@web-ts-toolkit/access-router 0.52.0 → 0.54.0

package/README.md

@@ -18,6 +18,7 @@ ACL-aware Express routers and in-memory data services for Mongoose-backed APIs.
 [Persistence limits](#persistence-concurrency-and-resource-limits)
 
 **Migration:** [Removed overrides](#breaking-release-service-overrides-migration) ·
+[Server-owned hydration](#breaking-release-server-owned-hydration) ·
 [Named helpers](#breaking-release-named-helpers-and-default-behavior) ·
 [Distinct values](#distinct-whole-value-request-authorization) ·
 [Numeric grouped counts](#numeric-grouped-count-service-api-breaking-migration) ·
@@ -124,11 +125,11 @@ package-managed execution, falling back to `defaultRuntime` outside it.
 | Layer / public type                                                             | Where to put it                                                                                         | Scope and examples                                                                                                                                                                                          |
 | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Runtime/global — `GlobalOptions`                                                | `api.setGlobalOptions({...})`, `api.setGlobalOption(key, value)`; `api.set` is an alias for these forms | That runtime's request grants (`globalPermissions`, `requestPermissionField`), logger, registered-populate policy and `requestComplexity`.                                                                  |
-| Model defaults — `DefaultModelRouterOptions`                                    | `api.setDefaultModelOptions({...})`, `api.setDefaultModelOption(path, value)`                           | Shared model starting values such as `listHardLimit`, IDs, route segments, `operationAccess` and metadata posture. Data/root routers do not inherit them.                                                   |
-| Model router — `ModelRouterOptions<Model, Virtuals>`                            | `api.createRouter(Model, {...})`, then `router.setOptions`, `router.setOption` / `router.set`           | One registered model's guards, `permissionSchema`, hooks, virtuals, request schemas and method defaults. Routers for the same model/runtime share its stored options.                                       |
+| Model defaults — `DefaultModelRouterOptions`                                    | `api.setDefaultModelOptions({...})`, `api.setDefaultModelOption(path, value)`                           | Shared model starting values such as `listHardLimit`, IDs, route segments, `operationAccess`, `hydration` and metadata posture. Data/root routers do not inherit them.                                      |
+| Model router — `ModelRouterOptions<Model, Virtuals>`                            | `api.createRouter(Model, {...})`, then `router.setOptions`, `router.setOption` / `router.set`           | One registered model's guards, `permissionSchema`, hooks, virtuals, request schemas, `hydration` and method defaults. Routers for the same model/runtime share its stored options.                          |
 | Data router — `DataRouterOptions<Data>`                                         | `api.createDataRouter(name, {...})`, its setters, or `api.runtime.setDataOptions` / `setDataOption`     | Owned in-memory `data`, list/read guards, request-only fields/filters and decorators. No model `defaults` or model authorization policy. Set `idParam` and `idField` explicitly for data identifier routes. |
 | Root router — `RootRouterOptions`                                               | Single-argument `api.createRouter({ basePath, operationAccess, ... })`                                  | The batch endpoint's scalar guard and batch/order/whole-operation limits; each target keeps its own policy.                                                                                                 |
-| Per-method defaults — `Defaults<Model>` from `/advanced`                        | `ModelRouterOptions.defaults`, e.g. `defaults.publicListArgs` or `defaults.findOptions`                 | Query/presentation defaults for the **named method**, not global settings or trusted authority. Public wrappers and internal methods have separate buckets.                                                 |
+| Per-method defaults — `Defaults<Model>` from `/advanced`                        | `ModelRouterOptions.defaults`, e.g. `defaults.publicListArgs` or `defaults.findOptions`                 | Query/presentation defaults for the **named method**, not hydration, global settings or trusted authority. Public wrappers and internal methods have separate buckets.                                      |
 | Wire query / `args` / `options`                                                 | GET query, advanced body, or root entry                                                                 | Request-controlled selection, sorting, pagination and allowed presentation options; placement and spelling depend on transport (below).                                                                     |
 | Trusted per-call policy — `ServiceAuthorization`, `MutationAuthorization`, etc. | The internal service's final `options.authorization`                                                    | Server-owned, method-specific row/input/output/related authority. Absent dimensions use request authority. Never a router default, HTTP option or reusable permission mutation.                             |
 
@@ -164,8 +165,9 @@ package-managed execution, falling back to `defaultRuntime` outside it.
    and selection meanings still apply. Public `_list`/`_read`/`_create`/`_update`
    resolve `public*Args`/`public*Options` first, then forward resolved values to
    internal methods. A still-undefined query setting can reach the internal bucket;
-   an already resolved built-in (such as public list `lean: true`) takes precedence
-   over that internal default. By-ID delegations similarly forward resolved values.
+   an already resolved built-in (such as public list `includeCount: false`) takes
+   precedence over that internal default. By-ID delegations similarly forward
+   resolved values. Hydration is separate model configuration, not a method value.
    Public `_upsert` uses the public create or update bucket for its branch; trusted
    `upsert` has `upsertArgs`/`upsertOptions`. There is no `publicUpsertOptions` bucket.
 5. **Metadata posture is absolute.** Model `stripPermissionsField: true` removes
@@ -179,6 +181,8 @@ The supported `Defaults` buckets are `findArgs`/`findOptions`,
 `updateByIdArgs`/`updateByIdOptions`, `upsertArgs`/`upsertOptions`, `existsOptions`,
 and the four `publicList`, `publicRead`, `publicCreate`, `publicUpdate` Args/Options
 pairs. There is no general `defaults.options`, count, or data-method bucket.
