@web-ts-toolkit/access-router 0.47.1 → 0.48.0

package/index.js

@@ -193,6 +193,12 @@ function genPagination({
   }
   return { skip: _skip, limit: _limit };
 }
+function parseSelectParam(select) {
+  if (select === void 0) return void 0;
+  const values = Array.isArray(select) ? select : [select];
+  const fields = values.flatMap((value) => String(value).split(/[\s,]+/)).filter(Boolean);
+  return fields.length > 0 ? fields : void 0;
+}
 function normalizeSelect(select) {
   if (Array.isArray(select)) return (0, import_utils2.flattenDeep)(select.map(normalizeSelect));
   if ((0, import_utils2.isPlainObject)(select)) {
@@ -234,6 +240,15 @@ function getDocPermissions(modelName, doc) {
   const permissions = getDocValue(doc, docPermissionField, {});
   return (0, import_utils3.isPlainObject)(permissions) ? permissions : {};
 }
+function stripUnexposedDocPermissions(modelName, doc) {
+  const exposed = getModelOption(modelName, "exposedDocPermissionKeys");
+  if (exposed === void 0) return;
+  const docPermissionField = getModelOption(modelName, "documentPermissionField");
+  const current = getDocValue(doc, docPermissionField, void 0);
+  if (!(0, import_utils3.isPlainObject)(current)) return;
+  const keep = /* @__PURE__ */ new Set(["_view", "_edit", ...exposed]);
+  setDocValue(doc, docPermissionField, Object.fromEntries(Object.entries(current).filter(([key]) => keep.has(key))));
+}
 function toObject(doc) {
   return isDocument(doc) ? doc.toObject() : doc;
 }
@@ -1222,11 +1237,11 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       }
       if ((0, import_utils11.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       if (hasModelPermission(value, modelPermissionPrefix)) {
         modelPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       globalPermissionKeys[accessKey].push(schemaKey);
     }
@@ -2477,7 +2492,8 @@ var Base = class {
         ...options,
         access: "read",
         lean: true,
-        includePermissions: false
+        includePermissions: false,
+        includeFieldPermissions: false
       };
       const result = await svc.findOne(filter2, this.sanitizeIncludeArgs(args), trustedOptions);
       if (result.success) {
@@ -2505,6 +2521,7 @@ var Base = class {
       ...options,
       lean: true,
       includePermissions: false,
+      includeFieldPermissions: false,
       includeCount: false
     };
     const trustedResult = await svc.find(filter2, trustedArgs, trustedOptions);
@@ -2635,7 +2652,7 @@ var Base = class {
               include: nestedInclude,
               overrides: { filter: authorized }
             },
-            { access: "read", lean: true, includePermissions: false }
+            { access: "read", lean: true, includePermissions: false, includeFieldPermissions: false }
           );
         } catch (error2) {
           const clientResult = this.getClientRequestErrorResult(error2);
@@ -2713,7 +2730,7 @@ var Base = class {
             include: nestedInclude,
             overrides: { filter: authorized }
           },
-          { access: "read", lean: true, includePermissions: false }
+          { access: "read", lean: true, includePermissions: false, includeFieldPermissions: false }
         );
       } catch (error2) {
         const clientResult = this.getClientRequestErrorResult(error2);
@@ -2798,7 +2815,7 @@ var Base = class {
             include: nestedInclude,
             overrides: { filter: authorized }
           },
-          { includeCount: false, lean: true, includePermissions: false }
+          { includeCount: false, lean: true, includePermissions: false, includeFieldPermissions: false }
         );
       } catch (error2) {
         const clientResult = this.getClientRequestErrorResult(error2);
@@ -3379,6 +3396,16 @@ async function getParentDoc(service, id, sub, args, options) {
 }
 
 // src/services/model-service-defaults.ts
+function applyPermissionsPosture(service, resolved) {
+  const posture = service.getPermissionsPosture();
+  if (posture.stripPermissionsField) {
+    resolved.includePermissions = false;
+    resolved.includeFieldPermissions = false;
+  } else if (posture.disableFieldPermissions) {
+    resolved.includeFieldPermissions = false;
+  }
+  return resolved;
+}
 function resolveFindOneArgs(service, args = {}) {
   return {
     select: args.select ?? service.defaults.findOneArgs?.select,
@@ -3389,13 +3416,15 @@ function resolveFindOneArgs(service, args = {}) {
   };
 }
 function resolveFindOneOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findOneOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findOneOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findOneOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOneOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findOneOptions?.access ?? "read",
     populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess,
