryEntry, bC as RootOperationResult, bD as RootQueryEntry, bE as RootRouterOptions, bF as RootSubOperation, bG as RootTarget, bH as RouteGuardAccess, bI as SelectAccess, bJ as SelectedPopulatedPublicOutput, bK as SelectedPublicOutput, bL as ServiceResult, bM as SingleResult, bN as Sort, bO as SortOrder, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, bW as StatusCodes, bX as SubListBody, bY as SubPopulate, bZ as SubQueryEntry, b_ as SubReadBody, b$ as SubdocumentBulkRecord, c0 as SubdocumentBulkUpdateInput, c1 as SubdocumentCreateInput, c2 as SubdocumentCreateOptions, c3 as SubdocumentId, c4 as SubdocumentListOptions, c5 as SubdocumentName, c6 as SubdocumentParentArgs, c7 as SubdocumentParentOptions, c8 as SubdocumentReadOptions, c9 as SubdocumentRecord, ca as SuperstructFailureLike, cb as SuperstructValidateLike, cc as Task, cd as TaskType, ce as TransformAccess, cf as TypedFilter, cg as UpdateByIdArgs, ch as UpdateByIdOptions, ci as UpdateOneArgs, cj as UpdateOneOptions, ck as UpdateQueryInput, cl as UpsertArgs, cm as UpsertOptions, cn as UpsertQueryInput, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cs as ValidateAccess, ct as ValidateRule, cu as Validation, cv as ValidationError, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod, cM as parseBody, cN as parseBodyWithSchema, cO as parseNestedBodyWithSchema, cP as parsePathParam, cQ as parseQuery } from './parsers-BidvJUu7.mjs';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CorrelatedCountInclude, t as CorrelatedFilter, u as CorrelatedInclude, v as CorrelatedIncludeArgs, w as CorrelatedListInclude, x as CorrelatedReadByFilterInclude, y as CorrelatedReadByIdInclude, z as CountBody, D as CreateArgs, E as CreateOptions, F as CreateQueryInput, G as CustomHeaders, H as DATA_MIDDLEWARE, I as DataBaseFilterHook, J as DataFilter, K as DataFindArgs, L as DataFindOneArgs, M as DataFindOneOptions, N as DataFindOptions, O as DataHook, P as DataHookContext, Q as DataIdentifierHook, R as DataListHook, S as DataOverrideFilterHook, T as DataRequest, U as DataRequestSchemas, V as DataRouterOptions, W as DecorateAccess, X as DecorateAllAccess, Y as DeepFieldPath, Z as DefaultModelRouterOptions, _ as Defaults, $ as DistinctArgs, a0 as DistinctBody, a1 as DocPermissionsAccess, a2 as ErrorResult, a3 as ExistsOptions, a4 as ExtendedDataRouterOptions, a5 as ExtendedDefaultModelRouterOptions, a6 as ExtendedModelRouterOptions, a7 as Filter, a8 as FilterOperator, a9 as FindAccess, aa as FindArgs, ab as FindByIdArgs, ac as FindByIdOptions, ad as FindOneArgs, ae as FindOneOptions, af as FindOptions, ag as GlobalOptions, ah as GlobalPermissionValue, ai as GuardHook, aj as IdentifierHook, ak as Include, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, aq as KeyValueProjection, ar as LegacyInclude, as as ListQueryInput, at as ListResult, au as MIDDLEWARE, av as MaybePromise, aw as ModelBaseFilterHook, ax as ModelChangeHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aA as ModelDocument, aB as ModelDocumentHook, aC as ModelHook, aD as ModelHookContext, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aH as ModelRequest, aI as ModelRouterOptions, aJ as ModelValidateHook, aK as PERMISSIONS, aL as PERMISSION_KEYS, aM as ParentRef, aN as PathValue, aO as PermissionSchema, aP as Populate, aQ as PopulateAccess, aR as PrepareAccess, aS as Projection, aT as PublicCreateArgs, aU as PublicCreateOptions, aV as PublicErrorResult, aW as PublicListArgs, aX as PublicListOptions, aY as PublicListResult, aZ as PublicOutput, a_ as PublicReadArgs, a$ as PublicReadOptions, b0 as PublicServiceResult, b1 as PublicSingleResult, b2 as PublicUpdateArgs, b3 as PublicUpdateOptions, b4 as PublicUpsertArgs, b5 as PublicUpsertOptions, b6 as ReadQueryInput, b7 as Request, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bg as RequestSchemas, bh