+An explicit `service.defaults` assignment replaces the entire runtime defaults bag
+for that service; it does not merge buckets. Neither form selects hydration.
 
 <!-- doc-example: partial -->
 
@@ -246,8 +250,9 @@ GET flag values are strings `true`/`false`; body/root flags are booleans. The ta
 describes list/read fields on routes that support them, not arbitrary forwarding.
 GET lists start with `{}` as their client filter; use an advanced body for `filter`,
 `populate` or `include`. Model GET-by-ID also accepts `select`; basic data GET-by-ID
-does not project query selection (use its advanced read). `lean` is a model service/
-root read-list option, not a generated direct HTTP body option. Mutation bodies use
+does not project query selection (use its advanced read). Neither `lean` nor
+`hydration` is a supported service/wire option; use server model configuration.
+Mutation bodies use
 top-level `data`/`select`/`populate`/`tasks` and their own allowed `options`; see
 [advanced mutation validation](#advanced-mutation-validation).
 
@@ -270,7 +275,7 @@ separate from both objects. Root entries keep `target`, `name`, base `op`, `filt
 | `requestSchemas` / `validate` / `prepare` / `transform`                 | HTTP parsing / admitted model-input validation / trusted data preparation / live-document mutation before save.                                                                        |
 | `populate` / `include` / `related`                                      | Declared Mongoose references / output-only related query attachments / independent trusted target policy for an exact requested path.                                                  |
 | `access` / `populateAccess`                                             | Method-specific effective row/field access / target populate access (`list` or `read` on the wire). Neither chooses a basic/advanced route variant.                                    |
-| `lean` / `skim` / metadata flags                                        | Mongoose hydration choice / deprecated no-op / serialization and field-map choices. All preserve authorization.                                                                        |
+| Model `hydration` / `skim` / metadata flags                             | Server-owned Mongoose fetch choice / deprecated per-call no-op / serialization and field-map choices. All preserve authorization.                                                      |
 | `maxConcurrentOperations` / `maxHookConcurrency` / `maxBulkConcurrency` | Whole root operations per order group / request-runtime hook chains / request-runtime leaf persistence operations. Separate counted units and pools.                                   |
 | `count` / `includeCount` / `countByFieldValues`                         | One exact numeric query result / list match-total option / bounded numeric counts per original key alias. Returned-row counts and overlapping per-key counts are not union totals.     |
 
@@ -279,11 +284,160 @@ separate from both objects. Root entries keep `target`, `name`, base `op`, `filt
 `skim` remains accepted in existing service/default and supported wire option slots
 for compatibility, but is **deprecated and has no behavioral effect** in canonical
 model operations. True, false and omission all keep field/row authorization, document
-grants, virtuals and decoration. Remove it from new code. Use `lean` to choose fetch
-hydration, `includePermissions`/`includeFieldPermissions` to choose metadata, or the
+grants, virtuals and decoration. Remove it from new code. Use model `hydration`
+configuration for fetch mode, `includePermissions`/`includeFieldPermissions` for metadata, or the
 router's absolute metadata postures; none skips authorization. Existing examples
 that retain `skim` below demonstrate this compatibility contract.
 
+### Breaking release: server-owned hydration
+
+**Removed:** per-call `lean` from `PublicListOptions`, `PublicReadOptions`,
+`FindOptions`, `FindOneOptions`, inherited `FindByIdOptions`, and
+`SubdocumentParentOptions`. There is no renamed per-call, client, GET/body/root,
+include or populate hydration switch. Raw Mongoose `.lean()` remains supported.
+
+Configure the optional **model-level** `hydration: ModelHydrationOptions` record.
+Both it and `HydrationMode = 'lean' | 'hydrated'` are exported from the package root
+and `/advanced`. Exactly these five independent entries are supported:
+
+| Entry        | Built-in mode | Applies to                                                                                        |
+| ------------ | ------------- | ------------------------------------------------------------------------------------------------- |
+| `publicList` | `'lean'`      | Public `_list`, direct/root model lists                                                           |
+| `publicRead` | `'hydrated'`  | Public `_read`/`_readFilter`, identifier/filter routes and both attempts of read-to-list fallback |
+| `find`       | `'hydrated'`  | Internal service `find`                                                                           |
+| `findOne`    | `'hydrated'`  | Internal service `findOne`                                                                        |
+| `findById`   | `'hydrated'`  | Internal service `findById`, independently of `findOne`                                           |
+
+<!-- doc-example: partial -->
+
+```ts
+import mongoose from 'mongoose';
+import { createAccessRuntime, type ModelRouterOptions } from '@web-ts-toolkit/access-router';
+import type { ModelRequest } from '@web-ts-toolkit/access-router/advanced';
+
+const api = createAccessRuntime();
+const Thing = mongoose.model('Thing', new mongoose.Schema({ name: String }));
+// Server-owned hydration migration: configure once, not around each request.
+const options = {
+  operationAccess: { list: true, read: true },
+  permissionSchema: { name: true },
+  // Before: defaults.publicListOptions.lean = false; findOneOptions.lean = true.
+  hydration: { publicList: 'hydrated', findOne: 'lean', find: 'lean' },
+  defaults: { publicListOptions: { includeCount: true } },
+} satisfies ModelRouterOptions;
+const router = api.createRouter(Thing, options);
+router.setOption('hydration.publicRead', 'lean'); // Keeps the other stored entries.
+
+export async function findThings(req: ModelRequest) {
+  // req must be initialized by this runtime's middleware (for example router.routes).
+  const service = router.getService(req);
+  // Before: service.defaults = { findOptions: { lean: true, includeCount: true } }.
+  // Fetch mode is now model-wide hydration.find above, not service-instance state.
+  service.defaults = { findOptions: { includeCount: true } };
+  return service.find({}); // No fetch-mode option.
+}
+```
+
+Supported writers are model construction/router setters,
+`api.runtime.setModelOptions` / `setModelOption`, and starting defaults through
+`api.setDefaultModelOptions` / `setDefaultModelOption` (also on `api.runtime`).
+`GlobalOptions`, data/root router options, method `defaults`, `service.defaults`
+and client defaults are not hydration scopes. Decorator applications use the same
+record through `@Router`, per-model/default `@RouterOptions`, `@ModelOption` and
+`@DefaultModelOption`; see `@web-ts-toolkit/access-router-deco`'s installed README
+for its compiling configuration example.
+No dedicated hydration decorator is needed.
+
+Assignment follows `{ ...runtimeStartingDefaults, ...storedModelOptions,
+...incomingModelOptions }`: a supplied hydration record **replaces** the previous
+record, not individual members. Omitted/undefined entries use the matrix's
+built-ins, never an older record's members or generic nested `.default` lookup.
+For example, replacing `{ publicList: 'hydrated' }` with `{ find: 'lean' }`
+restores public lists to their built-in lean mode. The five exact
+`hydration.<entry>` setters change one stored member; member `undefined` clears
+that override and whole-record `undefined` clears the setting. Starting-default
+changes do not broadcast over an existing stored record. Default providers obey
+the same shallow semantics and existing decorator precedence.
+
+Only plain records with those five keys and mode strings (or `undefined`) are
+valid; scalars, null, arrays, unknown keys and invalid modes throw a path-bearing
+`TypeError` **before publication**. Failed updates preserve the prior snapshot;
+failed decorator bootstrap rolls back package-controlled state. Fresh service
+calls capture their owning runtime/model's current configuration; suspended calls,
+read fallback and already-captured related work retain their capture, even if
+another runtime later replaces `req.macl`.
+
+**Defaults migration:** move each old `defaults.<bucket>.lean` entry as follows;
+convert `true` to `'lean'` and `false` to `'hydrated'`:
+
+| Old bucket          | New model setting      |
+| ------------------- | ---------------------- |
+| `publicListOptions` | `hydration.publicList` |
+| `publicReadOptions` | `hydration.publicRead` |
+| `findOptions`       | `hydration.find`       |
+| `findOneOptions`    | `hydration.findOne`    |
+| `findByIdOptions`   | `hydration.findById`   |
+
+Keep unrelated presentation defaults in their existing buckets. Old `lean` keys,
+even `undefined`, and `hydration` keys in method-option buckets throw migration
+diagnostics instead of being translated or silently ignored. This covers model
+setters, synchronous `service.defaults` assignment, and later mutation of an
+assigned defaults bag detected before querying. Other methods explain their fixed
+mode rather than offer a replacement knob. Moving a former `service.defaults`
+override changes **all services for that model in its runtime**, not just one
+service instance; make that choice deliberately, never emulate request-local mode
+by changing shared configuration around a call.
+
+**Old JavaScript/wire inputs:** stale `lean` or `hydration` controls in permissive
+service/direct/root/`$$sq`/legacy-include/populate slots are inert and never select
+fetch mode. Strict correlated includes still reject nonempty execution options,
+including these keys. Ordinary business fields named `lean` or `hydration` remain
+valid in filters, selections, mutations and task data. Private execution choices
+are not added to public query/context metadata or response DTOs.
+
+| Fixed/related stage                                                                           | Fetch contract (not a new setting)                                                                                                                                                              |
+| --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Legacy/correlated include list/read targets                                                   | Fixed lean; read fallback disabled for correlated reads                                                                                                                                         |
+| `$$sq` list/read target                                                                       | Target's captured `publicList`/`publicRead`; no read fallback                                                                                                                                   |
+| Mongoose populate, including nested targets                                                   | Inherits the originating parent query's mode, not target hydration configuration                                                                                                                |
+| `getParentDoc(id, sub, args?, { access? })`, `findRawParentDoc({ filter, select, populate })` | Raw hydrated parent/null; not finalized DTOs or permission metadata. `getParentDoc` keeps its row/projection/populate checks; the low-level raw adapter helper is not an authorization boundary |
+| Dedicated subdocument read/mutation parent; `readSub` populate                                | Fixed hydrated parent/live document; post-save visibility re-fetch alone stays fixed lean                                                                                                       |
+| Create/new, update/upsert mutation lookup/save, delete hooks                                  | Live hydrated documents for setters, validation, saves and deletion, regardless of read configuration                                                                                           |
+| Exists/public-upsert existence, field-membership queries                                      | Fixed lean `_id` lookups; count/distinct/aggregates do not hydrate document results                                                                                                             |
+
+**Value caveat:** finalized model results and output-stage hook views are
+plain objects in both modes; this is not a promise of identical values. Hydration
+can apply missing schema defaults, init hooks and schema getters/`toObject`
+transforms that bare lean skips. Package virtuals, authorization, selection,
+decoration and metadata rules still run in both modes. Test your application's
+schema/plugins before switching; no universal JSON parity or measured speedup is
+claimed. Client save-capable `Model` wrappers are a separate client feature.