     lean: options.lean ?? service.defaults.findOneOptions?.lean ?? false
-  };
+  });
 }
 function resolveFindByIdArgs(service, args = {}) {
   return {
@@ -3406,13 +3435,15 @@ function resolveFindByIdArgs(service, args = {}) {
   };
 }
 function resolveFindByIdOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findByIdOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findByIdOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findByIdOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findByIdOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findByIdOptions?.access ?? "read",
     populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess,
     lean: options.lean ?? service.defaults.findByIdOptions?.lean ?? false
-  };
+  });
 }
 function resolveFindArgs(service, args = {}) {
   return {
@@ -3428,13 +3459,15 @@ function resolveFindArgs(service, args = {}) {
   };
 }
 function resolveFindOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOptions?.includeFieldPermissions ?? includePermissions,
     includeCount: options.includeCount ?? service.defaults.findOptions?.includeCount ?? false,
     populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read",
     lean: options.lean ?? service.defaults.findOptions?.lean ?? false
-  };
+  });
 }
 function resolveCreateArgs(service, args = {}) {
   return {
@@ -3442,11 +3475,13 @@ function resolveCreateArgs(service, args = {}) {
   };
 }
 function resolveCreateOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.createOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.createOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.createOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.createOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.createOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpdateOneArgs(service, args = {}) {
   return {
@@ -3455,11 +3490,13 @@ function resolveUpdateOneArgs(service, args = {}) {
   };
 }
 function resolveUpdateOneOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.updateOneOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.updateOneOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.updateOneOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.updateOneOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.updateOneOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpdateByIdArgs(service, args = {}) {
   return {
@@ -3468,11 +3505,13 @@ function resolveUpdateByIdArgs(service, args = {}) {
   };
 }
 function resolveUpdateByIdOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.updateByIdOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.updateByIdOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.updateByIdOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.updateByIdOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.updateByIdOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpsertArgs(service, args = {}) {
   return {
@@ -3481,11 +3520,13 @@ function resolveUpsertArgs(service, args = {}) {
   };
 }
 function resolveUpsertOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.upsertOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.upsertOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.upsertOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.upsertOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.upsertOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveExistsOptions(service, options = {}) {
   return {
@@ -3547,6 +3588,27 @@ var Service = class extends Base {
   getModelRouterOptions(modelName) {
     return getModelOptions(modelName);
   }
+  /**
+   * Router-level permission output postures (see `ModelRouterOptions`).
+   * Absolute: they win over client input and per-operation `defaults`.
+   */
+  getPermissionsPosture() {
+    return {
+      stripPermissionsField: this.options.stripPermissionsField ?? false,
+      disableFieldPermissions: this.options.disableFieldPermissions ?? false
+    };
+  }
+  /**
+   * Router posture `stripPermissionsField`: drop the whole document
+   * permissions field (including the empty placeholder) from output instead
+   * of emitting permission metadata. Returns true when applied.
+   */
+  stripPermissionsOutput(doc) {
+    if (!this.options.stripPermissionsField) return false;
+    const field = this.options.documentPermissionField;
+    if (field) unsetDocPath(doc, field);
+    return true;
+  }
   asServiceHookContext(context) {
     return context;
   }
@@ -3554,6 +3616,14 @@ var Service = class extends Base {
     const extra = this.options?.sortableFields ?? [];
     return extra.length > 0 ? [...allowedSortFields, ...extra] : allowedSortFields;
   }
+  /**
+   * With `requireExplicitSelect`, an omitted client select behaves as an
+   * `_id`-only projection, yielding field-less rows. Explicit selects pass
+   * through untouched.
