@web-ts-toolkit/access-router 0.51.0 → 0.52.0

package/advanced.mjs

@@ -41,10 +41,86 @@ var FilterOperator = /* @__PURE__ */ ((FilterOperator2) => {
 })(FilterOperator || {});
 
 // src/validation/parsers.ts
-import JsonRouter from "@web-ts-toolkit/express-json-router";
+import JsonRouter2 from "@web-ts-toolkit/express-json-router";
 
 // src/runtime.ts
 import mongoose from "mongoose";
+
+// src/validation/public-admission.ts
+import JsonRouter from "@web-ts-toolkit/express-json-router";
+import { isPlainObject } from "@web-ts-toolkit/utils";
+var privateControls = [
+  "authorization",
+  "overrides",
+  "documentAuthorization",
+  "documentAuthorizationStage",
+  "execution",
+  "executionContext",
+  "serviceExecutionContext",
+  "resolvedAuthorization",
+  "preparedQuery",
+  "preparedFilter",
+  "preparedModelQuery",
+  "resolvedIdentifier",
+  "skipParsing",
+  "skipAuthorization",
+  "alreadyAuthorized",
+  "operation"
+];
+var PublicAdmissionError = class extends JsonRouter.clientErrors.BadRequestError {
+  constructor(detail) {
+    const errors = [{ detail }];
+    super("Bad Request", { errors });
+    this.result = { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors };
+  }
+};
+function assertPublicAdmission(input, kind = "envelope") {
+  const pending = [{ value: input, kind, path: "request" }];
+  const seen = /* @__PURE__ */ new WeakMap();
+  while (pending.length) {
+    const { value, kind: slot, path } = pending.pop();
+    if (!value || typeof value !== "object" && typeof value !== "function") continue;
+    const kinds = seen.get(value) ?? /* @__PURE__ */ new Set();
+    if (kinds.has(slot)) continue;
+    kinds.add(slot);
+    seen.set(value, kinds);
+    const add = (child, childKind, key) => {
+      pending.push({ value: child, kind: childKind, path: `${path}.${key}` });
+    };
+    const record = value;
+    if (slot !== "data") {
+      for (const key of privateControls) {
+        if (key in record) {
+          throw new PublicAdmissionError(
+            `Unsupported public control ${path}.${key}; use explicit per-call internal service options for backend authorization`
+          );
+        }
+      }
+    }
+    if (Array.isArray(value)) {
+      value.forEach((child, index) => add(child, slot, String(index)));
+      continue;
+    }
+    if (slot === "data") {
+      if (!isPlainObject(value)) continue;
+      for (const [key, child] of Object.entries(value)) add(child, key === "$$sq" ? "envelope" : "data", key);
+      continue;
+    }
+    for (const key of ["args", "options", "sqOptions"]) add(record[key], "envelope", key);
+    add(record.include, "include", "include");
+    add(record.populate, "populate", "populate");
+    for (const key of ["filter", "match", "data"]) add(record[key], "data", key);
+  }
+}
+function assertPublicDefaults(defaults) {
+  assertPublicAdmission(defaults);
+  if (defaults && typeof defaults === "object") {
+    for (const value of Object.values(defaults)) assertPublicAdmission(value);
+  }
+}
+var requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
+
+// src/runtime.ts
 import mschema2Jsonschema from "mongoose-schema-jsonschema";
 import {
   addLeadingSlash,
@@ -54,15 +130,15 @@ import {
   isBoolean,
   isFunction,
   isNil as isNil2,
-  isPlainObject as isPlainObject9,
+  isPlainObject as isPlainObject10,
   isString as isString3,
   keys,
   normalizeUrlPath,
-  set as set2
+  set as set3
 } from "@web-ts-toolkit/utils";
 
 // src/helpers/query.ts
-import { flattenDeep, isNil, isPlainObject, isString, reduce } from "@web-ts-toolkit/utils";
+import { flattenDeep, isNil, isPlainObject as isPlainObject2, isString, reduce } from "@web-ts-toolkit/utils";
 var DEFAULT_LIST_HARD_LIMIT = 1e3;
 
 // src/helpers/sort-policy.ts
@@ -72,14 +148,14 @@ function isValidFieldPath(field) {
 }
 
 // src/helpers/index.ts
-import { forEach, isArray, isEmpty, isObject, isPlainObject as isPlainObject3, isString as isString2 } from "@web-ts-toolkit/utils";
+import { forEach, isArray, isEmpty, isObject, isPlainObject as isPlainObject4, isString as isString2 } from "@web-ts-toolkit/utils";
 
 // src/lib.ts
 import { Document, Schema } from "mongoose";
-import { isPlainObject as isPlainObject2 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject3 } from "@web-ts-toolkit/utils";
 var isSchema = (val) => val instanceof Schema;
 var isObjectIdType = (val) => val === "ObjectId" || val === Schema.Types.ObjectId;
-var isReference = (val) => isPlainObject2(val) && !!val.ref && isObjectIdType(val.type);
+var isReference = (val) => isPlainObject3(val) && !!val.ref && isObjectIdType(val.type);
 
 // src/helpers/index.ts
 function recurseObject(obj) {
@@ -109,7 +185,7 @@ function buildRefs(schema) {
     }
     const target = isObject(val) && "type" in val ? val.type ?? val : val;
     if (isArray(target) && target.length > 0) {
-      if (isSchema(target[0]) || isPlainObject3(target[0])) {
+      if (isSchema(target[0]) || isPlainObject4(target[0])) {
         return;
       }
     }
@@ -122,7 +198,7 @@ function buildSubPaths(schema) {
   forEach(schema, (val, key) => {
     const target = isObject(val) && "type" in val ? val.type ?? val : val;
     if (isArray(target) && target.length > 0) {
-      if (isSchema(target[0]) || isPlainObject3(target[0]) && !isReference(target[0])) {
+      if (isSchema(target[0]) || isPlainObject4(target[0]) && !isReference(target[0])) {
         subPaths.push(key);
       }
     }
@@ -131,7 +207,7 @@ function buildSubPaths(schema) {
 }
 
 // src/openapi/build-spec.ts
-import { isArray as isArray2, isPlainObject as isPlainObject5 } from "@web-ts-toolkit/utils";
+import { isArray as isArray2, isPlainObject as isPlainObject6 } from "@web-ts-toolkit/utils";
 
 // src/openapi/responses.ts
 var json = (schema) => ({
@@ -202,19 +278,19 @@ var openApiResponses = {
 
 // src/openapi/schemas.ts
 import { z } from "zod";
-import { isPlainObject as isPlainObject4 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject5 } from "@web-ts-toolkit/utils";
 var fallbackObjectSchema = { type: "object", additionalProperties: true };
 function isOpenApiSchemaPatch(source) {
-  return isPlainObject4(source) && source.kind === "objectProperties";
+  return isPlainObject5(source) && source.kind === "objectProperties";
 }
 function isOpenApiSchemaResolver(source) {
-  return isPlainObject4(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+  return isPlainObject5(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
 }
 function isJsonSchemaLike(source) {
-  return isPlainObject4(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+  return isPlainObject5(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
 }
 function hasOpenApiSchema(source) {
-  return isPlainObject4(source) && isJsonSchemaLike(source.openapi);
+  return isPlainObject5(source) && isJsonSchemaLike(source.openapi);
 }
 function toOpenApiSchema(source) {
   if (!source) return void 0;
@@ -222,7 +298,7 @@ function toOpenApiSchema(source) {
   if (!resolvedSource) return void 0;
   if (isOpenApiSchemaPatch(resolvedSource)) {
     const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
-    const properties = isPlainObject4(schema.properties) ? { ...schema.properties } : {};
+    const properties = isPlainObject5(schema.properties) ? { ...schema.properties } : {};
     for (const [key, value] of Object.entries(resolvedSource.properties)) {
       properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
     }
@@ -255,7 +331,7 @@ var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "
 var schemaToQueryParameters = (schema) => {
   const jsonSchema = toOpenApiSchema(schema);
   if (!jsonSchema || jsonSchema.type !== "object") return [];
-  const properties = isPlainObject5(jsonSchema.properties) ? jsonSchema.properties : {};
+  const properties = isPlainObject6(jsonSchema.properties) ? jsonSchema.properties : {};
   const required = new Set(
     isArray2(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
   );
@@ -348,7 +424,7 @@ var OpenApiCollisionError = class extends Error {
 };
 
 // src/openapi/registry.ts
-var isPlainObject6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var isPlainObject7 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var stableKey = (value) => {
   if (value === null || typeof value === "undefined") return "null";
   if (typeof value === "function") return "[Function]";
@@ -383,7 +459,7 @@ var OpenApiRegistry = class {
       this.routes[existingIndex] = route;
       return;
     }
-    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject6(existing) && existing.idempotent)) {
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject7(existing) && existing.idempotent)) {
       return;
     }
     if (this.options.rejectConflicts) {
@@ -472,7 +548,7 @@ var defaultLogger = createLogger({
 });
 
 // src/options/manager.ts
-import { assign, get, isPlainObject as isPlainObject7, set } from "@web-ts-toolkit/utils";
+import { assign, get, isPlainObject as isPlainObject8, set } from "@web-ts-toolkit/utils";
 var toPath = (key) => {
   if (Array.isArray(key)) return key;
   return typeof key === "string" ? key.split(".") : [key];
@@ -533,19 +609,20 @@ var freezeConfigValue = (value) => {
   return value;
 };
 var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
-var getNestedOption = (manager, key, defaultValue) => {
-  const keys2 = String(key).split(".");
+var getNestedOption = (manager, key, defaultValue) => resolveNestedOption((path, fallback) => manager.get(path, fallback), String(key), defaultValue);
+var resolveNestedOption = (read, key, defaultValue) => {
+  const keys2 = key.split(".");
   if (keys2.length === 1) {
-    return manager.get(key, defaultValue);
+    return read(key, defaultValue);
   }
-  let option = manager.get(key, void 0);
+  let option = read(key);
   if (option !== void 0) {
     return option;
   }
   const parentKey = keys2.slice(0, -1).join(".");
-  option = manager.get(`${parentKey}.default`, void 0);
+  option = read(`${parentKey}.default`);
   if (option === void 0) {
-    option = manager.get(parentKey, defaultValue);
+    option = read(parentKey, defaultValue);
   }
   return option;
 };
@@ -588,7 +665,7 @@ var OptionsManager = class {
     }
     const [rootKey, ...nestedPath] = path;
     const currentRoot = get(this.currentOptions, [rootKey], void 0);
-    const baseRoot = isPlainObject7(currentRoot) ? currentRoot : {};
+    const baseRoot = isPlainObject8(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
     set(nextRoot, nestedPath, cloneForRead(value));
     set(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
@@ -642,8 +719,226 @@ var OptionsManager = class {
   }
 };
 
+// src/options/data-manager.ts
+import { set as set2 } from "@web-ts-toolkit/utils";
+
+// src/options/data-values.ts
+import { types } from "util";
+var typedArrays = [
+  Int8Array,
+  Uint8Array,
+  Uint8ClampedArray,
+  Int16Array,
+  Uint16Array,
+  Int32Array,
+  Uint32Array,
+  Float32Array,
+  Float64Array,
+  BigInt64Array,
+  BigUint64Array
+];
+var unsupported = (path, reason) => {
+  throw new TypeError(`Unsupported data value at ${path}: ${reason}`);
+};
+var isPlainContainer = (value) => {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null || prototype === Array.prototype;
+};
+var defineValue = (target, key, value) => {
+  Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });
+};
+var assertNativeProperties = (value, path, allowed = () => false) => {
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !allowed(key)) unsupported(path, "custom native properties are not supported");
+  }
+};
+var copyBytes = (buffer, path, start = 0, end) => {
+  if (!types.isArrayBuffer(buffer) || Object.getPrototypeOf(buffer) !== ArrayBuffer.prototype) {
+    return unsupported(path, "binary storage must be a fixed, non-shared ArrayBuffer");
+  }
+  assertNativeProperties(buffer, path);
+  if (buffer.resizable) {
+    return unsupported(path, "resizable binary storage is not supported");
+  }
+  try {
+    return ArrayBuffer.prototype.slice.call(buffer, start, end);
+  } catch {
+    return unsupported(path, "detached binary storage is not supported");
+  }
+};
+function copyValue(input, freezePlain, rootPath) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const active = /* @__PURE__ */ new WeakSet();
+  const visit = (value, path) => {
+    if (typeof value === "function" || typeof value === "symbol") {
+      return unsupported(path, `${typeof value} values are not supported`);
+    }
+    if (value === null || typeof value !== "object") return value;
+    if (types.isProxy(value)) return unsupported(path, "proxies are not supported");
+    if (active.has(value)) return unsupported(path, "cycles are not supported");
+    const previous = copies.get(value);
+    if (previous) return previous;
+    active.add(value);
+    try {
+      const prototype = Object.getPrototypeOf(value);
+      if (isPlainContainer(value)) {
+        const array = Array.isArray(value);
+        if (array && prototype !== Array.prototype) return unsupported(path, "unsupported array prototype");
+        if (prototype === Array.prototype && !array) return unsupported(path, "unsupported object prototype");
+        if (Object.getOwnPropertySymbols(value).length) return unsupported(path, "symbol keys are not supported");
+        const output2 = array ? new Array(value.length) : Object.create(prototype);
+        copies.set(value, output2);
+        for (const key of Object.keys(value)) {
+          const childPath = array ? `${path}[${key}]` : `${path}.${key}`;
+          defineValue(output2, key, visit(value[key], childPath));
+        }
+        return freezePlain ? Object.freeze(output2) : output2;
+      }
+      let output;
+      if (prototype === Date.prototype && types.isDate(value)) {
+        assertNativeProperties(value, path);
+        output = new Date(Date.prototype.getTime.call(value));
+      } else if (prototype === Map.prototype && types.isMap(value)) {
+        assertNativeProperties(value, path);
+        const map = /* @__PURE__ */ new Map();
+        copies.set(value, map);
+        let index = 0;
+        for (const [key, entry] of Map.prototype.entries.call(value)) {
+          map.set(visit(key, `${path}.<key:${index}>`), visit(entry, `${path}.<value:${index}>`));
+          index += 1;
+        }
+        output = map;
+      } else if (prototype === Set.prototype && types.isSet(value)) {
+        assertNativeProperties(value, path);
+        const set4 = /* @__PURE__ */ new Set();
+        copies.set(value, set4);
+        let index = 0;
+        for (const entry of Set.prototype.values.call(value)) {
+          set4.add(visit(entry, `${path}.<entry:${index}>`));
+          index += 1;
+        }
+        output = set4;
+      } else if (prototype === RegExp.prototype && types.isRegExp(value)) {
+        assertNativeProperties(value, path, (key) => key === "lastIndex");
+        const regexp = value;
+        if (typeof regexp.lastIndex !== "number") return unsupported(path, "RegExp.lastIndex must be a number");
+        const copy = new RegExp(regexp.source, regexp.flags);
+        copy.lastIndex = regexp.lastIndex;
+        output = copy;
+      } else if (prototype === ArrayBuffer.prototype) {
+        output = copyBytes(value, path);
+      } else if (ArrayBuffer.isView(value)) {
+        const Type = typedArrays.find((candidate) => candidate.prototype === prototype);
+        const buffer = prototype === Buffer.prototype && Buffer.isBuffer(value);
+        const dataView = prototype === DataView.prototype;
+        if (!Type && !buffer && !dataView) return unsupported(path, "unsupported binary view prototype");
+        assertNativeProperties(
+          value,
+          path,
+          (key) => !dataView && /^(0|[1-9]\d*)$/.test(key) && Number(key) < value.length
+        );
+        let bytes;
+        try {
+          bytes = copyBytes(value.buffer, path, value.byteOffset, value.byteOffset + value.byteLength);
+        } catch (error) {
+          if (error instanceof TypeError && error.message.startsWith("Unsupported data value at ")) throw error;
+          return unsupported(path, "detached binary storage is not supported");
+        }
+        output = buffer ? Buffer.from(bytes) : dataView ? new DataView(bytes) : new Type(bytes);
+      } else {
+        return unsupported(path, "unsupported object prototype");
+      }
+      copies.set(value, output);
+      return output;
+    } finally {
+      active.delete(value);
+    }
+  };
+  return visit(input, rootPath);
+}
+var copyDataValue = (value) => copyValue(value, false, "data");
+function exposeSnapshot(root) {
+  const views = /* @__PURE__ */ new WeakMap();
+  const visit = (value) => {
+    const previous = views.get(value);
+    if (previous) return previous;
+    let exposed;
+    const keys2 = Object.keys(value);
+    const mutableView = () => {
+      if (!exposed) {
+        exposed = Array.isArray(value) ? new Array(value.length) : Object.create(Object.getPrototypeOf(value));
+        for (const key of keys2) defineValue(exposed, key, value[key]);
+      }
+      return exposed;
+    };
+    for (const key of keys2) {
+      const child = value[key];
+      if (child === null || typeof child !== "object") continue;
+      if (isPlainContainer(child)) {
+        const view2 = visit(child);
+        if (view2 !== child) defineValue(mutableView(), key, view2);
+      } else {
+        Object.defineProperty(mutableView(), key, {
+          enumerable: true,
+          configurable: true,
+          get: () => copyDataValue(child)
+        });
+      }
+    }
+    const view = exposed ? Object.freeze(exposed) : value;
+    views.set(value, view);
+    return view;
+  };
+  return visit(root);
+}
+var emptyDataSnapshot = Object.freeze([]);
+var ownedSnapshots = new WeakMap([[emptyDataSnapshot, emptyDataSnapshot]]);
+function createDataSnapshot(data) {
+  if (data === void 0) return void 0;
+  if (!Array.isArray(data) || types.isProxy(data) || Object.getPrototypeOf(data) !== Array.prototype) {
+    return unsupported("data", "expected an ordinary array or undefined");
+  }
+  if (ownedSnapshots.has(data)) return data;
+  const owned = copyValue(data, true, "data");
+  const exposed = exposeSnapshot(owned);
+  ownedSnapshots.set(exposed, owned);
+  return exposed;
+}
+function getOwnedDataSnapshot(snapshot = emptyDataSnapshot) {
+  const owned = ownedSnapshots.get(snapshot);
+  if (!owned) throw new TypeError("DataService requires an admitted data snapshot");
+  return owned;
+}
+
+// src/options/data-manager.ts
+var admitData = (options) => {
+  if (!Object.hasOwn(options, "data")) return options;
+  const { data, ...otherOptions } = options;
+  return { ...otherOptions, data: createDataSnapshot(data) };
+};
+var DataOptionsManager = class extends OptionsManager {
+  assign(options) {
+    super.assign(admitData(options));
+  }
+  set(key, value) {
+    const path = String(key);
+    if (path === "data") {
+      super.set("data", createDataSnapshot(value));
+    } else if (path.startsWith("data.")) {
+      const next = copyDataValue(getOwnedDataSnapshot(super.get("data")));
+      set2(next, path.slice("data.".length), value);
+      super.set("data", createDataSnapshot(next));
+    } else {
+      super.set(key, value);
+    }
+  }
+  restore(snapshot) {
+    super.restore(admitData(snapshot));
+  }
+};
+
 // src/request-complexity.ts
-import { isArray as isArray3, isPlainObject as isPlainObject8 } from "@web-ts-toolkit/utils";
+import { isArray as isArray3, isPlainObject as isPlainObject9 } from "@web-ts-toolkit/utils";
 var defaultRequestComplexity = {
   maxDepth: 8,
   maxNodes: 500,
@@ -729,7 +1024,7 @@ function validateRequestComplexity(value, options, scope = "request") {
       }
       return;
     }
-    if (!isPlainObject8(current)) return;
+    if (!isPlainObject9(current)) return;
     for (const [key, child] of Object.entries(current)) {
       if (key === "__proto__" || key === "prototype" || key === "constructor") {
         pushError(`Unsupported key: ${key}`, path.concat(key));
@@ -808,7 +1103,7 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const modelPermissionKeys = {};
   forEach2(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = isPlainObject9(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = isPlainObject10(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
       if (!isArray4(globalPermissionKeys[accessKey])) {
@@ -849,13 +1144,13 @@ var VIRTUAL_UNSUPPORTED_ACCESSES = ["delete", "distinct", "count"];
 var VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
 var VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-var isVirtualContainerValue = (value) => isPlainObject9(value) && "sub" in value;
+var isVirtualContainerValue = (value) => isPlainObject10(value) && "sub" in value;
 var virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
 var virtualPathsOverlap = (virtualPath, permissionField) => {
   if (!virtualPath || !permissionField) return false;
   try {
-    if (get2(set2({}, virtualPath, true), permissionField) !== void 0) return true;
-    if (get2(set2({}, permissionField, true), virtualPath) !== void 0) return true;
+    if (get2(set3({}, virtualPath, true), permissionField) !== void 0) return true;
+    if (get2(set3({}, permissionField, true), virtualPath) !== void 0) return true;
   } catch {
     return false;
   }
@@ -944,7 +1239,7 @@ var validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirt
 };
 var validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
   if (isFunction(value)) return;
-  if (!isPlainObject9(value)) {
+  if (!isPlainObject10(value)) {
     throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
   }
   const record = value;
@@ -988,7 +1283,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
           `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
         );
       }
-      if (!isPlainObject9(record2.sub)) {
+      if (!isPlainObject10(record2.sub)) {
         throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
       }
       continue;
@@ -999,7 +1294,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
       );
     }
     if (isFunction(raw)) continue;
-    if (!isPlainObject9(raw)) {
+    if (!isPlainObject10(raw)) {
       throw new Error(
         `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
       );
@@ -1007,7 +1302,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
     const record = raw;
     const hasGet = "get" in record;
     const accessKeys = Object.keys(record).filter((k) => VIRTUAL_SUPPORTED_ACCESSES.includes(k));
-    const unsupported = Object.keys(record).filter(
+    const unsupported2 = Object.keys(record).filter(
       (k) => k !== "get" && k !== "dependsOn" && k !== "sub" && !VIRTUAL_SUPPORTED_ACCESSES.includes(k)
     );
     for (const key of Object.keys(record)) {
@@ -1017,9 +1312,9 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
         );
       }
     }
-    if (unsupported.length > 0) {
+    if (unsupported2.length > 0) {
       throw new Error(
-        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported[0]}" (supported: default + list/create/read/update)`
+        `Virtual ${scopeLabel}${name}: unsupported access/key "${unsupported2[0]}" (supported: default + list/create/read/update)`
       );
     }
     if (hasGet) {
@@ -1053,7 +1348,7 @@ var validateVirtualsScope = (scope, documentPermissionField) => {
 };
 var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
   if (virtuals === void 0 || virtuals === null) return;
-  if (!isPlainObject9(virtuals)) {
+  if (!isPlainObject10(virtuals)) {
     throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
   }
   const rootSchema = model?.schema ?? null;
@@ -1100,25 +1395,25 @@ var validateVirtualsTree = (model, virtuals, documentPermissionField, modelName)
   visitContainers(rootVirtuals, rootSchema, "");
 };
 var getScopeVirtualsObject = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !isPlainObject9(rootVirtuals)) return null;
+  if (!rootVirtuals || !isPlainObject10(rootVirtuals)) return null;
   if (!scopePath || scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!isPlainObject9(current)) return null;
+    if (!isPlainObject10(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValue(container)) return null;
     current = container.sub;
-    if (!isPlainObject9(current)) return null;
+    if (!isPlainObject10(current)) return null;
   }
   return current;
 };
 var toVirtualDescriptor = (leaf, sharedDependsOn) => {
   if (isFunction(leaf))
     return { get: leaf, dependsOn: sharedDependsOn ?? [] };
-  if (!isPlainObject9(leaf)) return null;
+  if (!isPlainObject10(leaf)) return null;
   const record = leaf;
   if (!isFunction(record.get)) return null;
   const dependsOn = record.dependsOn ?? sharedDependsOn ?? [];
@@ -1301,6 +1596,7 @@ var AccessRuntime = class {
     Object.assign(this.modelAtts, snapshot.modelAtts);
     this.openApiRegistry.restore(snapshot.openApi);
   }
+  /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
   setGlobalOptions(options) {
     this.globalOptions.assign(options);
   }
@@ -1313,6 +1609,7 @@ var AccessRuntime = class {
   getGlobalOption(key, defaultValue) {
     return this.globalOptions.get(key, defaultValue);
   }
+  /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
   setDefaultModelOptions(options) {
     this.defaultModelOptions.assign(options);
   }
@@ -1357,7 +1654,15 @@ var AccessRuntime = class {
     }
     return manager;
   }
+  /**
+   * Assign `{ ...modelDefaults, ...storedOptions, ...options }` shallowly. A supplied
+   * operationAccess/defaults object replaces that whole value. Defaults accept only
+   * query/presentation settings; virtual configuration is validated before assignment.
+   * Existing router.options remains its construction-time snapshot. Fresh model-service
+   * calls capture the owner's current options/defaults; in-flight calls retain their snapshot.
+   */
   setModelOptions(modelName, options) {
+    assertPublicDefaults(options.defaults);
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
@@ -1370,6 +1675,12 @@ var AccessRuntime = class {
   setModelOption(modelName, key, value) {
     const manager = this.getOrCreateModelOptions(modelName);
     const keyStr = String(key);
+    if (keyStr === "defaults") assertPublicDefaults(value);
+    else if (keyStr.startsWith("defaults.")) {
+      const proposed = {};
+      set3(proposed, keyStr.slice("defaults.".length), value);
+      assertPublicDefaults(proposed);
+    }
     if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
       const model = this.getModelInstance(modelName);
       const currentVirtuals = manager.get("virtuals");
@@ -1387,15 +1698,15 @@ var AccessRuntime = class {
           const segments = nestedPath.split(".");
           let cursor = cloned;
           for (let i = 0; i < segments.length - 1; i++) {
-            if (!isPlainObject9(cursor)) break;
+            if (!isPlainObject10(cursor)) break;
             cursor = cursor[segments[i]];
           }
-          if (isPlainObject9(cursor)) {
+          if (isPlainObject10(cursor)) {
             delete cursor[segments[segments.length - 1]];
           }
           proposedVirtuals = cloned;
         } else {
-          set2(cloned, nestedPath, value);
+          set3(cloned, nestedPath, value);
           proposedVirtuals = cloned;
         }
       }
@@ -1403,10 +1714,17 @@ var AccessRuntime = class {
     }
     manager.set(key, value);
   }
+  /** Frozen stored snapshot, not fully resolved per-path defaults. Read again for current configuration. */
   getModelOptions(modelName) {
     const manager = this.getOrCreateModelOptions(modelName);
     return manager.fetch();
   }
+  /**
+   * Generic stored exact → parent.default → parent lookup; only undefined falls through.
+   * The exact runtime-model-default path is the final fallback if the stored parent is
+   * absent. This is not the route-specific variant-to-base resolver; use
+   * getExactModelOption to inspect a variant including its exact model-default fallback.
+   */
   getModelOption(modelName, key, defaultValue) {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultModelValue = this.getDefaultModelOption(
@@ -1415,6 +1733,7 @@ var AccessRuntime = class {
     );
     return getNestedOption(manager, key, defaultModelValue);
   }
+  /** Exact stored path, then the same runtime-model-default path; no parent/default or variant-to-base lookup. */
   getExactModelOption(modelName, key) {
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultModelValue = this.getDefaultModelOption(key);
@@ -1466,7 +1785,7 @@ var AccessRuntime = class {
     const entry = scopeVirtuals[virtualName];
     if (entry === void 0 || isVirtualContainerValue(entry)) return void 0;
     if (isFunction(entry)) return { get: entry, dependsOn: [] };
-    if (!isPlainObject9(entry)) return void 0;
+    if (!isPlainObject10(entry)) return void 0;
     const record = entry;
     if ("get" in record) {
       const descriptor = toVirtualDescriptor(entry, void 0);
@@ -1495,7 +1814,7 @@ var AccessRuntime = class {
     return this.modelJsonSchemas[modelName];
   }
   createDataOptions(dataName) {
-    const manager = new OptionsManager({
+    const manager = new DataOptionsManager({
       ...defaultDataOptions,
       dataName
     });
@@ -1527,10 +1846,15 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  /**
+   * Reusable configured data view: plain containers are frozen; native properties
+   * return detached mutable copies on access. Native identity is not stable.
+   * Replacement leaves previously captured views on their original data version.
+   */
   getDataSnapshot(dataName) {
     const manager = this.getOrCreateDataOptions(dataName);
     const snapshot = manager.get("data");
-    return snapshot ?? [];
+    return snapshot ?? emptyDataSnapshot;
   }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1590,10 +1914,29 @@ var getGlobalOption = (key, defaultValue) => {
 
 // src/validation/common.ts
 import { z as z2 } from "zod";
-import { isPlainObject as isPlainObject11 } from "@web-ts-toolkit/utils";
+import { isPlainObject as isPlainObject12 } from "@web-ts-toolkit/utils";
+
+// src/validation/public-admission-schema.ts
+var admissions = /* @__PURE__ */ new WeakMap();
+function publicBoundarySchema(schema, kind = "envelope") {
+  const checked = schema.superRefine((value, ctx) => {
+    try {
+      assertPublicAdmission(value, kind);
+    } catch (error) {
+      if (!(error instanceof PublicAdmissionError)) throw error;
+      ctx.addIssue({ code: "custom", message: error.result.errors[0].detail });
+    }
+  });
+  admissions.set(checked, kind);
+  return checked;
+}
+function assertTransformedPublicAdmission(schema, value) {
+  const kind = admissions.get(schema);
+  if (kind) assertPublicAdmission(value, kind);
+}
 
 // src/correlated-includes.ts
-import { cloneDeep, isArray as isArray5, isPlainObject as isPlainObject10 } from "@web-ts-toolkit/utils";
+import { cloneDeep, isArray as isArray5, isPlainObject as isPlainObject11 } from "@web-ts-toolkit/utils";
 var PARENT_MARKER_KEY = "$parent";
 var ESCAPE_WRAPPER_KEY = "$escape";
 var SUBQUERY_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["$$sq", "$$date"]);
@@ -1604,10 +1947,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return isPlainObject10(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return isPlainObject11(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return isPlainObject10(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return isPlainObject11(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -1631,7 +1974,7 @@ function containsParentMarkerShape(value) {
       seen.add(current);
       return current.some(visit);
     }
-    if (isPlainObject10(current)) {
+    if (isPlainObject11(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -1661,7 +2004,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if (isPlainObject10(value)) {
+  if (isPlainObject11(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -1726,7 +2069,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if (isPlainObject10(clause)) {
+        if (isPlainObject11(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -1737,7 +2080,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter) {
   const issues = [];
-  if (!isPlainObject10(filter)) {
+  if (!isPlainObject11(filter)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -1784,42 +2127,48 @@ var sortSchema = z2.union([
   z2.null()
 ]);
 var populateAccessSchema = z2.enum(["list", "read"]);
-var populateSchema = z2.union([
-  z2.string(),
-  z2.array(
-    z2.union([
-      z2.string(),
-      z2.object({
-        path: z2.string().min(1),
-        select: projectionSchema.optional(),
-        match: z2.unknown().optional(),
-        access: populateAccessSchema.optional()
-      }).passthrough()
-    ])
-  ),
-  z2.object({
-    path: z2.string().min(1),
-    select: projectionSchema.optional(),
-    match: z2.unknown().optional(),
-    access: populateAccessSchema.optional()
-  }).passthrough()
-]);
-var subPopulateSchema = z2.union([
-  z2.string(),
-  z2.array(
-    z2.union([
-      z2.string(),
-      z2.object({
-        path: z2.string().min(1),
-        select: projectionSchema.optional()
-      }).passthrough()
-    ])
-  ),
-  z2.object({
-    path: z2.string().min(1),
-    select: projectionSchema.optional()
-  }).passthrough()
-]);
+var populateSchema = publicBoundarySchema(
+  z2.union([
+    z2.string(),
+    z2.array(
+      z2.union([
+        z2.string(),
+        z2.object({
+          path: z2.string().min(1),
+          select: projectionSchema.optional(),
+          match: z2.unknown().optional(),
+          access: populateAccessSchema.optional()
+        }).passthrough()
+      ])
+    ),
+    z2.object({
+      path: z2.string().min(1),
+      select: projectionSchema.optional(),
+      match: z2.unknown().optional(),
+      access: populateAccessSchema.optional()
+    }).passthrough()
+  ]),
+  "populate"
+);
+var subPopulateSchema = publicBoundarySchema(
+  z2.union([
+    z2.string(),
+    z2.array(
+      z2.union([
+        z2.string(),
+        z2.object({
+          path: z2.string().min(1),
+          select: projectionSchema.optional()
+        }).passthrough()
+      ])
+    ),
+    z2.object({
+      path: z2.string().min(1),
+      select: projectionSchema.optional()
+    }).passthrough()
+  ]),
+  "populate"
+);
 var legacyIncludeItemSchema = z2.object({
   mode: z2.enum(["legacy"]).optional(),
   model: z2.string().min(1),
@@ -1859,7 +2208,7 @@ var correlatedFilterSchema = z2.record(z2.string(), z2.unknown()).superRefine((f
   }
 });
 var correlatedEmptyOptionsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject11(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject12(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = z2.string().min(1).superRefine((path, ctx) => {
@@ -1896,7 +2245,7 @@ var correlatedListArgsSchema = z2.object({
   include: z2.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = z2.unknown().refine(
-  (value) => value === void 0 || isPlainObject11(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || isPlainObject12(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = z2.object({
@@ -1935,18 +2284,21 @@ var correlatedCountSchema = z2.object({
   args: correlatedCountArgsSchema,
   options: correlatedEmptyOptionsSchema
 }).strict();
-var includeItemSchema = z2.union([
-  legacyIncludeItemSchema,
-  correlatedReadByIdSchema,
-  correlatedReadByFilterSchema,
-  correlatedListSchema,
-  correlatedCountSchema
-]);
+var includeItemSchema = publicBoundarySchema(
+  z2.union([
+    legacyIncludeItemSchema,
+    correlatedReadByIdSchema,
+    correlatedReadByFilterSchema,
+    correlatedListSchema,
+    correlatedCountSchema
+  ]),
+  "include"
+);
 var correlatedNestedIncludeSchema = z2.union([includeItemSchema, z2.array(includeItemSchema)]);
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if (isPlainObject11(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if (isPlainObject12(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: z2.ZodIssueCode.custom,
@@ -1984,7 +2336,7 @@ function rejectKeys(body, ctx, keys2) {
 }
 
 // src/validation/parsers.ts
-var clientErrors = JsonRouter.clientErrors;
+var clientErrors = JsonRouter2.clientErrors;
 function parsePathParam(value, parameter) {
   const result = stringOrStringArray.safeParse(value);
   if (!result.success) {
@@ -1999,6 +2351,7 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  assertTransformedPublicAdmission(schema, value);
   const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
   if (complexityErrors.length > 0) {
     throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
@@ -2010,6 +2363,7 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  assertTransformedPublicAdmission(schema, value);
   const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
   if (complexityErrors.length > 0) {
     throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
@@ -2020,17 +2374,22 @@ function parseBody(schema, value) {
   }
   return result.data;
 }
-function parseBodyWithSchema(schema, value, userSchema) {
+async function parseBodyWithSchema(schema, value, userSchema) {
   const body = parseBody(schema, value);
-  return isRequestSchema(userSchema) ? parseUserSchema(userSchema, body) : Promise.resolve(body);
+  if (!isRequestSchema(userSchema)) return body;
+  const transformed = await parseUserSchema(userSchema, body);
+  assertTransformedPublicAdmission(schema, transformed);
+  return transformed;
 }
 async function parseNestedBodyWithSchema(schema, value, nestedKey, userSchema) {
   const body = parseBody(schema, value);
   if (!isRequestSchema(userSchema)) return body;
-  return {
+  const transformed = {
     ...body,
     [nestedKey]: await parseUserSchema(userSchema, body?.[nestedKey], [nestedKey])
   };
+  assertTransformedPublicAdmission(schema, transformed);
+  return transformed;
 }
 function throwValidationError(issues, key, location = "pointer") {
   const errors = issues.map((issue) => formatIssue(issue, key, location));
@@ -2458,147 +2817,177 @@ function buildPointer(path) {
 
 // src/validation/model-router.ts
 import { z as z3 } from "zod";
-var listQuerySchema = z3.object({
-  skip: nonNegativeIntegerString.optional(),
-  limit: positiveIntegerString.optional(),
-  page: nonNegativeIntegerString.optional(),
-  page_size: positiveIntegerString.optional(),
-  skim: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  include_count: queryBooleanString.optional(),
-  include_extra_headers: queryBooleanString.optional(),
-  select: stringOrStringArray.optional(),
-  sort: z3.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
-}).passthrough();
-var createQuerySchema = z3.object({
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional()
-}).passthrough();
-var readQuerySchema = z3.object({
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  try_list: queryBooleanString.optional(),
-  select: stringOrStringArray.optional()
-}).passthrough();
-var updateQuerySchema = z3.object({
-  returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional(),
-  select: stringOrStringArray.optional()
-}).passthrough();
-var upsertQuerySchema = z3.object({
-  returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional(),
-  include_field_permissions: queryBooleanString.optional()
-}).passthrough();
-var listBodySchema = z3.object({
-  filter: objectOrArraySchema.optional(),
-  select: projectionSchema.optional(),
-  sort: sortSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  skip: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
-  limit: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
-  page: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
-  pageSize: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
-  options: z3.object({
-    skim: z3.boolean().optional(),
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    includeCount: z3.boolean().optional(),
-    includeExtraHeaders: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = z3.object({
-  filter: objectOrArraySchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options", "include"]));
-var readFilterBodySchema = z3.object({
-  filter: objectOrArraySchema.optional(),
-  select: projectionSchema.optional(),
-  sort: sortSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: z3.object({
-    skim: z3.boolean().optional(),
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    tryList: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var readByIdBodySchema = z3.object({
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  include: includeSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: z3.object({
-    skim: z3.boolean().optional(),
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    tryList: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var advancedCreateBodySchema = z3.object({
-  data: z3.unknown(),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: z3.object({
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var createBodySchema = z3.union([
-  z3.record(z3.string(), z3.unknown()),
-  z3.array(z3.record(z3.string(), z3.unknown()))
-]);
-var updateBodySchema = z3.record(z3.string(), z3.unknown());
-var advancedUpdateBodySchema = z3.object({
-  data: z3.unknown(),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: z3.object({
-    returningAll: z3.boolean().optional(),
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var upsertBodySchema = z3.record(z3.string(), z3.unknown());
-var advancedUpsertBodySchema = z3.object({
-  data: z3.record(z3.string(), z3.unknown()),
-  select: projectionSchema.optional(),
-  populate: populateSchema.optional(),
-  tasks: tasksSchema.optional(),
-  options: z3.object({
-    returningAll: z3.boolean().optional(),
-    includePermissions: z3.boolean().optional(),
-    includeFieldPermissions: z3.boolean().optional(),
-    populateAccess: populateAccessSchema.optional()
-  }).passthrough().optional()
-}).passthrough();
-var distinctBodySchema = z3.object({
-  filter: objectOrArraySchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = z3.object({
-  filter: z3.record(z3.string(), z3.unknown()).optional(),
-  select: fieldsSchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = z3.union([
-  z3.record(z3.string(), z3.unknown()),
-  z3.array(z3.record(z3.string(), z3.unknown()))
-]);
-var subReadBodySchema = z3.object({
-  select: fieldsSchema.optional(),
-  populate: subPopulateSchema.optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
+var listQuerySchema = publicBoundarySchema(
+  z3.object({
+    skip: nonNegativeIntegerString.optional(),
+    limit: positiveIntegerString.optional(),
+    page: nonNegativeIntegerString.optional(),
+    page_size: positiveIntegerString.optional(),
+    skim: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    include_count: queryBooleanString.optional(),
+    include_extra_headers: queryBooleanString.optional(),
+    select: stringOrStringArray.optional(),
+    sort: z3.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
+  }).passthrough()
+);
+var createQuerySchema = publicBoundarySchema(
+  z3.object({
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional()
+  }).passthrough()
+);
+var readQuerySchema = publicBoundarySchema(
+  z3.object({
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    try_list: queryBooleanString.optional(),
+    select: stringOrStringArray.optional()
+  }).passthrough()
+);
+var updateQuerySchema = publicBoundarySchema(
+  z3.object({
+    returning_all: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional(),
+    select: stringOrStringArray.optional()
+  }).passthrough()
+);
+var upsertQuerySchema = publicBoundarySchema(
+  z3.object({
+    returning_all: queryBooleanString.optional(),
+    include_permissions: queryBooleanString.optional(),
+    include_field_permissions: queryBooleanString.optional()
+  }).passthrough()
+);
+var listBodySchema = publicBoundarySchema(
+  z3.object({
+    filter: objectOrArraySchema.optional(),
+    select: projectionSchema.optional(),
+    sort: sortSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    skip: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+    limit: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+    page: z3.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+    pageSize: z3.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+    options: z3.object({
+      skim: z3.boolean().optional(),
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      includeCount: z3.boolean().optional(),
+      includeExtraHeaders: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]))
+);
+var countBodySchema = publicBoundarySchema(
+  z3.object({
+    filter: objectOrArraySchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options", "include"]))
+);
+var readFilterBodySchema = publicBoundarySchema(
+  z3.object({
+    filter: objectOrArraySchema.optional(),
+    select: projectionSchema.optional(),
+    sort: sortSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: z3.object({
+      skim: z3.boolean().optional(),
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      tryList: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var readByIdBodySchema = publicBoundarySchema(
+  z3.object({
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    include: includeSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: z3.object({
+      skim: z3.boolean().optional(),
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      tryList: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var advancedCreateBodySchema = publicBoundarySchema(
+  z3.object({
+    data: z3.unknown(),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: z3.object({
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var createBodySchema = publicBoundarySchema(
+  z3.union([z3.record(z3.string(), z3.unknown()), z3.array(z3.record(z3.string(), z3.unknown()))]),
+  "data"
+);
+var updateBodySchema = publicBoundarySchema(z3.record(z3.string(), z3.unknown()), "data");
+var advancedUpdateBodySchema = publicBoundarySchema(
+  z3.object({
+    data: z3.unknown(),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: z3.object({
+      returningAll: z3.boolean().optional(),
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var upsertBodySchema = publicBoundarySchema(z3.record(z3.string(), z3.unknown()), "data");
+var advancedUpsertBodySchema = publicBoundarySchema(
+  z3.object({
+    data: z3.record(z3.string(), z3.unknown()),
+    select: projectionSchema.optional(),
+    populate: populateSchema.optional(),
+    tasks: tasksSchema.optional(),
+    options: z3.object({
+      returningAll: z3.boolean().optional(),
+      includePermissions: z3.boolean().optional(),
+      includeFieldPermissions: z3.boolean().optional(),
+      populateAccess: populateAccessSchema.optional()
+    }).passthrough().optional()
+  }).passthrough()
+);
+var distinctBodySchema = publicBoundarySchema(
+  z3.object({
+    filter: objectOrArraySchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]))
+);
+var subListBodySchema = publicBoundarySchema(
+  z3.object({
+    filter: z3.record(z3.string(), z3.unknown()).optional(),
+    select: fieldsSchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]))
+);
+var subMutationBodySchema = publicBoundarySchema(
+  z3.union([z3.record(z3.string(), z3.unknown()), z3.array(z3.record(z3.string(), z3.unknown()))]),
+  "data"
+);
+var subReadBodySchema = publicBoundarySchema(
+  z3.object({
+    select: fieldsSchema.optional(),
+    populate: subPopulateSchema.optional()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]))
+);
 var requestSchemas = {
   listQuery: listQuerySchema,
   createQuery: createQuerySchema,
@@ -2876,7 +3265,9 @@ var rootDataQueryEntrySchema = z5.union([
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = z5.array(z5.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = publicBoundarySchema(
+  z5.array(z5.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]))
+);
 export {
   Codes,
   CustomHeaders,