+
+### Finalized permissions alias
+
+**Compatibility expansion:** when a package-finalized model row already carries
+serialized permission metadata, `row.permissions` aliases that finalized value at
+`documentPermissionField` (default `_permissions`, also dotted paths such as
+`meta.grants`), independently of hydration and plugin installation. It is a
+non-enumerable, writable, configurable own data property: JSON, `Object.keys` and
+object spread omit the generated alias. It is a convenience value, **not authority
+or a live binding** after application reassignment.
+
+Exposure pruning, metadata flags, field-map disabling and empty/placeholder
+metadata apply before aliasing; private/unfiltered grants are never copied from
+raw documents. `stripPermissionsField: true` suppresses both canonical metadata
+and its generated alias. Existing `permissions` output wins, including selected
+business fields, package virtuals and include attachments/descriptors. A canonical
+path of `permissions` or `permissions.grants` keeps its existing enumerable
+property; no separate alias is created.
+
+Package-owned copies/related attachments preserve the alias **where metadata is
+already present**; ordinary populated/dedicated subdocument outputs do not gain
+metadata just to create one. Arbitrary application copies/transform replacements
+and client `Model` wrappers need not retain non-enumerable properties. The optional
+[Mongoose plugin](#optional-permissions-plugin) is a separate raw-document getter,
+not a prerequisite for this finalized alias.
+
 ### Root batch bounds
 
 Create the batch endpoint with the **single-options** overload,
@@ -787,6 +941,7 @@ async function runServiceAuthorizationExample() {
     const router = api.createRouter<Order, Virtuals>(OrderModel, {
       basePath: '/orders',
       operationAccess: { read: true },
+      hydration: { findOne: 'lean' },
       stripPermissionsField: true,
       baseFilter: { read: () => ({ tenantId: 'request-tenant' }) },
       overrideFilter: {
@@ -830,7 +985,7 @@ async function runServiceAuthorizationExample() {
       ...output,
       rows: { mode: 'scope', filter: { tenantId: 'backend' } },
     } as const satisfies ServiceAuthorization<Order, Virtuals>;
-    const quiet = { skim: true, lean: true, includePermissions: false, includeFieldPermissions: false };
+    const quiet = { skim: true, includePermissions: false, includeFieldPermissions: false };
     const selected = { select: ['status', 'internalNote', '-_id'] };
 
     async function verifyServiceAuthorization(req: ModelRequest) {
@@ -1771,6 +1926,7 @@ Root entrypoint (`@web-ts-toolkit/access-router`):
 - logger helpers: `redactFilter`, `redactPayload`, `safeStringify`, `isLevelEnabled` + `OpLogContext` type
 - option helpers: `setGlobalOptions`, `setGlobalOption`, `getGlobalOptions`, `getGlobalOption`, `setModelOptions`, `setModelOption`, `getModelOptions`, `getModelOption`, `getModelNames`, `getModelJsonSchema`, `setDefaultModelOptions`, `setDefaultModelOption`, `getDefaultModelOptions`, `getDefaultModelOption`
 - route-policy types: `OperationAccess`, `SubOperationAccess`, `Validation`, `GuardHook`, `RouteVariantAccess`, `ModelRouterOptions`, `DefaultModelRouterOptions`, `DataRouterOptions`, `ExtendedModelRouterOptions`, `ExtendedDefaultModelRouterOptions`, and `ExtendedDataRouterOptions` for typed setters; `PermissionSchema` / `FieldOperationAccess` are separate base-operation field grants. These types are also available from `/advanced`.
+- fetch configuration types (also `/advanced`): `HydrationMode`, `ModelHydrationOptions` — server-owned model/default configuration, never per-call/wire options.
 - trusted service policy types (also `/advanced`): `ServiceAuthorization` (reads), `MutationAuthorization` (update/upsert), `CreateAuthorization`, `InputFieldAuthorization`, `InputFieldPath`, `OutputAuthorization`, `FieldAuthorization`, `RowAuthorization`, `OperationAuthorization`, `RelatedAuthorization`, `OutputFieldPath`. Input paths use persisted types only; output paths also include virtuals. Unknown models have an explicit runtime-validated string fallback; grant arrays may be readonly.
 - named helper/result types (also `/advanced`): `OutputPlanningOptions`, `OutputFieldOptions`, `AllowedOutputFieldOptions`, opaque `DocumentAuthorization`, `ServiceOutputContext`, `ServiceOutputDecorator`, `AuthorizedSingleResult`, `AuthorizedListResult`, `NewArgs`, `NewOptions`. Acquire the service from a router/request; there is no standalone `Service` export or public issuer/execution/prepared API.
 
@@ -1952,8 +2108,11 @@ schema.plugin(permissionsPlugin, { modelName: 'User', virtualPermissionField: 'p
 ```
 
 Use it only when application code needs that hydrated-document alias. Package output
-finalization uses the configured metadata path directly and supports lean results.
-`virtualPermissionField` is an alias name, not the package's computed `virtuals` API.
+finalization supplies its own [non-enumerable alias](#finalized-permissions-alias)
+from exposed metadata in both modes, without the plugin. The raw getter retains
+literal `_doc[documentPermissionField]` lookup (not dotted-path traversal).
+`virtualPermissionField` names only that raw getter, not the finalized alias or the
+package's computed `virtuals` API.
 
 ## Include Cardinality
 
@@ -2315,10 +2474,12 @@ getter fields are type errors (and configuration rejections at runtime).
 Virtual names are never added to persisted `Filter`, sort/distinct inputs, or
 client write types.
 
-Lean/hydrated parity: getters always receive an isolated, stable plain-object
+Lean/hydrated normalization: getters always receive an isolated, stable plain-object
 view (`toObject({ virtuals: false })` for documents, recursively isolated
 copies for lean results, with `Date`/`Buffer`/`ObjectId` cloned by their own
 constructors), so package virtuals compute for both lean and hydrated results.
+Schema defaults/getters/transforms/init hooks can still change their input values;
+see the [hydration value caveat](#breaking-release-server-owned-hydration).
 Only returned field values are committed via document-aware helpers;
 `undefined` omits the field; a throw omits it fail-closed with a structural
 log (no raw values or secret-bearing text). Sibling virtual values are never

package/advanced.d.mts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as IdentifierHook, as as Include, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aA as KeyValueProjection, aB as LegacyInclude, aC as ListQueryInput, aD as ListResult, aE as MIDDLEWARE, aF as MaybePromise, aG as ModelBaseFilterHook, aH as ModelChangeHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aK as ModelDocument, aL as ModelDocumentHook, aM as ModelHook, aN as ModelHookContext, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aR as ModelRequest, aS as ModelRouterOptions, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aX as ModelVirtualDescriptor, aY as ModelVirtualDoc, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, a$ as ModelVirtualRecordAccess, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, ba as PERMISSIONS, bb as PERMISSION_KEYS, bc as PairedRouteAccess, bd as ParentRef, be as PathValue, bf as PermissionSchema, bg as Populate, bh as PopulateAccess, bi as PopulatePlanningOptions, bj as PrepareAccess, bk as Projection, bl as PublicCreateArgs, bm as PublicCreateOptions, bn as PublicErrorResult, bo as PublicListArgs, bp as PublicListOptions, bq as PublicListResult, br as PublicOutput, bs as PublicReadArgs, bt as PublicReadOptions, bu as PublicServiceResult, bv as PublicSingleResult, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bA as PublicUpdateArgs, bB as PublicUpdateOptions, bC as PublicUpsertArgs, bD as PublicUpsertOptions, bE as ReadQueryInput, bF as RelatedAuthorization, bG as Request, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, bP as RequestSchemas, bQ as RootDataListQueryEntry, bR as RootDataOperation, bS as RootDataReadByFilterQueryEntry, bT as RootDataReadByIdQueryEntry, bU as RootModelCountQueryEntry, bV as RootModelCreateQueryEntry, bW as RootModelDeleteQueryEntry, bX as RootModelDistinctQueryEntry, bY as RootModelListQueryEntry, bZ as RootModelNewQueryEntry, b_ as RootModelOperation, b$ as RootModelReadByFilterQueryEntry, c0 as RootModelReadByIdQueryEntry, c1 as RootModelSubBulkUpdateQueryEntry, c2 as RootModelSubCreateQueryEntry, c3 as RootModelSubDeleteQueryEntry, c4 as RootModelSubListQueryEntry, c5 as RootModelSubReadQueryEntry, c6 as RootModelSubUpdateQueryEntry, c7 as RootModelUpdateQueryEntry, c8 as RootModelUpsertQueryEntry, c9 as RootOperationResult, ca as RootQueryEntry, cb as RootRouterOptions, cc as RootSubOperation, cd as RootTarget, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cj as SelectAccess, ck as SelectedPopulatedPublicOutput, cl as SelectedPublicOutput, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, cp as ServiceResult, cq as SingleResult, cr as Sort, cs as SortOrder, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cA as StatusCodes, cB as SubListBody, cC as SubOperationAccess, cD as SubPopulate, cE as SubQueryEntry, cF as SubReadBody, cG as SubRouteGuardOptions, cH as SubdocumentBulkRecord, cI as SubdocumentBulkUpdateInput, cJ as SubdocumentCreateAuthorization, cK as SubdocumentCreateInput, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cQ as SubdocumentId, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cX as SubdocumentParentArgs, cY as SubdocumentParentOptions, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, c$ as SubdocumentRecord, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, d5 as Task, d6 as TaskType, d7 as TransformAccess, d8 as TypedFilter, d9 as UpdateByIdArgs, da as UpdateByIdOptions, db as UpdateOneArgs, dc as UpdateOneOptions, dd as UpdateQueryInput, de as UpsertArgs, df as UpsertOptions, dg as UpsertQueryInput, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dl as ValidateAccess, dm as ValidateRule, dn as Validation, dp as ValidationError, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod, dI as parseBody, dJ as parseBodyWithSchema, dK as parseNestedBodyWithSchema, dL as parsePathParam, dM as parseQuery } from './parsers-BnmChTfF.mjs';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualRecordAccess, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, bc as PERMISSIONS, bd as PERMISSION_KEYS, be as PairedRouteAccess, bf as ParentRef, bg as PathValue, bh as PermissionSchema, bi as Populate, bj as PopulateAccess, bk as PopulatePlanningOptions, bl as PrepareAccess, bm as Projection, bn as PublicCreateArgs, bo as PublicCreateOptions, bp as PublicErrorResult, bq as PublicListArgs, br as PublicListOptions, bs as