@web-ts-toolkit/access-router 0.51.0 → 0.52.0

package/advanced.js

@@ -123,15 +123,91 @@ var FilterOperator = /* @__PURE__ */ ((FilterOperator2) => {
 })(FilterOperator || {});
 
 // src/validation/parsers.ts
-var import_express_json_router = __toESM(require("@web-ts-toolkit/express-json-router"));
+var import_express_json_router2 = __toESM(require("@web-ts-toolkit/express-json-router"));
 
 // src/runtime.ts
 var import_mongoose2 = __toESM(require("mongoose"));
+
+// src/validation/public-admission.ts
+var import_express_json_router = __toESM(require("@web-ts-toolkit/express-json-router"));
+var import_utils = require("@web-ts-toolkit/utils");
+var privateControls = [
+  "authorization",
+  "overrides",
+  "documentAuthorization",
+  "documentAuthorizationStage",
+  "execution",
+  "executionContext",
+  "serviceExecutionContext",
+  "resolvedAuthorization",
+  "preparedQuery",
+  "preparedFilter",
+  "preparedModelQuery",
+  "resolvedIdentifier",
+  "skipParsing",
+  "skipAuthorization",
+  "alreadyAuthorized",
+  "operation"
+];
+var PublicAdmissionError = class extends import_express_json_router.default.clientErrors.BadRequestError {
+  constructor(detail) {
+    const errors = [{ detail }];
+    super("Bad Request", { errors });
+    this.result = { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors };
+  }
+};
+function assertPublicAdmission(input, kind = "envelope") {
+  const pending = [{ value: input, kind, path: "request" }];
+  const seen = /* @__PURE__ */ new WeakMap();
+  while (pending.length) {
+    const { value, kind: slot, path } = pending.pop();
+    if (!value || typeof value !== "object" && typeof value !== "function") continue;
+    const kinds = seen.get(value) ?? /* @__PURE__ */ new Set();
+    if (kinds.has(slot)) continue;
+    kinds.add(slot);
+    seen.set(value, kinds);
+    const add = (child, childKind, key) => {
+      pending.push({ value: child, kind: childKind, path: `${path}.${key}` });
+    };
+    const record = value;
+    if (slot !== "data") {
+      for (const key of privateControls) {
+        if (key in record) {
+          throw new PublicAdmissionError(
+            `Unsupported public control ${path}.${key}; use explicit per-call internal service options for backend authorization`
+          );
+        }
+      }
+    }
+    if (Array.isArray(value)) {
+      value.forEach((child, index) => add(child, slot, String(index)));
+      continue;
+    }
+    if (slot === "data") {
+      if (!(0, import_utils.isPlainObject)(value)) continue;
+      for (const [key, child] of Object.entries(value)) add(child, key === "$$sq" ? "envelope" : "data", key);
+      continue;
+    }
+    for (const key of ["args", "options", "sqOptions"]) add(record[key], "envelope", key);
+    add(record.include, "include", "include");
+    add(record.populate, "populate", "populate");
+    for (const key of ["filter", "match", "data"]) add(record[key], "data", key);
+  }
+}
+function assertPublicDefaults(defaults) {
+  assertPublicAdmission(defaults);
+  if (defaults && typeof defaults === "object") {
+    for (const value of Object.values(defaults)) assertPublicAdmission(value);
+  }
+}
+var requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
+
+// src/runtime.ts
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-var import_utils8 = require("@web-ts-toolkit/utils");
+var import_utils10 = require("@web-ts-toolkit/utils");
 
 // src/helpers/query.ts
-var import_utils = require("@web-ts-toolkit/utils");
+var import_utils2 = require("@web-ts-toolkit/utils");
 var DEFAULT_LIST_HARD_LIMIT = 1e3;
 
 // src/helpers/sort-policy.ts
@@ -141,44 +217,44 @@ function isValidFieldPath(field) {
 }
 
 // src/helpers/index.ts
-var import_utils3 = require("@web-ts-toolkit/utils");
+var import_utils4 = require("@web-ts-toolkit/utils");
 
 // src/lib.ts
 var import_mongoose = require("mongoose");
-var import_utils2 = require("@web-ts-toolkit/utils");
+var import_utils3 = require("@web-ts-toolkit/utils");
 var isSchema = (val) => val instanceof import_mongoose.Schema;
 var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose.Schema.Types.ObjectId;
-var isReference = (val) => (0, import_utils2.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
+var isReference = (val) => (0, import_utils3.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
 
 // src/helpers/index.ts
 function recurseObject(obj) {
   if (isSchema(obj)) {
     return buildRefs(obj.tree);
   }
-  if (!(0, import_utils3.isObject)(obj)) return null;
+  if (!(0, import_utils4.isObject)(obj)) return null;
   if (isReference(obj)) {
     return obj.ref;
   }
   let ret = null;
-  (0, import_utils3.forEach)(obj, (val) => {
+  (0, import_utils4.forEach)(obj, (val) => {
     ret = recurseObject(val);
-    if (!(0, import_utils3.isEmpty)(ret)) {
+    if (!(0, import_utils4.isEmpty)(ret)) {
       return false;
     }
   });
   return ret;
 }
 function buildRefs(schema) {
-  if (!(0, import_utils3.isObject)(schema)) return {};
+  if (!(0, import_utils4.isObject)(schema)) return {};
   const references = {};
-  (0, import_utils3.forEach)(schema, (val, key) => {
+  (0, import_utils4.forEach)(schema, (val, key) => {
     const paths = recurseObject(val);
-    if (!(0, import_utils3.isEmpty)(paths)) {
+    if (!(0, import_utils4.isEmpty)(paths)) {
       references[key] = paths;
     }
-    const target = (0, import_utils3.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils3.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils3.isPlainObject)(target[0])) {
+    const target = (0, import_utils4.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils4.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils4.isPlainObject)(target[0])) {
         return;
       }
     }
@@ -186,12 +262,12 @@ function buildRefs(schema) {
   return references;
 }
 function buildSubPaths(schema) {
-  if (!(0, import_utils3.isObject)(schema)) return [];
+  if (!(0, import_utils4.isObject)(schema)) return [];
   const subPaths = [];
-  (0, import_utils3.forEach)(schema, (val, key) => {
-    const target = (0, import_utils3.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils3.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils3.isPlainObject)(target[0]) && !isReference(target[0])) {
+  (0, import_utils4.forEach)(schema, (val, key) => {
+    const target = (0, import_utils4.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils4.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils4.isPlainObject)(target[0]) && !isReference(target[0])) {
         subPaths.push(key);
       }
     }
@@ -200,7 +276,7 @@ function buildSubPaths(schema) {
 }
 