+   */
+  resolveEffectiveSelect(select) {
+    return this.options?.requireExplicitSelect && select === void 0 ? ["_id"] : select;
+  }
   beginOp(op, filter2, extra) {
     const startedAt = Date.now();
     debug({
@@ -3578,8 +3648,9 @@ var Service = class extends Base {
   async findOne(filter2, args, options) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
-    const { select, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
-    const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
+    const { select: requestedSelect, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
     let processedInclude;
@@ -3660,11 +3731,11 @@ var Service = class extends Base {
       throw error2;
     }
     let includeDocPermissions = includePermissions;
-    if (!includeDocPermissions && !skim) {
+    if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
       includeDocPermissions = this.checkIfModelPermissionExists([access, "read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, access, context);
-    if (includePermissions) doc = await this.addFieldPermissions(doc, access, context);
+    if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, access, context);
     doc = await this.trimOutputFields(
       doc,
       access,
@@ -3682,13 +3753,16 @@ var Service = class extends Base {
         if (!shouldKeepCorrelatedRef(ref, keep)) unsetDocPath(doc, ref);
       }
     }
-    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    if (!this.stripPermissionsOutput(doc)) {
+      if (!includePermissions && !includeFieldPermissions) doc = this.addEmptyPermissions(doc);
+      stripUnexposedDocPermissions(this.modelName, doc);
+    }
     this.completeOp("findOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query, context };
   }
   async findById(id, args, options) {
     const { select, populate, include, overrides } = this.resolveFindByIdArgs(args);
-    const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
     const { select: overrideSelect, populate: overridePopulate, idFilter: overrideIdFilter } = overrides ?? {};
     const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
@@ -3703,14 +3777,25 @@ var Service = class extends Base {
           populate: overridePopulate
         }
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
   }
   async find(filter2, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
-    const { select, populate, include, sort, skip, limit, page, pageSize, overrides } = this.resolveFindArgs(args);
-    const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
+    const {
+      select: requestedSelect,
+      populate,
+      include,
+      sort,
+      skip,
+      limit,
+      page,
+      pageSize,
+      overrides
+    } = this.resolveFindArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
     let processedInclude;
@@ -3794,16 +3879,16 @@ var Service = class extends Base {
       }
       throw error2;
     }
-    const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
+    const fieldPermissionAccess = includeFieldPermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
       docs.map(async (doc, i) => {
         this.asServiceHookContext(contexts[i]).fieldPermissionAccess = fieldPermissionAccess;
         let includeDocPermissions = includePermissions;
-        if (!includeDocPermissions && !skim) {
+        if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
           includeDocPermissions = this.checkIfModelPermissionExists(["list", "read", "update"]);
         }
         if (includeDocPermissions) doc = await this.addDocPermissions(doc, "list", contexts[i]);
-        if (includePermissions) doc = await this.addFieldPermissions(doc, "list", contexts[i]);
+        if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "list", contexts[i]);
         doc = await this.trimOutputFields(
           doc,
           "list",
@@ -3822,7 +3907,10 @@ var Service = class extends Base {
           }
         }
         doc = await _decorate(doc, contexts[i]);
-        if (!includePermissions) doc = this.addEmptyPermissions(doc);
+        if (!this.stripPermissionsOutput(doc)) {
+          if (!includePermissions && !includeFieldPermissions) doc = this.addEmptyPermissions(doc);
+          stripUnexposedDocPermissions(this.modelName, doc);
+        }
         return doc;
       })
     );
@@ -3840,7 +3928,7 @@ var Service = class extends Base {
   }
   async create(data, args, options, decorate) {
     const { populate } = this.resolveCreateArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveCreateOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveCreateOptions(options);
     const isArr = Array.isArray(data);
     let dataArr = isArr ? data : [data];
     const { maxBulkItems, maxBulkConcurrency } = this.getRequestComplexity();
@@ -3947,15 +4035,18 @@ var Service = class extends Base {
       contexts[index].currentDocument = doc;
       contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
       let includeDocPermissions = includePermissions;
-      if (!includeDocPermissions && !skim) {
+      if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
         includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
       }
       if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
-      if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
+      if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
       if (resolvedPopulate.length > 0) await this.persist(() => populateDoc(doc, resolvedPopulate));
       doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
       let outputDoc = await _decorate(doc, contexts[index]);
-      if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      if (!this.stripPermissionsOutput(outputDoc)) {
+        if (!includePermissions && !includeFieldPermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+        stripUnexposedDocPermissions(this.modelName, outputDoc);
+      }
       return outputDoc;
     });
     return {