PublicListResult, bt as PublicOutput, bu as PublicReadArgs, bv as PublicReadOptions, bw as PublicServiceResult, bx as PublicSingleResult, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bC as PublicUpdateArgs, bD as PublicUpdateOptions, bE as PublicUpsertArgs, bF as PublicUpsertOptions, bG as ReadQueryInput, bH as RelatedAuthorization, bI as Request, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, bR as RequestSchemas, bS as RootDataListQueryEntry, bT as RootDataOperation, bU as RootDataReadByFilterQueryEntry, bV as RootDataReadByIdQueryEntry, bW as RootModelCountQueryEntry, bX as RootModelCreateQueryEntry, bY as RootModelDeleteQueryEntry, bZ as RootModelDistinctQueryEntry, b_ as RootModelListQueryEntry, b$ as RootModelNewQueryEntry, c0 as RootModelOperation, c1 as RootModelReadByFilterQueryEntry, c2 as RootModelReadByIdQueryEntry, c3 as RootModelSubBulkUpdateQueryEntry, c4 as RootModelSubCreateQueryEntry, c5 as RootModelSubDeleteQueryEntry, c6 as RootModelSubListQueryEntry, c7 as RootModelSubReadQueryEntry, c8 as RootModelSubUpdateQueryEntry, c9 as RootModelUpdateQueryEntry, ca as RootModelUpsertQueryEntry, cb as RootOperationResult, cc as RootQueryEntry, cd as RootRouterOptions, ce as RootSubOperation, cf as RootTarget, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, cl as SelectAccess, cm as SelectedPopulatedPublicOutput, cn as SelectedPublicOutput, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cr as ServiceResult, cs as SingleResult, ct as Sort, cu as SortOrder, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cC as StatusCodes, cD as SubListBody, cE as SubOperationAccess, cF as SubPopulate, cG as SubQueryEntry, cH as SubReadBody, cI as SubRouteGuardOptions, cJ as SubdocumentBulkRecord, cK as SubdocumentBulkUpdateInput, cL as SubdocumentCreateAuthorization, cM as SubdocumentCreateInput, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cS as SubdocumentId, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, cZ as SubdocumentParentArgs, c_ as SubdocumentParentOptions, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d1 as SubdocumentRecord, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, d7 as Task, d8 as TaskType, d9 as TransformAccess, da as TypedFilter, db as UpdateByIdArgs, dc as UpdateByIdOptions, dd as UpdateOneArgs, de as UpdateOneOptions, df as UpdateQueryInput, dg as UpsertArgs, dh as UpsertOptions, di as UpsertQueryInput, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, dn as ValidateAccess, dp as ValidateRule, dq as Validation, dr as ValidationError, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod, dK as parseBody, dL as parseBodyWithSchema, dM as parseNestedBodyWithSchema, dN as parsePathParam, dO as parseQuery } from './parsers-ZSrF7SNu.mjs';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';
@@ -1049,7 +1049,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;
@@ -1228,7 +1227,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;
@@ -1408,7 +1406,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;

package/advanced.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as IdentifierHook, as as Include, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aA as KeyValueProjection, aB as LegacyInclude, aC as ListQueryInput, aD as ListResult, aE as MIDDLEWARE, aF as MaybePromise, aG as ModelBaseFilterHook, aH as ModelChangeHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aK as ModelDocument, aL as ModelDocumentHook, aM as ModelHook, aN as ModelHookContext, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aR as ModelRequest, aS as ModelRouterOptions, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aX as ModelVirtualDescriptor, aY as ModelVirtualDoc, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, a$ as ModelVirtualRecordAccess, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, ba as PERMISSIONS, bb as PERMISSION_KEYS, bc as PairedRouteAccess, bd as ParentRef, be as PathValue, bf as PermissionSchema, bg as Populate, bh as PopulateAccess, bi as PopulatePlanningOptions, bj as PrepareAccess, bk as Projection, bl as PublicCreateArgs, bm as PublicCreateOptions, bn as PublicErrorResult, bo as PublicListArgs, bp as PublicListOptions, bq as PublicListResult, br as PublicOutput, bs as PublicReadArgs, bt as PublicReadOptions, bu as PublicServiceResult, bv as PublicSingleResult, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bA as PublicUpdateArgs, bB as PublicUpdateOptions, bC as PublicUpsertArgs, bD as PublicUpsertOptions, bE as ReadQueryInput, bF as RelatedAuthorization, bG as Request, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, bP as RequestSchemas, bQ as RootDataListQueryEntry, bR as RootDataOperation, bS as RootDataReadByFilterQueryEntry, bT as RootDataReadByIdQueryEntry, bU as RootModelCountQueryEntry, bV as RootModelCreateQueryEntry, bW as RootModelDeleteQueryEntry, bX as RootModelDistinctQueryEntry, bY as RootModelListQueryEntry, bZ as RootModelNewQueryEntry, b_ as RootModelOperation, b$ as RootModelReadByFilterQueryEntry, c0 as RootModelReadByIdQueryEntry, c1 as RootModelSubBulkUpdateQueryEntry, c2 as RootModelSubCreateQueryEntry, c3 as RootModelSubDeleteQueryEntry, c4 as RootModelSubListQueryEntry, c5 as RootModelSubReadQueryEntry, c6 as RootModelSubUpdateQueryEntry, c7 as RootModelUpdateQueryEntry, c8 as RootModelUpsertQueryEntry, c9 as RootOperationResult, ca as RootQueryEntry, cb as RootRouterOptions, cc as RootSubOperation, cd as RootTarget, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cj as SelectAccess, ck as SelectedPopulatedPublicOutput, cl