 // src/openapi/build-spec.ts
-var import_utils5 = require("@web-ts-toolkit/utils");
+var import_utils6 = require("@web-ts-toolkit/utils");
 
 // src/openapi/responses.ts
 var json = (schema) => ({
@@ -271,19 +347,19 @@ var openApiResponses = {
 
 // src/openapi/schemas.ts
 var import_zod = require("zod");
-var import_utils4 = require("@web-ts-toolkit/utils");
+var import_utils5 = require("@web-ts-toolkit/utils");
 var fallbackObjectSchema = { type: "object", additionalProperties: true };
 function isOpenApiSchemaPatch(source) {
-  return (0, import_utils4.isPlainObject)(source) && source.kind === "objectProperties";
+  return (0, import_utils5.isPlainObject)(source) && source.kind === "objectProperties";
 }
 function isOpenApiSchemaResolver(source) {
-  return (0, import_utils4.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+  return (0, import_utils5.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
 }
 function isJsonSchemaLike(source) {
-  return (0, import_utils4.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+  return (0, import_utils5.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
 }
 function hasOpenApiSchema(source) {
-  return (0, import_utils4.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
+  return (0, import_utils5.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
 }
 function toOpenApiSchema(source) {
   if (!source) return void 0;
@@ -291,7 +367,7 @@ function toOpenApiSchema(source) {
   if (!resolvedSource) return void 0;
   if (isOpenApiSchemaPatch(resolvedSource)) {
     const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
-    const properties = (0, import_utils4.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
+    const properties = (0, import_utils5.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
     for (const [key, value] of Object.entries(resolvedSource.properties)) {
       properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
     }
@@ -324,9 +400,9 @@ var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "
 var schemaToQueryParameters = (schema) => {
   const jsonSchema = toOpenApiSchema(schema);
   if (!jsonSchema || jsonSchema.type !== "object") return [];
-  const properties = (0, import_utils5.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
+  const properties = (0, import_utils6.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
   const required = new Set(
-    (0, import_utils5.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+    (0, import_utils6.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
   );
   return Object.entries(properties).map(([name, value]) => ({
     name,
@@ -417,7 +493,7 @@ var OpenApiCollisionError = class extends Error {
 };
 
 // src/openapi/registry.ts
-var isPlainObject6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var isPlainObject7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var stableKey = (value) => {
   if (value === null || typeof value === "undefined") return "null";
   if (typeof value === "function") return "[Function]";
@@ -452,7 +528,7 @@ var OpenApiRegistry = class {
       this.routes[existingIndex] = route;
       return;
     }
-    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject6(existing) && existing.idempotent)) {
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject7(existing) && existing.idempotent)) {
       return;
     }
     if (this.options.rejectConflicts) {
@@ -541,7 +617,7 @@ var defaultLogger = (0, import_winston.createLogger)({
 });
 
 // src/options/manager.ts
-var import_utils6 = require("@web-ts-toolkit/utils");
+var import_utils7 = require("@web-ts-toolkit/utils");
 var toPath = (key) => {
   if (Array.isArray(key)) return key;
   return typeof key === "string" ? key.split(".") : [key];
@@ -602,19 +678,20 @@ var freezeConfigValue = (value) => {
   return value;
 };
 var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
-var getNestedOption = (manager, key, defaultValue) => {
-  const keys2 = String(key).split(".");
+var getNestedOption = (manager, key, defaultValue) => resolveNestedOption((path, fallback) => manager.get(path, fallback), String(key), defaultValue);
+var resolveNestedOption = (read, key, defaultValue) => {
+  const keys2 = key.split(".");
   if (keys2.length === 1) {
-    return manager.get(key, defaultValue);
+    return read(key, defaultValue);
   }
-  let option = manager.get(key, void 0);
+  let option = read(key);
   if (option !== void 0) {
     return option;
   }
   const parentKey = keys2.slice(0, -1).join(".");
-  option = manager.get(`${parentKey}.default`, void 0);
+  option = read(`${parentKey}.default`);
   if (option === void 0) {
-    option = manager.get(parentKey, defaultValue);
+    option = read(parentKey, defaultValue);
   }
   return option;
 };
@@ -647,20 +724,20 @@ var OptionsManager = class {
     return this;
   }
   get(key, defaultValue) {
-    return (0, import_utils6.get)(this.currentOptions, key, defaultValue);
+    return (0, import_utils7.get)(this.currentOptions, key, defaultValue);
   }
   set(key, value) {
     const path = toPath(key);
     if (path.length <= 1) {
-      (0, import_utils6.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
+      (0, import_utils7.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
       return;
     }
     const [rootKey, ...nestedPath] = path;
-    const currentRoot = (0, import_utils6.get)(this.currentOptions, [rootKey], void 0);
-    const baseRoot = (0, import_utils6.isPlainObject)(currentRoot) ? currentRoot : {};
+    const currentRoot = (0, import_utils7.get)(this.currentOptions, [rootKey], void 0);
+    const baseRoot = (0, import_utils7.isPlainObject)(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
-    (0, import_utils6.set)(nextRoot, nestedPath, cloneForRead(value));
-    (0, import_utils6.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
+    (0, import_utils7.set)(nextRoot, nestedPath, cloneForRead(value));
+    (0, import_utils7.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
   }
   fetch() {
     const cloned = cloneForRead(this.currentOptions);
@@ -678,10 +755,10 @@ var OptionsManager = class {
         cloned[key] = options[key];
       }
     }
-    (0, import_utils6.assign)(this.currentOptions, freezeConfigValue(cloned));
+    (0, import_utils7.assign)(this.currentOptions, freezeConfigValue(cloned));
   }
   onchange(key, func) {
-    (0, import_utils6.set)(this.listeners, key, func);
+    (0, import_utils7.set)(this.listeners, key, func);
     return this;
   }
   snapshot() {
@@ -707,12 +784,230 @@ var OptionsManager = class {
         cloned[key] = snap[key];
       }
     }
-    (0, import_utils6.assign)(current, freezeConfigValue(cloned));
+    (0, import_utils7.assign)(current, freezeConfigValue(cloned));
+  }
+};
+
+// src/options/data-manager.ts
+var import_utils8 = require("@web-ts-toolkit/utils");
+
+// src/options/data-values.ts
+var import_node_util2 = require("util");
+var typedArrays = [
+  Int8Array,
+  Uint8Array,
+  Uint8ClampedArray,
+  Int16Array,
+  Uint16Array,
+  Int32Array,
+  Uint32Array,
+  Float32Array,
+  Float64Array,
+  BigInt64Array,
+  BigUint64Array
+];
+var unsupported = (path, reason) => {
+  throw new TypeError(`Unsupported data value at ${path}: ${reason}`);
+};
+var isPlainContainer = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null || prototype === Array.prototype;
+};
+var defineValue = (target, key, value) => {
+  Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });
+};
+var assertNativeProperties = (value, path, allowed = () => false) => {
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed(key)) unsupported(path, "custom native properties are not supported");
+  }
+};
+var copyBytes = (buffer, path, start = 0, end) => {
+  if (!import_node_util2.types.isArrayBuffer(buffer) || Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype) {
+    return unsupported(path, "binary storage must be a fixed, non-shared ArrayBuffer");
+  }
+  assertNativeProperties(buffer, path);
+  if (buffer.resizable) {
+    return unsupported(path, "resizable binary storage is not supported");
+  }
+  try {
+    return ArrayBuffer.prototype.slice.call(buffer, start, end);
+  } catch {
+    return unsupported(path, "detached binary storage is not supported");
+  }
+};
+function copyValue(input, freezePlain, rootPath) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const active = /* @__PURE__ */ new WeakSet();
+  const visit = (value, path) => {
+    if (typeof value === "function" || typeof value === "symbol") {
+      return unsupported(path, `${typeof value} values are not supported`);
+    }
+    if (value === null || typeof value !== "object") return value;
+    if (import_node_util2.types.isProxy(value)) return unsupported(path, "proxies are not supported");
+    if (active.has(value)) return unsupported(path, "cycles are not supported");
+    const previous = copies.get(value);
+    if (previous) return previous;
+    active.add(value);
+    try {
+      const prototype = Object.getPrototypeOf(value);
+      if (isPlainContainer(value)) {
+        const array = Array.isArray(value);
+        if (array && prototype !== Array.prototype) return unsupported(path, "unsupported array prototype");
+        if (prototype === Array.prototype && !array) return unsupported(path, "unsupported object prototype");
+        if (Object.getOwnPropertySymbols(value).length) return unsupported(path, "symbol keys are not supported");
+        const output2 = array ? new Array(value.length) : Object.create(prototype);
+        copies.set(value, output2);
+        for (const key of Object.keys(value)) {
+          const childPath = array ? `${path}[${key}]` : `${path}.${key}`;
+          defineValue(output2, key, visit(value[key], childPath));
+        }
+        return freezePlain ? Object.freeze(output2) : output2;
+      }
+      let output;
+      if (prototype === Date.prototype && import_node_util2.types.isDate(value)) {
+        assertNativeProperties(value, path);
+        output = new Date(Date.prototype.getTime.call(value));
+      } else if (prototype === Map.prototype && import_node_util2.types.isMap(value)) {
+        assertNativeProperties(value, path);
+        const map = /* @__PURE__ */ new Map();
+        copies.set(value, map);
+        let index = 0;
+        for (const [key, entry] of Map.prototype.entries.call(value)) {
+          map.set(visit(key, `${path}.<key:${index}>`), visit(entry, `${path}.<value:${index}>`));
+          index += 1;
+        }
+        output = map;
+      } else if (prototype === Set.prototype && import_node_util2.types.isSet(value)) {
+        assertNativeProperties(value, path);
+        const set4 = /* @__PURE__ */ new Set();
+        copies.set(value, set4);
+        let index = 0;
+        for (const entry of Set.prototype.values.call(value)) {
+          set4.add(visit(entry, `${path}.<entry:${index}>`));
+          index += 1;
+        }
+        output = set4;
+      } else if (prototype === RegExp.prototype && import_node_util2.types.isRegExp(value)) {
+        assertNativeProperties(value, path, (key) => key === "lastIndex");
+        const regexp = value;
+        if (typeof regexp.lastIndex !== "number") return unsupported(path, "RegExp.lastIndex must be a number");
+        const copy = new RegExp(regexp.source, regexp.flags);
+        copy.lastIndex = regexp.lastIndex;
+        output = copy;
+      } else if (prototype === ArrayBuffer.prototype) {
+        output = copyBytes(value, path);
+      } else if (ArrayBuffer.isView(value)) {
+        const Type = typedArrays.find((candidate) => candidate.prototype === prototype);
+        const buffer = prototype === Buffer.prototype && Buffer.isBuffer(value);
+        const dataView = prototype === DataView.prototype;
+        if (!Type && !buffer && !dataView) return unsupported(path, "unsupported binary view prototype");
+        assertNativeProperties(
+          value,
+          path,
+          (key) => !dataView && /^(0|[1-9]\d*)$/.test(key) && Number(key) < value.length
+        );
+        let bytes;
+        try {
+          bytes = copyBytes(value.buffer, path, value.byteOffset, value.byteOffset + value.byteLength);
+        } catch (error) {
+          if (error instanceof TypeError && error.message.startsWith("Unsupported data value at ")) throw error;
+          return unsupported(path, "detached binary storage is not supported");
+        }
+        output = buffer ? Buffer.from(bytes) : dataView ? new DataView(bytes) : new Type(bytes);
+      } else {
+        return unsupported(path, "unsupported object prototype");
+      }
+      copies.set(value, output);
+      return output;
+    } finally {
+      active.delete(value);
+    }
+  };
+  return visit(input, rootPath);
+}
+var copyDataValue = (value) => copyValue(value, false, "data");
+function exposeSnapshot(root) {
+  const views = /* @__PURE__ */ new WeakMap();
+  const visit = (value) => {
+    const previous = views.get(value);
+    if (previous) return previous;
+    let exposed;
+    const keys2 = Object.keys(value);
+    const mutableView = () => {
+      if (!exposed) {
+        exposed = Array.isArray(value) ? new Array(value.length) : Object.create(Object.getPrototypeOf(value));
+        for (const key of keys2) defineValue(exposed, key, value[key]);
+      }
+      return exposed;
+    };
+    for (const key of keys2) {
+      const child = value[key];
+      if (child === null || typeof child !== "object") continue;
+      if (isPlainContainer(child)) {
+        const view2 = visit(child);
+        if (view2 !== child) defineValue(mutableView(), key, view2);
+      } else {
+        Object.defineProperty(mutableView(), key, {
+          enumerable: true,
+          configurable: true,
+          get: () => copyDataValue(child)
+        });
+      }
+    }
+    const view = exposed ? Object.freeze(exposed) : value;
+    views.set(value, view);
+    return view;
+  };
+  return visit(root);
+}
+var emptyDataSnapshot = Object.freeze([]);
+var ownedSnapshots = new WeakMap([[emptyDataSnapshot, emptyDataSnapshot]]);
+function createDataSnapshot(data) {
+  if (data === void 0) return void 0;
+  if (!Array.isArray(data) || import_node_util2.types.isProxy(data) || Object.getPrototypeOf(data) !== Array.prototype) {
+    return unsupported("data", "expected an ordinary array or undefined");
+  }
+  if (ownedSnapshots.has(data)) return data;
+  const owned = copyValue(data, true, "data");
+  const exposed = exposeSnapshot(owned);
+  ownedSnapshots.set(exposed, owned);
+  return exposed;
+}
+function getOwnedDataSnapshot(snapshot = emptyDataSnapshot) {
+  const owned = ownedSnapshots.get(snapshot);
+  if (!owned) throw new TypeError("DataService requires an admitted data snapshot");
+  return owned;
+}
+
+// src/options/data-manager.ts
+var admitData = (options) => {
+  if (!Object.hasOwn(options, "data")) return options;
+  const { data, ...otherOptions } = options;
+  return { ...otherOptions, data: createDataSnapshot(data) };
+};
+var DataOptionsManager = class extends OptionsManager {
+  assign(options) {
+    super.assign(admitData(options));
+  }
+  set(key, value) {
+    const path = String(key);
+    if (path === "data") {
+      super.set("data", createDataSnapshot(value));
+    } else if (path.startsWith("data.")) {
+      const next = copyDataValue(getOwnedDataSnapshot(super.get("data")));
+      (0, import_utils8.set)(next, path.slice("data.".length), value);
+      super.set("data", createDataSnapshot(next));
+    } else {
+      super.set(key, value);
+    }
+  }
+  restore(snapshot) {
+    super.restore(admitData(snapshot));
   }
 };
 
 // src/request-complexity.ts
-var import_utils7 = require("@web-ts-toolkit/utils");
+var import_utils9 = require("@web-ts-toolkit/utils");
 var defaultRequestComplexity = {
   maxDepth: 8,
   maxNodes: 500,
@@ -778,7 +1073,7 @@ function validateRequestComplexity(value, options, scope = "request") {
       pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
       return;
     }
-    if ((0, import_utils7.isArray)(current)) {
+    if ((0, import_utils9.isArray)(current)) {
       if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
         logicalClauses += current.length;
         if (logicalClauses > limits.maxLogicalClauses) {
@@ -798,14 +1093,14 @@ function validateRequestComplexity(value, options, scope = "request") {
       }
       return;
     }
-    if (!(0, import_utils7.isPlainObject)(current)) return;
+    if (!(0, import_utils9.isPlainObject)(current)) return;
     for (const [key, child] of Object.entries(current)) {
       if (key === "__proto__" || key === "prototype" || key === "constructor") {
         pushError(`Unsupported key: ${key}`, path.concat(key));
         return;
       }
       if (scope === "request" && key === "include") {
-        includeCount += (0, import_utils7.isArray)(child) ? child.length : 1;
+        includeCount += (0, import_utils9.isArray)(child) ? child.length : 1;
         if (includeCount > limits.maxIncludeCount) {
           pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
           return;
@@ -849,44 +1144,44 @@ var defaultDataOptions = {
   listHardLimit: DEFAULT_LIST_HARD_LIMIT
 };
 var normalizeBasePath = (name, value) => {
-  if ((0, import_utils8.isNil)(value)) {
+  if ((0, import_utils10.isNil)(value)) {
     return `/${pluralize(name)}`;
   }
-  return (0, import_utils8.isString)(value) ? (0, import_utils8.addLeadingSlash)(value) : "";
+  return (0, import_utils10.isString)(value) ? (0, import_utils10.addLeadingSlash)(value) : "";
 };
 var hasModelPermission = (value, modelPermissionPrefix) => {
   if (!modelPermissionPrefix) {
     return true;
   }
-  if ((0, import_utils8.isString)(value)) {
+  if ((0, import_utils10.isString)(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if ((0, import_utils8.isArray)(value)) {
+  if ((0, import_utils10.isArray)(value)) {
     return value.some((item) => {
-      if ((0, import_utils8.isString)(item) || (0, import_utils8.isArray)(item)) {
+      if ((0, import_utils10.isString)(item) || (0, import_utils10.isArray)(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
     });
   }
-  return (0, import_utils8.isFunction)(value);
+  return (0, import_utils10.isFunction)(value);
 };
 var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const schemaKeys = Object.keys(permissionSchema);
   const globalPermissionKeys = {};
   const modelPermissionKeys = {};
-  (0, import_utils8.forEach)(schemaKeys, (schemaKey) => {
+  (0, import_utils10.forEach)(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = (0, import_utils8.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = (0, import_utils10.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!(0, import_utils8.isArray)(globalPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!(0, import_utils8.isArray)(modelPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
-      if ((0, import_utils8.isBoolean)(value)) {
+      if ((0, import_utils10.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
         continue;
       }
@@ -918,13 +1213,13 @@ var VIRTUAL_UNSUPPORTED_ACCESSES = ["delete", "distinct", "count"];
 var VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
 var VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-var isVirtualContainerValue = (value) => (0, import_utils8.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValue = (value) => (0, import_utils10.isPlainObject)(value) && "sub" in value;
 var virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
 var virtualPathsOverlap = (virtualPath, permissionField) => {
   if (!virtualPath || !permissionField) return false;
   try {
-    if ((0, import_utils8.get)((0, import_utils8.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-    if ((0, import_utils8.get)((0, import_utils8.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+    if ((0, import_utils10.get)((0, import_utils10.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+    if ((0, import_utils10.get)((0, import_utils10.set)({}, permissionField, true), virtualPath) !== void 0) return true;
   } catch {
     return false;
   }
@@ -985,12 +1280,12 @@ var cloneVirtualsForValidation = (value) => {
 };
 var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
   if (dependsOn === void 0) return [];
-  if (!(0, import_utils8.isArray)(dependsOn)) {
+  if (!(0, import_utils10.isArray)(dependsOn)) {
     throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
   }
   const list = dependsOn;
   for (const dep of list) {
-    if (!(0, import_utils8.isString)(dep) || dep.length === 0) {
+    if (!(0, import_utils10.isString)(dep) || dep.length === 0) {
       throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
     }
     if (dep.includes(".")) {
@@ -1012,12 +1307,12 @@ var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirt
   return list;
 };
 var validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-  if ((0, import_utils8.isFunction)(value)) return;
-  if (!(0, import_utils8.isPlainObject)(value)) {
+  if ((0, import_utils10.isFunction)(value)) return;
+  if (!(0, import_utils10.isPlainObject)(value)) {
     throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
   }
   const record = value;
-  if (!(0, import_utils8.isFunction)(record.get)) {
+  if (!(0, import_utils10.isFunction)(record.get)) {
     throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
   }
   validateVirtualDependsOn(record.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -1057,7 +1352,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
           `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
         );
       }
-      if (!(0, import_utils8.isPlainObject)(record2.sub)) {
+      if (!(0, import_utils10.isPlainObject)(record2.sub)) {
         throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
       }
       continue;
@@ -1067,8 +1362,8 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
         `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
       );
     }
-    if ((0, import_utils8.isFunction)(raw)) continue;
-    if (!(0, import_utils8.isPlainObject)(raw)) {
+    if ((0, import_utils10.isFunction)(raw)) continue;
+    if (!(0, import_utils10.isPlainObject)(raw)) {
       throw new Error(
         `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
       );
@@ -1076,7 +1371,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
     const record = raw;
     const hasGet = "get" in record;
     const accessKeys = Object.keys(record).filter((k) => VIRTUAL_SUPPORTED_ACCESSES.includes(k));
-    const unsupported = Object.keys(record).filter(
+    const unsupported2 = Object.keys(record).filter(
       (k) => k !== "get" && k !== "dependsOn" && k !== "sub" && !VIRTUAL_SUPPORTED_ACCESSES.includes(k)
     );
     for (const key of Object.keys(record)) {
@@ -1086,9 +1381,9 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
         );
       }
     }
-    if (unsupported.length > 0) {
+    if (unsupported2.length > 0) {
       throw new Error(
-        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported[0]}" (supported: default + list/create/read/update)`
+        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported2[0]}" (supported: default + list/create/read/update)`
       );
     }
     if (hasGet) {
@@ -1122,7 +1417,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
 };
 var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
   if (virtuals === void 0 || virtuals === null) return;
-  if (!(0, import_utils8.isPlainObject)(virtuals)) {
+  if (!(0, import_utils10.isPlainObject)(virtuals)) {
     throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
   }
   const rootSchema = model?.schema ?? null;
@@ -1169,27 +1464,27 @@ var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName)
   visitContainers(rootVirtuals, rootSchema, "");
 };
 var getScopeVirtualsObject = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !(0, import_utils8.isPlainObject)(rootVirtuals)) return null;
+  if (!rootVirtuals || !(0, import_utils10.isPlainObject)(rootVirtuals)) return null;
   if (!scopePath || scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!(0, import_utils8.isPlainObject)(current)) return null;
+    if (!(0, import_utils10.isPlainObject)(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValue(container)) return null;
     current = container.sub;
-    if (!(0, import_utils8.isPlainObject)(current)) return null;
+    if (!(0, import_utils10.isPlainObject)(current)) return null;
   }
   return current;
 };
 var toVirtualDescriptor = (leaf, sharedDependsOn) => {
-  if ((0, import_utils8.isFunction)(leaf))
+  if ((0, import_utils10.isFunction)(leaf))
     return { get: leaf, dependsOn: sharedDependsOn ?? [] };
-  if (!(0, import_utils8.isPlainObject)(leaf)) return null;
+  if (!(0, import_utils10.isPlainObject)(leaf)) return null;
   const record = leaf;
-  if (!(0, import_utils8.isFunction)(record.get)) return null;
+  if (!(0, import_utils10.isFunction)(record.get)) return null;
   const dependsOn = record.dependsOn ?? sharedDependsOn ?? [];
   return { get: record.get, dependsOn };
 };
@@ -1254,7 +1549,7 @@ var AccessRuntime = class {
   }
   registerOpenApiRoute(route) {
     this.openApiRegistry.register(
-      this.openApiPathPrefix ? { ...route, path: (0, import_utils8.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+      this.openApiPathPrefix ? { ...route, path: (0, import_utils10.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
     );
   }
   /**
@@ -1265,7 +1560,7 @@ var AccessRuntime = class {
    */
   withOpenApiPathPrefix(prefix, build) {
     const previous = this.openApiPathPrefix;
-    this.openApiPathPrefix = (0, import_utils8.normalizeUrlPath)(`${previous}/${prefix}`);
+    this.openApiPathPrefix = (0, import_utils10.normalizeUrlPath)(`${previous}/${prefix}`);
     try {
       return build();
     } finally {
@@ -1370,6 +1665,7 @@ var AccessRuntime = class {
     Object.assign(this.modelAtts, snapshot.modelAtts);
     this.openApiRegistry.restore(snapshot.openApi);
   }
+  /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
   setGlobalOptions(options) {
     this.globalOptions.assign(options);
   }
@@ -1382,6 +1678,7 @@ var AccessRuntime = class {
   getGlobalOption(key, defaultValue) {
     return this.globalOptions.get(key, defaultValue);
   }
+  /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
   setDefaultModelOptions(options) {
     this.defaultModelOptions.assign(options);
   }
@@ -1412,7 +1709,7 @@ var AccessRuntime = class {
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
-        (0, import_utils8.isString)(newval) || (0, import_utils8.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -1426,7 +1723,15 @@ var AccessRuntime = class {
     }
     return manager;
   }
+  /**
+   * Assign `{ ...modelDefaults, ...storedOptions, ...options }` shallowly. A supplied
+   * operationAccess/defaults object replaces that whole value. Defaults accept only
+   * query/presentation settings; virtual configuration is validated before assignment.
+   * Existing router.options remains its construction-time snapshot. Fresh model-service
+   * calls capture the owner's current options/defaults; in-flight calls retain their snapshot.
+   */
   setModelOptions(modelName, options) {
+    assertPublicDefaults(options.defaults);
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
@@ -1439,6 +1744,12 @@ var AccessRuntime = class {
   setModelOption(modelName, key, value) {
     const manager = this.getOrCreateModelOptions(modelName);
     const keyStr = String(key);
+    if (keyStr === "defaults") assertPublicDefaults(value);
+    else if (keyStr.startsWith("defaults.")) {
+      const proposed = {};
+      (0, import_utils10.set)(proposed, keyStr.slice("defaults.".length), value);
+      assertPublicDefaults(proposed);
+    }
     if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
       const model = this.getModelInstance(modelName);
       const currentVirtuals = manager.get("virtuals");
@@ -1456,15 +1767,15 @@ var AccessRuntime = class {
           const segments = nestedPath.split(".");
           let cursor = cloned;
           for (let i = 0; i < segments.length - 1; i++) {
-            if (!(0, import_utils8.isPlainObject)(cursor)) break;
+            if (!(0, import_utils10.isPlainObject)(cursor)) break;
             cursor = cursor[segments[i]];
           }
-          if ((0, import_utils8.isPlainObject)(cursor)) {
+          if ((0, import_utils10.isPlainObject)(cursor)) {
             delete cursor[segments[segments.length - 1]];
           }
           proposedVirtuals = cloned;
         } else {
-          (0, import_utils8.set)(cloned, nestedPath, value);
+          (0, import_utils10.set)(cloned, nestedPath, value);
           proposedVirtuals = cloned;
         }
       }
@@ -1472,10 +1783,17 @@ var AccessRuntime = class {
     }
     manager.set(key, value);
   }
+  /** Frozen stored snapshot, not fully resolved per-path defaults. Read again for current configuration. */
   getModelOptions(modelName) {
     const manager = this.getOrCreateModelOptions(modelName);
     return manager.fetch();
   }
+  /**
+   * Generic stored exact → parent.default → parent lookup; only undefined falls through.
+   * The exact runtime-model-default path is the final fallback if the stored parent is
+   * absent. This is not the route-specific variant-to-base resolver; use
+   * getExactModelOption to inspect a variant including its exact model-default fallback.
+   */
   getModelOption(modelName, key, defaultValue) {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultModelValue = this.getDefaultModelOption(
@@ -1484,6 +1802,7 @@ var AccessRuntime = class {
     );
     return getNestedOption(manager, key, defaultModelValue);
   }
+  /** Exact stored path, then the same runtime-model-default path; no parent/default or variant-to-base lookup. */
   getExactModelOption(modelName, key) {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultModelValue = this.getDefaultModelOption(key);
@@ -1534,8 +1853,8 @@ var AccessRuntime = class {
     if (!scopeVirtuals || !(virtualName in scopeVirtuals)) return void 0;
     const entry = scopeVirtuals[virtualName];
     if (entry === void 0 || isVirtualContainerValue(entry)) return void 0;
-    if ((0, import_utils8.isFunction)(entry)) return { get: entry, dependsOn: [] };
-    if (!(0, import_utils8.isPlainObject)(entry)) return void 0;
+    if ((0, import_utils10.isFunction)(entry)) return { get: entry, dependsOn: [] };
+    if (!(0, import_utils10.isPlainObject)(entry)) return void 0;
     const record = entry;
     if ("get" in record) {
       const descriptor = toVirtualDescriptor(entry, void 0);
@@ -1564,14 +1883,14 @@ var AccessRuntime = class {
     return this.modelJsonSchemas[modelName];
   }
   createDataOptions(dataName) {
-    const manager = new OptionsManager({
+    const manager = new DataOptionsManager({
       ...defaultDataOptions,
       dataName
     });
     manager.onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         dataName,
-        (0, import_utils8.isString)(newval) || (0, import_utils8.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     return manager;
@@ -1596,10 +1915,15 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  /**
+   * Reusable configured data view: plain containers are frozen; native properties
+   * return detached mutable copies on access. Native identity is not stable.
+   * Replacement leaves previously captured views on their original data version.
+   */
   getDataSnapshot(dataName) {
     const manager = this.getOrCreateDataOptions(dataName);
     const snapshot = manager.get("data");
-    return snapshot ?? [];
+    return snapshot ?? emptyDataSnapshot;
   }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1626,20 +1950,20 @@ var AccessRuntime = class {
     const schema = model.schema;
     this.modelRefs[modelName] = buildRefs(schema.tree);
     this.modelSubs[modelName] = buildSubPaths(schema.tree);
-    this.modelAtts[modelName] = (0, import_utils8.keys)(schema.obj);
+    this.modelAtts[modelName] = (0, import_utils10.keys)(schema.obj);
   }
   getModelRef(modelName, refPath) {
     this.ensureModelMeta(modelName);
-    const value = (0, import_utils8.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-    return (0, import_utils8.isString)(value) ? value : null;
+    const value = (0, import_utils10.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils10.isString)(value) ? value : null;
   }
   getModelSub(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils8.get)(this.modelSubs, modelName, []);
+    return (0, import_utils10.get)(this.modelSubs, modelName, []);
   }
   getModelAtt(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils8.get)(this.modelAtts, modelName, []);
+    return (0, import_utils10.get)(this.modelAtts, modelName, []);
   }
 };
 var defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -1659,10 +1983,29 @@ var getGlobalOption = (key, defaultValue) => {
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils10 = require("@web-ts-toolkit/utils");
+var import_utils12 = require("@web-ts-toolkit/utils");
+
+// src/validation/public-admission-schema.ts
+var admissions = /* @__PURE__ */ new WeakMap();
+function publicBoundarySchema(schema, kind = "envelope") {
+  const checked = schema.superRefine((value, ctx) => {
+    try {
+      assertPublicAdmission(value, kind);
+    } catch (error) {
+      if (!(error instanceof PublicAdmissionError)) throw error;
+      ctx.addIssue({ code: "custom", message: error.result.errors[0].detail });
+    }
+  });
+  admissions.set(checked, kind);
+  return checked;
+}
+function assertTransformedPublicAdmission(schema, value) {
+  const kind = admissions.get(schema);
+  if (kind) assertPublicAdmission(value, kind);
+}
 
 // src/correlated-includes.ts
-var import_utils9 = require("@web-ts-toolkit/utils");
+var import_utils11 = require("@web-ts-toolkit/utils");
 var PARENT_MARKER_KEY = "$parent";
 var ESCAPE_WRAPPER_KEY = "$escape";
 var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
@@ -1673,10 +2016,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils9.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils11.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils9.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils11.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -1695,12 +2038,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils9.isArray)(current)) {
+    if ((0, import_utils11.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils9.isPlainObject)(current)) {
+    if ((0, import_utils11.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -1730,7 +2073,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils9.isPlainObject)(value)) {
+  if ((0, import_utils11.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -1741,7 +2084,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils9.isArray)(value)) {
+  if ((0, import_utils11.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -1782,7 +2125,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils9.isArray)(child)) {
+      if (!(0, import_utils11.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -1795,7 +2138,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils9.isPlainObject)(clause)) {
+        if ((0, import_utils11.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -1806,7 +2149,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter) {
   const issues = [];
-  if (!(0, import_utils9.isPlainObject)(filter)) {
+  if (!(0, import_utils11.isPlainObject)(filter)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -1853,42 +2196,48 @@ var sortSchema = import_zod2.z.union([
   import_zod2.z.null()
 ]);
 var populateAccessSchema = import_zod2.z.enum(["list", "read"]);
-var populateSchema = import_zod2.z.union([
-  import_zod2.z.string(),
-  import_zod2.z.array(
-    import_zod2.z.union([
-      import_zod2.z.string(),
-      import_zod2.z.object({
-        path: import_zod2.z.string().min(1),
-        select: projectionSchema.optional(),
-        match: import_zod2.z.unknown().optional(),
-        access: populateAccessSchema.optional()
-      }).passthrough()
-    ])
-  ),
-  import_zod2.z.object({
-    path: import_zod2.z.string().min(1),
-    select: projectionSchema.optional(),
-    match: import_zod2.z.unknown().optional(),
-    access: populateAccessSchema.optional()
-  }).passthrough()
-]);
-var subPopulateSchema = import_zod2.z.union([
-  import_zod2.z.string(),
-  import_zod2.z.array(
-    import_zod2.z.union([
-      import_zod2.z.string(),
-      import_zod2.z.object({
-        path: import_zod2.z.string().min(1),
-        select: projectionSchema.optional()
-      }).passthrough()
-    ])
-  ),
-  import_zod2.z.object({
-    path: import_zod2.z.string().min(1),
-    select: projectionSchema.optional()
-  }).passthrough()
-]);
+var populateSchema = publicBoundarySchema(
+  import_zod2.z.union([
+    import_zod2.z.string(),
+    import_zod2.z.array(
+      import_zod2.z.union([
+        import_zod2.z.string(),
+        import_zod2.z.object({
+          path: import_zod2.z.string().min(1),
+          select: projectionSchema.optional(),
+          match: import_zod2.z.unknown().optional(),
+          access: populateAccessSchema.optional()
+        }).passthrough()
+      ])
+    ),
+    import_zod2.z.object({
+      path: import_zod2.z.string().min(1),
+      select: projectionSchema.optional(),
+      match: import_zod2.z.unknown().optional(),
+      access: populateAccessSchema.optional()
+    }).passthrough()
+  ]),
+  "populate"
+);
+var subPopulateSchema = publicBoundarySchema(
+  import_zod2.z.union([
+    import_zod2.z.string(),
+    import_zod2.z.array(
+      import_zod2.z.union([
+        import_zod2.z.string(),
+        import_zod2.z.object({
+          path: import_zod2.z.string().min(1),
+          select: projectionSchema.optional()
+        }).passthrough()
+      ])
+    ),
+    import_zod2.z.object({
+      path: import_zod2.z.string().min(1),
+      select: projectionSchema.optional()
+    }).passthrough()
+  ]),
+  "populate"
+);
 var legacyIncludeItemSchema = import_zod2.z.object({
   mode: import_zod2.z.enum(["legacy"]).optional(),
   model: import_zod2.z.string().min(1),
@@ -1928,7 +2277,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils10.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils12.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -1965,7 +2314,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils10.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils12.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -2004,18 +2353,21 @@ var correlatedCountSchema = import_zod2.z.object({
   args: correlatedCountArgsSchema,
   options: correlatedEmptyOptionsSchema
 }).strict();
-var includeItemSchema = import_zod2.z.union([
-  legacyIncludeItemSchema,
-  correlatedReadByIdSchema,
-  correlatedReadByFilterSchema,
-  correlatedListSchema,
-  correlatedCountSchema
-]);
+var includeItemSchema = publicBoundarySchema(
+  import_zod2.z.union([
+    legacyIncludeItemSchema,
+    correlatedReadByIdSchema,
+    correlatedReadByFilterSchema,
+    correlatedListSchema,
+    correlatedCountSchema
+  ]),
+  "include"
+);
 var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils10.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils12.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -2053,7 +2405,7 @@ function rejectKeys(body, ctx, keys2) {
 }
 
 // src/validation/parsers.ts
-var clientErrors = import_express_json_router.default.clientErrors;
+var clientErrors = import_express_json_router2.default.clientErrors;
 function parsePathParam(value, parameter) {
   const result = stringOrStringArray.safeParse(value);
   if (!result.success) {
@@ -2068,6 +2420,7 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  assertTransformedPublicAdmission(schema, value);
   const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
   if (complexityErrors.length > 0) {
     throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
@@ -2079,6 +2432,7 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  assertTransformedPublicAdmission(schema, value);
   const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
   if (complexityErrors.length > 0) {
     throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
@@ -2089,17 +2443,22 @@ function parseBody(schema, value) {
   }
   return result.data;
 }
-function parseBodyWithSchema(schema, value, userSchema) {
+async function parseBodyWithSchema(schema, value, userSchema) {
   const body = parseBody(schema, value);
-  return isRequestSchema(userSchema) ? parseUserSchema(userSchema, body) : Promise.resolve(body);
+  if (!isRequestSchema(userSchema)) return body;
+  const transformed = await parseUserSchema(userSchema, body);
+  assertTransformedPublicAdmission(schema, transformed);
+  return transformed;
 }
 async function parseNestedBodyWithSchema(schema, value, nestedKey, userSchema) {
   const body = parseBody(schema, value);
   if (!isRequestSchema(userSchema)) return body;
-  return {
+  const transformed = {
     ...body,
     [nestedKey]: await parseUserSchema(userSchema, body?.[nestedKey], [nestedKey])
   };
+  assertTransformedPublicAdmission(schema, transformed);
+  return transformed;
 }
 function throwValidationError(issues, key, location = "pointer") {
   const errors = issues.map((issue) => formatIssue(issue, key, location));
@@ -2527,147 +2886,177 @@ function buildPointer(path) {
 
 // src/validation/model-router.ts
 var import_zod3 = require("zod");
-var listQuerySchema = import_zod3.z.object({
-  skip: nonNegativeIntegerString.optional(),
-  limit: positiveIntegerString.optional(),
-  page: nonNegativeIntegerString.optional(),
-  page_size: positiveIntegerString.optional(),
-  skim: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  include_count: queryBooleanString.optional(),
-  include_extra_headers: queryBooleanString.optional(),
-  select: stringOrStringArray.optional(),
-  sort: import_zod3.z.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
-}).passthrough();
-var createQuerySchema = import_zod3.z.object({
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional()
-}).passthrough();
-var readQuerySchema = import_zod3.z.object({
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  try_list: queryBooleanString.optional(),
-  select: stringOrStringArray.optional()
-}).passthrough();
-var updateQuerySchema = import_zod3.z.object({
-  returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  select: stringOrStringArray.optional()
-}).passthrough();
-var upsertQuerySchema = import_zod3.z.object({
-  returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional()
-}).passthrough();
-var listBodySchema = import_zod3.z.object({
-  filter: objectOrArraySchema.optional(),
-  select: projectionSchema.optional(),
-  sort: sortSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  skip: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
-  limit: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
-  pageSize: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod3.z.object({
-    skim: import_zod3.z.boolean().optional(),
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    includeCount: import_zod3.z.boolean().optional(),
-    includeExtraHeaders: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = import_zod3.z.object({
-  filter: objectOrArraySchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options", "include"]));
-var readFilterBodySchema = import_zod3.z.object({
-  filter: objectOrArraySchema.optional(),
-  select: projectionSchema.optional(),
-  sort: sortSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: import_zod3.z.object({
-    skim: import_zod3.z.boolean().optional(),
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    tryList: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var readByIdBodySchema = import_zod3.z.object({
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: import_zod3.z.object({
-    skim: import_zod3.z.boolean().optional(),
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    tryList: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var advancedCreateBodySchema = import_zod3.z.object({
-  data: import_zod3.z.unknown(),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: import_zod3.z.object({
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var createBodySchema = import_zod3.z.union([
-  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
-  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
-]);
-var updateBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
-var advancedUpdateBodySchema = import_zod3.z.object({
-  data: import_zod3.z.unknown(),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: import_zod3.z.object({
-    returningAll: import_zod3.z.boolean().optional(),
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var upsertBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
-var advancedUpsertBodySchema = import_zod3.z.object({
-  data: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: import_zod3.z.object({
-    returningAll: import_zod3.z.boolean().optional(),
-    includePermissions: import_zod3.z.boolean().optional(),
-    includeFieldPermissions: import_zod3.z.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var distinctBodySchema = import_zod3.z.object({
-  filter: objectOrArraySchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = import_zod3.z.object({
-  filter: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
-  select: fieldsSchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = import_zod3.z.union([
-  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
-  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
-]);
-var subReadBodySchema = import_zod3.z.object({
-  select: fieldsSchema.optional(),
-  populate: subPopulateSchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
+var listQuerySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    skip: nonNegativeIntegerString.optional(),
+    limit: positiveIntegerString.optional(),
+    page: nonNegativeIntegerString.optional(),
+    page_size: positiveIntegerString.optional(),
+    skim: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    include_count: queryBooleanString.optional(),
+    include_extra_headers: queryBooleanString.optional(),
+    select: stringOrStringArray.optional(),
+    sort: import_zod3.z.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
+  }).passthrough()
+);
+var createQuerySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional()
+  }).passthrough()
+);
+var readQuerySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    try_list: queryBooleanString.optional(),
+    select: stringOrStringArray.optional()
+  }).passthrough()
+);
+var updateQuerySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    returning_all: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    select: stringOrStringArray.optional()
+  }).passthrough()
+);
+var upsertQuerySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    returning_all: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional()
+  }).passthrough()
+);
+var listBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    filter: objectOrArraySchema.optional(),
+    select: projectionSchema.optional(),
+    sort: sortSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    skip: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+    limit: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+    page: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+    pageSize: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+    options: import_zod3.z.object({
+      skim: import_zod3.z.boolean().optional(),
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      includeCount: import_zod3.z.boolean().optional(),
+      includeExtraHeaders: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]))
+);
+var countBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    filter: objectOrArraySchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options", "include"]))
+);
+var readFilterBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    filter: objectOrArraySchema.optional(),
+    select: projectionSchema.optional(),
+    sort: sortSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: import_zod3.z.object({
+      skim: import_zod3.z.boolean().optional(),
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      tryList: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var readByIdBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: import_zod3.z.object({
+      skim: import_zod3.z.boolean().optional(),
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      tryList: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var advancedCreateBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    data: import_zod3.z.unknown(),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: import_zod3.z.object({
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var createBodySchema = publicBoundarySchema(
+  import_zod3.z.union([import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()), import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))]),
+  "data"
+);
+var updateBodySchema = publicBoundarySchema(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()), "data");
+var advancedUpdateBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    data: import_zod3.z.unknown(),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: import_zod3.z.object({
+      returningAll: import_zod3.z.boolean().optional(),
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var upsertBodySchema = publicBoundarySchema(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()), "data");
+var advancedUpsertBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    data: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: import_zod3.z.object({
+      returningAll: import_zod3.z.boolean().optional(),
+      includePermissions: import_zod3.z.boolean().optional(),
+      includeFieldPermissions: import_zod3.z.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var distinctBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    filter: objectOrArraySchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]))
+);
+var subListBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    filter: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
+    select: fieldsSchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]))
+);
+var subMutationBodySchema = publicBoundarySchema(
+  import_zod3.z.union([import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()), import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))]),
+  "data"
+);
+var subReadBodySchema = publicBoundarySchema(
+  import_zod3.z.object({
+    select: fieldsSchema.optional(),
+    populate: subPopulateSchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]))
+);
 var requestSchemas = {
   listQuery: listQuerySchema,
   createQuery: createQuerySchema,
@@ -2945,7 +3334,9 @@ var rootDataQueryEntrySchema = import_zod5.z.union([
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = publicBoundarySchema(
+  import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]))
+);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Codes,