@@ -3991,7 +4082,8 @@ var Service = class extends Base {
     return { ...typedIssue, detail, pointer: `#/${index}` };
   }
   async new(args, options) {
-    const { skim, includePermissions } = options ?? {};
+    const { skim, includePermissions: requestedPermissions } = options ?? {};
+    const includePermissions = this.options.stripPermissionsField ? false : requestedPermissions;
     const data = await this.model.new();
     let doc = data;
     doc = await this.trimOutputFields(doc, "create", this.baseFieldsExt);
@@ -4000,7 +4092,10 @@ var Service = class extends Base {
       includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", {});
-    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    if (!this.stripPermissionsOutput(doc)) {
+      if (!includePermissions) doc = this.addEmptyPermissions(doc);
+      stripUnexposedDocPermissions(this.modelName, doc);
+    }
     return {
       success: true,
       kind: "single",
@@ -4019,7 +4114,7 @@ var Service = class extends Base {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpdateOneArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpdateOneOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpdateOneOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const [_filter, _populate] = await Promise.all([
       overrideFilter ?? this.genFilter("update", filter2),
@@ -4096,22 +4191,25 @@ var Service = class extends Base {
     this.asServiceHookContext(context).diff(doc);
     await this.changes(doc.toObject({ virtuals: false }), context);
     let includeDocPermissions = includePermissions;
-    if (!includeDocPermissions && !skim) {
+    if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
       includeDocPermissions = this.checkIfModelPermissionExists(["read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, "update", context);
-    if (includePermissions) doc = await this.addFieldPermissions(doc, "update", context);
+    if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "update", context);
     if (_populate) await this.persist(() => populateDoc(doc, _populate));
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
     if ((0, import_utils17.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
-    if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+    if (!this.stripPermissionsOutput(outputDoc)) {
+      if (!includePermissions && !includeFieldPermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      stripUnexposedDocPermissions(this.modelName, outputDoc);
+    }
     this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
   async updateById(id, data, args = {}, options = {}, decorate) {
     const { populate, overrides } = this.resolveUpdateByIdArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpdateByIdOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpdateByIdOptions(options);
     const { populate: overridePopulate, idFilter: overrideIdFilter } = overrides;
     const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
@@ -4124,7 +4222,7 @@ var Service = class extends Base {
           populate: overridePopulate
         }
       },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       decorate
     );
   }
@@ -4132,7 +4230,7 @@ var Service = class extends Base {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpsertArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpsertOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpsertOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const _filter = await (overrideFilter ?? this.genFilter("update", filter2));
     const query = { filter: _filter };
@@ -4154,7 +4252,7 @@ var Service = class extends Base {
             populate: overridePopulate
           }
         },
-        { skim, includePermissions, populateAccess },
+        { skim, includePermissions, includeFieldPermissions, populateAccess },
         decorate
       );
     } else {
@@ -4164,6 +4262,7 @@ var Service = class extends Base {
         {
           skim,
           includePermissions,
+          includeFieldPermissions,
           populateAccess
         },
         decorate
@@ -4488,11 +4587,11 @@ var import_utils18 = require("@web-ts-toolkit/utils");
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
-    const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
     const result = await this.find(
       filter2,
       { select, populate, include, sort, skip, limit, page, pageSize },
-      { skim, includePermissions, includeCount, populateAccess, lean },
+      { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean },
       async (doc, context) => {
         doc = toObject(doc);
         return this.decorate(doc, "list", context);
@@ -4514,11 +4613,11 @@ var PublicService = class extends Service {
   }
   async _create(data, args, options) {
     const { select, populate, tasks } = this.resolvePublicCreateArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolvePublicCreateOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolvePublicCreateOptions(options);
     const result = await this.create(
       data,
       { populate },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       async (doc, context) => {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
@@ -4537,7 +4636,7 @@ var PublicService = class extends Service {
   }
   async _read(id, args, options) {
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
-    const { skim, includePermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
     let access = "read";
     const idFilter = await this.genIDFilter(id);
     let result = await this.findById(
@@ -4548,7 +4647,7 @@ var PublicService = class extends Service {
         include,
         overrides: { idFilter }
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
     if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
@@ -4565,7 +4664,7 @@ var PublicService = class extends Service {
           include,
           overrides: { idFilter }
         },