as SelectedPublicOutput, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, cp as ServiceResult, cq as SingleResult, cr as Sort, cs as SortOrder, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cA as StatusCodes, cB as SubListBody, cC as SubOperationAccess, cD as SubPopulate, cE as SubQueryEntry, cF as SubReadBody, cG as SubRouteGuardOptions, cH as SubdocumentBulkRecord, cI as SubdocumentBulkUpdateInput, cJ as SubdocumentCreateAuthorization, cK as SubdocumentCreateInput, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cQ as SubdocumentId, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cX as SubdocumentParentArgs, cY as SubdocumentParentOptions, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, c$ as SubdocumentRecord, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, d5 as Task, d6 as TaskType, d7 as TransformAccess, d8 as TypedFilter, d9 as UpdateByIdArgs, da as UpdateByIdOptions, db as UpdateOneArgs, dc as UpdateOneOptions, dd as UpdateQueryInput, de as UpsertArgs, df as UpsertOptions, dg as UpsertQueryInput, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dl as ValidateAccess, dm as ValidateRule, dn as Validation, dp as ValidationError, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod, dI as parseBody, dJ as parseBodyWithSchema, dK as parseNestedBodyWithSchema, dL as parsePathParam, dM as parseQuery } from './parsers-BnmChTfF.js';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualRecordAccess, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, bc as PERMISSIONS, bd as PERMISSION_KEYS, be as PairedRouteAccess, bf as ParentRef, bg as PathValue, bh as PermissionSchema, bi as Populate, bj as PopulateAccess, bk as PopulatePlanningOptions, bl as PrepareAccess, bm as Projection, bn as PublicCreateArgs, bo as PublicCreateOptions, bp as PublicErrorResult, bq as PublicListArgs, br as PublicListOptions, bs as PublicListResult, bt as PublicOutput, bu as PublicReadArgs, bv as PublicReadOptions, bw as PublicServiceResult, bx as PublicSingleResult, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bC as PublicUpdateArgs, bD as PublicUpdateOptions, bE as PublicUpsertArgs, bF as PublicUpsertOptions, bG as ReadQueryInput, bH as RelatedAuthorization, bI as Request, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, bR as RequestSchemas, bS as RootDataListQueryEntry, bT as RootDataOperation, bU as RootDataReadByFilterQueryEntry, bV as RootDataReadByIdQueryEntry, bW as RootModelCountQueryEntry, bX as RootModelCreateQueryEntry, bY as RootModelDeleteQueryEntry, bZ as RootModelDistinctQueryEntry, b_ as RootModelListQueryEntry, b$ as RootModelNewQueryEntry, c0 as RootModelOperation, c1 as RootModelReadByFilterQueryEntry, c2 as RootModelReadByIdQueryEntry, c3 as RootModelSubBulkUpdateQueryEntry, c4 as RootModelSubCreateQueryEntry, c5 as RootModelSubDeleteQueryEntry, c6 as RootModelSubListQueryEntry, c7 as RootModelSubReadQueryEntry, c8 as RootModelSubUpdateQueryEntry, c9 as RootModelUpdateQueryEntry, ca as RootModelUpsertQueryEntry, cb as RootOperationResult, cc as RootQueryEntry, cd as RootRouterOptions, ce as RootSubOperation, cf as RootTarget, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, cl as SelectAccess, cm as SelectedPopulatedPublicOutput, cn as SelectedPublicOutput, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cr as ServiceResult, cs as SingleResult, ct as Sort, cu as SortOrder, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cC as StatusCodes, cD as SubListBody, cE as SubOperationAccess, cF as SubPopulate, cG as SubQueryEntry, cH as SubReadBody, cI as SubRouteGuardOptions, cJ as SubdocumentBulkRecord, cK as SubdocumentBulkUpdateInput, cL as SubdocumentCreateAuthorization, cM as SubdocumentCreateInput, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cS as SubdocumentId, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, cZ as SubdocumentParentArgs, c_ as SubdocumentParentOptions, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d1 as SubdocumentRecord, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, d7 as Task, d8 as TaskType, d9 as TransformAccess, da as TypedFilter, db as UpdateByIdArgs, dc as UpdateByIdOptions, dd as UpdateOneArgs, de as UpdateOneOptions, df as UpdateQueryInput, dg as UpsertArgs, dh as UpsertOptions, di as UpsertQueryInput, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, dn as ValidateAccess, dp as ValidateRule, dq as Validation, dr as ValidationError, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod, dK as parseBody, dL as parseBodyWithSchema, dM as parseNestedBodyWithSchema, dN as parsePathParam, dO as parseQuery } from './parsers-ZSrF7SNu.js';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';
@@ -1049,7 +1049,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;
@@ -1228,7 +1227,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;
@@ -1408,7 +1406,6 @@ declare const rootQuerySchema: z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readon
             list: "list";
             read: "read";
         }>>;
-        lean: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
     name: z.ZodString;
     order: z.ZodOptional<z.ZodNumber>;

package/advanced.js

@@ -194,7 +194,38 @@ function assertPublicAdmission(input, kind = "envelope") {
     for (const key of ["filter", "match", "data"]) add(record[key], "data", key);
   }
 }
+function assertHydrationDefaults(defaults) {
+  if (defaults && typeof defaults === "object") {
+    const record = defaults;
+    if ("hydration" in record)
+      throw new TypeError("defaults.hydration is unsupported; use model hydration configuration");
+    for (const bucket of [
+      "publicListOptions",
+      "publicReadOptions",
+      "findOptions",
+      "findOneOptions",
+      "findByIdOptions",
+      "createOptions",
+      "updateOneOptions",
+      "updateByIdOptions",
+      "upsertOptions",
+      "existsOptions",
+      "publicCreateOptions",
+      "publicUpdateOptions"
+    ]) {
+      const options = record[bucket];
+      if (!options || typeof options !== "object" && typeof options !== "function") continue;
+      for (const key of ["lean", "hydration"]) {
+        if (!(key in options)) continue;
+        const method = bucket.slice(0, -"Options".length);
+        const migration = ["publicList", "publicRead", "find", "findOne", "findById"].includes(method) ? `use model hydration.${method} ('lean' or 'hydrated')` : "this method has a fixed fetch mode";
+        throw new TypeError(`defaults.${bucket}.${key} is unsupported; ${migration}`);
+      }
+    }
+  }
+}
 function assertPublicDefaults(defaults) {
+  assertHydrationDefaults(defaults);
   assertPublicAdmission(defaults);
   if (defaults && typeof defaults === "object") {
     for (const value of Object.values(defaults)) assertPublicAdmission(value);
@@ -202,6 +233,31 @@ function assertPublicDefaults(defaults) {
 }
 var requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
 
+// src/options/hydration.ts
+var methods = ["publicList", "publicRead", "find", "findOne", "findById"];
+function normalizeHydration(value, path = "hydration") {
+  if (value === void 0) return void 0;
+  if (value === null || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    throw new TypeError(`${path} must be a plain record of model hydration modes`);
+  const result = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !methods.includes(key))
+      throw new TypeError(`${path}.${String(key)} is not a supported hydration method`);
+    const mode = value[key];
+    if (mode !== void 0 && mode !== "lean" && mode !== "hydrated")
+      throw new TypeError(`${path}.${key} must be 'lean', 'hydrated', or undefined`);
+    result[key] = mode;
+  }
+  return Object.freeze(result);
+}
+function normalizeHydrationUpdate(current, key, value) {
+  if (key === "hydration") return normalizeHydration(value);
+  const method = key.slice("hydration.".length);
+  if (!methods.includes(method))
+    throw new TypeError(`${key} is not a supported hydration method`);
+  return normalizeHydration({ ...normalizeHydration(current), [method]: value });
+}
+
 // src/runtime.ts
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
 var import_utils10 = require("@web-ts-toolkit/utils");
@@ -1680,9 +1736,25 @@ var AccessRuntime = class {
   }
   /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
   setDefaultModelOptions(options) {
+    assertPublicDefaults(options.defaults);
+    if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
     this.defaultModelOptions.assign(options);
   }
   setDefaultModelOption(key, value) {
+    const keyStr = String(key);
+    if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+      this.defaultModelOptions.set(
+        "hydration",
+        normalizeHydrationUpdate(this.getDefaultModelOptions().hydration, keyStr, value)
+      );
+      return;
+    }
+    if (keyStr === "defaults") assertPublicDefaults(value);
+    else if (keyStr.startsWith("defaults.")) {
+      const proposed = {};
+      (0, import_utils10.set)(proposed, keyStr.slice("defaults.".length), value);
+      assertPublicDefaults(proposed);
+    }
     this.defaultModelOptions.set(key, value);
   }
   getDefaultModelOptions() {
@@ -1732,6 +1804,7 @@ var AccessRuntime = class {
    */
   setModelOptions(modelName, options) {
     assertPublicDefaults(options.defaults);
+    if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
@@ -1742,14 +1815,19 @@ var AccessRuntime = class {
     manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
   }
   setModelOption(modelName, key, value) {
-    const manager = this.getOrCreateModelOptions(modelName);
     const keyStr = String(key);
+    if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+      const hydration = normalizeHydrationUpdate(this.modelOptions[modelName]?.get("hydration"), keyStr, value);
+      this.getOrCreateModelOptions(modelName).set("hydration", hydration);
+      return;
+    }
     if (keyStr === "defaults") assertPublicDefaults(value);
     else if (keyStr.startsWith("defaults.")) {
       const proposed = {};
       (0, import_utils10.set)(proposed, keyStr.slice("defaults.".length), value);
       assertPublicDefaults(proposed);
     }
+    const manager = this.getOrCreateModelOptions(modelName);
     if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
       const model = this.getModelInstance(modelName);
       const currentVirtuals = manager.get("virtuals");
@@ -3111,8 +3189,7 @@ var rootModelListOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   includeCount: import_zod5.z.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: import_zod5.z.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
@@ -3128,8 +3205,7 @@ var rootModelReadOptionsSchema = import_zod5.z.object({
   includePermissions: import_zod5.z.boolean().optional(),
   includeFieldPermissions: import_zod5.z.boolean().optional(),
   tryList: import_zod5.z.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: import_zod5.z.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelCreateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),