as RootDataListQueryEntry, bi as RootDataOperation, bj as RootDataReadByFilterQueryEntry, bk as RootDataReadByIdQueryEntry, bl as RootModelCountQueryEntry, bm as RootModelCreateQueryEntry, bn as RootModelDeleteQueryEntry, bo as RootModelDistinctQueryEntry, bp as RootModelListQueryEntry, bq as RootModelNewQueryEntry, br as RootModelOperation, bs as RootModelReadByFilterQueryEntry, bt as RootModelReadByIdQueryEntry, bu as RootModelSubBulkUpdateQueryEntry, bv as RootModelSubCreateQueryEntry, bw as RootModelSubDeleteQueryEntry, bx as RootModelSubListQueryEntry, by as RootModelSubReadQueryEntry, bz as RootModelSubUpdateQueryEntry, bA as RootModelUpdateQueryEntry, bB as RootModelUpsertQueryEntry, bC as RootOperationResult, bD as RootQueryEntry, bE as RootRouterOptions, bF as RootSubOperation, bG as RootTarget, bH as RouteGuardAccess, bI as SelectAccess, bJ as SelectedPopulatedPublicOutput, bK as SelectedPublicOutput, bL as ServiceResult, bM as SingleResult, bN as Sort, bO as SortOrder, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, bW as StatusCodes, bX as SubListBody, bY as SubPopulate, bZ as SubQueryEntry, b_ as SubReadBody, b$ as SubdocumentBulkRecord, c0 as SubdocumentBulkUpdateInput, c1 as SubdocumentCreateInput, c2 as SubdocumentCreateOptions, c3 as SubdocumentId, c4 as SubdocumentListOptions, c5 as SubdocumentName, c6 as SubdocumentParentArgs, c7 as SubdocumentParentOptions, c8 as SubdocumentReadOptions, c9 as SubdocumentRecord, ca as SuperstructFailureLike, cb as SuperstructValidateLike, cc as Task, cd as TaskType, ce as TransformAccess, cf as TypedFilter, cg as UpdateByIdArgs, ch as UpdateByIdOptions, ci as UpdateOneArgs, cj as UpdateOneOptions, ck as UpdateQueryInput, cl as UpsertArgs, cm as UpsertOptions, cn as UpsertQueryInput, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cs as ValidateAccess, ct as ValidateRule, cu as Validation, cv as ValidationError, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod, cM as parseBody, cN as parseBodyWithSchema, cO as parseNestedBodyWithSchema, cP as parsePathParam, cQ as parseQuery } from './parsers-BKF7VX2-.js';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CorrelatedCountInclude, t as CorrelatedFilter, u as CorrelatedInclude, v as CorrelatedIncludeArgs, w as CorrelatedListInclude, x as CorrelatedReadByFilterInclude, y as CorrelatedReadByIdInclude, z as CountBody, D as CreateArgs, E as CreateOptions, F as CreateQueryInput, G as CustomHeaders, H as DATA_MIDDLEWARE, I as DataBaseFilterHook, J as DataFilter, K as DataFindArgs, L as DataFindOneArgs, M as DataFindOneOptions, N as DataFindOptions, O as DataHook, P as DataHookContext, Q as DataIdentifierHook, R as DataListHook, S as DataOverrideFilterHook, T as DataRequest, U as DataRequestSchemas, V as DataRouterOptions, W as DecorateAccess, X as DecorateAllAccess, Y as DeepFieldPath, Z as DefaultModelRouterOptions, _ as Defaults, $ as DistinctArgs, a0 as DistinctBody, a1 as DocPermissionsAccess, a2 as ErrorResult, a3 as ExistsOptions, a4 as ExtendedDataRouterOptions, a5 as ExtendedDefaultModelRouterOptions, a6 as ExtendedModelRouterOptions, a7 as Filter, a8 as FilterOperator, a9 as FindAccess, aa as FindArgs, ab as FindByIdArgs, ac as FindByIdOptions, ad as FindOneArgs, ae as FindOneOptions, af as FindOptions, ag as GlobalOptions, ah as GlobalPermissionValue, ai as GuardHook, aj as IdentifierHook, ak as Include, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, aq as KeyValueProjection, ar as LegacyInclude, as as ListQueryInput, at as ListResult, au as MIDDLEWARE, av as MaybePromise, aw as ModelBaseFilterHook, ax as ModelChangeHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aA as ModelDocument, aB as ModelDocumentHook, aC as ModelHook, aD as ModelHookContext, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aH as ModelRequest, aI as ModelRouterOptions, aJ as ModelValidateHook, aK as PERMISSIONS, aL as PERMISSION_KEYS, aM as ParentRef, aN as PathValue, aO as PermissionSchema, aP as Populate, aQ as PopulateAccess, aR as PrepareAccess, aS as Projection, aT as PublicCreateArgs, aU as PublicCreateOptions, aV as PublicErrorResult, aW as PublicListArgs, aX as PublicListOptions, aY as PublicListResult, aZ as PublicOutput, a_ as PublicReadArgs, a$ as PublicReadOptions, b0 as PublicServiceResult, b1 as PublicSingleResult, b2 as PublicUpdateArgs, b3 as PublicUpdateOptions, b4 as PublicUpsertArgs, b5 as PublicUpsertOptions, b6 as ReadQueryInput, b7 as Request, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bg as RequestSchemas, bh as RootDataListQueryEntry, bi as RootDataOperation, bj as RootDataReadByFilterQueryEntry, bk as RootDataReadByIdQueryEntry, bl as RootModelCountQueryEntry, bm as RootModelCreateQueryEntry, bn as RootModelDeleteQueryEntry, bo as RootModelDistinctQueryEntry, bp as RootModelListQueryEntry, bq as RootModelNewQueryEntry, br as RootModelOperation, bs as RootModelReadByFilterQueryEntry, bt as RootModelReadByIdQueryEntry, bu as RootModelSubBulkUpdateQueryEntry, bv as RootModelSubCreateQueryEntry, bw as RootModelSubDeleteQueryEntry, bx as RootModelSubListQueryEntry, by as RootModelSubReadQueryEntry, bz as RootModelSubUpdateQueryEntry, bA as RootModelUpdateQueryEntry, bB as RootModelUpsertQueryEntry, bC as RootOperationResult, bD as RootQueryEntry, bE as RootRouterOptions, bF as RootSubOperation, bG as RootTarget, bH as RouteGuardAccess, bI as SelectAccess, bJ as SelectedPopulatedPublicOutput, bK as SelectedPublicOutput, bL as ServiceResult, bM as SingleResult, bN as Sort, bO as SortOrder, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, bW as StatusCodes, bX as SubListBody, bY as SubPopulate, bZ as SubQueryEntry, b_ as SubReadBody, b$ as SubdocumentBulkRecord, c0 as SubdocumentBulkUpdateInput, c1 as SubdocumentCreateInput, c2 as SubdocumentCreateOptions, c3 as SubdocumentId, c4 as SubdocumentListOptions, c5 as SubdocumentName, c6 as SubdocumentParentArgs, c7 as SubdocumentParentOptions, c8 as SubdocumentReadOptions, c9 as SubdocumentRecord, ca as SuperstructFailureLike, cb as SuperstructValidateLike, cc as Task, cd as TaskType, ce as TransformAccess, cf as TypedFilter, cg as UpdateByIdArgs, ch as UpdateByIdOptions, ci as UpdateOneArgs, cj as UpdateOneOptions, ck as UpdateQueryInput, cl as UpsertArgs, cm as UpsertOptions, cn as UpsertQueryInput, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cs as ValidateAccess, ct as ValidateRule, cu as Validation, cv as ValidationError, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod, cM as parseBody, cN as parseBodyWithSchema, cO as parseNestedBodyWithSchema, cP as parsePathParam, cQ as parseQuery } from './parsers-BidvJUu7.js';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, ai as GuardHook, aH as ModelRequest, cR as AccessRuntime, V as DataRouterOptions, T as DataRequest, cS as DataService, a7 as Filter, aS as Projection, bN as Sort, aP as Populate, aI as ModelRouterOptions, cT as Service, cU as PublicService, a6 as ExtendedModelRouterOptions, cu as Validation, bE as RootRouterOptions, cV as OpenApiRouterOptions, cW as OpenApiRegistryOptions, cX as OpenApiRouteDescriptor, cY as OpenApiDocumentOptions, cZ as OpenApiParameter, c_ as OpenApiSchema, c$ as OpenApiResponses, ag as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-BKF7VX2-.mjs';
-export { d0 as AccessRouterPermissionMap, d1 as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, ah as GlobalPermissionValue, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, av as MaybePromise, aw as ModelBaseFilterHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aB as ModelDocumentHook, aC as ModelHook, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aJ as ModelValidateHook, d2 as OpenApiMethod, d3 as Permissions, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bH as RouteGuardAccess, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, ca as SuperstructFailureLike, cb as SuperstructValidateLike, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, d4 as defaultRuntime, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod } from './parsers-BKF7VX2-.mjs';
+import { A as AccessRouterBaseRequest, ai as GuardHook, aH as ModelRequest, cR as AccessRuntime, V as DataRouterOptions, T as DataRequest, cS as DataService, a7 as Filter, aS as Projection, bN as Sort, aP as Populate, aI as ModelRouterOptions, cT as Service, cU as PublicService, a6 as ExtendedModelRouterOptions, cu as Validation, bE as RootRouterOptions, cV as OpenApiRouterOptions, cW as OpenApiRegistryOptions, cX as OpenApiRouteDescriptor, cY as OpenApiDocumentOptions, cZ as OpenApiParameter, c_ as OpenApiSchema, c$ as OpenApiResponses, ag as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-BidvJUu7.mjs';
+export { d0 as AccessRouterPermissionMap, d1 as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, ah as GlobalPermissionValue, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, av as MaybePromise, aw as ModelBaseFilterHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aB as ModelDocumentHook, aC as ModelHook, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aJ as ModelValidateHook, d2 as OpenApiMethod, d3 as Permissions, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bH as RouteGuardAccess, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, ca as SuperstructFailureLike, cb as SuperstructValidateLike, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, d4 as defaultRuntime, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod } from './parsers-BidvJUu7.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 

package/index.d.ts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, ai as GuardHook, aH as ModelRequest, cR as AccessRuntime, V as DataRouterOptions, T as DataRequest, cS as DataService, a7 as Filter, aS as Projection, bN as Sort, aP as Populate, aI as ModelRouterOptions, cT as Service, cU as PublicService, a6 as ExtendedModelRouterOptions, cu as Validation, bE as RootRouterOptions, cV as OpenApiRouterOptions, cW as OpenApiRegistryOptions, cX as OpenApiRouteDescriptor, cY as OpenApiDocumentOptions, cZ as OpenApiParameter, c_ as OpenApiSchema, c$ as OpenApiResponses, ag as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-BKF7VX2-.js';
-export { d0 as AccessRouterPermissionMap, d1 as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, ah as GlobalPermissionValue, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, av as MaybePromise, aw as ModelBaseFilterHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aB as ModelDocumentHook, aC as ModelHook, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aJ as ModelValidateHook, d2 as OpenApiMethod, d3 as Permissions, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bH as RouteGuardAccess, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, ca as SuperstructFailureLike, cb as SuperstructValidateLike, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, d4 as defaultRuntime, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod } from './parsers-BKF7VX2-.js';
+import { A as AccessRouterBaseRequest, ai as GuardHook, aH as ModelRequest, cR as AccessRuntime, V as DataRouterOptions, T as DataRequest, cS as DataService, a7 as Filter, aS as Projection, bN as Sort, aP as Populate, aI as ModelRouterOptions, cT as Service, cU as PublicService, a6 as ExtendedModelRouterOptions, cu as Validation, bE as RootRouterOptions, cV as OpenApiRouterOptions, cW as OpenApiRegistryOptions, cX as OpenApiRouteDescriptor, cY as OpenApiDocumentOptions, cZ as OpenApiParameter, c_ as OpenApiSchema, c$ as OpenApiResponses, ag as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-BidvJUu7.js';
+export { d0 as AccessRouterPermissionMap, d1 as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, ah as GlobalPermissionValue, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, av as MaybePromise, aw as ModelBaseFilterHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aB as ModelDocumentHook, aC as ModelHook, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aJ as ModelValidateHook, d2 as OpenApiMethod, d3 as Permissions, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bH as RouteGuardAccess, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, ca as SuperstructFailureLike, cb as SuperstructValidateLike, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, d4 as defaultRuntime, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod } from './parsers-BidvJUu7.js';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 

package/index.js

@@ -376,6 +376,41 @@ function normalizeSortForOrderBy(sort) {
     orders: normalized.fields.map(({ direction }) => direction)
   };
 }
+function sanitizeSortFields(sort, allowedFields) {
+  const { fields, errors } = normalizeSort(sort);
+  if (errors.length > 0) return { sort: void 0, stripped: [], errors };
+  const allowedSet = new Set(allowedFields.concat(["id", "_id"]));
+  const kept = fields.filter(({ field }) => allowedSet.has(field));
+  const stripped = fields.filter(({ field }) => !allowedSet.has(field)).map(({ field }) => field);
+  if (stripped.length === 0) return { sort, stripped, errors: [] };
+  if (kept.length === 0) return { sort: void 0, stripped, errors: [] };
+  if (typeof sort === "string") {
+    return {
+      sort: kept.map(({ field, direction }) => direction === "desc" ? `-${field}` : field).join(" "),
+      stripped,
+      errors: []
+    };
+  }
+  if (sort instanceof Map) {
+    return {
+      sort: new Map(kept.map(({ field, direction }) => [field, direction])),
+      stripped,
+      errors: []
+    };
+  }
+  if (Array.isArray(sort)) {
+    return {
+      sort: kept.map(({ field, direction }) => [field, direction]),
+      stripped,
+      errors: []
+    };
+  }
+  return {
+    sort: Object.fromEntries(kept.map(({ field, direction }) => [field, direction])),
+    stripped,
+    errors: []
+  };
+}
 
 // src/helpers/index.ts
 var import_utils6 = require("@web-ts-toolkit/utils");
@@ -3515,6 +3550,10 @@ var Service = class extends Base {
   asServiceHookContext(context) {
     return context;
   }
+  getEffectiveAllowedSortFields(allowedSortFields) {
+    const extra = this.options?.sortableFields ?? [];
+    return extra.length > 0 ? [...allowedSortFields, ...extra] : allowedSortFields;
+  }
   beginOp(op, filter2, extra) {
     const startedAt = Date.now();
     debug({
@@ -3561,14 +3600,18 @@ var Service = class extends Base {
     const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
     const finalSelect = normalizeSelect(_select).concat(includeLocalFields, correlatedReferenceFields);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect,
-      sort,
+      sort: effectiveSort,
       populate: _populate
     };
     const startedAt = this.beginOp("findOne", _filter, {
-      sort,
+      sort: effectiveSort,
       selectCount: finalSelect.length,
       populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
     });
@@ -3576,10 +3619,17 @@ var Service = class extends Base {
       this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let doc = await this.model.findOne({ ...query, lean });
     if (!doc) {
@@ -3683,15 +3733,19 @@ var Service = class extends Base {
     const filteredPopulate = (0, import_utils17.isArray)(finalSelect) && (0, import_utils17.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect.concat(includeLocalFields, correlatedReferenceFields),
       populate: filteredPopulate,
-      sort,
+      sort: effectiveSort,
       ...pagination
     };
     const startedAt = this.beginOp("find", _filter, {
-      sort,
+      sort: effectiveSort,
       skip: pagination.skip,
       limit: pagination.limit,
       selectCount: finalSelect.concat(includeLocalFields, correlatedReferenceFields).length,
@@ -3701,10 +3755,17 @@ var Service = class extends Base {
       this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let docs = await this.model.find({
       ...query,
@@ -5478,6 +5539,7 @@ async function resolveSelectForRequest({
 }
 
 // src/core.ts
+var emptyPermissionLeaf = () => ({ $: "_" });
 var Core = class {
   constructor(req) {
     this.cachedPermissions = null;
@@ -5681,7 +5743,7 @@ var Core = class {
   }
   addEmptyPermissions(modelName, doc) {
     const docPermissionField = getModelOption(modelName, "documentPermissionField");
-    setDocValue(doc, docPermissionField, { _view: { $: "_" }, _edit: { $: "_" } });
+    setDocValue(doc, docPermissionField, { _view: emptyPermissionLeaf(), _edit: emptyPermissionLeaf() });
     return doc;
   }
   async addDocPermissions(modelName, doc, access, context) {
@@ -5731,8 +5793,8 @@ var Core = class {
       },
       {}
     );
-    setDocValue(doc, `${docPermissionField}._view`, viewObj);
-    setDocValue(doc, `${docPermissionField}._edit`, editObj);
+    setDocValue(doc, `${docPermissionField}._view`, Object.keys(viewObj).length > 0 ? viewObj : emptyPermissionLeaf());
+    setDocValue(doc, `${docPermissionField}._edit`, Object.keys(editObj).length > 0 ? editObj : emptyPermissionLeaf());
     return doc;
   }
   async decorate(modelName, doc, access, context) {

package/index.mjs

@@ -320,6 +320,41 @@ function normalizeSortForOrderBy(sort) {
     orders: normalized.fields.map(({ direction }) => direction)
   };
 }
+function sanitizeSortFields(sort, allowedFields) {
+  const { fields, errors } = normalizeSort(sort);
+  if (errors.length > 0) return { sort: void 0, stripped: [], errors };
+  const allowedSet = new Set(allowedFields.concat(["id", "_id"]));
+  const kept = fields.filter(({ field }) => allowedSet.has(field));
+  const stripped = fields.filter(({ field }) => !allowedSet.has(field)).map(({ field }) => field);
+  if (stripped.length === 0) return { sort, stripped, errors: [] };
+  if (kept.length === 0) return { sort: void 0, stripped, errors: [] };
+  if (typeof sort === "string") {
+    return {
+      sort: kept.map(({ field, direction }) => direction === "desc" ? `-${field}` : field).join(" "),
+      stripped,
+      errors: []
+    };
+  }
+  if (sort instanceof Map) {
+    return {
+      sort: new Map(kept.map(({ field, direction }) => [field, direction])),
+      stripped,
+      errors: []
+    };
+  }
+  if (Array.isArray(sort)) {
+    return {
+      sort: kept.map(({ field, direction }) => [field, direction]),
+      stripped,
+      errors: []
+    };
+  }
+  return {
+    sort: Object.fromEntries(kept.map(({ field, direction }) => [field, direction])),
+    stripped,
+    errors: []
+  };
+}
 
 // src/helpers/index.ts
 import { forEach, isArray as isArray2, isEmpty, isObject, isPlainObject as isPlainObject4, isString as isString3 } from "@web-ts-toolkit/utils";
@@ -3481,6 +3516,10 @@ var Service = class extends Base {
   asServiceHookContext(context) {
     return context;
   }
+  getEffectiveAllowedSortFields(allowedSortFields) {
+    const extra = this.options?.sortableFields ?? [];
+    return extra.length > 0 ? [...allowedSortFields, ...extra] : allowedSortFields;
+  }
   beginOp(op, filter2, extra) {
     const startedAt = Date.now();
     debug({
@@ -3527,14 +3566,18 @@ var Service = class extends Base {
     const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
     const finalSelect = normalizeSelect(_select).concat(includeLocalFields, correlatedReferenceFields);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect,
-      sort,
+      sort: effectiveSort,
       populate: _populate
     };
     const startedAt = this.beginOp("findOne", _filter, {
-      sort,
+      sort: effectiveSort,
       selectCount: finalSelect.length,
       populateCount: Array.isArray(_populate) ? _populate.length : _populate ? 1 : 0
     });
@@ -3542,10 +3585,17 @@ var Service = class extends Base {
       this.completeOp("findOne", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("findOne", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let doc = await this.model.findOne({ ...query, lean });
     if (!doc) {
@@ -3649,15 +3699,19 @@ var Service = class extends Base {
     const filteredPopulate = isArray8(finalSelect) && isArray8(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, correlatedIncludes, includeLocalFields, includePaths, correlatedReferenceFields } = processedInclude;
     const correlatedOutputPaths = correlatedIncludes.map((entry) => entry.path);
+    const effectiveAllowedSortFields = this.getEffectiveAllowedSortFields(allowedSortFields);
+    const stripDisallowedSort = this.options?.stripDisallowedSort ?? false;
+    const sanitizedSort = stripDisallowedSort ? sanitizeSortFields(sort, effectiveAllowedSortFields) : null;
+    const effectiveSort = stripDisallowedSort ? sanitizedSort?.sort : sort;
     const query = {
       filter: _filter,
       select: finalSelect.concat(includeLocalFields, correlatedReferenceFields),
       populate: filteredPopulate,
-      sort,
+      sort: effectiveSort,
       ...pagination
     };
     const startedAt = this.beginOp("find", _filter, {
-      sort,
+      sort: effectiveSort,
       skip: pagination.skip,
       limit: pagination.limit,
       selectCount: finalSelect.concat(includeLocalFields, correlatedReferenceFields).length,
@@ -3667,10 +3721,17 @@ var Service = class extends Base {
       this.completeOp("find", startedAt, "forbidden" /* Forbidden */, _filter);
       return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query };
     }
-    const sortErrors = validateSortFields(sort, allowedSortFields);
-    if (sortErrors.length > 0) {
-      this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
-      return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+    if (stripDisallowedSort) {
+      if (sanitizedSort && sanitizedSort.errors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sanitizedSort.errors, query };
+      }
+    } else {
+      const sortErrors = validateSortFields(sort, effectiveAllowedSortFields);
+      if (sortErrors.length > 0) {
+        this.completeOp("find", startedAt, "bad_request" /* BadRequest */, _filter);
+        return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
+      }
     }
     let docs = await this.model.find({
       ...query,
@@ -5455,6 +5516,7 @@ async function resolveSelectForRequest({
 }
 
 // src/core.ts
+var emptyPermissionLeaf = () => ({ $: "_" });
 var Core = class {
   constructor(req) {
     this.cachedPermissions = null;
@@ -5658,7 +5720,7 @@ var Core = class {
   }
   addEmptyPermissions(modelName, doc) {
     const docPermissionField = getModelOption(modelName, "documentPermissionField");
-    setDocValue(doc, docPermissionField, { _view: { $: "_" }, _edit: { $: "_" } });
+    setDocValue(doc, docPermissionField, { _view: emptyPermissionLeaf(), _edit: emptyPermissionLeaf() });
     return doc;
   }
   async addDocPermissions(modelName, doc, access, context) {
@@ -5708,8 +5770,8 @@ var Core = class {
       },
       {}
     );
-    setDocValue(doc, `${docPermissionField}._view`, viewObj);
-    setDocValue(doc, `${docPermissionField}._edit`, editObj);
+    setDocValue(doc, `${docPermissionField}._view`, Object.keys(viewObj).length > 0 ? viewObj : emptyPermissionLeaf());
+    setDocValue(doc, `${docPermissionField}._edit`, Object.keys(editObj).length > 0 ? editObj : emptyPermissionLeaf());
     return doc;
   }
   async decorate(modelName, doc, access, context) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/access-router",
   "description": "ACL-aware Express routers and in-memory data services for Mongoose-backed APIs",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/access-router",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "sideEffects": [
     "./**/index.js",
     "./**/index.mjs",
@@ -57,8 +57,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-json-router": "0.46.0",
-    "@web-ts-toolkit/utils": "0.46.0",
+    "@web-ts-toolkit/express-json-router": "0.47.0",
+    "@web-ts-toolkit/utils": "0.47.0",
     "just-diff": "^6.0.2",
     "mongoose-schema-jsonschema": "^4.0.1",
     "sift": "^17.1.3",

package/{parsers-BKF7VX2-.d.mts → parsers-BidvJUu7.d.mts}

@@ -40,6 +40,7 @@ declare class Service<TModel = unknown> extends Base<TModel> {
     protected createModelAdapter(modelName: string): any;
     protected getModelRouterOptions(modelName: string): ModelRouterOptions<TModel>;
     private asServiceHookContext;
+    private getEffectiveAllowedSortFields;
     private beginOp;
     private completeOp;
     constructor(req: ModelRequest, modelName: string);
@@ -1715,6 +1716,19 @@ interface DefaultModelRouterOptions<TModel = unknown> {
     mutationRouteSegment?: string;
     operationAccess?: Validation | OperationAccess;
     modelPermissionPrefix?: string;
+    /**
+     * Extra fields allowed in `sort` regardless of `list`/`read` field policy.
+     * Merged as a union with permission-derived allowed fields (`id`/`_id` are
+     * always allowed). Does not grant output visibility, only sortability.
+     */
+    sortableFields?: string[];
+    /**
+     * When `true`, disallowed `sort` keys are omitted from the sort sent upstream
+     * (Mongoose) instead of returning `BadRequest`. Malformed sort syntax still
+     * returns `BadRequest`. If every key is stripped, no sort is applied.
+     * Defaults to `false` (strict: disallowed sort returns `BadRequest`).
+     */
+    stripDisallowedSort?: boolean;
 }
 interface ExtendedDefaultModelRouterOptions<TModel = unknown> extends DefaultModelRouterOptions<TModel> {
     'operationAccess.default'?: Validation;

package/{parsers-BKF7VX2-.d.ts → parsers-BidvJUu7.d.ts}

@@ -40,6 +40,7 @@ declare class Service<TModel = unknown> extends Base<TModel> {
     protected createModelAdapter(modelName: string): any;
     protected getModelRouterOptions(modelName: string): ModelRouterOptions<TModel>;
     private asServiceHookContext;
+    private getEffectiveAllowedSortFields;
     private beginOp;
     private completeOp;
     constructor(req: ModelRequest, modelName: string);
@@ -1715,6 +1716,19 @@ interface DefaultModelRouterOptions<TModel = unknown> {
     mutationRouteSegment?: string;
     operationAccess?: Validation | OperationAccess;
     modelPermissionPrefix?: string;
+    /**
+     * Extra fields allowed in `sort` regardless of `list`/`read` field policy.
+     * Merged as a union with permission-derived allowed fields (`id`/`_id` are
+     * always allowed). Does not grant output visibility, only sortability.
+     */
+    sortableFields?: string[];
+    /**
+     * When `true`, disallowed `sort` keys are omitted from the sort sent upstream
+     * (Mongoose) instead of returning `BadRequest`. Malformed sort syntax still
+     * returns `BadRequest`. If every key is stripped, no sort is applied.
+     * Defaults to `false` (strict: disallowed sort returns `BadRequest`).
+     */
+    stripDisallowedSort?: boolean;
 }
 interface ExtendedDefaultModelRouterOptions<TModel = unknown> extends DefaultModelRouterOptions<TModel> {
     'operationAccess.default'?: Validation;