-        { skim, includePermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
       );
     }
     if (!result.success) {
@@ -4578,7 +4677,7 @@ var PublicService = class extends Service {
   }
   async _readFilter(filter2, args, options) {
     const { select, sort, populate, include, tasks } = this.resolvePublicReadFilterArgs(args);
-    const { skim, includePermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
     let access = "read";
     let result = await this.findOne(
       filter2,
@@ -4589,7 +4688,7 @@ var PublicService = class extends Service {
         include,
         overrides: {}
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
     if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
@@ -4607,7 +4706,7 @@ var PublicService = class extends Service {
           include,
           overrides: {}
         },
-        { skim, includePermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
       );
     }
     if (!result.success) {
@@ -4619,13 +4718,14 @@ var PublicService = class extends Service {
     return { ...result, data: doc };
   }
   async _update(id, data, args, options) {
-    const { select, populate, tasks } = this.resolvePublicUpdateArgs(args);
-    const { skim, returningAll, includePermissions, populateAccess } = this.resolvePublicUpdateOptions(options);
+    const { select: requestedSelect, populate, tasks } = this.resolvePublicUpdateArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, returningAll, includePermissions, includeFieldPermissions, populateAccess } = this.resolvePublicUpdateOptions(options);
     const result = await this.updateById(
       id,
       data,
       { populate },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       async (doc, context) => {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
@@ -4665,6 +4765,7 @@ var PublicService = class extends Service {
     return this._create(otherData, args, {
       skim: options?.skim,
       includePermissions: options?.includePermissions,
+      includeFieldPermissions: options?.includeFieldPermissions,
       populateAccess: options?.populateAccess
     });
   }
@@ -4694,9 +4795,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicListOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicListOptions?.includePermissions ?? false;
     return {
       skim: options.skim ?? this.defaults.publicListOptions?.skim ?? true,
-      includePermissions: options.includePermissions ?? this.defaults.publicListOptions?.includePermissions ?? false,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicListOptions?.includeFieldPermissions ?? includePermissions,
       includeCount: options.includeCount ?? this.defaults.publicListOptions?.includeCount ?? false,
       populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read",
       lean: options.lean ?? this.defaults.publicListOptions?.lean ?? true
@@ -4710,9 +4813,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicCreateOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicCreateOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicCreateOptions?.skim ?? false,
-      includePermissions: options.includePermissions ?? this.defaults.publicCreateOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicCreateOptions?.includeFieldPermissions ?? includePermissions,
       populateAccess: options.populateAccess ?? this.defaults.publicCreateOptions?.populateAccess ?? "read"
     };
   }
@@ -4732,9 +4837,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicReadOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicReadOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicReadOptions?.skim ?? false,
-      includePermissions: options.includePermissions ?? this.defaults.publicReadOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicReadOptions?.includeFieldPermissions ?? includePermissions,
       tryList: options.tryList ?? this.defaults.publicReadOptions?.tryList ?? true,
       populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess,
       lean: options.lean ?? this.defaults.publicReadOptions?.lean ?? false
@@ -4748,10 +4855,12 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicUpdateOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicUpdateOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicUpdateOptions?.skim ?? false,
       returningAll: options.returningAll ?? this.defaults.publicUpdateOptions?.returningAll ?? true,
-      includePermissions: options.includePermissions ?? this.defaults.publicUpdateOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicUpdateOptions?.includeFieldPermissions ?? includePermissions,
       populateAccess: options.populateAccess ?? this.defaults.publicUpdateOptions?.populateAccess ?? "read"
     };
   }
@@ -6815,23 +6924,32 @@ var listQuerySchema = import_zod3.z.object({
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
   include_count: queryBooleanString.optional(),
-  include_extra_headers: queryBooleanString.optional()
+  include_extra_headers: queryBooleanString.optional(),
+  select: stringOrStringArray.optional(),
+  sort: import_zod3.z.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
 }).passthrough();
 var createQuerySchema = import_zod3.z.object({
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var readQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional(),
-  try_list: queryBooleanString.optional()
+  include_field_permissions: queryBooleanString.optional(),
+  try_list: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var updateQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var upsertQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var listBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
@@ -6847,6 +6965,7 @@ var listBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     skim: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     includeCount: import_zod3.z.boolean().optional(),
     includeExtraHeaders: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
@@ -6865,6 +6984,7 @@ var readFilterBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     skim: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     tryList: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
@@ -6877,6 +6997,7 @@ var readByIdBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     skim: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     tryList: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
@@ -6888,6 +7009,7 @@ var advancedCreateBodySchema = import_zod3.z.object({
   tasks: tasksSchema.optional(),
   options: import_zod3.z.object({
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6904,6 +7026,7 @@ var advancedUpdateBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     returningAll: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6916,6 +7039,7 @@ var advancedUpsertBodySchema = import_zod3.z.object({
   options: import_zod3.z.object({
     returningAll: import_zod3.z.boolean().optional(),
     includePermissions: import_zod3.z.boolean().optional(),
+    includeFieldPermissions: import_zod3.z.boolean().optional(),
     populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6986,6 +7110,7 @@ var rootModelListArgsSchema = import_zod5.z.object({
 var rootModelListOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
+  includeFieldPermissions: import_zod5.z.boolean().optional(),
   includeCount: import_zod5.z.boolean().optional(),
   populateAccess: import_zod5.z.unknown().optional(),
   lean: import_zod5.z.boolean().optional()
@@ -7002,6 +7127,7 @@ var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
 var rootModelReadOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
+  includeFieldPermissions: import_zod5.z.boolean().optional(),
   tryList: import_zod5.z.boolean().optional(),
   populateAccess: import_zod5.z.unknown().optional(),
   lean: import_zod5.z.boolean().optional()
@@ -7014,6 +7140,7 @@ var rootModelCreateArgsSchema = import_zod5.z.object({
 var rootModelCreateOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
+  includeFieldPermissions: import_zod5.z.boolean().optional(),
   populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
 var rootModelUpdateArgsSchema = import_zod5.z.object({
@@ -7025,6 +7152,7 @@ var rootModelUpdateOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
   returningAll: import_zod5.z.boolean().optional(),
   includePermissions: import_zod5.z.boolean().optional(),
+  includeFieldPermissions: import_zod5.z.boolean().optional(),
   populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
@@ -7056,7 +7184,8 @@ var rootModelNewArgsSchema = import_zod5.z.object({
 }).passthrough();
 var rootModelNewOptionsSchema = import_zod5.z.object({
   skim: import_zod5.z.boolean().optional(),
-  includePermissions: import_zod5.z.boolean().optional()
+  includePermissions: import_zod5.z.boolean().optional(),
+  includeFieldPermissions: import_zod5.z.boolean().optional()
 }).passthrough();
 var rootModelQueryEntrySchema = import_zod5.z.union([
   import_zod5.z.object({
@@ -7225,16 +7354,29 @@ function setModelCollectionRoutes(context) {
   };
   router.get("", async (req) => {
     await context.assertAllowed(req, "list");
-    const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
+    const {
+      skip,
+      limit,
+      page,
+      page_size,
+      skim,
+      include_permissions,
+      include_field_permissions,
+      include_count,
+      include_extra_headers,
+      select,
+      sort
+    } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
     const includeCount = (0, import_utils27.parseBooleanString)(include_count);
     const includeExtraHeaders = (0, import_utils27.parseBooleanString)(include_extra_headers);
     const result = await svc._list(
       {},
-      { skip, limit, page, pageSize: page_size },
+      { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
         skim: (0, import_utils27.parseBooleanString)(skim),
         includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils27.parseBooleanString)(include_field_permissions),
         includeCount
       }
     );
@@ -7257,7 +7399,7 @@ function setModelCollectionRoutes(context) {
     );
     const { filter: filter2, select, sort, populate, include, tasks, skip, limit, page, pageSize } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, includeCount, includeExtraHeaders, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, includeCount, includeExtraHeaders, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const listFilter = filter2 ?? {};
     const result = await svc._list(
@@ -7266,6 +7408,7 @@ function setModelCollectionRoutes(context) {
       {
         skim,
         includePermissions,
+        includeFieldPermissions,
         includeCount,
         populateAccess
       }
@@ -7282,14 +7425,21 @@ function setModelCollectionRoutes(context) {
   });
   router.post("", async (req) => {
     await context.assertAllowed(req, "create");
-    const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+    const { include_permissions, include_field_permissions } = parseQuery(requestSchemas.createQuery, req.query);
     const data = await parseBodyWithSchema(
       createBodySchema,
       req.body,
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: (0, import_utils27.parseBooleanString)(include_permissions) });
+    const result = await svc._create(
+      data,
+      {},
+      {
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils27.parseBooleanString)(include_field_permissions)
+      }
+    );
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
@@ -7303,7 +7453,7 @@ function setModelCollectionRoutes(context) {
   });
   router.post(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "create");
-    const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+    const { include_permissions, include_field_permissions } = parseQuery(requestSchemas.createQuery, req.query);
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedCreateBodySchema,
       req.body,
@@ -7319,13 +7469,14 @@ function setModelCollectionRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { includePermissions, populateAccess } = finalOptions;
+    const { includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._create(
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils27.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -7343,7 +7494,7 @@ function setModelCollectionRoutes(context) {
   router.get("/new", async (req) => {
     await context.assertAllowed(req, "new");
     const svc = context.getPublicService(req);
-    const result = await svc._new({}, { includePermissions: false });
+    const result = await svc._new({}, { includePermissions: false, includeFieldPermissions: false });
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -7411,13 +7562,17 @@ function setModelDocumentRoutes(context) {
   router.get(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { include_permissions, try_list } = parseQuery(requestSchemas.readQuery, req.query);
+    const { include_permissions, include_field_permissions, try_list, select } = parseQuery(
+      requestSchemas.readQuery,
+      req.query
+    );
     const svc = context.getPublicService(req);
     const result = await svc._read(
       id,
-      {},
+      { select: parseSelectParam(select) },
       {
         includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils27.parseBooleanString)(include_field_permissions),
         tryList: (0, import_utils27.parseBooleanString)(try_list)
       }
     );
@@ -7440,12 +7595,18 @@ function setModelDocumentRoutes(context) {
     );
     const { filter: filter2, select, sort, populate, include, tasks } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, tryList, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const result = await svc._readFilter(
       filter2 ?? {},
       { select, sort, populate, include, tasks },
-      { skim, includePermissions, tryList, populateAccess }
+      {
+        skim,
+        includePermissions,
+        includeFieldPermissions,
+        tryList,
+        populateAccess
+      }
     );
     handleResultError(result);
     return unwrapServiceData(result);
@@ -7469,12 +7630,18 @@ function setModelDocumentRoutes(context) {
     );
     const { select, populate, include, tasks } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, tryList, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const result = await svc._read(
       id,
       { select, populate, include, tasks },
-      { skim, includePermissions, tryList, populateAccess }
+      {
+        skim,
+        includePermissions,
+        includeFieldPermissions,
+        tryList,
+        populateAccess
+      }
     );
     handleResultError(result);
     return unwrapServiceData(result);
@@ -7491,7 +7658,10 @@ function setModelDocumentRoutes(context) {
   router.patch(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.updateQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions, select } = parseQuery(
+      requestSchemas.updateQuery,
+      req.query
+    );
     const data = await parseBodyWithSchema(
       updateBodySchema,
       req.body,
@@ -7501,10 +7671,11 @@ function setModelDocumentRoutes(context) {
     const result = await svc._update(
       id,
       data,
-      {},
+      { select: parseSelectParam(select) },
       {
         returningAll: (0, import_utils27.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions)
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils27.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result);
@@ -7521,7 +7692,10 @@ function setModelDocumentRoutes(context) {
   router.patch(`/${options.mutationRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.updateQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.updateQuery,
+      req.query
+    );
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpdateBodySchema,
       req.body,
@@ -7543,7 +7717,7 @@ function setModelDocumentRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { returningAll, includePermissions, populateAccess } = finalOptions;
+    const { returningAll, includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._update(
       id,
@@ -7552,6 +7726,7 @@ function setModelDocumentRoutes(context) {
       {
         returningAll: returningAll ?? (0, import_utils27.parseBooleanString)(returning_all),
         includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils27.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -7569,7 +7744,10 @@ function setModelDocumentRoutes(context) {
   router.put(`/`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.upsertQuery,
+      req.query
+    );
     const body = await parseBodyWithSchema(
       upsertBodySchema,
       req.body,
@@ -7580,7 +7758,8 @@ function setModelDocumentRoutes(context) {
       {},
       {
         returningAll: (0, import_utils27.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions)
+        includePermissions: (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils27.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result);
@@ -7597,7 +7776,10 @@ function setModelDocumentRoutes(context) {
   router.put(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.upsertQuery,
+      req.query
+    );
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpsertBodySchema,
       req.body,
@@ -7619,13 +7801,14 @@ function setModelDocumentRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { returningAll, includePermissions, populateAccess } = finalOptions;
+    const { returningAll, includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const result = await svc._upsert(
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         returningAll: returningAll ?? (0, import_utils27.parseBooleanString)(returning_all),
         includePermissions: includePermissions ?? (0, import_utils27.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils27.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );