@web-ts-toolkit/access-router 0.52.0 → 0.53.0

package/index.js

@@ -68,7 +68,38 @@ function assertPublicAdmission(input, kind = "envelope") {
     for (const key of ["filter", "match", "data"]) add(record2[key], "data", key);
   }
 }
+function assertHydrationDefaults(defaults) {
+  if (defaults && typeof defaults === "object") {
+    const record2 = defaults;
+    if ("hydration" in record2)
+      throw new TypeError("defaults.hydration is unsupported; use model hydration configuration");
+    for (const bucket of [
+      "publicListOptions",
+      "publicReadOptions",
+      "findOptions",
+      "findOneOptions",
+      "findByIdOptions",
+      "createOptions",
+      "updateOneOptions",
+      "updateByIdOptions",
+      "upsertOptions",
+      "existsOptions",
+      "publicCreateOptions",
+      "publicUpdateOptions"
+    ]) {
+      const options = record2[bucket];
+      if (!options || typeof options !== "object" && typeof options !== "function") continue;
+      for (const key of ["lean", "hydration"]) {
+        if (!(key in options)) continue;
+        const method = bucket.slice(0, -"Options".length);
+        const migration = ["publicList", "publicRead", "find", "findOne", "findById"].includes(method) ? `use model hydration.${method} ('lean' or 'hydrated')` : "this method has a fixed fetch mode";
+        throw new TypeError(`defaults.${bucket}.${key} is unsupported; ${migration}`);
+      }
+    }
+  }
+}
 function assertPublicDefaults(defaults) {
+  assertHydrationDefaults(defaults);
   assertPublicAdmission(defaults);
   if (defaults && typeof defaults === "object") {
     for (const value of Object.values(defaults)) assertPublicAdmission(value);
@@ -134,21 +165,43 @@ var init_public_admission = __esm({
       "includePermissions",
       "includeFieldPermissions",
       "includeCount",
-      "populateAccess",
-      "lean"
-    ];
-    readOptions = [
-      "skim",
-      "includePermissions",
-      "includeFieldPermissions",
-      "tryList",
-      "populateAccess",
-      "lean"
+      "populateAccess"
     ];
+    readOptions = ["skim", "includePermissions", "includeFieldPermissions", "tryList", "populateAccess"];
     requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
   }
 });
 
+// src/options/hydration.ts
+function normalizeHydration(value, path = "hydration") {
+  if (value === void 0) return void 0;
+  if (value === null || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    throw new TypeError(`${path} must be a plain record of model hydration modes`);
+  const result2 = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !methods.includes(key))
+      throw new TypeError(`${path}.${String(key)} is not a supported hydration method`);
+    const mode = value[key];
+    if (mode !== void 0 && mode !== "lean" && mode !== "hydrated")
+      throw new TypeError(`${path}.${key} must be 'lean', 'hydrated', or undefined`);
+    result2[key] = mode;
+  }
+  return Object.freeze(result2);
+}
+function normalizeHydrationUpdate(current, key, value) {
+  if (key === "hydration") return normalizeHydration(value);
+  const method = key.slice("hydration.".length);
+  if (!methods.includes(method))
+    throw new TypeError(`${key} is not a supported hydration method`);
+  return normalizeHydration({ ...normalizeHydration(current), [method]: value });
+}
+var methods;
+var init_hydration = __esm({
+  "src/options/hydration.ts"() {
+    methods = ["publicList", "publicRead", "find", "findOne", "findById"];
+  }
+});
+
 // src/helpers/collection.ts
 var import_sift, import_utils2, filterCollection, findElement, findElementById;
 var init_collection = __esm({
@@ -278,6 +331,50 @@ var init_concurrency = __esm({
   }
 });
 
+// src/output/permissions-alias.ts
+function attachPermissionsAlias(output, field) {
+  if ("permissions" in output) return;
+  const metadata = (0, import_utils3.get)(output, field);
+  if (metadata === void 0) return;
+  Object.defineProperty(output, "permissions", {
+    value: metadata,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  });
+  aliases.set(output, field);
+}
+function removeGeneratedPermissionsAlias(output) {
+  const field = aliases.get(output);
+  if (field && Object.getOwnPropertyDescriptor(output, "permissions")?.value === (0, import_utils3.get)(output, field)) {
+    delete output.permissions;
+  }
+  aliases.delete(output);
+}
+function copyPermissionsAlias(source, target) {
+  if (source && typeof source === "object" && target && typeof target === "object") {
+    const field = aliases.get(source);
+    if (field && Object.getOwnPropertyDescriptor(source, "permissions")?.value === (0, import_utils3.get)(source, field))
+      attachPermissionsAlias(target, field);
+  }
+  return target;
+}
+function copyPermissionsAliasGraph(source, target, seen = /* @__PURE__ */ new WeakSet()) {
+  if (!source || !target || typeof source !== "object" || typeof target !== "object" || seen.has(target)) return;
+  seen.add(target);
+  copyPermissionsAlias(source, target);
+  for (const key of Object.keys(target)) {
+    copyPermissionsAliasGraph(source[key], target[key], seen);
+  }
+}
+var import_utils3, aliases;
+var init_permissions_alias = __esm({
+  "src/output/permissions-alias.ts"() {
+    import_utils3 = require("@web-ts-toolkit/utils");
+    aliases = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // src/helpers/query.ts
 function genPagination({
   skip,
@@ -312,9 +409,9 @@ function parseSelectParam(select) {
   return fields.length > 0 ? fields : void 0;
 }
 function normalizeSelect(select) {
-  if (Array.isArray(select)) return (0, import_utils3.flattenDeep)(select.map(normalizeSelect));
-  if ((0, import_utils3.isPlainObject)(select)) {
-    return (0, import_utils3.reduce)(
+  if (Array.isArray(select)) return (0, import_utils4.flattenDeep)(select.map(normalizeSelect));
+  if ((0, import_utils4.isPlainObject)(select)) {
+    return (0, import_utils4.reduce)(
       select,
       (ret, val, key) => {
         if (val === 1) ret.push(key);
@@ -324,17 +421,17 @@ function normalizeSelect(select) {
       []
     );
   }
-  if ((0, import_utils3.isString)(select))
+  if ((0, import_utils4.isString)(select))
     return String(select).split(/[\s,]+/).map((v) => v.trim()).filter(Boolean);
   return [];
 }
-var import_utils3, DEFAULT_LIST_HARD_LIMIT, normalizeSafeInteger;
+var import_utils4, DEFAULT_LIST_HARD_LIMIT, normalizeSafeInteger;
 var init_query = __esm({
   "src/helpers/query.ts"() {
-    import_utils3 = require("@web-ts-toolkit/utils");
+    import_utils4 = require("@web-ts-toolkit/utils");
     DEFAULT_LIST_HARD_LIMIT = 1e3;
     normalizeSafeInteger = (value, min) => {
-      if ((0, import_utils3.isNil)(value)) return null;
+      if ((0, import_utils4.isNil)(value)) return null;
       const parsed = Number(value);
       if (!Number.isSafeInteger(parsed) || parsed < min) return null;
       return parsed;
@@ -348,57 +445,49 @@ function isDocument(doc) {
 }
 function getDocValue(doc, path, defaultValue) {
   if (isDocument(doc)) {
-    return (0, import_utils4.get)(doc._doc, path, defaultValue);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    return (0, import_utils4.get)(doc, path, defaultValue);
+    return (0, import_utils5.get)(doc._doc, path, defaultValue);
+  } else if ((0, import_utils5.isPlainObject)(doc)) {
+    return (0, import_utils5.get)(doc, path, defaultValue);
   }
 }
 function setDocValue(doc, path, value) {
   if (isDocument(doc)) {
-    (0, import_utils4.set)(doc._doc, path, value);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    (0, import_utils4.set)(doc, path, value);
+    (0, import_utils5.set)(doc._doc, path, value);
+  } else if ((0, import_utils5.isPlainObject)(doc)) {
+    (0, import_utils5.set)(doc, path, value);
   }
 }
 function getDocPermissions(modelName, doc) {
   const docPermissionField = getModelOption(modelName, "documentPermissionField");
   const permissions = getDocValue(doc, docPermissionField, {});
-  return (0, import_utils4.isPlainObject)(permissions) ? permissions : {};
-}
-function stripUnexposedDocPermissions(modelName, doc) {
-  const exposed = getModelOption(modelName, "exposedDocPermissionKeys");
-  if (exposed === void 0) return;
-  const docPermissionField = getModelOption(modelName, "documentPermissionField");
-  const current = getDocValue(doc, docPermissionField, void 0);
-  if (!(0, import_utils4.isPlainObject)(current)) return;
-  const keep = /* @__PURE__ */ new Set(["_view", "_edit", ...exposed]);
-  setDocValue(doc, docPermissionField, Object.fromEntries(Object.entries(current).filter(([key]) => keep.has(key))));
+  return (0, import_utils5.isPlainObject)(permissions) ? permissions : {};
 }
 function toObject(doc) {
   return isDocument(doc) ? doc.toObject() : doc;
 }
 function pickDocFields(doc, fields = []) {
   if (isDocument(doc)) {
-    doc._doc = (0, import_utils4.pick)(doc._doc, fields);
+    doc._doc = (0, import_utils5.pick)(doc._doc, fields);
     return doc;
   } else {
-    return (0, import_utils4.pick)(doc, fields);
+    return (0, import_utils5.pick)(doc, fields);
   }
 }
 async function populateDoc(doc, target) {
   let p = doc.populate(target);
-  if ((0, import_utils5.isPromise)(p)) return p;
+  if ((0, import_utils6.isPromise)(p)) return p;
   return "execPopulate" in p && p.execPopulate?.();
 }
-var import_mongoose, import_utils4, import_utils5, isMongooseDocument, cloneIsolatedLeaf, deepIsolateValue, isolateDocForOutput, retainedAssociations, retainRawAssociation, getRetainedAssociations, normalizeSubPopulate, genSubPopulate;
+var import_mongoose, import_utils5, import_utils6, isMongooseDocument, cloneIsolatedLeaf, deepIsolateValue, isolateDocForOutput, retainedAssociations, retainRawAssociation, getRetainedAssociations, normalizeSubPopulate, genSubPopulate;
 var init_document = __esm({
   "src/helpers/document.ts"() {
     import_mongoose = require("mongoose");
+    init_permissions_alias();
     init_public_admission();
-    import_utils4 = require("@web-ts-toolkit/utils");
+    import_utils5 = require("@web-ts-toolkit/utils");
     init_options();
     init_query();
-    import_utils5 = require("@web-ts-toolkit/utils");
+    import_utils6 = require("@web-ts-toolkit/utils");
     isMongooseDocument = (doc) => isDocument(doc);
     cloneIsolatedLeaf = (value) => {
       if (value === null || value === void 0) return value;
@@ -486,7 +575,7 @@ var init_document = __esm({
         for (const [key, entry] of value) out.set(deepIsolateValue(key, seen), deepIsolateValue(entry, seen));
         return out;
       }
-      if ((0, import_utils4.isPlainObject)(value)) {
+      if ((0, import_utils5.isPlainObject)(value)) {
         if (seen.has(value)) return seen.get(value);
         const out = {};
         seen.set(value, out);
@@ -498,6 +587,7 @@ var init_document = __esm({
             configurable: true
           });
         }
+        copyPermissionsAlias(value, out);
         return out;
       }
       return value;
@@ -532,13 +622,13 @@ var init_document = __esm({
       const entry = retainedAssociations.get(output);
       return entry ? { ...entry } : void 0;
     };
-    normalizeSubPopulate = (populate) => (0, import_utils5.isArray)(populate) ? populate.map((item) => (0, import_utils5.isString)(item) ? { path: item } : item) : (0, import_utils5.isString)(populate) ? { path: populate } : populate ?? [];
+    normalizeSubPopulate = (populate) => (0, import_utils6.isArray)(populate) ? populate.map((item) => (0, import_utils6.isString)(item) ? { path: item } : item) : (0, import_utils6.isString)(populate) ? { path: populate } : populate ?? [];
     genSubPopulate = (sub, popul) => {
       assertPublicAdmission(popul, "populate");
       if (!popul) return [];
-      let populate = (0, import_utils5.isArray)(popul) ? popul : [popul];
+      let populate = (0, import_utils6.isArray)(popul) ? popul : [popul];
       populate = populate.map((p) => {
-        const ret = (0, import_utils5.isString)(p) ? { path: `${sub}.${p}` } : {
+        const ret = (0, import_utils6.isString)(p) ? { path: `${sub}.${p}` } : {
           path: `${sub}.${p.path}`,
           select: normalizeSelect(p.select)
         };
@@ -718,14 +808,14 @@ var init_sort_policy = __esm({
 });
 
 // src/lib.ts
-var import_mongoose2, import_utils6, isSchema, isObjectIdType, isReference, isDocument2;
+var import_mongoose2, import_utils7, isSchema, isObjectIdType, isReference, isDocument2;
 var init_lib = __esm({
   "src/lib.ts"() {
     import_mongoose2 = require("mongoose");
-    import_utils6 = require("@web-ts-toolkit/utils");
+    import_utils7 = require("@web-ts-toolkit/utils");
     isSchema = (val) => val instanceof import_mongoose2.Schema;
     isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose2.Schema.Types.ObjectId;
-    isReference = (val) => (0, import_utils6.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
+    isReference = (val) => (0, import_utils7.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
     isDocument2 = function isDocument3(doc) {
       return doc instanceof import_mongoose2.Document;
     };
@@ -737,30 +827,30 @@ function recurseObject(obj) {
   if (isSchema(obj)) {
     return buildRefs(obj.tree);
   }
-  if (!(0, import_utils7.isObject)(obj)) return null;
+  if (!(0, import_utils8.isObject)(obj)) return null;
   if (isReference(obj)) {
     return obj.ref;
   }
   let ret = null;
-  (0, import_utils7.forEach)(obj, (val) => {
+  (0, import_utils8.forEach)(obj, (val) => {
     ret = recurseObject(val);
-    if (!(0, import_utils7.isEmpty)(ret)) {
+    if (!(0, import_utils8.isEmpty)(ret)) {
       return false;
     }
   });
   return ret;
 }
 function buildRefs(schema) {
-  if (!(0, import_utils7.isObject)(schema)) return {};
+  if (!(0, import_utils8.isObject)(schema)) return {};
   const references = {};
-  (0, import_utils7.forEach)(schema, (val, key) => {
+  (0, import_utils8.forEach)(schema, (val, key) => {
     const paths = recurseObject(val);
-    if (!(0, import_utils7.isEmpty)(paths)) {
+    if (!(0, import_utils8.isEmpty)(paths)) {
       references[key] = paths;
     }
-    const target = (0, import_utils7.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils7.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils7.isPlainObject)(target[0])) {
+    const target = (0, import_utils8.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils8.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils8.isPlainObject)(target[0])) {
         return;
       }
     }
@@ -768,12 +858,12 @@ function buildRefs(schema) {
   return references;
 }
 function buildSubPaths(schema) {
-  if (!(0, import_utils7.isObject)(schema)) return [];
+  if (!(0, import_utils8.isObject)(schema)) return [];
   const subPaths = [];
-  (0, import_utils7.forEach)(schema, (val, key) => {
-    const target = (0, import_utils7.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils7.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils7.isPlainObject)(target[0]) && !isReference(target[0])) {
+  (0, import_utils8.forEach)(schema, (val, key) => {
+    const target = (0, import_utils8.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils8.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils8.isPlainObject)(target[0]) && !isReference(target[0])) {
         subPaths.push(key);
       }
     }
@@ -781,12 +871,12 @@ function buildSubPaths(schema) {
   return subPaths;
 }
 async function iterateQuery(query, handler, scheduler, scheduled = false) {
-  if (!(0, import_utils7.isPlainObject)(query)) return query;
+  if (!(0, import_utils8.isPlainObject)(query)) return query;
   if (!handler) return query;
   const queryObject = query;
   const entries = Object.entries(queryObject);
   const mapEntry = async ([key, val]) => {
-    if ((0, import_utils7.isPlainObject)(val)) {
+    if ((0, import_utils8.isPlainObject)(val)) {
       const plainValue = val;
       if (plainValue.$$sq) {
         return scheduled || !scheduler ? handler(0 /* SubQuery */, plainValue.$$sq, key) : scheduler.run(() => Promise.resolve(handler(0 /* SubQuery */, plainValue.$$sq, key)));
@@ -796,7 +886,7 @@ async function iterateQuery(query, handler, scheduler, scheduled = false) {
         return iterateQuery(val, handler, scheduler, scheduled);
       }
     }
-    if ((0, import_utils7.isArray)(val)) {
+    if ((0, import_utils8.isArray)(val)) {
       const items = val;
       if (scheduler && !scheduled) {
         return scheduler.map(items, (v) => iterateQuery(v, handler, scheduler, true));
@@ -808,7 +898,7 @@ async function iterateQuery(query, handler, scheduler, scheduled = false) {
   const values = scheduler && !scheduled ? await scheduler.map(entries, mapEntry) : await Promise.all(entries.map(mapEntry));
   return Object.fromEntries(entries.map(([key], index) => [key, values[index]]));
 }
-var import_utils7, createValidator;
+var import_utils8, createValidator;
 var init_helpers = __esm({
   "src/helpers/index.ts"() {
     init_collection();
@@ -817,13 +907,13 @@ var init_helpers = __esm({
     init_errors();
     init_query();
     init_sort_policy();
-    import_utils7 = require("@web-ts-toolkit/utils");
+    import_utils8 = require("@web-ts-toolkit/utils");
     init_lib();
     createValidator = (fn) => {
       const stringHandler = (key) => key.trim().split(" ").every((v) => fn(v));
       const arrayHandler = (arr) => arr.some((item) => {
-        if ((0, import_utils7.isString)(item)) return stringHandler(item);
-        else if ((0, import_utils7.isArray)(item)) return arrayHandler(item);
+        if ((0, import_utils8.isString)(item)) return stringHandler(item);
+        else if ((0, import_utils8.isArray)(item)) return arrayHandler(item);
         else return false;
       });
       return { stringHandler, arrayHandler };
@@ -918,25 +1008,25 @@ function defineOpenApiSchemaResolver(resolve) {
   };
 }
 function getNestedOpenApiSchemaDataSource(source) {
-  return (0, import_utils8.isPlainObject)(source) && "data" in source ? source.data : void 0;
+  return (0, import_utils9.isPlainObject)(source) && "data" in source ? source.data : void 0;
 }
 function unwrapNestedOpenApiSchemaSource(source, fallback) {
-  if ((0, import_utils8.isPlainObject)(source) && ("default" in source || "data" in source)) {
+  if ((0, import_utils9.isPlainObject)(source) && ("default" in source || "data" in source)) {
     return source.default ?? fallback;
   }
   return source ?? fallback;
 }
 function isOpenApiSchemaPatch(source) {
-  return (0, import_utils8.isPlainObject)(source) && source.kind === "objectProperties";
+  return (0, import_utils9.isPlainObject)(source) && source.kind === "objectProperties";
 }
 function isOpenApiSchemaResolver(source) {
-  return (0, import_utils8.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+  return (0, import_utils9.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
 }
 function isJsonSchemaLike(source) {
-  return (0, import_utils8.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+  return (0, import_utils9.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
 }
 function hasOpenApiSchema(source) {
-  return (0, import_utils8.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
+  return (0, import_utils9.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
 }
 function toOpenApiSchema(source) {
   if (!source) return void 0;
@@ -944,7 +1034,7 @@ function toOpenApiSchema(source) {
   if (!resolvedSource) return void 0;
   if (isOpenApiSchemaPatch(resolvedSource)) {
     const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
-    const properties = (0, import_utils8.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
+    const properties = (0, import_utils9.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
     for (const [key, value] of Object.entries(resolvedSource.properties)) {
       properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
     }
@@ -966,11 +1056,11 @@ function toOpenApiSchema(source) {
     return fallbackObjectSchema;
   }
 }
-var import_zod, import_utils8, fallbackObjectSchema;
+var import_zod, import_utils9, fallbackObjectSchema;
 var init_schemas = __esm({
   "src/openapi/schemas.ts"() {
     import_zod = require("zod");
-    import_utils8 = require("@web-ts-toolkit/utils");
+    import_utils9 = require("@web-ts-toolkit/utils");
     fallbackObjectSchema = { type: "object", additionalProperties: true };
   }
 });
@@ -993,10 +1083,10 @@ function buildOpenApiSpec(routes, options) {
     paths
   };
 }
-var import_utils9, openApiMediaType, normalizePath, toOpenApiPath, schemaToQueryParameters, schemaToPathParameters, getDefaultResponses, buildOperation;
+var import_utils10, openApiMediaType, normalizePath, toOpenApiPath, schemaToQueryParameters, schemaToPathParameters, getDefaultResponses, buildOperation;
 var init_build_spec = __esm({
   "src/openapi/build-spec.ts"() {
-    import_utils9 = require("@web-ts-toolkit/utils");
+    import_utils10 = require("@web-ts-toolkit/utils");
     init_responses();
     init_schemas();
     openApiMediaType = "application/json";
@@ -1008,9 +1098,9 @@ var init_build_spec = __esm({
     schemaToQueryParameters = (schema) => {
       const jsonSchema = toOpenApiSchema(schema);
       if (!jsonSchema || jsonSchema.type !== "object") return [];
-      const properties = (0, import_utils9.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
+      const properties = (0, import_utils10.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
       const required = new Set(
-        (0, import_utils9.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+        (0, import_utils10.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
       );
       return Object.entries(properties).map(([name, value]) => ({
         name,
@@ -1227,10 +1317,10 @@ var init_logger_default = __esm({
 });
 
 // src/options/manager.ts
-var import_utils10, toPath, cloneConfigValue, cloneForRead, freezeConfigValue, cloneAndFreezeForStore, getNestedOption, resolveNestedOption, OptionsManager;
+var import_utils11, toPath, cloneConfigValue, cloneForRead, freezeConfigValue, cloneAndFreezeForStore, getNestedOption, resolveNestedOption, OptionsManager;
 var init_manager = __esm({
   "src/options/manager.ts"() {
-    import_utils10 = require("@web-ts-toolkit/utils");
+    import_utils11 = require("@web-ts-toolkit/utils");
     toPath = (key) => {
       if (Array.isArray(key)) return key;
       return typeof key === "string" ? key.split(".") : [key];
@@ -1337,20 +1427,20 @@ var init_manager = __esm({
         return this;
       }
       get(key, defaultValue) {
-        return (0, import_utils10.get)(this.currentOptions, key, defaultValue);
+        return (0, import_utils11.get)(this.currentOptions, key, defaultValue);
       }
       set(key, value) {
         const path = toPath(key);
         if (path.length <= 1) {
-          (0, import_utils10.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
+          (0, import_utils11.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
           return;
         }
         const [rootKey, ...nestedPath] = path;
-        const currentRoot = (0, import_utils10.get)(this.currentOptions, [rootKey], void 0);
-        const baseRoot = (0, import_utils10.isPlainObject)(currentRoot) ? currentRoot : {};
+        const currentRoot = (0, import_utils11.get)(this.currentOptions, [rootKey], void 0);
+        const baseRoot = (0, import_utils11.isPlainObject)(currentRoot) ? currentRoot : {};
         const nextRoot = cloneConfigValue(baseRoot);
-        (0, import_utils10.set)(nextRoot, nestedPath, cloneForRead(value));
-        (0, import_utils10.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
+        (0, import_utils11.set)(nextRoot, nestedPath, cloneForRead(value));
+        (0, import_utils11.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
       }
       fetch() {
         const cloned = cloneForRead(this.currentOptions);
@@ -1368,10 +1458,10 @@ var init_manager = __esm({
             cloned[key] = options[key];
           }
         }
-        (0, import_utils10.assign)(this.currentOptions, freezeConfigValue(cloned));
+        (0, import_utils11.assign)(this.currentOptions, freezeConfigValue(cloned));
       }
       onchange(key, func) {
-        (0, import_utils10.set)(this.listeners, key, func);
+        (0, import_utils11.set)(this.listeners, key, func);
         return this;
       }
       snapshot() {
@@ -1397,7 +1487,7 @@ var init_manager = __esm({
             cloned[key] = snap[key];
           }
         }
-        (0, import_utils10.assign)(current, freezeConfigValue(cloned));
+        (0, import_utils11.assign)(current, freezeConfigValue(cloned));
       }
     };
   }
@@ -1597,10 +1687,10 @@ var init_data_values = __esm({
 });
 
 // src/options/data-manager.ts
-var import_utils11, admitData, DataOptionsManager;
+var import_utils12, admitData, DataOptionsManager;
 var init_data_manager = __esm({
   "src/options/data-manager.ts"() {
-    import_utils11 = require("@web-ts-toolkit/utils");
+    import_utils12 = require("@web-ts-toolkit/utils");
     init_manager();
     init_data_values();
     admitData = (options) => {
@@ -1618,7 +1708,7 @@ var init_data_manager = __esm({
           super.set("data", createDataSnapshot(value));
         } else if (path.startsWith("data.")) {
           const next = copyDataValue(getOwnedDataSnapshot(super.get("data")));
-          (0, import_utils11.set)(next, path.slice("data.".length), value);
+          (0, import_utils12.set)(next, path.slice("data.".length), value);
           super.set("data", createDataSnapshot(next));
         } else {
           super.set(key, value);
@@ -1656,7 +1746,7 @@ function validateRequestComplexity(value, options, scope2 = "request") {
       pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
       return;
     }
-    if ((0, import_utils12.isArray)(current)) {
+    if ((0, import_utils13.isArray)(current)) {
       if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
         logicalClauses += current.length;
         if (logicalClauses > limits.maxLogicalClauses) {
@@ -1676,14 +1766,14 @@ function validateRequestComplexity(value, options, scope2 = "request") {
       }
       return;
     }
-    if (!(0, import_utils12.isPlainObject)(current)) return;
+    if (!(0, import_utils13.isPlainObject)(current)) return;
     for (const [key, child] of Object.entries(current)) {
       if (key === "__proto__" || key === "prototype" || key === "constructor") {
         pushError(`Unsupported key: ${key}`, path.concat(key));
         return;
       }
       if (scope2 === "request" && key === "include") {
-        includeCount += (0, import_utils12.isArray)(child) ? child.length : 1;
+        includeCount += (0, import_utils13.isArray)(child) ? child.length : 1;
         if (includeCount > limits.maxIncludeCount) {
           pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
           return;
@@ -1706,10 +1796,10 @@ function validateRequestComplexity(value, options, scope2 = "request") {
   visit(value, [], 0);
   return errors;
 }
-var import_utils12, defaultRequestComplexity, normalizePositiveInteger, resolveRequestComplexity;
+var import_utils13, defaultRequestComplexity, normalizePositiveInteger, resolveRequestComplexity;
 var init_request_complexity = __esm({
   "src/request-complexity.ts"() {
-    import_utils12 = require("@web-ts-toolkit/utils");
+    import_utils13 = require("@web-ts-toolkit/utils");
     defaultRequestComplexity = {
       maxDepth: 8,
       maxNodes: 500,
@@ -1755,13 +1845,14 @@ var init_request_complexity = __esm({
 });
 
 // src/runtime.ts
-var import_mongoose3, import_mongoose_schema_jsonschema, import_utils13, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, getScopeVirtualsObject, toVirtualDescriptor, AccessRuntime, defaultRuntime;
+var import_mongoose3, import_mongoose_schema_jsonschema, import_utils14, mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluralize, FIELD_ACCESS_KEYS, defaultModelOptions, defaultDataOptions, normalizeBasePath, hasModelPermission, classifyPermissionSchema, refreshPermissionMetadata, VIRTUAL_SUPPORTED_ACCESSES, VIRTUAL_UNSUPPORTED_ACCESSES, VIRTUAL_RESERVED_NAMES, VIRTUAL_DANGEROUS_SEGMENTS, VIRTUAL_NAME_PATTERN, isVirtualContainerValue, virtualFullPath, virtualPathsOverlap, collectStoredTopLevel, getChildSchemaForField, getNestedChildFields, cloneVirtualsForValidation, validateVirtualDependsOn, validateVirtualLeafValue, validateVirtualsScope, validateVirtualsTree, getScopeVirtualsObject, toVirtualDescriptor, AccessRuntime, defaultRuntime;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     import_mongoose3 = __toESM(require("mongoose"));
     init_public_admission();
+    init_hydration();
     import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-    import_utils13 = require("@web-ts-toolkit/utils");
+    import_utils14 = require("@web-ts-toolkit/utils");
     init_helpers();
     init_registry();
     init_logger_default();
@@ -1788,44 +1879,44 @@ var init_runtime = __esm({
       listHardLimit: DEFAULT_LIST_HARD_LIMIT
     };
     normalizeBasePath = (name, value) => {
-      if ((0, import_utils13.isNil)(value)) {
+      if ((0, import_utils14.isNil)(value)) {
         return `/${pluralize(name)}`;
       }
-      return (0, import_utils13.isString)(value) ? (0, import_utils13.addLeadingSlash)(value) : "";
+      return (0, import_utils14.isString)(value) ? (0, import_utils14.addLeadingSlash)(value) : "";
     };
     hasModelPermission = (value, modelPermissionPrefix) => {
       if (!modelPermissionPrefix) {
         return true;
       }
-      if ((0, import_utils13.isString)(value)) {
+      if ((0, import_utils14.isString)(value)) {
         return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
       }
-      if ((0, import_utils13.isArray)(value)) {
+      if ((0, import_utils14.isArray)(value)) {
         return value.some((item) => {
-          if ((0, import_utils13.isString)(item) || (0, import_utils13.isArray)(item)) {
+          if ((0, import_utils14.isString)(item) || (0, import_utils14.isArray)(item)) {
             return hasModelPermission(item, modelPermissionPrefix);
           }
           return true;
         });
       }
-      return (0, import_utils13.isFunction)(value);
+      return (0, import_utils14.isFunction)(value);
     };
     classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       const schemaKeys = Object.keys(permissionSchema);
       const globalPermissionKeys = {};
       const modelPermissionKeys = {};
-      (0, import_utils13.forEach)(schemaKeys, (schemaKey) => {
+      (0, import_utils14.forEach)(schemaKeys, (schemaKey) => {
         const schemaRule = permissionSchema[schemaKey];
-        const ruleEntries = (0, import_utils13.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+        const ruleEntries = (0, import_utils14.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
         for (let x = 0; x < ruleEntries.length; x++) {
           const [accessKey, value] = ruleEntries[x];
-          if (!(0, import_utils13.isArray)(globalPermissionKeys[accessKey])) {
+          if (!(0, import_utils14.isArray)(globalPermissionKeys[accessKey])) {
             globalPermissionKeys[accessKey] = [];
           }
-          if (!(0, import_utils13.isArray)(modelPermissionKeys[accessKey])) {
+          if (!(0, import_utils14.isArray)(modelPermissionKeys[accessKey])) {
             modelPermissionKeys[accessKey] = [];
           }
-          if ((0, import_utils13.isBoolean)(value)) {
+          if ((0, import_utils14.isBoolean)(value)) {
             globalPermissionKeys[accessKey].push(schemaKey);
             continue;
           }
@@ -1857,13 +1948,13 @@ var init_runtime = __esm({
     VIRTUAL_RESERVED_NAMES = /* @__PURE__ */ new Set(["_id", "__v", "id"]);
     VIRTUAL_DANGEROUS_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
     VIRTUAL_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-    isVirtualContainerValue = (value) => (0, import_utils13.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue = (value) => (0, import_utils14.isPlainObject)(value) && "sub" in value;
     virtualFullPath = (prefix, name) => prefix ? `${prefix}.${name}` : name;
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
       try {
-        if ((0, import_utils13.get)((0, import_utils13.set)({}, virtualPath, true), permissionField) !== void 0) return true;
-        if ((0, import_utils13.get)((0, import_utils13.set)({}, permissionField, true), virtualPath) !== void 0) return true;
+        if ((0, import_utils14.get)((0, import_utils14.set)({}, virtualPath, true), permissionField) !== void 0) return true;
+        if ((0, import_utils14.get)((0, import_utils14.set)({}, permissionField, true), virtualPath) !== void 0) return true;
       } catch {
         return false;
       }
@@ -1924,12 +2015,12 @@ var init_runtime = __esm({
     };
     validateVirtualDependsOn = (dependsOn, entryLabel, storedFields, siblingVirtualNames) => {
       if (dependsOn === void 0) return [];
-      if (!(0, import_utils13.isArray)(dependsOn)) {
+      if (!(0, import_utils14.isArray)(dependsOn)) {
         throw new Error(`Virtual ${entryLabel}: dependsOn must be an array of top-level persisted field names`);
       }
       const list = dependsOn;
       for (const dep of list) {
-        if (!(0, import_utils13.isString)(dep) || dep.length === 0) {
+        if (!(0, import_utils14.isString)(dep) || dep.length === 0) {
           throw new Error(`Virtual ${entryLabel}: dependsOn entries must be non-empty strings`);
         }
         if (dep.includes(".")) {
@@ -1951,12 +2042,12 @@ var init_runtime = __esm({
       return list;
     };
     validateVirtualLeafValue = (value, entryLabel, storedFields, siblingVirtualNames, sharedDependsOn) => {
-      if ((0, import_utils13.isFunction)(value)) return;
-      if (!(0, import_utils13.isPlainObject)(value)) {
+      if ((0, import_utils14.isFunction)(value)) return;
+      if (!(0, import_utils14.isPlainObject)(value)) {
         throw new Error(`Virtual ${entryLabel}: descriptor must be a getter function or { get, dependsOn }`);
       }
       const record2 = value;
-      if (!(0, import_utils13.isFunction)(record2.get)) {
+      if (!(0, import_utils14.isFunction)(record2.get)) {
         throw new Error(`Virtual ${entryLabel}: descriptor.get must be a callable getter function`);
       }
       validateVirtualDependsOn(record2.dependsOn ?? sharedDependsOn, entryLabel, storedFields, siblingVirtualNames);
@@ -1996,7 +2087,7 @@ var init_runtime = __esm({
               `Virtual ${scopeLabel}${name}: scope-container must only hold "sub" (embedded container "${name}" is not a virtual-leaf collision)`
             );
           }
-          if (!(0, import_utils13.isPlainObject)(record3.sub)) {
+          if (!(0, import_utils14.isPlainObject)(record3.sub)) {
             throw new Error(`Virtual ${scopeLabel}${name}: scope-container "sub" must be a plain object`);
           }
           continue;
@@ -2006,8 +2097,8 @@ var init_runtime = __esm({
             `Virtual ${scopeLabel}${name}: collides with a stored path (inspected actual Mongoose schema/child scope; getModelAtt alone is insufficient)`
           );
         }
-        if ((0, import_utils13.isFunction)(raw)) continue;
-        if (!(0, import_utils13.isPlainObject)(raw)) {
+        if ((0, import_utils14.isFunction)(raw)) continue;
+        if (!(0, import_utils14.isPlainObject)(raw)) {
           throw new Error(
             `Virtual ${scopeLabel}${name}: malformed descriptor (expected getter, { get, dependsOn }, or per-access record)`
           );
@@ -2061,7 +2152,7 @@ var init_runtime = __esm({
     };
     validateVirtualsTree = (model, virtuals, documentPermissionField, modelName) => {
       if (virtuals === void 0 || virtuals === null) return;
-      if (!(0, import_utils13.isPlainObject)(virtuals)) {
+      if (!(0, import_utils14.isPlainObject)(virtuals)) {
         throw new Error(`Virtuals for model "${modelName}": virtuals must be a plain object mapping names to descriptors`);
       }
       const rootSchema = model?.schema ?? null;
@@ -2108,27 +2199,27 @@ var init_runtime = __esm({
       visitContainers(rootVirtuals, rootSchema, "");
     };
     getScopeVirtualsObject = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils13.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils14.isPlainObject)(rootVirtuals)) return null;
       if (!scopePath || scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils13.isPlainObject)(current)) return null;
+        if (!(0, import_utils14.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue(container)) return null;
         current = container.sub;
-        if (!(0, import_utils13.isPlainObject)(current)) return null;
+        if (!(0, import_utils14.isPlainObject)(current)) return null;
       }
       return current;
     };
     toVirtualDescriptor = (leaf, sharedDependsOn) => {
-      if ((0, import_utils13.isFunction)(leaf))
+      if ((0, import_utils14.isFunction)(leaf))
         return { get: leaf, dependsOn: sharedDependsOn ?? [] };
-      if (!(0, import_utils13.isPlainObject)(leaf)) return null;
+      if (!(0, import_utils14.isPlainObject)(leaf)) return null;
       const record2 = leaf;
-      if (!(0, import_utils13.isFunction)(record2.get)) return null;
+      if (!(0, import_utils14.isFunction)(record2.get)) return null;
       const dependsOn = record2.dependsOn ?? sharedDependsOn ?? [];
       return { get: record2.get, dependsOn };
     };
@@ -2193,7 +2284,7 @@ var init_runtime = __esm({
       }
       registerOpenApiRoute(route) {
         this.openApiRegistry.register(
-          this.openApiPathPrefix ? { ...route, path: (0, import_utils13.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
+          this.openApiPathPrefix ? { ...route, path: (0, import_utils14.normalizeUrlPath)(`${this.openApiPathPrefix}/${route.path}`) } : route
         );
       }
       /**
@@ -2204,7 +2295,7 @@ var init_runtime = __esm({
        */
       withOpenApiPathPrefix(prefix, build) {
         const previous = this.openApiPathPrefix;
-        this.openApiPathPrefix = (0, import_utils13.normalizeUrlPath)(`${previous}/${prefix}`);
+        this.openApiPathPrefix = (0, import_utils14.normalizeUrlPath)(`${previous}/${prefix}`);
         try {
           return build();
         } finally {
@@ -2324,9 +2415,25 @@ var init_runtime = __esm({
       }
       /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
       setDefaultModelOptions(options) {
+        assertPublicDefaults(options.defaults);
+        if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
         this.defaultModelOptions.assign(options);
       }
       setDefaultModelOption(key, value) {
+        const keyStr = String(key);
+        if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+          this.defaultModelOptions.set(
+            "hydration",
+            normalizeHydrationUpdate(this.getDefaultModelOptions().hydration, keyStr, value)
+          );
+          return;
+        }
+        if (keyStr === "defaults") assertPublicDefaults(value);
+        else if (keyStr.startsWith("defaults.")) {
+          const proposed = {};
+          (0, import_utils14.set)(proposed, keyStr.slice("defaults.".length), value);
+          assertPublicDefaults(proposed);
+        }
         this.defaultModelOptions.set(key, value);
       }
       getDefaultModelOptions() {
@@ -2353,7 +2460,7 @@ var init_runtime = __esm({
         }).onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             modelName,
-            (0, import_utils13.isString)(newval) || (0, import_utils13.isNil)(newval) ? newval : void 0
+            (0, import_utils14.isString)(newval) || (0, import_utils14.isNil)(newval) ? newval : void 0
           );
         }).build();
         this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -2376,6 +2483,7 @@ var init_runtime = __esm({
        */
       setModelOptions(modelName, options) {
         assertPublicDefaults(options.defaults);
+        if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
         const manager = this.getOrCreateModelOptions(modelName);
         const defaultOptions = this.getDefaultModelOptions();
         const currentModelOptions = manager.fetch();
@@ -2386,14 +2494,19 @@ var init_runtime = __esm({
         manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
       }
       setModelOption(modelName, key, value) {
-        const manager = this.getOrCreateModelOptions(modelName);
         const keyStr = String(key);
+        if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+          const hydration = normalizeHydrationUpdate(this.modelOptions[modelName]?.get("hydration"), keyStr, value);
+          this.getOrCreateModelOptions(modelName).set("hydration", hydration);
+          return;
+        }
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
-          (0, import_utils13.set)(proposed, keyStr.slice("defaults.".length), value);
+          (0, import_utils14.set)(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
+        const manager = this.getOrCreateModelOptions(modelName);
         if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
           const model = this.getModelInstance(modelName);
           const currentVirtuals = manager.get("virtuals");
@@ -2411,15 +2524,15 @@ var init_runtime = __esm({
               const segments = nestedPath.split(".");
               let cursor = cloned;
               for (let i = 0; i < segments.length - 1; i++) {
-                if (!(0, import_utils13.isPlainObject)(cursor)) break;
+                if (!(0, import_utils14.isPlainObject)(cursor)) break;
                 cursor = cursor[segments[i]];
               }
-              if ((0, import_utils13.isPlainObject)(cursor)) {
+              if ((0, import_utils14.isPlainObject)(cursor)) {
                 delete cursor[segments[segments.length - 1]];
               }
               proposedVirtuals = cloned;
             } else {
-              (0, import_utils13.set)(cloned, nestedPath, value);
+              (0, import_utils14.set)(cloned, nestedPath, value);
               proposedVirtuals = cloned;
             }
           }
@@ -2497,8 +2610,8 @@ var init_runtime = __esm({
         if (!scopeVirtuals || !(virtualName in scopeVirtuals)) return void 0;
         const entry = scopeVirtuals[virtualName];
         if (entry === void 0 || isVirtualContainerValue(entry)) return void 0;
-        if ((0, import_utils13.isFunction)(entry)) return { get: entry, dependsOn: [] };
-        if (!(0, import_utils13.isPlainObject)(entry)) return void 0;
+        if ((0, import_utils14.isFunction)(entry)) return { get: entry, dependsOn: [] };
+        if (!(0, import_utils14.isPlainObject)(entry)) return void 0;
         const record2 = entry;
         if ("get" in record2) {
           const descriptor = toVirtualDescriptor(entry, void 0);
@@ -2534,7 +2647,7 @@ var init_runtime = __esm({
         manager.onchange("basePath", function(newval, key, target) {
           target[key] = normalizeBasePath(
             dataName,
-            (0, import_utils13.isString)(newval) || (0, import_utils13.isNil)(newval) ? newval : void 0
+            (0, import_utils14.isString)(newval) || (0, import_utils14.isNil)(newval) ? newval : void 0
           );
         }).build();
         return manager;
@@ -2594,20 +2707,20 @@ var init_runtime = __esm({
         const schema = model.schema;
         this.modelRefs[modelName] = buildRefs(schema.tree);
         this.modelSubs[modelName] = buildSubPaths(schema.tree);
-        this.modelAtts[modelName] = (0, import_utils13.keys)(schema.obj);
+        this.modelAtts[modelName] = (0, import_utils14.keys)(schema.obj);
       }
       getModelRef(modelName, refPath) {
         this.ensureModelMeta(modelName);
-        const value = (0, import_utils13.get)(this.modelRefs, `${modelName}.${refPath}`, null);
-        return (0, import_utils13.isString)(value) ? value : null;
+        const value = (0, import_utils14.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+        return (0, import_utils14.isString)(value) ? value : null;
       }
       getModelSub(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils13.get)(this.modelSubs, modelName, []);
+        return (0, import_utils14.get)(this.modelSubs, modelName, []);
       }
       getModelAtt(modelName) {
         this.ensureModelMeta(modelName);
-        return (0, import_utils13.get)(this.modelAtts, modelName, []);
+        return (0, import_utils14.get)(this.modelAtts, modelName, []);
       }
     };
     defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -2783,10 +2896,10 @@ var init_options = __esm({
 });
 
 // src/permission.ts
-var import_utils14, Permission, permission_default;
+var import_utils15, Permission, permission_default;
 var init_permission = __esm({
   "src/permission.ts"() {
-    import_utils14 = require("@web-ts-toolkit/utils");
+    import_utils15 = require("@web-ts-toolkit/utils");
     Permission = class {
       constructor(permissions) {
         this.permissions = { ...permissions };
@@ -2802,7 +2915,7 @@ var init_permission = __esm({
         return [permissionOrPermissions].concat(permissions);
       }
       hasKey(permission) {
-        return (0, import_utils14.hasOwn)(this.permissions, permission);
+        return (0, import_utils15.hasOwn)(this.permissions, permission);
       }
       has(permission) {
         return this.permissions[permission] === true;
@@ -3872,36 +3985,36 @@ function planVirtualProjection(args) {
     relatedPlans
   };
 }
-var import_utils17, isVirtualContainerValue2, getScopeVirtualsObject2, toSnapshotDescriptor, resolveSnapshotDescriptor, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
+var import_utils18, isVirtualContainerValue2, getScopeVirtualsObject2, toSnapshotDescriptor, resolveSnapshotDescriptor, getScopedPermissionSchema, resolveAlwaysSelectForAccess, stripVirtualsFromNormalizedSelect, snapshotVirtualPaths, stripLeadingDash, dbPrefixForScope, toDbPath;
 var init_virtual_projection = __esm({
   "src/acl/virtual-projection.ts"() {
-    import_utils17 = require("@web-ts-toolkit/utils");
+    import_utils18 = require("@web-ts-toolkit/utils");
     init_query();
     init_field_authorization();
     init_output_projection();
-    isVirtualContainerValue2 = (value) => (0, import_utils17.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue2 = (value) => (0, import_utils18.isPlainObject)(value) && "sub" in value;
     getScopeVirtualsObject2 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils17.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils18.isPlainObject)(rootVirtuals)) return null;
       if (!scopePath || scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils17.isPlainObject)(current)) return null;
+        if (!(0, import_utils18.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue2(container)) return null;
         current = container.sub;
-        if (!(0, import_utils17.isPlainObject)(current)) return null;
+        if (!(0, import_utils18.isPlainObject)(current)) return null;
       }
       return current;
     };
     toSnapshotDescriptor = (leaf, sharedDependsOn) => {
-      if ((0, import_utils17.isFunction)(leaf))
+      if ((0, import_utils18.isFunction)(leaf))
         return { get: leaf, dependsOn: sharedDependsOn ?? [] };
-      if (!(0, import_utils17.isPlainObject)(leaf)) return null;
+      if (!(0, import_utils18.isPlainObject)(leaf)) return null;
       const record2 = leaf;
-      if (!(0, import_utils17.isFunction)(record2.get)) return null;
+      if (!(0, import_utils18.isFunction)(record2.get)) return null;
       const dependsOn = record2.dependsOn ?? sharedDependsOn ?? [];
       return { get: record2.get, dependsOn: [...dependsOn] };
     };
@@ -3909,8 +4022,8 @@ var init_virtual_projection = __esm({
       if (!scopeVirtuals || !(virtualName in scopeVirtuals)) return void 0;
       const entry = scopeVirtuals[virtualName];
       if (entry === void 0 || isVirtualContainerValue2(entry)) return void 0;
-      if ((0, import_utils17.isFunction)(entry)) return { get: entry, dependsOn: [] };
-      if (!(0, import_utils17.isPlainObject)(entry)) return void 0;
+      if ((0, import_utils18.isFunction)(entry)) return { get: entry, dependsOn: [] };
+      if (!(0, import_utils18.isPlainObject)(entry)) return void 0;
       const record2 = entry;
       if ("get" in record2) {
         return toSnapshotDescriptor(entry, void 0) ?? void 0;
@@ -3929,20 +4042,20 @@ var init_virtual_projection = __esm({
       return void 0;
     };
     getScopedPermissionSchema = (root, scopePath) => {
-      if (!root || !(0, import_utils17.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils18.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
-      const scoped = (0, import_utils17.get)(root, scopePath.join("."));
-      return (0, import_utils17.isPlainObject)(scoped) ? scoped : null;
+      const scoped = (0, import_utils18.get)(root, scopePath.join("."));
+      return (0, import_utils18.isPlainObject)(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
       if (!raw) return [];
-      if ((0, import_utils17.isArray)(raw)) return [...raw];
-      if ((0, import_utils17.isPlainObject)(raw)) {
+      if ((0, import_utils18.isArray)(raw)) return [...raw];
+      if ((0, import_utils18.isPlainObject)(raw)) {
         const record2 = raw;
         const exact = record2[access];
-        if ((0, import_utils17.isArray)(exact)) return [...exact];
+        if ((0, import_utils18.isArray)(exact)) return [...exact];
         const def = record2.default;
-        if ((0, import_utils17.isArray)(def)) return [...def];
+        if ((0, import_utils18.isArray)(def)) return [...def];
         return [];
       }
       return [];
@@ -4182,12 +4295,11 @@ var init_output_projection = __esm({
 
 // src/acl/model-output-planning.ts
 function getCapturedAuthorizationOption(configuration, key) {
-  return resolveNestedOption((path, fallback) => (0, import_utils18.get)(configuration, path, fallback), key);
+  return resolveNestedOption((path, fallback) => (0, import_utils19.get)(configuration, path, fallback), key);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
-  const options = runtime.getModelOptions(modelName);
   const virtuals = options.virtuals;
   return {
     catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
@@ -4205,7 +4317,8 @@ function captureModelAuthorizationConfiguration(runtime, modelName) {
     baseFilter: options.baseFilter,
     idField: options.idField,
     resolveIdFilter: options.resolveIdFilter,
-    operationAccess: options.operationAccess
+    operationAccess: options.operationAccess,
+    hydration: options.hydration
   };
 }
 function planModelOutputForHelper(args) {
@@ -4230,10 +4343,10 @@ function planModelOutputForHelper(args) {
     requestedSelect: args.select
   });
 }
-var import_utils18;
+var import_utils19;
 var init_model_output_planning = __esm({
   "src/acl/model-output-planning.ts"() {
-    import_utils18 = require("@web-ts-toolkit/utils");
+    import_utils19 = require("@web-ts-toolkit/utils");
     init_manager();
     init_field_catalog();
     init_authorization_snapshot();
@@ -4244,10 +4357,10 @@ var init_model_output_planning = __esm({
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils19.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils19.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils20.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils20.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils19.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils20.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -4264,11 +4377,11 @@ function optimizeAndFilter(clausesInput) {
   const dedupeKey = (value) => {
     if (value instanceof RegExp) return `regexp:${JSON.stringify([value.source, value.flags])}`;
     if (value instanceof Date) return `date:${value.getTime()}`;
-    if ((0, import_utils19.isArray)(value)) {
+    if ((0, import_utils20.isArray)(value)) {
       const entries = Array.from(value, dedupeKey);
       return entries.every((entry) => entry !== void 0) ? `array:${JSON.stringify(entries)}` : void 0;
     }
-    if ((0, import_utils19.isPlainObject)(value)) {
+    if ((0, import_utils20.isPlainObject)(value)) {
       const entries = Object.keys(value).sort().map((key) => [key, dedupeKey(value[key])]);
       return entries.every(([, entry]) => entry !== void 0) ? `object:${JSON.stringify(entries)}` : void 0;
     }
@@ -4298,7 +4411,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if ((0, import_utils19.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
+      if ((0, import_utils20.hasOwn)(mergedClause, key) && !(0, import_node_util4.isDeepStrictEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -4309,24 +4422,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils19.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils20.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils19.isPlainObject)(filter2) || (0, import_utils19.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils20.isPlainObject)(filter2) || (0, import_utils20.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils19.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils20.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils19.isString)(idField)) {
+  if ((0, import_utils20.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -4350,7 +4463,7 @@ async function resolveAccessFilterParts({
   }
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
   const baseFilterFn = rows.mode === "request" ? getOption(`baseFilter.${access}`, null) : null;
-  if (nextFilter !== false && (0, import_utils19.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils20.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   if (nextFilter === false) return { transformed: false, scope: {}, filter: false };
@@ -4358,7 +4471,7 @@ async function resolveAccessFilterParts({
     const scope2 = rows.mode === "scope" ? rows.filter : {};
     return { transformed: nextFilter ?? {}, scope: scope2, filter: intersectFilters(nextFilter, scope2) };
   }
-  if (!(0, import_utils19.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
+  if (!(0, import_utils20.isFunction)(baseFilterFn)) return { transformed: nextFilter ?? {}, scope: {}, filter: nextFilter ?? {} };
   const cached = cache.get(cacheKey);
   const reusable = cached?.resolver === baseFilterFn;
   const baseFilter = normalizeFilter(
@@ -4393,34 +4506,34 @@ async function setRequestPermissions(req) {
   if (owner === activeRuntime) return;
   if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  const permissions = (0, import_utils19.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
-  if ((0, import_utils19.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils19.isArray)(permissions)) req[requestPermissionField] = (0, import_utils19.arrayToRecord)(permissions);
-  else if ((0, import_utils19.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  const permissions = (0, import_utils20.isFunction)(globalPermissions) ? await globalPermissions.call(req, req) : void 0;
+  if ((0, import_utils20.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils20.isArray)(permissions)) req[requestPermissionField] = (0, import_utils20.arrayToRecord)(permissions);
+  else if ((0, import_utils20.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
   else req[requestPermissionField] = {};
   owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils19.isBoolean)(routeGuard)) {
+  if ((0, import_utils20.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils19.isString)(routeGuard)) {
+  if ((0, import_utils20.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils19.isArray)(routeGuard)) {
+  if ((0, import_utils20.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils19.isFunction)(routeGuard)) {
+  if ((0, import_utils20.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils19.castArray)(hook);
+  const hooks = (0, import_utils20.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils19.isFunction)(hooks[x])) {
+    if ((0, import_utils20.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -4440,22 +4553,22 @@ async function collectSchemaFields({
   for (let x = 0; x < keys2.length; x++) {
     const key = keys2[x];
     const value = extractScopedOutputRule(permissionSchema, key, access);
-    if ((0, import_utils19.isBoolean)(value)) {
+    if ((0, import_utils20.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils19.isString)(value)) {
+    } else if ((0, import_utils20.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils19.isArray)(value)) {
+    } else if ((0, import_utils20.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils19.isFunction)(value)) {
+    } else if ((0, import_utils20.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
   return fields;
 }
-var import_utils19, import_node_util4, permissionFieldOwners;
+var import_utils20, import_node_util4, permissionFieldOwners;
 var init_core_shared = __esm({
   "src/core-shared.ts"() {
-    import_utils19 = require("@web-ts-toolkit/utils");
+    import_utils20 = require("@web-ts-toolkit/utils");
     import_node_util4 = require("util");
     init_helpers();
     init_options();
@@ -4683,7 +4796,7 @@ async function resolveOutputDocumentAuthorization(args) {
     try {
       const run = () => hook.call(this, doc, permissions, args.context);
       const grants = await getRequestWorkState(binding.request, binding.runtime).hookGate.run(run);
-      return (0, import_utils23.isPlainObject)(grants) ? grants : {};
+      return (0, import_utils24.isPlainObject)(grants) ? grants : {};
     } catch (error2) {
       warn("docPermissions hook failed; applying empty document permissions", {
         modelName: binding.modelName,
@@ -4798,7 +4911,7 @@ function copyOutputValue(value, plan, path) {
   const visit = (input, current) => {
     if (Array.isArray(input)) return input.map((entry) => visit(entry, current));
     if (input instanceof Map) return visit(Object.fromEntries(input), current);
-    if (!(0, import_utils23.isPlainObject)(input)) return deepIsolateValue(input);
+    if (!(0, import_utils24.isPlainObject)(input)) return deepIsolateValue(input);
     const output = {};
     for (const [key, entry] of Object.entries(input)) {
       const child = `${current}.${key}`;
@@ -4814,7 +4927,7 @@ function copyOutputValue(value, plan, path) {
 }
 function copyAuthorizedReference(value, plan, path) {
   if (Array.isArray(value)) return value.map((entry) => copyAuthorizedReference(entry, plan, path));
-  if (!(0, import_utils23.isPlainObject)(value)) return deepIsolateValue(value);
+  if (!(0, import_utils24.isPlainObject)(value)) return deepIsolateValue(value);
   const handle = getAssociatedDocumentAuthorization(value, plan.authorization);
   if (handle) {
     const copy = deepIsolateValue(value);
@@ -4831,8 +4944,8 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   if (scope2.length || configuration.stripPermissionsField) return;
   const parts = (configuration.documentPermissionField ?? "_permissions").split(".");
   let value = source;
-  for (const part of parts) value = (0, import_utils23.isPlainObject)(value) ? value[part] : void 0;
-  if (!(0, import_utils23.isPlainObject)(value)) return;
+  for (const part of parts) value = (0, import_utils24.isPlainObject)(value) ? value[part] : void 0;
+  if (!(0, import_utils24.isPlainObject)(value)) return;
   const keys2 = configuration.exposedDocPermissionKeys;
   const metadata = Object.fromEntries(
     Object.entries(value).filter(
@@ -4842,12 +4955,13 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   const copy = { ...output };
   let target = copy;
   for (const part of parts.slice(0, -1)) {
-    target[part] = (0, import_utils23.isPlainObject)(target[part]) ? { ...target[part] } : {};
+    target[part] = (0, import_utils24.isPlainObject)(target[part]) ? { ...target[part] } : {};
     target = target[part];
   }
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
   transferDocumentAuthorizationGraph(output[parts[0]], copy[parts[0]]);
   output[parts[0]] = copy[parts[0]];
+  attachPermissionsAlias(output, parts.join("."));
 }
 function helperPlan(authorization, binding) {
   const { configuration, authorization: policy, access } = readServiceAuthorization(authorization, binding);
@@ -4883,7 +4997,7 @@ async function filterExistingOutput(source, plan, handle, associated) {
           for (const entry of value2) values.push(await one(entry) ?? null);
           return values;
         }
-        if (!(0, import_utils23.isPlainObject)(value2)) return value2 === null ? null : void 0;
+        if (!(0, import_utils24.isPlainObject)(value2)) return value2 === null ? null : void 0;
         const childHandle = associated ? getAssociatedDocumentAuthorization(value2) : void 0;
         let child = scoped;
         if (childHandle) {
@@ -4963,7 +5077,7 @@ async function filterModelOutputForHelper(args) {
   const plan = helperPlan(normalized.authorization, binding);
   if (args.doc == null) return { output: args.doc, fields: [] };
   const source = isolateDocForOutput(args.doc);
-  if (!(0, import_utils23.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
+  if (!(0, import_utils24.isPlainObject)(source)) return authorizationError("output helper requires one plain or hydrated document");
   const knownOutput = !!args.doc && typeof args.doc === "object" && isKnownAuthorizationOutput(args.doc);
   const handle = await resolveOutputDocumentAuthorization({
     authorization: normalized.authorization,
@@ -4974,10 +5088,11 @@ async function filterModelOutputForHelper(args) {
   });
   return filterExistingOutput(source, plan, handle, false);
 }
-var import_utils23, unresolvedDocuments, owningDocuments;
+var import_utils24, unresolvedDocuments, owningDocuments;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
-    import_utils23 = require("@web-ts-toolkit/utils");
+    import_utils24 = require("@web-ts-toolkit/utils");
+    init_permissions_alias();
     init_document();
     init_request_work();
     init_logger_helpers();
@@ -5069,8 +5184,8 @@ async function finalizeSingleDoc(args, input) {
   const limit = args.resolvedLimit;
   const gate = args.sharedGate;
   const isolated = isolateDocForOutput(input);
-  const output = (0, import_utils24.isPlainObject)(isolated) ? isolated : {};
-  if (captured && (0, import_utils24.isPlainObject)(input))
+  const output = (0, import_utils25.isPlainObject)(isolated) ? isolated : {};
+  if (captured && (0, import_utils25.isPlainObject)(input))
     for (const key of Object.keys(output)) {
       transferDocumentAuthorizationGraph(input[key], output[key]);
     }
@@ -5125,7 +5240,7 @@ async function finalizeSingleDoc(args, input) {
       );
       continue;
     }
-    if (captured && !(0, import_utils24.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
+    if (captured && !(0, import_utils25.isPlainObject)(rawContainer) && !Array.isArray(rawContainer)) {
       delete output[containerName];
       continue;
     }
@@ -5147,7 +5262,7 @@ async function finalizeSingleDoc(args, input) {
     };
     const finalizeOneChild = async (rawChild) => {
       if (captured && Array.isArray(rawChild)) return mapWithConcurrencyLimit(rawChild, limit, finalizeOneChild);
-      if (!(0, import_utils24.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
+      if (!(0, import_utils25.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return captured ? null : deepIsolateValue(rawChild);
       if (args.traversal?.finalizeEmbeddedChildren) {
         return args.traversal.finalizeEmbeddedChildren({
           containerName,
@@ -5167,7 +5282,7 @@ async function finalizeSingleDoc(args, input) {
     if (Array.isArray(rawContainer)) {
       const finalized = await mapWithConcurrencyLimit(rawContainer, limit, (entry) => finalizeOneChild(entry));
       output[containerName] = finalized;
-    } else if ((0, import_utils24.isPlainObject)(rawContainer)) {
+    } else if ((0, import_utils25.isPlainObject)(rawContainer)) {
       output[containerName] = await finalizeOneChild(rawContainer);
     }
   }
@@ -5175,7 +5290,7 @@ async function finalizeSingleDoc(args, input) {
   for (const target of relatedTargets) {
     let rawRelated;
     try {
-      rawRelated = target.path.includes(".") ? (0, import_utils24.get)(output, target.path) : output[target.path];
+      rawRelated = target.path.includes(".") ? (0, import_utils25.get)(output, target.path) : output[target.path];
     } catch {
       continue;
     }
@@ -5204,7 +5319,7 @@ async function finalizeSingleDoc(args, input) {
       related: target.plan.relatedPlans?.length ? (args.related ?? []).filter((entry) => entry.path.startsWith(`${target.path}.`)) : []
     };
     const finalizeOneRelated = async (rawChild) => {
-      if (!(0, import_utils24.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
+      if (!(0, import_utils25.isPlainObject)(rawChild) && !Array.isArray(rawChild)) return rawChild;
       if (typeof rawChild?._bsontype === "string") return rawChild;
       if (args.traversal?.finalizeRelatedValue) {
         return args.traversal.finalizeRelatedValue({ path: target.path, target, rawValue: rawChild, parentArgs: args });
@@ -5214,13 +5329,13 @@ async function finalizeSingleDoc(args, input) {
     let finalized;
     if (Array.isArray(rawRelated)) {
       finalized = await mapWithConcurrencyLimit(rawRelated, limit, (entry) => finalizeOneRelated(entry));
-    } else if ((0, import_utils24.isPlainObject)(rawRelated)) {
+    } else if ((0, import_utils25.isPlainObject)(rawRelated)) {
       finalized = await finalizeOneRelated(rawRelated);
     } else {
       continue;
     }
     try {
-      if (target.path.includes(".")) (0, import_utils24.set)(output, target.path, finalized);
+      if (target.path.includes(".")) (0, import_utils25.set)(output, target.path, finalized);
       else output[target.path] = finalized;
     } catch {
     }
@@ -5390,10 +5505,10 @@ async function finalizeModelOutputs(args) {
     return finalizeSingleDoc(internal, input);
   });
 }
-var import_utils24, isVirtualContainerValue3, getScopeVirtualsObject3, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
+var import_utils25, isVirtualContainerValue3, getScopeVirtualsObject3, getScopeVirtualNames, getScopedPermissionSchema2, resolveGlobalPermissions, resolveDocPermissions, isAbsentDependency, __finalizeInternals;
 var init_finalize_model_output = __esm({
   "src/output/finalize-model-output.ts"() {
-    import_utils24 = require("@web-ts-toolkit/utils");
+    import_utils25 = require("@web-ts-toolkit/utils");
     init_document();
     init_concurrency();
     init_request_work();
@@ -5404,20 +5519,20 @@ var init_finalize_model_output = __esm({
     init_output_field_filter();
     init_field_authorization();
     init_field_catalog();
-    isVirtualContainerValue3 = (value) => (0, import_utils24.isPlainObject)(value) && "sub" in value;
+    isVirtualContainerValue3 = (value) => (0, import_utils25.isPlainObject)(value) && "sub" in value;
     getScopeVirtualsObject3 = (rootVirtuals, scopePath) => {
-      if (!rootVirtuals || !(0, import_utils24.isPlainObject)(rootVirtuals)) return null;
+      if (!rootVirtuals || !(0, import_utils25.isPlainObject)(rootVirtuals)) return null;
       if (scopePath.length === 0) return rootVirtuals;
       let current = rootVirtuals;
       for (let i = 0; i < scopePath.length; i += 2) {
         const field = scopePath[i];
         const subMarker = scopePath[i + 1];
         if (!field || subMarker !== "sub") return null;
-        if (!(0, import_utils24.isPlainObject)(current)) return null;
+        if (!(0, import_utils25.isPlainObject)(current)) return null;
         const container = current[field];
         if (!isVirtualContainerValue3(container)) return null;
         current = container.sub;
-        if (!(0, import_utils24.isPlainObject)(current)) return null;
+        if (!(0, import_utils25.isPlainObject)(current)) return null;
       }
       return current;
     };
@@ -5430,11 +5545,11 @@ var init_finalize_model_output = __esm({
       return Object.entries(scopeVirtuals).filter(([, v]) => v !== void 0 && !isVirtualContainerValue3(v)).map(([k]) => k);
     };
     getScopedPermissionSchema2 = (root, scopePath) => {
-      if (!root || !(0, import_utils24.isPlainObject)(root)) return null;
+      if (!root || !(0, import_utils25.isPlainObject)(root)) return null;
       if (scopePath.length === 0) return root;
       try {
-        const scoped = (0, import_utils24.get)(root, scopePath.join("."));
-        return (0, import_utils24.isPlainObject)(scoped) ? scoped : null;
+        const scoped = (0, import_utils25.get)(root, scopePath.join("."));
+        return (0, import_utils25.isPlainObject)(scoped) ? scoped : null;
       } catch {
         return null;
       }
@@ -5493,7 +5608,7 @@ var init_finalize_model_output = __esm({
           const grants = await args.sharedGate.run(
             () => hook.call(args.request, isolatedForHook, globalPerms, scopeContext)
           );
-          const normalized = (0, import_utils24.isPlainObject)(grants) ? grants : {};
+          const normalized = (0, import_utils25.isPlainObject)(grants) ? grants : {};
           scopeContext.docPermissions = normalized;
           return normalized;
         }
@@ -5565,15 +5680,15 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils42 = require("@web-ts-toolkit/utils");
+var import_utils43 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils35 = require("@web-ts-toolkit/utils");
+var import_utils36 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
 init_public_admission();
-var import_utils34 = require("@web-ts-toolkit/utils");
+var import_utils35 = require("@web-ts-toolkit/utils");
 init_options();
 
 // src/meta.ts
@@ -5598,13 +5713,13 @@ var getModelRef = (modelName, refPath) => {
 };
 
 // src/services/base.ts
-var import_utils20 = require("@web-ts-toolkit/utils");
+var import_utils21 = require("@web-ts-toolkit/utils");
 init_options();
 init_helpers();
 init_document();
 
 // src/output/include-output.ts
-var import_utils15 = require("@web-ts-toolkit/utils");
+var import_utils16 = require("@web-ts-toolkit/utils");
 init_document_authorization();
 init_document();
 var outputs2 = /* @__PURE__ */ new WeakMap();
@@ -5621,7 +5736,7 @@ function attachIncludeOutput(doc, path, value) {
   const state = stateFor(doc);
   if (!state) throw new Error("Include attachment requires a prepared output row");
   state.attachments.push({ path, value });
-  (0, import_utils15.set)(doc, path, deepIsolateValue(value));
+  (0, import_utils16.set)(doc, path, deepIsolateValue(value));
 }
 function getIncludeSource(doc) {
   return stateFor(doc)?.source ?? doc;
@@ -5636,7 +5751,7 @@ function restoreIncludeOutput(doc, output) {
   for (const { path, value } of attachments) {
     const copy = deepIsolateValue(value);
     if (copy !== null && typeof copy === "object") origins.set(copy, value);
-    (0, import_utils15.set)(output, path, copy);
+    (0, import_utils16.set)(output, path, copy);
   }
   return origins;
 }
@@ -5763,7 +5878,7 @@ function requestFieldScope(options) {
 init_public_admission();
 
 // src/correlated-includes.ts
-var import_utils16 = require("@web-ts-toolkit/utils");
+var import_utils17 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_sort_policy();
 var PARENT_MARKER_KEY = "$parent";
@@ -5776,10 +5891,10 @@ var FIELD_SEGMENT_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 var ARRAY_INDEX_SEGMENT_PATTERN = /^(0|[1-9]\d*)$/;
 var ownKeys = (value) => Object.keys(value);
 function isParentRefMarker(value) {
-  return (0, import_utils16.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
+  return (0, import_utils17.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === PARENT_MARKER_KEY;
 }
 function isEscapedParentRef(value) {
-  return (0, import_utils16.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
+  return (0, import_utils17.isPlainObject)(value) && ownKeys(value).length === 1 && ownKeys(value)[0] === ESCAPE_WRAPPER_KEY;
 }
 function hasMarkerKey(value) {
   return ownKeys(value).includes(PARENT_MARKER_KEY) || ownKeys(value).includes(ESCAPE_WRAPPER_KEY);
@@ -5798,12 +5913,12 @@ function containsParentMarkerShape(value) {
   const seen = /* @__PURE__ */ new Set();
   const visit = (current) => {
     if (isParentRefMarker(current) || isEscapedParentRef(current)) return true;
-    if ((0, import_utils16.isArray)(current)) {
+    if ((0, import_utils17.isArray)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       return current.some(visit);
     }
-    if ((0, import_utils16.isPlainObject)(current)) {
+    if ((0, import_utils17.isPlainObject)(current)) {
       if (seen.has(current)) return false;
       seen.add(current);
       if (hasMarkerKey(current)) return true;
@@ -5833,7 +5948,7 @@ function scanTemplateValueNode(value, path, issues) {
     }
     return;
   }
-  if ((0, import_utils16.isPlainObject)(value)) {
+  if ((0, import_utils17.isPlainObject)(value)) {
     if (hasMarkerKey(value)) {
       issues.push({
         message: 'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }',
@@ -5844,7 +5959,7 @@ function scanTemplateValueNode(value, path, issues) {
     scanTemplateObjectEntries(value, path, issues);
     return;
   }
-  if ((0, import_utils16.isArray)(value)) {
+  if ((0, import_utils17.isArray)(value)) {
     value.forEach((item, index) => scanTemplateValueNode(item, [...path, index], issues));
   }
 }
@@ -5885,7 +6000,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils16.isArray)(child)) {
+      if (!(0, import_utils17.isArray)(child)) {
         scanTemplateValueNode(child, childPath, issues);
         continue;
       }
@@ -5898,7 +6013,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
           });
           return;
         }
-        if ((0, import_utils16.isPlainObject)(clause)) {
+        if ((0, import_utils17.isPlainObject)(clause)) {
           scanTemplateObjectEntries(clause, clausePath, issues);
         }
       });
@@ -5909,7 +6024,7 @@ function scanTemplateObjectEntries(obj, basePath, issues) {
 }
 function validateCorrelatedFilterTemplate(filter2) {
   const issues = [];
-  if (!(0, import_utils16.isPlainObject)(filter2)) {
+  if (!(0, import_utils17.isPlainObject)(filter2)) {
     issues.push({ message: "Correlated include filter must be an object", path: [] });
     return issues;
   }
@@ -5952,13 +6067,13 @@ function collectFilterReferencePaths(filter2) {
       return;
     }
     if (isEscapedParentRef(value)) return;
-    if ((0, import_utils16.isArray)(value)) {
+    if ((0, import_utils17.isArray)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       value.forEach(visitValue);
       return;
     }
-    if ((0, import_utils16.isPlainObject)(value)) {
+    if ((0, import_utils17.isPlainObject)(value)) {
       if (seen.has(value)) return;
       seen.add(value);
       for (const [key, child] of Object.entries(value)) {
@@ -6004,7 +6119,7 @@ function getOwnPathValue(parent, path) {
   return current;
 }
 function cloneSubstitutedValue(value) {
-  if ((0, import_utils16.isPlainObject)(value) || (0, import_utils16.isArray)(value)) return (0, import_utils16.cloneDeep)(value);
+  if ((0, import_utils17.isPlainObject)(value) || (0, import_utils17.isArray)(value)) return (0, import_utils17.cloneDeep)(value);
   return value;
 }
 function literalParentRefObject(path) {
@@ -6045,7 +6160,7 @@ function resolveObjectEntries(obj, parent) {
       continue;
     }
     if (LOGICAL_CLAUSE_KEYS.has(key)) {
-      if (!(0, import_utils16.isArray)(child)) {
+      if (!(0, import_utils17.isArray)(child)) {
         out[key] = resolveValueNode(child, parent, false);
         continue;
       }
@@ -6053,7 +6168,7 @@ function resolveObjectEntries(obj, parent) {
         if (isParentRefMarker(clause) || isEscapedParentRef(clause)) {
           throw new CorrelatedReferenceError(`Unsupported $parent reference as a direct ${key} clause`);
         }
-        if (!(0, import_utils16.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
+        if (!(0, import_utils17.isPlainObject)(clause)) return cloneSubstitutedValue(clause);
         return resolveObjectEntries(clause, parent);
       });
       continue;
@@ -6082,10 +6197,10 @@ function resolveValueNode(template, parent, bare) {
     }
     const value = getOwnPathValue(parent, path);
     if (value === void 0 || value === null) throw UNRESOLVABLE;
-    if (bare && (0, import_utils16.isPlainObject)(value)) return { $eq: (0, import_utils16.cloneDeep)(value) };
+    if (bare && (0, import_utils17.isPlainObject)(value)) return { $eq: (0, import_utils17.cloneDeep)(value) };
     return cloneSubstitutedValue(value);
   }
-  if ((0, import_utils16.isPlainObject)(template)) {
+  if ((0, import_utils17.isPlainObject)(template)) {
     if (hasMarkerKey(template)) {
       throw new CorrelatedReferenceError(
         'Malformed $parent reference: objects carrying $parent must be exactly { "$parent": "<field>" }'
@@ -6093,7 +6208,7 @@ function resolveValueNode(template, parent, bare) {
     }
     return resolveObjectEntries(template, parent);
   }
-  if ((0, import_utils16.isArray)(template)) {
+  if ((0, import_utils17.isArray)(template)) {
     return template.map((item) => resolveValueNode(item, parent, false));
   }
   return template;
@@ -6127,7 +6242,7 @@ function resolveCorrelatedIdTemplate(id, parent) {
 }
 function resolveCorrelatedFilterTemplate(filter2, parent) {
   try {
-    if (!(0, import_utils16.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
+    if (!(0, import_utils17.isPlainObject)(filter2) || isParentRefMarker(filter2) || isEscapedParentRef(filter2)) {
       throw new CorrelatedReferenceError("Correlated include filter must be an object");
     }
     return { status: "resolved", filter: resolveObjectEntries(filter2, parent) };
@@ -6142,7 +6257,7 @@ function validateExpandedCorrelatedOperands(expanded, limits) {
 var MAX_NESTED_INCLUDE_DEPTH = 10;
 function validateCorrelatedArgsShape(args, op, depth) {
   if (args === void 0) return [];
-  if (!(0, import_utils16.isPlainObject)(args)) return ["Correlated include args must be an object"];
+  if (!(0, import_utils17.isPlainObject)(args)) return ["Correlated include args must be an object"];
   const record2 = args;
   const allowed = op === "list" ? /* @__PURE__ */ new Set(["select", "sort", "skip", "limit", "page", "pageSize", "include"]) : /* @__PURE__ */ new Set(["select", "sort", "include"]);
   for (const key of Object.keys(record2)) {
@@ -6164,7 +6279,7 @@ function validateCorrelatedArgsShape(args, op, depth) {
   return [];
 }
 function validateCorrelatedIncludeShape(entry, depth = 0) {
-  if (!(0, import_utils16.isPlainObject)(entry)) return ["Correlated include must be an object"];
+  if (!(0, import_utils17.isPlainObject)(entry)) return ["Correlated include must be an object"];
   const record2 = entry;
   if (record2.mode !== "correlated") return ['Correlated include mode must be "correlated"'];
   if (typeof record2.model !== "string" || record2.model.length === 0)
@@ -6177,7 +6292,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   if ("localField" in record2 || "foreignField" in record2) {
     return ["Correlated includes must not carry localField or foreignField"];
   }
-  if (record2.options !== void 0 && !((0, import_utils16.isPlainObject)(record2.options) && Object.keys(record2.options).length === 0)) {
+  if (record2.options !== void 0 && !((0, import_utils17.isPlainObject)(record2.options) && Object.keys(record2.options).length === 0)) {
     return ["Correlated include options must be absent or empty"];
   }
   const hasId = record2.id !== void 0;
@@ -6199,7 +6314,7 @@ function validateCorrelatedIncludeShape(entry, depth = 0) {
   return validateCorrelatedArgsShape(record2.args, record2.op, depth);
 }
 function isCorrelatedInclude(value) {
-  return (0, import_utils16.isPlainObject)(value) && value.mode === "correlated";
+  return (0, import_utils17.isPlainObject)(value) && value.mode === "correlated";
 }
 
 // src/services/base.ts
@@ -6346,7 +6461,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
   if (sources.length > MAX_GROUPS) invalid(`groups exceed ${MAX_GROUPS}`);
   const budget = new KeyBudget();
   const values = [];
-  const aliases = [];
+  const aliases2 = [];
   const indices = /* @__PURE__ */ new Map();
   const groups = [];
   for (const source of sources) {
@@ -6357,7 +6472,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
       if (index === void 0) {
         index = values.length;
         indices.set(alias, index);
-        aliases.push(alias);
+        aliases2.push(alias);
         values.push(snapshot);
       }
       group.add(index);
@@ -6377,7 +6492,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
   }
   return Object.freeze({
     values: Object.freeze(values),
-    aliases: Object.freeze(aliases),
+    aliases: Object.freeze(aliases2),
     groups: Object.freeze((multipleKeys ? groups : values.map((_, i) => [i])).map((group) => Object.freeze(group)))
   });
 }
@@ -6427,7 +6542,7 @@ function getServiceExecutors(receiver) {
   if (!registered) authorizationError("unregistered service receiver");
   return registered;
 }
-function createServiceExecution(receiver, access, authorization, applicability = "service", relatedTargets = [], parent, configuration, requestPermissions) {
+function createServiceExecution(receiver, access, authorization, applicability = "service", relatedTargets = [], parent, configuration, requestPermissions, hydration = access.operation === "list" ? "find" : "findOne") {
   const registered = getServiceExecutors(receiver);
   const receiving = registered.binding();
   const binding = Object.freeze({ ...receiving, scopePath: Object.freeze([...receiving.scopePath ?? []]) });
@@ -6449,11 +6564,23 @@ function createServiceExecution(receiver, access, authorization, applicability =
       binding,
       authorization: call,
       access: readServiceAuthorization(call, binding).access,
-      family: execution
+      family: execution,
+      hydration: resolveHydration(readServiceAuthorization(call, binding).configuration, hydration)
     })
   );
   return execution;
 }
+function resolveHydration(configuration, source) {
+  if (source === "lean" || source === "hydrated") return source;
+  return configuration.hydration?.[source] ?? (source === "publicList" ? "lean" : "hydrated");
+}
+function withExecutionHydration(receiver, parent, source) {
+  const record2 = readServiceExecution(receiver, parent);
+  const { configuration } = readServiceAuthorization(record2.authorization, record2.binding);
+  const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
+  executions.set(execution, Object.freeze({ ...record2, hydration: resolveHydration(configuration, source) }));
+  return execution;
+}
 function readServiceExecution(receiver, execution) {
   const record2 = executions.get(execution);
   if (!record2 || record2.receiver !== receiver) authorizationError("invalid execution receiver/call");
@@ -6658,20 +6785,20 @@ var copyAuthorizedOutput = (value) => {
   transferDocumentAuthorizationGraph(value, copy);
   return copy;
 };
-var isVirtualContainerValueForGuard = (value) => (0, import_utils20.isPlainObject)(value) && "sub" in value;
+var isVirtualContainerValueForGuard = (value) => (0, import_utils21.isPlainObject)(value) && "sub" in value;
 var getScopeVirtualsForGuard = (rootVirtuals, scopePath) => {
-  if (!rootVirtuals || !(0, import_utils20.isPlainObject)(rootVirtuals)) return null;
+  if (!rootVirtuals || !(0, import_utils21.isPlainObject)(rootVirtuals)) return null;
   if (scopePath.length === 0) return rootVirtuals;
   let current = rootVirtuals;
   for (let i = 0; i < scopePath.length; i += 2) {
     const field = scopePath[i];
     const subMarker = scopePath[i + 1];
     if (!field || subMarker !== "sub") return null;
-    if (!(0, import_utils20.isPlainObject)(current)) return null;
+    if (!(0, import_utils21.isPlainObject)(current)) return null;
     const container = current[field];
     if (!isVirtualContainerValueForGuard(container)) return null;
     current = container.sub;
-    if (!(0, import_utils20.isPlainObject)(current)) return null;
+    if (!(0, import_utils21.isPlainObject)(current)) return null;
   }
   return current;
 };
@@ -6737,7 +6864,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
       for (const entry of value) stripScope(entry, currentScope);
       return;
     }
-    if (!(0, import_utils20.isPlainObject)(value)) return;
+    if (!(0, import_utils21.isPlainObject)(value)) return;
     const record2 = value;
     const leaves = getScopeVirtualLeafNames(snapshot, currentScope);
     for (const leaf of leaves) {
@@ -6750,7 +6877,7 @@ var sanitizeSubScopeVirtualKeys = (data, snapshot, sub) => {
     for (const key of Object.keys(record2)) {
       if (leaves.has(key) || containers.has(key)) continue;
       const child = record2[key];
-      if (Array.isArray(child) || (0, import_utils20.isPlainObject)(child)) {
+      if (Array.isArray(child) || (0, import_utils21.isPlainObject)(child)) {
         stripScope(child, currentScope);
       }
     }
@@ -6762,7 +6889,7 @@ var LOGICAL_FILTER_KEYS = /* @__PURE__ */ new Set(["$and", "$or", "$nor"]);
 var isOperatorKey = (key) => key.startsWith("$");
 var REMOVED_VIRTUAL_FILTER = /* @__PURE__ */ Symbol("removed virtual filter clause");
 var rewriteFilterObject = (value, visit) => {
-  if (!(0, import_utils20.isPlainObject)(value)) return value;
+  if (!(0, import_utils21.isPlainObject)(value)) return value;
   let changed = false;
   const entries = [];
   for (const [key, child] of Object.entries(value)) {
@@ -6793,7 +6920,7 @@ var resolveVirtualFilterField = (path, scope2) => {
     if (!Object.hasOwn(scope2, segment) || scope2[segment] === void 0) return null;
     const definition = scope2[segment];
     if (!isVirtualContainerValueForGuard(definition)) return REMOVED_VIRTUAL_FILTER;
-    scope2 = (0, import_utils20.isPlainObject)(definition.sub) ? definition.sub : null;
+    scope2 = (0, import_utils21.isPlainObject)(definition.sub) ? definition.sub : null;
     inContainer = true;
   }
   return scope2;
@@ -6805,7 +6932,7 @@ var stripVirtualFilterOperator = (key, value, scope2) => {
   }
   if (key === "$all") {
     return rewriteFilterClauses(value, (entry) => {
-      if (!(0, import_utils20.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
+      if (!(0, import_utils21.isPlainObject)(entry) || Object.keys(entry).length !== 1 || !Object.hasOwn(entry, "$elemMatch")) return entry;
       return rewriteFilterObject(entry, (operator, operand) => stripVirtualFilterOperator(operator, operand, scope2));
     });
   }
@@ -6820,7 +6947,7 @@ var stripVirtualFilterQuery = (value, scope2, element = false) => {
     if (isOperatorKey(key)) return element ? stripVirtualFilterOperator(key, child, scope2) : child;
     const fieldScope = resolveVirtualFilterField(key, scope2);
     if (fieldScope === REMOVED_VIRTUAL_FILTER) return REMOVED_VIRTUAL_FILTER;
-    if (!fieldScope || !(0, import_utils20.isPlainObject)(child)) return child;
+    if (!fieldScope || !(0, import_utils21.isPlainObject)(child)) return child;
     if (Object.keys(child).some(isOperatorKey)) {
       return rewriteFilterObject(
         child,
@@ -6842,9 +6969,9 @@ var stripSubVirtualKeysFromFilter = (filter2, snapshot, sub) => {
 function getCorrelatedTemplateDepth(includes) {
   let max = 0;
   const visit = (entries, depth) => {
-    const list = (0, import_utils20.castArray)(entries).filter(Boolean);
+    const list = (0, import_utils21.castArray)(entries).filter(Boolean);
     for (const entry of list) {
-      if (!(0, import_utils20.isPlainObject)(entry)) continue;
+      if (!(0, import_utils21.isPlainObject)(entry)) continue;
       max = Math.max(max, depth);
       const nested = entry.args?.include;
       if (nested !== void 0) {
@@ -6869,11 +6996,11 @@ function validateClientFilter(filter2) {
   }
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils20.isArray)(value)) {
+    if ((0, import_utils21.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils20.isPlainObject)(value)) return;
+    if (!(0, import_utils21.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -7042,24 +7169,32 @@ var Base = class {
   relatedExecution(svc, include, parentAuthorization) {
     const op = include.op;
     if (!parentAuthorization)
-      return createServiceExecution(svc, {
-        operation: op,
-        rowAccess: op,
-        virtualAccess: op,
-        outputAccess: op,
-        docPermissionsAccess: op
-      });
-    return createRelatedExecution(
+      return withExecutionHydration(
+        svc,
+        createServiceExecution(svc, {
+          operation: op,
+          rowAccess: op,
+          virtualAccess: op,
+          outputAccess: op,
+          docPermissionsAccess: op
+        }),
+        "lean"
+      );
+    return withExecutionHydration(
       svc,
-      { operation: op, rowAccess: op, virtualAccess: op, outputAccess: op, docPermissionsAccess: op },
-      parentAuthorization,
-      this.relatedBinding(),
-      include.path
+      createRelatedExecution(
+        svc,
+        { operation: op, rowAccess: op, virtualAccess: op, outputAccess: op, docPermissionsAccess: op },
+        parentAuthorization,
+        this.relatedBinding(),
+        include.path
+      ),
+      "lean"
     );
   }
   processInclude(include) {
     assertPublicAdmission(include, "include");
-    const items = (0, import_utils20.compact)((0, import_utils20.castArray)(include));
+    const items = (0, import_utils21.compact)((0, import_utils21.castArray)(include));
     const legacy = [];
     const correlated = [];
     const correlatedReferenceFields = [];
@@ -7094,23 +7229,23 @@ var Base = class {
     this.assertIncludeOutputPaths([...legacy, ...correlated]);
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils20.forEach)(legacy, (inc) => {
+    (0, import_utils21.forEach)(legacy, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils20.uniq)((0, import_utils20.compact)(includeLocalFields));
-    includePaths = (0, import_utils20.uniq)((0, import_utils20.compact)(includePaths));
+    includeLocalFields = (0, import_utils21.uniq)((0, import_utils21.compact)(includeLocalFields));
+    includePaths = (0, import_utils21.uniq)((0, import_utils21.compact)(includePaths));
     return {
       includes: legacy,
       correlatedIncludes: correlated,
       includeLocalFields,
       includePaths,
-      correlatedReferenceFields: (0, import_utils20.uniq)((0, import_utils20.compact)(correlatedReferenceFields))
+      correlatedReferenceFields: (0, import_utils21.uniq)((0, import_utils21.compact)(correlatedReferenceFields))
     };
   }
   validateIncludeOutputPath(path, modelName) {
     const permissionField = getModelOption(modelName, "documentPermissionField");
-    if ((0, import_utils20.get)((0, import_utils20.set)({}, path, true), permissionField) !== void 0 || (0, import_utils20.get)((0, import_utils20.set)({}, permissionField, true), path) !== void 0) {
+    if ((0, import_utils21.get)((0, import_utils21.set)({}, path, true), permissionField) !== void 0 || (0, import_utils21.get)((0, import_utils21.set)({}, permissionField, true), path) !== void 0) {
       this.throwClientRequestError(
         "bad_request" /* BadRequest */,
         `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
@@ -7135,9 +7270,9 @@ var Base = class {
       const walk = (node, prefix) => {
         for (const [key, value] of Object.entries(node)) {
           if (value === void 0) continue;
-          if ((0, import_utils20.isPlainObject)(value) && "sub" in value) {
+          if ((0, import_utils21.isPlainObject)(value) && "sub" in value) {
             const sub = value.sub;
-            if ((0, import_utils20.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
+            if ((0, import_utils21.isPlainObject)(sub)) walk(sub, prefix ? `${prefix}.${key}` : key);
             continue;
           }
           out.push(prefix ? `${prefix}.${key}` : key);
@@ -7190,7 +7325,7 @@ var Base = class {
         this.throwClientRequestError("bad_request" /* BadRequest */, `Model ${modelName} not found`);
       }
       for (const entry of entries) {
-        if (!(0, import_utils20.isPlainObject)(entry)) continue;
+        if (!(0, import_utils21.isPlainObject)(entry)) continue;
         const models = visited.get(entry) ?? /* @__PURE__ */ new Set();
         if (models.has(modelName)) continue;
         models.add(modelName);
@@ -7200,13 +7335,13 @@ var Base = class {
         }
         if ((entry.op === "read" || entry.op === "list") && typeof entry.model === "string") {
           const nested = entry.args?.include;
-          if (nested) pending.push({ entries: (0, import_utils20.compact)((0, import_utils20.castArray)(nested)), modelName: entry.model });
+          if (nested) pending.push({ entries: (0, import_utils21.compact)((0, import_utils21.castArray)(nested)), modelName: entry.model });
         }
       }
     }
   }
   getForeignKeyValues(value) {
-    return (0, import_utils20.flatten)((0, import_utils20.castArray)(value));
+    return (0, import_utils21.flatten)((0, import_utils21.castArray)(value));
   }
   getForeignKey(value) {
     return String(value);
@@ -7214,7 +7349,7 @@ var Base = class {
   buildForeignKeyIndex(rows, foreignField) {
     const index = /* @__PURE__ */ new Map();
     for (const row of rows) {
-      for (const value of this.getForeignKeyValues((0, import_utils20.get)(row, foreignField))) {
+      for (const value of this.getForeignKeyValues((0, import_utils21.get)(row, foreignField))) {
         const key = this.getForeignKey(value);
         const values = index.get(key);
         if (values) values.push(row);
@@ -7250,9 +7385,9 @@ var Base = class {
   async includeDocs(docs, include, parentAuthorization) {
     assertPublicAdmission(include, "include");
     if (!include) return docs;
-    const includes = (0, import_utils20.compact)((0, import_utils20.castArray)(include));
+    const includes = (0, import_utils21.compact)((0, import_utils21.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils20.isArray)(docs);
+    const isSingle = !(0, import_utils21.isArray)(docs);
     let docList = (isSingle ? [docs] : docs).map(prepareIncludeOutput);
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -7282,7 +7417,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "read", path, parentAuthorization);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils20.get)(doc, localField);
+      const localValue = (0, import_utils21.get)(doc, localField);
       const execution = this.relatedExecution(svc, include, parentAuthorization);
       const prepared = await prepareModelQuery(
         svc,
@@ -7296,7 +7431,6 @@ var Base = class {
         skim,
         populateAccess,
         access: "read",
-        lean: true,
         includePermissions: false,
         includeFieldPermissions: false
       });
@@ -7318,15 +7452,15 @@ var Base = class {
     const { model, op, path, localField, foreignField, filter: _filters, args = {}, options = {} } = include;
     const svc = await this.getAuthorizedTargetService(model, op, path, parentAuthorization);
     const includeLocalValues = [];
-    (0, import_utils20.forEach)(docs, (doc) => {
-      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils20.get)(doc, localField)));
+    (0, import_utils21.forEach)(docs, (doc) => {
+      includeLocalValues.push(...this.getForeignKeyValues((0, import_utils21.get)(doc, localField)));
     });
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
       execution,
       { kind: "client-read", filter: _filters ?? {} },
-      { [foreignField]: { $in: (0, import_utils20.flatten)(includeLocalValues) } },
+      { [foreignField]: { $in: (0, import_utils21.flatten)(includeLocalValues) } },
       true
     );
     const trustedArgs = this.sanitizeIncludeArgs(args, "list");
@@ -7335,7 +7469,6 @@ var Base = class {
       ...requestOnlyServiceOptions({
         skim,
         populateAccess,
-        lean: true,
         includePermissions: false,
         includeFieldPermissions: false,
         includeCount: false
@@ -7370,7 +7503,7 @@ var Base = class {
     }
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const matches = this.getIndexedMatches(index, (0, import_utils20.get)(doc, localField));
+      const matches = this.getIndexedMatches(index, (0, import_utils21.get)(doc, localField));
       const isolated = matches.map((m) => copyAuthorizedOutput(m));
       attachIncludeOutput(doc, path, op === "list" ? isolated : isolated[0]);
     }
@@ -7379,7 +7512,7 @@ var Base = class {
   async includeDocsCount(docs, include, parentAuthorization) {
     const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count", path, parentAuthorization);
-    const groups = prepareCountGroups(docs, (doc) => (0, import_utils20.get)(doc, localField));
+    const groups = prepareCountGroups(docs, (doc) => (0, import_utils21.get)(doc, localField));
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
@@ -7433,7 +7566,7 @@ var Base = class {
     }
     const state = this.getCorrelatedExecState();
     docs = docs.map(prepareIncludeOutput);
-    const resolvedSnapshots = snapshots ?? docs.map((doc) => (0, import_utils20.cloneDeep)(toObject(getIncludeSource(doc))));
+    const resolvedSnapshots = snapshots ?? docs.map((doc) => (0, import_utils21.cloneDeep)(toObject(getIncludeSource(doc))));
     for (const include of correlatedIncludes) {
       switch (include.op) {
         case "read":
@@ -7510,7 +7643,6 @@ var Base = class {
             },
             requestOnlyServiceOptions({
               access: "read",
-              lean: true,
               includePermissions: false,
               includeFieldPermissions: false
             })
@@ -7585,7 +7717,6 @@ var Base = class {
           },
           requestOnlyServiceOptions({
             access: "read",
-            lean: true,
             includePermissions: false,
             includeFieldPermissions: false
           })
@@ -7670,7 +7801,6 @@ var Base = class {
           },
           requestOnlyServiceOptions({
             includeCount: false,
-            lean: true,
             includePermissions: false,
             includeFieldPermissions: false
           })
@@ -7785,10 +7915,10 @@ var Base = class {
     }
     let ret = result2.data;
     if (sqOptions.path) {
-      ret = (0, import_utils20.isArray)(ret) ? (0, import_utils20.flatten)(ret.map((v) => (0, import_utils20.get)(v, sqOptions.path))) : (0, import_utils20.get)(ret, sqOptions.path);
+      ret = (0, import_utils21.isArray)(ret) ? (0, import_utils21.flatten)(ret.map((v) => (0, import_utils21.get)(v, sqOptions.path))) : (0, import_utils21.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils20.compact)((0, import_utils20.castArray)(ret));
+      ret = (0, import_utils21.compact)((0, import_utils21.castArray)(ret));
     }
     return ret;
   }
@@ -7800,11 +7930,11 @@ var Base = class {
 };
 
 // src/services/service.ts
-var import_utils30 = require("@web-ts-toolkit/utils");
+var import_utils31 = require("@web-ts-toolkit/utils");
 var import_just_diff = require("just-diff");
 
 // src/model.ts
-var import_utils21 = require("@web-ts-toolkit/utils");
+var import_utils22 = require("@web-ts-toolkit/utils");
 init_runtime_context();
 init_runtime();
 function admitModelPersistence(adapter, scheduler) {
@@ -7880,7 +8010,7 @@ var Model = class {
   }
   /** Cast a copy using this model's query schema/setters, without executing query middleware or persistence. */
   castFilter(filter2) {
-    const query = this.mongooseModel.countDocuments((0, import_utils21.cloneDeep)(filter2));
+    const query = this.mongooseModel.countDocuments((0, import_utils22.cloneDeep)(filter2));
     return query.cast(this.mongooseModel);
   }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
@@ -7894,7 +8024,7 @@ var Model = class {
 var model_default = Model;
 
 // src/acl/distinct-field-authorization.ts
-var import_utils22 = require("@web-ts-toolkit/utils");
+var import_utils23 = require("@web-ts-toolkit/utils");
 init_field_authorization();
 init_field_catalog();
 var schemaVariants = (schema) => Object.values(schema.discriminators ?? {});
@@ -7976,8 +8106,8 @@ function isDistinctFieldAuthorized(args) {
       if (path !== field && !path.startsWith(`${field}.`) && !field.startsWith(`${path}.`)) continue;
       if (path.startsWith(`${field}.`) && (!eligible(path) || !schemaShape(schema, path) || !granted(path)))
         return false;
-      if ((0, import_utils22.isPlainObject)(raw) && raw.sub !== void 0) {
-        if (!(0, import_utils22.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
+      if ((0, import_utils23.isPlainObject)(raw) && raw.sub !== void 0) {
+        if (!(0, import_utils23.isPlainObject)(raw.sub) || !declaredRulesSafe(raw.sub, path, next)) return false;
       }
     }
     return true;
@@ -8155,6 +8285,7 @@ function copySubdocumentParent(parent) {
 init_permission();
 init_core_shared();
 init_finalize_model_output();
+init_permissions_alias();
 
 // src/acl/populate-target.ts
 var POPULATE_TARGET_PLAN = /* @__PURE__ */ Symbol("accessRouter.populateTargetPlan");
@@ -8179,7 +8310,7 @@ function getPopulateTargetMeta(entry) {
 init_document();
 
 // src/helpers/apply-update.ts
-var import_utils25 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 init_lib();
 function applyUpdate(target, data, allowedFields) {
   const wholeFields = /* @__PURE__ */ new Set();
@@ -8195,17 +8326,17 @@ function applyUpdate(target, data, allowedFields) {
     }
   };
   for (const field of allowedFields) {
-    collectBoundary((0, import_utils25.set)({}, field, true));
+    collectBoundary((0, import_utils26.set)({}, field, true));
   }
   const apply = (values, prefix = "") => {
     for (const [key, value] of Object.entries(values)) {
       const path = prefix ? `${prefix}.${key}` : key;
-      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils25.isPlainObject)(value) || Array.isArray(value))) {
+      if (partialContainers.has(path) && !wholeFields.has(path) && ((0, import_utils26.isPlainObject)(value) || Array.isArray(value))) {
         apply(value, path);
       } else if (isDocument2(target)) {
         target.set(path, value);
       } else {
-        (0, import_utils25.set)(target, path, value);
+        (0, import_utils26.set)(target, path, value);
       }
     }
   };
@@ -8213,7 +8344,7 @@ function applyUpdate(target, data, allowedFields) {
 }
 
 // src/acl/model-input-admission.ts
-var import_utils27 = require("@web-ts-toolkit/utils");
+var import_utils28 = require("@web-ts-toolkit/utils");
 var import_mongoose7 = require("mongoose");
 init_document();
 init_request_work();
@@ -8221,7 +8352,7 @@ init_logger_helpers();
 init_request_complexity();
 
 // src/acl/select-resolution.ts
-var import_utils26 = require("@web-ts-toolkit/utils");
+var import_utils27 = require("@web-ts-toolkit/utils");
 init_core_shared();
 init_helpers();
 async function collectAllowedFieldsForRequest({
@@ -8295,15 +8426,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils26.difference)(fields, normalizedSelect);
+        fields = (0, import_utils27.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils26.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils27.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(strippedAlways);
   }
-  return (0, import_utils26.intersection)(normalizedSelect, fields);
+  return (0, import_utils27.intersection)(normalizedSelect, fields);
 }
 function stripVirtuals(fields, virtualNames) {
   const set13 = virtualNames instanceof Set ? virtualNames : new Set(virtualNames ?? []);
@@ -8334,7 +8465,7 @@ init_field_catalog();
 init_service_authorization();
 var own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 var inside = (path, root) => path === root || path.startsWith(`${root}.`);
-var record = (value) => (0, import_utils27.isPlainObject)(value);
+var record = (value) => (0, import_utils28.isPlainObject)(value);
 function inputValue(value) {
   if (typeof value === "function" || typeof value === "symbol") {
     authorizationError("input values must be persisted data, not functions or symbols");
@@ -8403,7 +8534,7 @@ function requestBoundaries(fields) {
       else visit(value, path);
     }
   };
-  for (const field of fields) visit((0, import_utils27.set)({}, field, true));
+  for (const field of fields) visit((0, import_utils28.set)({}, field, true));
   return [...new Set(result2)];
 }
 function ownValue(data, parts) {
@@ -8533,7 +8664,7 @@ function admitModelInput(args) {
     if (forbidden(catalog, path, requested)) continue;
     const supplied = ownValue(data, parts);
     if (!supplied) continue;
-    (0, import_utils27.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
+    (0, import_utils28.set)(allowedData, field, copyInputValue(supplied.value, path, catalog, scopedRequests, logicalPath(field)));
     selected.push(field);
   }
   return { allowedData, allowedFields };
@@ -8545,7 +8676,7 @@ async function requestInputFields(args) {
   const prefix = configuration.modelPermissionPrefix ?? "";
   return collectModelRequestFields({
     req: args.binding.request,
-    permissionSchema: args.scopePath ? (0, import_utils27.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
+    permissionSchema: args.scopePath ? (0, import_utils28.get)(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
     access: args.access,
     permissions,
     grants,
@@ -8589,13 +8720,13 @@ init_logger_helpers();
 init_lib();
 
 // src/services/model-subdocument-service.ts
-var import_utils29 = require("@web-ts-toolkit/utils");
+var import_utils30 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_public_admission();
 
 // src/acl/subdocument-authorization.ts
-var import_utils28 = require("@web-ts-toolkit/utils");
+var import_utils29 = require("@web-ts-toolkit/utils");
 init_helpers();
 init_document();
 init_core_shared();
@@ -8782,8 +8913,8 @@ async function subdocumentGateAllowed(service, gate) {
   let guard2;
   if (access.startsWith("subs.")) {
     const [, sub, op] = access.split(".");
-    guard2 = (0, import_utils28.get)(configuration, `operationAccess.${access}`);
-    if (guard2 === void 0) guard2 = (0, import_utils28.get)(configuration, `operationAccess.subs.${sub}`);
+    guard2 = (0, import_utils29.get)(configuration, `operationAccess.${access}`);
+    if (guard2 === void 0) guard2 = (0, import_utils29.get)(configuration, `operationAccess.subs.${sub}`);
     if (guard2 === void 0) guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${op}`);
   } else guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${access}`);
   return evaluateRouteGuard(
@@ -8855,8 +8986,7 @@ async function mutationParent(service, id, call) {
   const parent = await service.findRawParentDoc({
     filter: filter2,
     select: parentSelection(service, call),
-    populate: [],
-    lean: false
+    populate: []
   });
   return parent ? { parent } : { error: denied2("not_found" /* NotFound */) };
 }
@@ -8905,18 +9035,17 @@ async function visibleMutationRows(service, call, parentId, rows) {
     const identity = { _id: parentId };
     const filter2 = await subdocumentRows(service, visibility.parent, identity, identity);
     if (filter2 === false) return [];
-    const parent = await service.findRawParentDoc({
+    const parent = await getServiceExecutors(service).subdocumentVisibility({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: [],
-      lean: true
+      populate: []
     });
     if (!parent) return [];
     const selected = call.method === "create" ? {} : { _id: { $in: rows.map((row) => row._id) } };
     const read = await subdocumentRows(service, visibility.child, selected, selected, call.sub);
     const list = visibility.list ? await subdocumentRows(service, visibility.list, {}, {}, call.sub) : {};
     if (read === false || list === false) return [];
-    const visible = filterCollection((0, import_utils29.get)(parent, call.sub), intersectFilters(read, list));
+    const visible = filterCollection((0, import_utils30.get)(parent, call.sub), intersectFilters(read, list));
     return await finalizeSubdocumentRows(service, call.output, parent, visible);
   } catch {
     return [];
@@ -8937,11 +9066,10 @@ async function listSub(service, id, sub, options) {
     const parent = await service.findRawParentDoc({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: [],
-      lean: false
+      populate: []
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const rows = filterCollection((0, import_utils29.get)(parent, sub), childFilter);
+    const rows = filterCollection((0, import_utils30.get)(parent, sub), childFilter);
     const data = await finalizeSubdocumentRows(service, call.output, parent, rows);
     return { success: true, kind: "list", code: "success" /* Success */, data, count: data.length };
   });
@@ -8960,11 +9088,10 @@ async function readSub(service, id, sub, subId, options) {
     const parent = await service.findRawParentDoc({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: entries,
-      lean: false
+      populate: entries
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const row = findElement((0, import_utils29.get)(copySubdocumentParent(parent), sub), childFilter);
+    const row = findElement((0, import_utils30.get)(copySubdocumentParent(parent), sub), childFilter);
     if (!row) return denied2("not_found" /* NotFound */);
     await service.finalizePopulateForSubParent({ [sub]: [row] }, entries, "subRead");
     const data = await finalizeSubdocumentRows(service, call.output, parent, [row]);
@@ -8984,7 +9111,7 @@ async function updateSub(service, persist, id, sub, subId, data, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils29.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils30.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     const original = isolateDocForOutput(row);
     const admit = await inputAdmission(service, call, parent);
@@ -9011,7 +9138,7 @@ async function bulkUpdateSub(service, persist, id, sub, data, options) {
     const selected = { _id: { $in: data.map((row) => row._id) } };
     const filter2 = await subdocumentRows(service, call.child, selected, selected, sub);
     if (filter2 === false) return denied2();
-    const rows = filterCollection((0, import_utils29.get)(parent, sub), filter2);
+    const rows = filterCollection((0, import_utils30.get)(parent, sub), filter2);
     const originals = rows.map((row) => isolateDocForOutput(row));
     const admit = await inputAdmission(service, call, parent);
     for (const [index, row] of rows.entries()) {
@@ -9039,7 +9166,7 @@ async function createSub(service, persist, id, sub, data, options) {
     const lookup = await mutationParent(service, id, call);
     if ("error" in lookup) return lookup.error;
     const { parent } = lookup;
-    const rows = (0, import_utils29.get)(parent, sub);
+    const rows = (0, import_utils30.get)(parent, sub);
     const admit = await inputAdmission(service, call, parent);
     const allowed = (Array.isArray(data) ? data : [data]).map((row) => admit(row).allowedData);
     if (options?.addFirst) rows.unshift(...allowed);
@@ -9060,7 +9187,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement((0, import_utils29.get)(parent, sub), filter2);
+    const row = findElement((0, import_utils30.get)(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     await ("deleteOne" in row ? row.deleteOne?.() : row.remove?.());
     await persist(() => parent.save());
@@ -9069,7 +9196,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
 }
 async function getParentDoc(service, id, sub, args, options) {
   assertPublicAdmission({ args, options });
-  const { access = "read", lean = false } = options ?? {};
+  const { access = "read" } = options ?? {};
   const identity = deepIsolateValue(await service.genIDFilter(id));
   const filter2 = intersectFilters(identity, await service.genFilter(access, deepIsolateValue(identity)));
   if (filter2 === false) return null;
@@ -9077,8 +9204,7 @@ async function getParentDoc(service, id, sub, args, options) {
   return service.findRawParentDoc({
     filter: filter2,
     select: access === "read" ? "" : sub,
-    populate,
-    lean
+    populate
   });
 }
 
@@ -9108,8 +9234,7 @@ function resolveFindOneOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOneOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findOneOptions?.access ?? "read",
-    populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess,
-    lean: options.lean ?? service.defaults.findOneOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess
   });
 }
 function resolveFindByIdArgs(service, args = {}) {
@@ -9126,8 +9251,7 @@ function resolveFindByIdOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findByIdOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findByIdOptions?.access ?? "read",
-    populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess,
-    lean: options.lean ?? service.defaults.findByIdOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess
   });
 }
 function resolveFindArgs(service, args = {}) {
@@ -9149,8 +9273,7 @@ function resolveFindOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOptions?.includeFieldPermissions ?? includePermissions,
     includeCount: options.includeCount ?? service.defaults.findOptions?.includeCount ?? false,
-    populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read",
-    lean: options.lean ?? service.defaults.findOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read"
   });
 }
 function resolveCreateArgs(service, args = {}) {
@@ -9264,7 +9387,7 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, this.options) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -9308,26 +9431,37 @@ var Service = class extends Base {
         data: await this.model.countDocuments(filter2),
         query: { filter: filter2 }
       }),
-      groupedCount: (filter2, field, input) => this.countPreparedByFieldValueGroups(field, input, filter2)
+      groupedCount: (filter2, field, input) => this.countPreparedByFieldValueGroups(field, input, filter2),
+      subdocumentVisibility: ({ filter: filter2, select, populate }) => this.model.findOne({ filter: filter2, select, populate, lean: true })
     });
   }
   get options() {
     return modelServiceOptions(this, () => this.getModelRouterOptions(this.modelName));
   }
+  /**
+   * Presentation/query defaults for this service instance; an explicit assignment
+   * replaces the runtime defaults bag, not a per-bucket merge. Fetch mode belongs
+   * to the owning model's hydration configuration and affects all its services.
+   * Legacy method-option lean/hydration keys throw on assignment and before calls
+   * if an assigned JavaScript bag is later mutated.
+   */
   get defaults() {
     return this.defaultsOverride ?? this.options.defaults ?? {};
   }
   set defaults(value) {
+    assertHydrationDefaults(value);
     this.defaultsOverride = value;
   }
   get baseFieldsExt() {
     return this.baseFields.concat(this.options.documentPermissionField);
   }
+  /** Raw hydrated parent/null. Fetch mode is fixed, independent of model read settings. */
   findRawParentDoc(args) {
     return this.model.findOne({
-      ...args,
       filter: args.filter,
-      populate: args.populate
+      select: args.select,
+      populate: args.populate,
+      lean: false
     });
   }
   createModelAdapter(modelName) {
@@ -9432,23 +9566,34 @@ var Service = class extends Base {
       }
     });
     const output = deepIsolateValue(finalized);
+    removeGeneratedPermissionsAlias(output);
     const includeOrigins = restoreIncludeOutput(args.doc, output);
     const field = configuration.documentPermissionField ?? "_permissions";
     unsetDocPath(output, field);
     if (!configuration.stripPermissionsField) {
-      (0, import_utils30.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
+      (0, import_utils31.set)(output, field, args.includePermissions || args.includeFieldPermissions ? deepIsolateValue(grants) : {});
       if (args.includeFieldPermissions && !configuration.disableFieldPermissions) {
         const rowAccess = this.asServiceHookContext(context).fieldPermissionAccess ?? await this.getFieldPermissionAccess([snapshot._id]);
         const id = String(snapshot._id);
         const views = rowAccess.readIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "read") : [];
         const edits = rowAccess.updateIds?.has(id) ? await requestOutputFieldPaths(handle, binding, "update") : [];
         const map2 = (paths) => paths.length ? Object.fromEntries(paths.map((path) => [path, true])) : { $: "_" };
-        (0, import_utils30.set)(output, `${field}._view`, map2(views));
-        (0, import_utils30.set)(output, `${field}._edit`, map2(edits));
-      } else if (!args.includePermissions) this.addEmptyPermissions(output);
-      stripUnexposedDocPermissions(this.modelName, output);
+        (0, import_utils31.set)(output, `${field}._view`, map2(views));
+        (0, import_utils31.set)(output, `${field}._edit`, map2(edits));
+      } else if (!args.includePermissions) (0, import_utils31.set)(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
+      const exposed = configuration.exposedDocPermissionKeys;
+      if (exposed) {
+        const metadata = (0, import_utils31.get)(output, field);
+        (0, import_utils31.set)(
+          output,
+          field,
+          Object.fromEntries(
+            Object.entries(metadata).filter(([key]) => key === "_view" || key === "_edit" || exposed.includes(key))
+          )
+        );
+      }
+      attachPermissionsAlias(output, field);
     }
-    this.preservePermissionsVirtual(getIncludeOriginal(args.doc), output, args.lean);
     transferDocumentAuthorizationGraph(finalized, output, includeOrigins);
     return {
       data: output,
@@ -9663,36 +9808,6 @@ var Service = class extends Base {
   stripVirtualsFromFilterForSnapshot(filter2, snapshot) {
     return stripVirtualKeysFromFilter(filter2, snapshot);
   }
-  /**
-   * Preserve the `permissions` Mongoose virtual (from `permissionsPlugin`) for
-   * hydrated outputs. `isolateDocForOutput` uses `toObject({ virtuals: false })`
-   * so Mongoose getter virtuals never leak into package-virtual planning;
-   * `lean: true` therefore drops them (explicit parity rule). For `lean: false`
-   * (hydrated Mongoose documents) the historical contract exposes
-   * `doc.permissions` as an alias of the document-permission field. The shared
-   * finalizer keeps only the document-permission field, so restore the alias
-   * here for backward compatibility when the input was hydrated and the
-   * virtual existed. Lean outputs stay without the virtual. Models without
-   * the plugin never had the virtual and stay unchanged.
-   */
-  preservePermissionsVirtual(originalDoc, finalized, lean) {
-    try {
-      if (lean) return;
-      if (!isDocument2(originalDoc)) return;
-      const schema = originalDoc.schema;
-      if (!schema?.virtualpath("permissions")) return;
-      const docField = this.options?.documentPermissionField ?? "_permissions";
-      if (docField in finalized && !("permissions" in finalized)) {
-        Object.defineProperty(finalized, "permissions", {
-          value: finalized[docField],
-          enumerable: false,
-          writable: true,
-          configurable: true
-        });
-      }
-    } catch {
-    }
-  }
   /**
    * VIRT-05 populate + association helpers.
    *
@@ -9729,7 +9844,7 @@ var Service = class extends Base {
     return docs.map((doc) => {
       try {
         const plain = toObject(doc);
-        const val = (0, import_utils30.get)(plain, associationField);
+        const val = (0, import_utils31.get)(plain, associationField);
         return deepIsolateValue(val);
       } catch {
         return void 0;
@@ -9826,7 +9941,7 @@ var Service = class extends Base {
     if (this.isScalarPopulateValue(rawTarget)) return rawTarget;
     const isDoc = (() => {
       try {
-        if ((0, import_utils30.isPlainObject)(rawTarget)) return true;
+        if ((0, import_utils31.isPlainObject)(rawTarget)) return true;
         const maybe = rawTarget;
         if (maybe && typeof maybe === "object" && "_doc" in maybe) return true;
         if (maybe && typeof maybe.toObject === "function") return true;
@@ -9914,7 +10029,7 @@ var Service = class extends Base {
       child = getDocValue(current, key);
       if (child === void 0) {
         try {
-          child = (0, import_utils30.get)(current, key);
+          child = (0, import_utils31.get)(current, key);
         } catch {
           return;
         }
@@ -10050,7 +10165,7 @@ var Service = class extends Base {
   async findOnePrepared(execution, filter2, args, options) {
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
     const { select: requestedSelect, sort, populate, include } = this.resolveFindOneArgs(args);
-    const { includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
+    const { includePermissions, includeFieldPermissions, access, populateAccess } = this.resolveFindOneOptions(options);
     const state = readServiceExecution(this, execution);
     const virtualSnapshot = readServiceAuthorization(state.authorization, state.binding).configuration;
     let processedInclude;
@@ -10112,7 +10227,7 @@ var Service = class extends Base {
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
       }
     }
-    let doc = await this.model.findOne({ ...query, select: dbSelect, lean });
+    let doc = await this.model.findOne({ ...query, select: dbSelect, lean: state.hydration === "lean" });
     if (!doc) {
       this.completeOp("findOne", startedAt, "not_found" /* NotFound */, _filter);
       return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
@@ -10126,7 +10241,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     };
-    const correlatedSnapshots = [(0, import_utils30.cloneDeep)(toObject(doc))];
+    const correlatedSnapshots = [(0, import_utils31.cloneDeep)(toObject(doc))];
     try {
       doc = await this.includeDocs(doc, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -10175,7 +10290,6 @@ var Service = class extends Base {
         context,
         includePermissions,
         includeFieldPermissions,
-        lean,
         sharedGate: findOneGate
       });
     } catch (error2) {
@@ -10200,7 +10314,7 @@ var Service = class extends Base {
     try {
       this.admitServiceCall(args, options);
       const { select, populate, include } = this.resolveFindByIdArgs(args);
-      const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
+      const { skim, includePermissions, includeFieldPermissions, access, populateAccess } = this.resolveFindByIdOptions(options);
       const execution = createServiceExecution(
         this,
         {
@@ -10212,7 +10326,11 @@ var Service = class extends Base {
         },
         options?.authorization,
         "service",
-        this.captureRelated(args, this.defaults.findByIdArgs)
+        this.captureRelated(args, this.defaults.findByIdArgs),
+        void 0,
+        void 0,
+        void 0,
+        "findById"
       );
       const filter2 = readModelIdentifier(this, execution, await resolveModelIdentifier(this, execution, id));
       const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
@@ -10225,7 +10343,7 @@ var Service = class extends Base {
           populate,
           include
         },
-        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess }
       );
     } catch (error2) {
       const result2 = this.getClientRequestErrorResult(error2);
@@ -10271,7 +10389,7 @@ var Service = class extends Base {
       page,
       pageSize
     } = this.resolveFindArgs(args);
-    const { includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
+    const { includePermissions, includeFieldPermissions, includeCount, populateAccess } = this.resolveFindOptions(options);
     let processedInclude;
     try {
       processedInclude = this.processInclude(include);
@@ -10302,7 +10420,7 @@ var Service = class extends Base {
     const findAssociationField = this.getAssociationFieldFromOptions(options);
     const withAssocSelect = findAssociationField && !finalSelect.includes(findAssociationField) ? [...finalSelect, findAssociationField] : finalSelect;
     const dbSelect = this.buildDbSelectForAssociation(withAssocSelect, findAssociationField);
-    const filteredPopulate = (0, import_utils30.isArray)(withAssocSelect) && (0, import_utils30.isArray)(_populate) ? _populate.filter(
+    const filteredPopulate = (0, import_utils31.isArray)(withAssocSelect) && (0, import_utils31.isArray)(_populate) ? _populate.filter(
       (p) => withAssocSelect.some(
         (field) => field === p.path || field.startsWith(`${p.path}.`) || p.path.startsWith(`${field}.`)
       )
@@ -10346,10 +10464,10 @@ var Service = class extends Base {
       ...query,
       select: dbSelect,
       hardLimit: this.options.listHardLimit,
-      lean
+      lean: state.hydration === "lean"
     });
     const capturedAssociation = findAssociationField ? this.captureAssociationValues(docs, findAssociationField) : void 0;
-    const correlatedSnapshots = docs.map((doc) => (0, import_utils30.cloneDeep)(toObject(doc)));
+    const correlatedSnapshots = docs.map((doc) => (0, import_utils31.cloneDeep)(toObject(doc)));
     try {
       docs = await this.includeDocs(docs, includes, state.authorization);
       if (correlatedIncludes.length > 0) {
@@ -10421,7 +10539,6 @@ var Service = class extends Base {
         context: contexts[i],
         includePermissions,
         includeFieldPermissions,
-        lean,
         sharedGate,
         privateAssociationField
       });
@@ -10543,12 +10660,12 @@ var Service = class extends Base {
       context.allowedFields = allowedFields;
       context.allowedData = allowedData;
       const validated = await this.validate(allowedData, "create", context);
-      if ((0, import_utils30.isBoolean)(validated)) {
+      if ((0, import_utils31.isBoolean)(validated)) {
         if (!validated) {
           validationErrors.push({ index, errors: [] });
           return void 0;
         }
-      } else if ((0, import_utils30.isArray)(validated)) {
+      } else if ((0, import_utils31.isArray)(validated)) {
         if (validated.length > 0) {
           validationErrors.push({
             index,
@@ -10611,7 +10728,6 @@ var Service = class extends Base {
         context: contexts[index],
         includePermissions,
         includeFieldPermissions,
-        lean: false,
         sharedGate: createGate
       });
       outputContexts[index] = output.context;
@@ -10674,8 +10790,7 @@ var Service = class extends Base {
         doc: data,
         plan: newPlan,
         context: newContext,
-        includePermissions,
-        lean: false
+        includePermissions
       });
       return {
         success: true,
@@ -10751,7 +10866,7 @@ var Service = class extends Base {
     }
     let doc = await this.model.findOne({
       filter: _filter,
-      select: (0, import_utils30.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
+      select: (0, import_utils31.uniq)([...updatePlan.persistedFetchSelection, ...inputFetchPaths(captured.configuration.catalog)]).map(
         (path) => `+${path}`
       )
     });
@@ -10790,12 +10905,12 @@ var Service = class extends Base {
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils30.isBoolean)(validated)) {
+    if ((0, import_utils31.isBoolean)(validated)) {
       if (!validated) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */ };
       }
-    } else if ((0, import_utils30.isArray)(validated)) {
+    } else if ((0, import_utils31.isArray)(validated)) {
       if (validated.length > 0) {
         this.completeOp("updateOne", startedAt, "bad_request" /* BadRequest */, _filter);
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: validated };
@@ -10815,10 +10930,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_just_diff.diff)(
-        (0, import_utils30.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils30.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils31.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils31.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils30.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
+      context.modifiedPaths = (0, import_utils31.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -10843,8 +10958,7 @@ var Service = class extends Base {
       plan: updatePlan,
       context,
       includePermissions,
-      includeFieldPermissions,
-      lean: false
+      includeFieldPermissions
     });
     const outputDoc = decorate ? await this.hookGate.run(() => decorate(output.data, output.context)) : output.data;
     this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
@@ -11363,7 +11477,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils30.compact)((0, import_utils30.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
+    const uniqueIds = (0, import_utils31.compact)((0, import_utils31.uniqBy)(ids, (id) => String(id)).map((id) => String(id)));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -11409,7 +11523,7 @@ var Service = class extends Base {
    * (direct/root-entry 200); count measures visible rows, not all updated rows.
    */
   async bulkUpdateSub(id, sub, data, options) {
-    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils30.castArray)(data), options);
+    return bulkUpdateSub(this, this.persist, id, sub, (0, import_utils31.castArray)(data), options);
   }
   /**
    * Append/prepend admitted rows, then return the visible full array (including when
@@ -11426,14 +11540,16 @@ var Service = class extends Base {
   async deleteSub(id, sub, subId, options) {
     return deleteSub(this, this.persist, id, sub, subId, options);
   }
+  /** Raw hydrated parent/null, with row policy and populate; no finalized permission metadata. */
   async getParentDoc(id, sub, args, options) {
     return getParentDoc(this, id, sub, args, options);
   }
 };
 
 // src/services/public-service.ts
-var import_utils31 = require("@web-ts-toolkit/utils");
+var import_utils32 = require("@web-ts-toolkit/utils");
 init_helpers();
+init_permissions_alias();
 init_public_admission();
 var PublicService = class extends Service {
   /** Public dispatch stays request-only even for JS callers and transformed envelopes. */
@@ -11471,36 +11587,61 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options, filter: filter2 });
     if (admission) return admission;
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
-    const result2 = await this.find(
-      filter2,
-      { select, populate, include, sort, skip, limit, page, pageSize },
-      requestOnlyServiceOptions({
-        skim,
-        includePermissions,
-        includeFieldPermissions,
-        includeCount,
-        populateAccess,
-        lean
-      }),
-      async (doc, context) => {
-        doc = toObject(doc);
-        return this.decorate(doc, "list", context);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess } = this.resolvePublicListOptions(options);
+    try {
+      const execution = withExecutionHydration(
+        this,
+        createServiceExecution(
+          this,
+          {
+            operation: "list",
+            rowAccess: "list",
+            virtualAccess: "list",
+            outputAccess: "list",
+            docPermissionsAccess: "list"
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findArgs)
+        ),
+        "publicList"
+      );
+      const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+      const result2 = await executePreparedFind(
+        this,
+        execution,
+        query,
+        { select, populate, include, sort, skip, limit, page, pageSize },
+        requestOnlyServiceOptions({
+          skim,
+          includePermissions,
+          includeFieldPermissions,
+          includeCount,
+          populateAccess
+        }),
+        async (doc, context) => {
+          doc = toObject(doc);
+          return this.decorate(doc, "list", context);
+        }
+      );
+      if (!result2.success) {
+        return result2;
       }
-    );
-    if (!result2.success) {
-      return result2;
+      const docs = await this.decorateAll(result2.data, "list", {
+        mongooseModel: this.model.mongooseModel,
+        modelName: this.modelName,
+        operation: "list",
+        resolvedQuery: result2.query
+      });
+      const transformedDocs = docs.map(
+        (row) => this.runTasks(row, tasks)
+      );
+      return { ...result2, data: transformedDocs };
+    } catch (error2) {
+      const result2 = this.getClientRequestErrorResult(error2);
+      if (result2) return result2;
+      throw error2;
     }
-    const docs = await this.decorateAll(result2.data, "list", {
-      mongooseModel: this.model.mongooseModel,
-      modelName: this.modelName,
-      operation: "list",
-      resolvedQuery: result2.query
-    });
-    const transformedDocs = docs.map(
-      (row) => this.runTasks(row, tasks)
-    );
-    return { ...result2, data: transformedDocs };
   }
   async _create(data, args, options) {
     const admission = this.admitPublicCall({ args, options, data });
@@ -11516,7 +11657,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = (0, import_utils31.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        if (select) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
         return d;
       }
     );
@@ -11537,21 +11678,25 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options });
     if (admission) return admission;
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = this.resolvePublicReadOptions(options);
     try {
       let access = "read";
-      let execution = createServiceExecution(
+      let execution = withExecutionHydration(
         this,
-        {
-          operation: "read",
-          rowAccess: access,
-          virtualAccess: access,
-          outputAccess: access,
-          docPermissionsAccess: access
-        },
-        requestOnlyServiceOptions({}).authorization,
-        "service",
-        this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        createServiceExecution(
+          this,
+          {
+            operation: "read",
+            rowAccess: access,
+            virtualAccess: access,
+            outputAccess: access,
+            docPermissionsAccess: access
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        ),
+        "publicRead"
       );
       const identifier = await resolveModelIdentifier(this, execution, id);
       const query = await prepareModelQuery(this, execution, {
@@ -11563,7 +11708,7 @@ var PublicService = class extends Service {
         execution,
         query,
         { select, populate, include },
-        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
+        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
       );
       if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
       if (tryList && (!result2.success || !result2.data)) {
@@ -11593,8 +11738,7 @@ var PublicService = class extends Service {
             includePermissions,
             includeFieldPermissions,
             access,
-            populateAccess,
-            lean
+            populateAccess
           })
         );
       }
@@ -11615,43 +11759,79 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options, filter: filter2 });
     if (admission) return admission;
     const { select, sort, populate, include, tasks } = this.resolvePublicReadFilterArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = this.resolvePublicReadOptions(options);
     let access = "read";
-    let result2 = await this.findOne(
-      filter2,
-      {
-        select,
-        sort,
-        populate,
-        include
-      },
-      requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
-    );
-    if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
-    if (tryList && (!result2.success || !result2.data)) {
-      const listAllowed = await this.requestCore.isAllowed(this.modelName, "list");
-      if (!listAllowed) {
-        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
-      }
-      access = "list";
-      result2 = await this.findOne(
-        filter2,
+    try {
+      let execution = withExecutionHydration(
+        this,
+        createServiceExecution(
+          this,
+          {
+            operation: "read",
+            rowAccess: access,
+            virtualAccess: access,
+            outputAccess: access,
+            docPermissionsAccess: access
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        ),
+        "publicRead"
+      );
+      const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+      let result2 = await executePreparedFindOne(
+        this,
+        execution,
+        query,
         {
           select,
           sort,
           populate,
           include
         },
-        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
+        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
       );
+      if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
+      if (tryList && (!result2.success || !result2.data)) {
+        const listAllowed = await this.requestCore.isAllowed(this.modelName, "list");
+        if (!listAllowed) {
+          return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+        }
+        access = "list";
+        execution = deriveServiceExecution(this, execution, {
+          operation: "read",
+          rowAccess: access,
+          virtualAccess: access,
+          outputAccess: access,
+          docPermissionsAccess: access
+        });
+        const fallback = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+        result2 = await executePreparedFindOne(
+          this,
+          execution,
+          fallback,
+          {
+            select,
+            sort,
+            populate,
+            include
+          },
+          requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
+        );
+      }
+      if (!result2.success) {
+        return result2;
+      }
+      let doc = toObject(result2.data);
+      doc = await this.decorate(doc, access, result2.context);
+      doc = this.runTasks(doc, tasks);
+      return { ...result2, data: doc };
+    } catch (error2) {
+      const result2 = this.getClientRequestErrorResult(error2);
+      if (result2) return result2;
+      throw error2;
     }
-    if (!result2.success) {
-      return result2;
-    }
-    let doc = toObject(result2.data);
-    doc = await this.decorate(doc, access, result2.context);
-    doc = this.runTasks(doc, tasks);
-    return { ...result2, data: doc };
   }
   async _update(id, data, args, options) {
     const admission = this.admitPublicCall({ args, options, data });
@@ -11672,8 +11852,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = (0, import_utils31.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) d = (0, import_utils31.pick)(d, [...Object.keys(data), "_id"]);
+        if (select) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...Object.keys(data), "_id"]));
         return d;
       }
     );
@@ -11753,8 +11933,8 @@ var PublicService = class extends Service {
             let d = toObject(doc);
             d = await this.decorate(d, "update", context);
             d = this.runTasks(d, tasks2);
-            if (select2) d = (0, import_utils31.pick)(d, [...normalizeSelect(select2), ...this.baseFieldsExt]);
-            else if (!returningAll) d = (0, import_utils31.pick)(d, [...Object.keys(otherData), "_id"]);
+            if (select2) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...normalizeSelect(select2), ...this.baseFieldsExt]));
+            else if (!returningAll) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...Object.keys(otherData), "_id"]));
             return d;
           }
         );
@@ -11783,7 +11963,7 @@ var PublicService = class extends Service {
           let d = toObject(doc);
           d = await this.decorate(d, "create", context);
           d = this.runTasks(d, tasks);
-          if (select) d = (0, import_utils31.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+          if (select) d = copyPermissionsAlias(d, (0, import_utils32.pick)(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
           return d;
         }
       );
@@ -11844,8 +12024,7 @@ var PublicService = class extends Service {
       includePermissions,
       includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicListOptions?.includeFieldPermissions ?? includePermissions,
       includeCount: options.includeCount ?? this.defaults.publicListOptions?.includeCount ?? false,
-      populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read",
-      lean: options.lean ?? this.defaults.publicListOptions?.lean ?? true
+      populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read"
     };
   }
   resolvePublicCreateArgs(args = {}) {
@@ -11886,8 +12065,7 @@ var PublicService = class extends Service {
       includePermissions,
       includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicReadOptions?.includeFieldPermissions ?? includePermissions,
       tryList: options.tryList ?? this.defaults.publicReadOptions?.tryList ?? true,
-      populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess,
-      lean: options.lean ?? this.defaults.publicReadOptions?.lean ?? false
+      populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess
     };
   }
   resolvePublicUpdateArgs(args = {}) {
@@ -11913,7 +12091,7 @@ var PublicService = class extends Service {
 init_options();
 init_data_values();
 init_helpers();
-var import_utils32 = require("@web-ts-toolkit/utils");
+var import_utils33 = require("@web-ts-toolkit/utils");
 init_request_complexity();
 init_runtime_context();
 init_runtime();
@@ -11942,7 +12120,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils32.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils33.pick)(doc, _select);
     return {
       success: true,
       kind: "single",
@@ -11988,13 +12166,13 @@ var DataService = class {
     const totalCount = docs.length;
     if (sort) {
       const normalizedSort = normalizeSortForOrderBy(sort);
-      docs = (0, import_utils32.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
+      docs = (0, import_utils33.orderBy)(docs, normalizedSort.fields, normalizedSort.orders);
     }
     const pagedDocs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     const { maxHookConcurrency } = this.getRequestComplexity();
     const trimmed = await mapWithConcurrencyLimit(pagedDocs, maxHookConcurrency, async (doc) => {
       doc = await this.trimOutputFields(doc, "list");
-      if (_select.length > 0) doc = (0, import_utils32.pick)(doc, _select);
+      if (_select.length > 0) doc = (0, import_utils33.pick)(doc, _select);
       return copyDataValue(doc);
     });
     if (!hasExplicitLimit && trimmed.length === totalCount) {
@@ -12069,7 +12247,13 @@ var DataService = class {
 init_helpers();
 
 // src/processors.ts
-var import_utils33 = require("@web-ts-toolkit/utils");
+var import_utils34 = require("@web-ts-toolkit/utils");
+init_permissions_alias();
+function cloneProcessorValue(value) {
+  const copy = (0, import_utils34.cloneDeep)(value);
+  copyPermissionsAliasGraph(value, copy);
+  return copy;
+}
 var UNSAFE_PATH_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var DEFAULT_MAX_SLICE = 1e3;
 var DEFAULT_MASK_REPLACEMENT = "***";
@@ -12104,10 +12288,10 @@ function resolveLeafParents(obj, src) {
   for (let ind = 0; ind < segs.length - 1; ind += 1) {
     const seg = segs[ind];
     targets = targets.reduce((ret, target) => {
-      if (!(0, import_utils33.isPlainObject)(target)) return ret;
+      if (!(0, import_utils34.isPlainObject)(target)) return ret;
       const targetObject = target;
       const next = targetObject[seg];
-      if ((0, import_utils33.isArray)(next)) {
+      if ((0, import_utils34.isArray)(next)) {
         for (const item of next) {
           ret.push(item);
         }
@@ -12117,8 +12301,8 @@ function resolveLeafParents(obj, src) {
   }
   const leaf = segs[segs.length - 1];
   const pairs = [];
-  (0, import_utils33.forEach)(targets, (target) => {
-    if (!(0, import_utils33.isPlainObject)(target)) return;
+  (0, import_utils34.forEach)(targets, (target) => {
+    if (!(0, import_utils34.isPlainObject)(target)) return;
     pairs.push({ parent: target, leaf });
   });
   return pairs;
@@ -12126,8 +12310,8 @@ function resolveLeafParents(obj, src) {
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -12136,19 +12320,19 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
     assertSafePath(dest);
     let targets = [obj];
     const segs = src.split(".");
-    (0, import_utils33.forEach)(segs, (seg, ind) => {
+    (0, import_utils34.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils33.forEach)(targets, (target) => {
-          if (!(0, import_utils33.isPlainObject)(target)) return;
+        (0, import_utils34.forEach)(targets, (target) => {
+          if (!(0, import_utils34.isPlainObject)(target)) return;
           const targetObject = target;
           const leaf = targetObject[seg];
           const sourceForDest = leaf;
           let depopulated;
-          if ((0, import_utils33.isArray)(leaf)) {
+          if ((0, import_utils34.isArray)(leaf)) {
             if (leaf.length === 0) {
               depopulated = [];
-            } else if (leaf.every((item) => (0, import_utils33.isPlainObject)(item))) {
-              depopulated = (0, import_utils33.map)(leaf, idField).map((id, i) => {
+            } else if (leaf.every((item) => (0, import_utils34.isPlainObject)(item))) {
+              depopulated = (0, import_utils34.map)(leaf, idField).map((id, i) => {
                 if (id === void 0) {
                   failMissingId(`${src}[${i}]`);
                 }
@@ -12157,8 +12341,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
             } else {
               return;
             }
-          } else if ((0, import_utils33.isPlainObject)(leaf)) {
-            const id = (0, import_utils33.get)(leaf, idField);
+          } else if ((0, import_utils34.isPlainObject)(leaf)) {
+            const id = (0, import_utils34.get)(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -12166,15 +12350,15 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           } else {
             return;
           }
-          (0, import_utils33.set)(targetObject, dest, sourceForDest);
-          (0, import_utils33.set)(targetObject, seg, depopulated);
+          (0, import_utils34.set)(targetObject, dest, sourceForDest);
+          (0, import_utils34.set)(targetObject, seg, depopulated);
         });
       } else {
         targets = targets.reduce((ret, target) => {
-          if (!(0, import_utils33.isPlainObject)(target)) return ret;
+          if (!(0, import_utils34.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils33.isArray)(next)) {
+          if ((0, import_utils34.isArray)(next)) {
             for (const item of next) {
               ret.push(item);
             }
@@ -12188,8 +12372,8 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 };
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -12197,17 +12381,17 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "copyPaths");
     assertSafePath(dest, "copyPaths");
     if (src === dest) return;
-    (0, import_utils33.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils33.hasOwn)(parent, leaf)) return;
-      (0, import_utils33.set)(parent, dest, (0, import_utils33.cloneDeep)(parent[leaf]));
+    (0, import_utils34.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils34.hasOwn)(parent, leaf)) return;
+      (0, import_utils34.set)(parent, dest, cloneProcessorValue(parent[leaf]));
     });
   });
   return obj;
 };
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
@@ -12215,10 +12399,10 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     assertSafePath(src, "movePaths");
     assertSafePath(dest, "movePaths");
     if (src === dest) return;
-    (0, import_utils33.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils33.hasOwn)(parent, leaf)) return;
-      const value = (0, import_utils33.cloneDeep)(parent[leaf]);
-      (0, import_utils33.set)(parent, dest, value);
+    (0, import_utils34.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils34.hasOwn)(parent, leaf)) return;
+      const value = cloneProcessorValue(parent[leaf]);
+      (0, import_utils34.set)(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
     });
@@ -12229,8 +12413,8 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const mutable = options.mutable !== false;
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
@@ -12247,15 +12431,15 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
       assertNonNegativeSafeInteger(op.limit, "limit", "sliceArrays");
       limit = Math.min(op.limit, maxSlice);
     }
-    (0, import_utils33.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+    (0, import_utils34.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       const leafValue = parent[leaf];
-      if (!(0, import_utils33.isArray)(leafValue)) return;
+      if (!(0, import_utils34.isArray)(leafValue)) return;
       const end = typeof limit === "undefined" ? void 0 : skip + limit;
       const window = leafValue.slice(skip, end);
       if (typeof rawDest === "undefined") {
-        (0, import_utils33.set)(parent, leaf, window);
+        (0, import_utils34.set)(parent, leaf, window);
       } else {
-        (0, import_utils33.set)(parent, rawDest, window);
+        (0, import_utils34.set)(parent, rawDest, window);
       }
     });
   });
@@ -12263,44 +12447,44 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 };
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
     const dest = op.dest;
     if (src.length === 0 || dest.length === 0) return;
     assertSafePath(src, "countPaths");
     assertSafePath(dest, "countPaths");
-    (0, import_utils33.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils33.hasOwn)(parent, leaf)) return;
+    (0, import_utils34.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils34.hasOwn)(parent, leaf)) return;
       const leafValue = parent[leaf];
       let count;
-      if ((0, import_utils33.isArray)(leafValue)) {
+      if ((0, import_utils34.isArray)(leafValue)) {
         count = leafValue.length;
-      } else if ((0, import_utils33.isPlainObject)(leafValue)) {
+      } else if ((0, import_utils34.isPlainObject)(leafValue)) {
         count = Object.keys(leafValue).length;
       } else if (leafValue === null || typeof leafValue === "undefined") {
         count = 0;
       } else {
         count = 1;
       }
-      (0, import_utils33.set)(parent, dest, count);
+      (0, import_utils34.set)(parent, dest, count);
     });
   });
   return obj;
 };
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : (0, import_utils33.cloneDeep)(docObject);
-  (0, import_utils33.forEach)(Array.isArray(operations) ? operations : [], (op) => {
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
+  (0, import_utils34.forEach)(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
     if (src.length === 0) return;
     assertSafePath(src, "maskPaths");
     const replacement = Object.prototype.hasOwnProperty.call(op, "replacement") ? op.replacement : DEFAULT_MASK_REPLACEMENT;
-    (0, import_utils33.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
-      if (!(0, import_utils33.hasOwn)(parent, leaf)) return;
-      (0, import_utils33.set)(parent, leaf, replacement);
+    (0, import_utils34.forEach)(resolveLeafParents(obj, src), ({ parent, leaf }) => {
+      if (!(0, import_utils34.hasOwn)(parent, leaf)) return;
+      (0, import_utils34.set)(parent, leaf, replacement);
     });
   });
   return obj;
@@ -12400,10 +12584,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils34.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils35.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils34.isString)(idField)) {
+    if ((0, import_utils35.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -12524,15 +12708,15 @@ var Core = class {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
     for (const p of populate) {
-      if (!(0, import_utils34.isString)(p)) assertPopulateAccess(p.access);
+      if (!(0, import_utils35.isString)(p)) assertPopulateAccess(p.access);
     }
-    populate = (0, import_utils34.compact)(
+    populate = (0, import_utils35.compact)(
       await Promise.all(
         populate.map(async (p) => {
-          const populateAccess = !(0, import_utils34.isString)(p) && p.access ? p.access : access;
+          const populateAccess = !(0, import_utils35.isString)(p) && p.access ? p.access : access;
           assertPopulateAccess(populateAccess);
-          const originalSelect = (0, import_utils34.isString)(p) ? void 0 : p.select;
-          const ret = (0, import_utils34.isString)(p) ? { path: p } : {
+          const originalSelect = (0, import_utils35.isString)(p) ? void 0 : p.select;
+          const ret = (0, import_utils35.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -12560,7 +12744,7 @@ var Core = class {
           }
           ret.select = await this.requestPopulateSelect(refModelName, populateAccess, ret.select);
           const hookInputs = getModelOption(refModelName, `alwaysSelectFields.${populateAccess}`, []);
-          ret.select = (0, import_utils34.uniq)([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
+          ret.select = (0, import_utils35.uniq)([...ret.select, ...stripVirtuals(hookInputs, runtime.getVirtualNames(refModelName))]);
           const filter2 = await this.genFilter(refModelName, populateAccess, null);
           if (filter2 === false) return null;
           ret.match = filter2;
@@ -12596,7 +12780,7 @@ var Core = class {
               internalFetch: { baseFields: ["_id"] },
               globalPermissions: globalForPlan
             });
-            const merged = (0, import_utils34.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
+            const merged = (0, import_utils35.uniq)([...normalizeSelect(ret.select), ...targetPlan.virtualOnlyDeps ?? []]).filter(
               (t) => t !== "-_id" && !t.includes(".sub.")
             );
             if (!merged.includes("_id")) merged.push("_id");
@@ -12620,10 +12804,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils34.isFunction)(validate)) {
+    if ((0, import_utils35.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils34.isBoolean)(validate) || (0, import_utils34.isArray)(validate)) {
+    } else if ((0, import_utils35.isBoolean)(validate) || (0, import_utils35.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -12648,7 +12832,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils34.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils35.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -12672,7 +12856,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils34.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils35.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await getRequestWorkState(this.req, this.requestRuntime).hookGate.run(
@@ -12756,7 +12940,7 @@ var Core = class {
       readExists ? requestFields("read") : [],
       updateExists ? requestFields("update") : []
     ]);
-    const viewObj = (0, import_utils34.reduce)(
+    const viewObj = (0, import_utils35.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -12764,7 +12948,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils34.reduce)(
+    const editObj = (0, import_utils35.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -12795,9 +12979,9 @@ var Core = class {
     });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils34.compact)((0, import_utils34.castArray)(task));
+    const tasks = (0, import_utils35.compact)((0, import_utils35.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils34.forEach)(tasks, (task2) => {
+    (0, import_utils35.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -12865,9 +13049,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils34.isUndefined)(subOption)) {
+      if ((0, import_utils35.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils34.isUndefined)(subFieldOption)) {
+        if ((0, import_utils35.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -12933,25 +13117,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils35.isPlainObject)(condition)) {
+    if ((0, import_utils36.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils35.isString)(id) ? id : null;
-      if ((0, import_utils35.isPlainObject)(id)) {
+      let _id = (0, import_utils36.isString)(id) ? id : null;
+      if ((0, import_utils36.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils35.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils36.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils35.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils36.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils35.isString)(_id) || !_id) {
+      if (!(0, import_utils36.isString)(_id) || !_id) {
         return next(new import_express_json_router5.default.clientErrors.BadRequestError());
       }
       const result2 = await svc._read(_id, { select });
@@ -12963,11 +13147,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils35.isString)(cond)) {
+    if ((0, import_utils36.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils35.isArray)(cond)) {
+    } else if ((0, import_utils36.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils35.isFunction)(cond)) {
+    } else if ((0, import_utils36.isFunction)(cond)) {
       const result2 = await cond.call(req, permissions);
       if (!!result2) return next();
     }
@@ -12980,7 +13164,7 @@ var import_express2 = __toESM(require("express"));
 
 // src/routers/model-router.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils39 = require("@web-ts-toolkit/utils");
+var import_utils40 = require("@web-ts-toolkit/utils");
 init_logger_helpers();
 init_runtime();
 init_runtime_context();
@@ -13114,7 +13298,7 @@ init_request_complexity();
 
 // src/validation/common.ts
 var import_zod2 = require("zod");
-var import_utils36 = require("@web-ts-toolkit/utils");
+var import_utils37 = require("@web-ts-toolkit/utils");
 
 // src/validation/public-admission-schema.ts
 init_public_admission();
@@ -13243,7 +13427,7 @@ var correlatedFilterSchema = import_zod2.z.record(import_zod2.z.string(), import
   }
 });
 var correlatedEmptyOptionsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils36.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils37.isPlainObject)(value) && Object.keys(value).length === 0,
   "Correlated include options must be absent or empty"
 ).optional();
 var correlatedPathSchema = import_zod2.z.string().min(1).superRefine((path, ctx) => {
@@ -13280,7 +13464,7 @@ var correlatedListArgsSchema = import_zod2.z.object({
   include: import_zod2.z.lazy(() => correlatedNestedIncludeSchema).optional()
 }).strict().superRefine((args, ctx) => checkArgsMarkers(args.select, args.sort, ctx));
 var correlatedCountArgsSchema = import_zod2.z.unknown().refine(
-  (value) => value === void 0 || (0, import_utils36.isPlainObject)(value) && Object.keys(value).length === 0,
+  (value) => value === void 0 || (0, import_utils37.isPlainObject)(value) && Object.keys(value).length === 0,
   "Count includes accept no args"
 ).optional();
 var correlatedReadByIdSchema = import_zod2.z.object({
@@ -13333,7 +13517,7 @@ var correlatedNestedIncludeSchema = import_zod2.z.union([includeItemSchema, impo
 var rejectDuplicateCorrelatedPaths = (items, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   items.forEach((item, index) => {
-    if ((0, import_utils36.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
+    if ((0, import_utils37.isPlainObject)(item) && item.mode === "correlated" && typeof item.path === "string") {
       if (seen.has(item.path)) {
         ctx.addIssue({
           code: import_zod2.z.ZodIssueCode.custom,
@@ -14077,8 +14261,7 @@ var rootModelListOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   includeCount: import_zod5.z.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: import_zod5.z.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
@@ -14094,8 +14277,7 @@ var rootModelReadOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   tryList: import_zod5.z.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: import_zod5.z.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelCreateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
@@ -14308,7 +14490,7 @@ var rootQuerySchema = publicBoundarySchema(
 init_helpers();
 
 // src/routers/shared.ts
-var import_utils37 = require("@web-ts-toolkit/utils");
+var import_utils38 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 init_schemas();
@@ -14339,15 +14521,15 @@ function setModelCollectionRoutes(context) {
       sort
     } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = (0, import_utils37.parseBooleanString)(include_count);
-    const includeExtraHeaders = (0, import_utils37.parseBooleanString)(include_extra_headers);
+    const includeCount = (0, import_utils38.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils38.parseBooleanString)(include_extra_headers);
     const result2 = await svc._list(
       {},
       { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
-        skim: (0, import_utils37.parseBooleanString)(skim),
-        includePermissions: (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils37.parseBooleanString)(include_field_permissions),
+        skim: (0, import_utils38.parseBooleanString)(skim),
+        includePermissions: (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils38.parseBooleanString)(include_field_permissions),
         includeCount
       }
     );
@@ -14407,8 +14589,8 @@ function setModelCollectionRoutes(context) {
       data,
       {},
       {
-        includePermissions: (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils37.parseBooleanString)(include_field_permissions)
+        includePermissions: (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils38.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -14446,8 +14628,8 @@ function setModelCollectionRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        includePermissions: includePermissions ?? (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils37.parseBooleanString)(include_field_permissions),
+        includePermissions: includePermissions ?? (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils38.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -14544,9 +14726,9 @@ function setModelDocumentRoutes(context) {
       id,
       { select: parseSelectParam(select) },
       {
-        includePermissions: (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils37.parseBooleanString)(include_field_permissions),
-        tryList: (0, import_utils37.parseBooleanString)(try_list)
+        includePermissions: (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils38.parseBooleanString)(include_field_permissions),
+        tryList: (0, import_utils38.parseBooleanString)(try_list)
       }
     );
     handleResultError(result2);
@@ -14646,9 +14828,9 @@ function setModelDocumentRoutes(context) {
       data,
       { select: parseSelectParam(select) },
       {
-        returningAll: (0, import_utils37.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils37.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils38.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils38.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -14697,9 +14879,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils37.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils37.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils38.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils38.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -14730,9 +14912,9 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: (0, import_utils37.parseBooleanString)(returning_all),
-        includePermissions: (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: (0, import_utils37.parseBooleanString)(include_field_permissions)
+        returningAll: (0, import_utils38.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: (0, import_utils38.parseBooleanString)(include_field_permissions)
       }
     );
     handleResultError(result2);
@@ -14779,9 +14961,9 @@ function setModelDocumentRoutes(context) {
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
-        returningAll: returningAll ?? (0, import_utils37.parseBooleanString)(returning_all),
-        includePermissions: includePermissions ?? (0, import_utils37.parseBooleanString)(include_permissions),
-        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils37.parseBooleanString)(include_field_permissions),
+        returningAll: returningAll ?? (0, import_utils38.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils38.parseBooleanString)(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? (0, import_utils38.parseBooleanString)(include_field_permissions),
         populateAccess
       }
     );
@@ -15021,11 +15203,11 @@ function setModelSubDocumentRoutes(context) {
 }
 
 // src/openapi/route-registration.ts
-var import_utils38 = require("@web-ts-toolkit/utils");
+var import_utils39 = require("@web-ts-toolkit/utils");
 function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
   runtime.registerOpenApiRoute({
     ...route,
-    path: (0, import_utils38.normalizeUrlPath)(basePath + route.path),
+    path: (0, import_utils39.normalizeUrlPath)(basePath + route.path),
     tags: route.tags ?? [defaultTag]
   });
 }
@@ -15033,8 +15215,8 @@ function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router8.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils39.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils39.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils40.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils40.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(
     this.modelName,
@@ -15233,7 +15415,7 @@ var ModelRouter = class _ModelRouter {
     this.runtime = runtime;
     this.runtime.setModelOptions(modelName, initialOptions);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils39.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils40.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router8.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName, this.runtime);
@@ -15319,13 +15501,13 @@ var ModelRouter = class _ModelRouter {
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils39.forEach)(this.router.getEndpoints(), ({ method, path }) => {
-        logInfoMessage(`${(0, import_utils39.padEnd)(method, 6)} ${(0, import_utils39.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils40.forEach)(this.router.getEndpoints(), ({ method, path }) => {
+        logInfoMessage(`${(0, import_utils40.padEnd)(method, 6)} ${(0, import_utils40.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils39.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils40.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -15333,7 +15515,7 @@ var ModelRouter = class _ModelRouter {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils39.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils40.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(
         this.modelName,
@@ -15361,7 +15543,7 @@ var ModelRouter = class _ModelRouter {
 
 // src/routers/root-router.ts
 var import_express_json_router9 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils40 = require("@web-ts-toolkit/utils");
+var import_utils41 = require("@web-ts-toolkit/utils");
 
 // src/core-data.ts
 init_options();
@@ -15667,7 +15849,7 @@ var RootRouter = class {
     this.setRoutes();
   }
   registerOpenApiRoute(route) {
-    registerOpenApiRoute(this.runtime, (0, import_utils40.normalizeUrlPath)(this.basename), "root", route);
+    registerOpenApiRoute(this.runtime, (0, import_utils41.normalizeUrlPath)(this.basename), "root", route);
   }
   wrapResult(index, item, result2) {
     return {
@@ -15727,8 +15909,8 @@ var RootRouter = class {
     const presentation = ["skim", "includePermissions", "includeFieldPermissions"];
     const optionKeys = {
       new: presentation,
-      list: [...presentation, "includeCount", "populateAccess", "lean"],
-      read: [...presentation, "populateAccess", "lean", "tryList"],
+      list: [...presentation, "includeCount", "populateAccess"],
+      read: [...presentation, "populateAccess", "tryList"],
       create: [...presentation, "populateAccess"],
       update: [...presentation, "populateAccess", "returningAll"],
       upsert: [...presentation, "populateAccess", "returningAll"]
@@ -15776,7 +15958,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     const groups = /* @__PURE__ */ new Map();
     items.forEach((item, index) => {
-      const order = (0, import_utils40.isNumber)(item.order) ? item.order : 0;
+      const order = (0, import_utils41.isNumber)(item.order) ? item.order : 0;
       const group = groups.get(order);
       if (group) {
         group.push({ index, item });
@@ -15847,7 +16029,7 @@ var RootRouter = class {
         const arrResult = await this.runGroup(req, groupedItems[x]);
         results.push(...arrResult);
       }
-      return (0, import_utils40.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils41.orderBy)(results, ["index"], ["asc"]);
     });
     this.registerOpenApiRoute({
       method: "post",
@@ -15865,14 +16047,14 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 var import_express_json_router10 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils41 = require("@web-ts-toolkit/utils");
+var import_utils42 = require("@web-ts-toolkit/utils");
 init_runtime();
 init_helpers();
 init_schemas();
 var clientErrors4 = import_express_json_router10.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils41.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils41.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils42.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils42.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -15921,7 +16103,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils41.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils42.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router10.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -15954,8 +16136,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = (0, import_utils37.parseBooleanString)(include_count);
-      const includeExtraHeaders = (0, import_utils37.parseBooleanString)(include_extra_headers);
+      const includeCount = (0, import_utils38.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils38.parseBooleanString)(include_extra_headers);
       const result2 = await svc.find(
         {},
         { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
@@ -16073,7 +16255,7 @@ var DataRouter = class {
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils41.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils42.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(
         this.dataName,
@@ -16081,7 +16263,7 @@ var DataRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils41.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils42.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -16216,7 +16398,7 @@ function createRuntimeApi(runtime) {
   const wtt2 = runtimeMiddleware;
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
-    if ((0, import_utils42.isUndefined)(options)) {
+    if ((0, import_utils43.isUndefined)(options)) {
       return new RootRouter(modelName, runtime);
     }
     if (typeof modelName === "string") {
@@ -16237,10 +16419,10 @@ function createRuntimeApi(runtime) {
   };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils42.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils43.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils42.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils43.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };