@web-ts-toolkit/access-router 0.52.0 → 0.54.0

package/advanced.mjs

@@ -112,7 +112,38 @@ function assertPublicAdmission(input, kind = "envelope") {
     for (const key of ["filter", "match", "data"]) add(record[key], "data", key);
   }
 }
+function assertHydrationDefaults(defaults) {
+  if (defaults && typeof defaults === "object") {
+    const record = defaults;
+    if ("hydration" in record)
+      throw new TypeError("defaults.hydration is unsupported; use model hydration configuration");
+    for (const bucket of [
+      "publicListOptions",
+      "publicReadOptions",
+      "findOptions",
+      "findOneOptions",
+      "findByIdOptions",
+      "createOptions",
+      "updateOneOptions",
+      "updateByIdOptions",
+      "upsertOptions",
+      "existsOptions",
+      "publicCreateOptions",
+      "publicUpdateOptions"
+    ]) {
+      const options = record[bucket];
+      if (!options || typeof options !== "object" && typeof options !== "function") continue;
+      for (const key of ["lean", "hydration"]) {
+        if (!(key in options)) continue;
+        const method = bucket.slice(0, -"Options".length);
+        const migration = ["publicList", "publicRead", "find", "findOne", "findById"].includes(method) ? `use model hydration.${method} ('lean' or 'hydrated')` : "this method has a fixed fetch mode";
+        throw new TypeError(`defaults.${bucket}.${key} is unsupported; ${migration}`);
+      }
+    }
+  }
+}
 function assertPublicDefaults(defaults) {
+  assertHydrationDefaults(defaults);
   assertPublicAdmission(defaults);
   if (defaults && typeof defaults === "object") {
     for (const value of Object.values(defaults)) assertPublicAdmission(value);
@@ -120,6 +151,31 @@ function assertPublicDefaults(defaults) {
 }
 var requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
 
+// src/options/hydration.ts
+var methods = ["publicList", "publicRead", "find", "findOne", "findById"];
+function normalizeHydration(value, path = "hydration") {
+  if (value === void 0) return void 0;
+  if (value === null || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    throw new TypeError(`${path} must be a plain record of model hydration modes`);
+  const result = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !methods.includes(key))
+      throw new TypeError(`${path}.${String(key)} is not a supported hydration method`);
+    const mode = value[key];
+    if (mode !== void 0 && mode !== "lean" && mode !== "hydrated")
+      throw new TypeError(`${path}.${key} must be 'lean', 'hydrated', or undefined`);
+    result[key] = mode;
+  }
+  return Object.freeze(result);
+}
+function normalizeHydrationUpdate(current, key, value) {
+  if (key === "hydration") return normalizeHydration(value);
+  const method = key.slice("hydration.".length);
+  if (!methods.includes(method))
+    throw new TypeError(`${key} is not a supported hydration method`);
+  return normalizeHydration({ ...normalizeHydration(current), [method]: value });
+}
+
 // src/runtime.ts
 import mschema2Jsonschema from "mongoose-schema-jsonschema";
 import {
@@ -1611,9 +1667,25 @@ var AccessRuntime = class {
   }
   /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
   setDefaultModelOptions(options) {
+    assertPublicDefaults(options.defaults);
+    if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
     this.defaultModelOptions.assign(options);
   }
   setDefaultModelOption(key, value) {
+    const keyStr = String(key);
+    if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+      this.defaultModelOptions.set(
+        "hydration",
+        normalizeHydrationUpdate(this.getDefaultModelOptions().hydration, keyStr, value)
+      );
+      return;
+    }
+    if (keyStr === "defaults") assertPublicDefaults(value);
+    else if (keyStr.startsWith("defaults.")) {
+      const proposed = {};
+      set3(proposed, keyStr.slice("defaults.".length), value);
+      assertPublicDefaults(proposed);
+    }
     this.defaultModelOptions.set(key, value);
   }
   getDefaultModelOptions() {
@@ -1663,6 +1735,7 @@ var AccessRuntime = class {
    */
   setModelOptions(modelName, options) {
     assertPublicDefaults(options.defaults);
+    if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
     const manager = this.getOrCreateModelOptions(modelName);
     const defaultOptions = this.getDefaultModelOptions();
     const currentModelOptions = manager.fetch();
@@ -1673,14 +1746,19 @@ var AccessRuntime = class {
     manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
   }
   setModelOption(modelName, key, value) {
-    const manager = this.getOrCreateModelOptions(modelName);
     const keyStr = String(key);
+    if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+      const hydration = normalizeHydrationUpdate(this.modelOptions[modelName]?.get("hydration"), keyStr, value);
+      this.getOrCreateModelOptions(modelName).set("hydration", hydration);
+      return;
+    }
     if (keyStr === "defaults") assertPublicDefaults(value);
     else if (keyStr.startsWith("defaults.")) {
       const proposed = {};
       set3(proposed, keyStr.slice("defaults.".length), value);
       assertPublicDefaults(proposed);
     }
+    const manager = this.getOrCreateModelOptions(modelName);
     if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
       const model = this.getModelInstance(modelName);
       const currentVirtuals = manager.get("virtuals");
@@ -3042,8 +3120,7 @@ var rootModelListOptionsSchema = z5.object({
   includePermissions: z5.boolean().optional(),
   includeFieldPermissions: z5.boolean().optional(),
   includeCount: z5.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: z5.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelReadArgsSchema = z5.object({
   select: projectionSchema.optional(),
@@ -3059,8 +3136,7 @@ var rootModelReadOptionsSchema = z5.object({
   includePermissions: z5.boolean().optional(),
   includeFieldPermissions: z5.boolean().optional(),
   tryList: z5.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: z5.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelCreateArgsSchema = z5.object({
   select: projectionSchema.optional(),

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aq as GuardHook, aR as ModelRequest, dN as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dO as DataService, aa as ExtendedDataRouterOptions, af as Filter, bk as Projection, cr as Sort, bg as Populate, aS as ModelRouterOptions, dP as Service, dQ as PublicService, a$ as ModelVirtualRecordAccess, aX as ModelVirtualDescriptor, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dn as Validation, cb as RootRouterOptions, dR as OpenApiRouterOptions, dS as OpenApiRegistryOptions, dT as OpenApiRouteDescriptor, dU as OpenApiDocumentOptions, dV as OpenApiParameter, dW as OpenApiSchema, dX as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-BnmChTfF.mjs';
-export { dY as AccessRouterPermissionMap, dZ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aF as MaybePromise, aG as ModelBaseFilterHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aL as ModelDocumentHook, aM as ModelHook, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aY as ModelVirtualDoc, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, d_ as OpenApiMethod, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, bc as PairedRouteAccess, bf as PermissionSchema, d$ as Permissions, bi as PopulatePlanningOptions, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bF as RelatedAuthorization, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cC as SubOperationAccess, cG as SubRouteGuardOptions, cJ as SubdocumentCreateAuthorization, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, e0 as defaultRuntime, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod } from './parsers-BnmChTfF.mjs';
+import { A as AccessRouterBaseRequest, aq as GuardHook, aT as ModelRequest, dP as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dQ as DataService, aa as ExtendedDataRouterOptions, af as Filter, bm as Projection, ct as Sort, bi as Populate, aU as ModelRouterOptions, dR as Service, dS as PublicService, b1 as ModelVirtualRecordAccess, aZ as ModelVirtualDescriptor, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dq as Validation, cd as RootRouterOptions, dT as OpenApiRouterOptions, dU as OpenApiRegistryOptions, dV as OpenApiRouteDescriptor, dW as OpenApiDocumentOptions, dX as OpenApiParameter, dY as OpenApiSchema, dZ as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-ZSrF7SNu.mjs';
+export { d_ as AccessRouterPermissionMap, d$ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, ar as HydrationMode, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aG as MaybePromise, aH as ModelBaseFilterHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aM as ModelDocumentHook, aN as ModelHook, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, a_ as ModelVirtualDoc, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, e0 as OpenApiMethod, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, be as PairedRouteAccess, bh as PermissionSchema, e1 as Permissions, bk as PopulatePlanningOptions, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bH as RelatedAuthorization, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cE as SubOperationAccess, cI as SubRouteGuardOptions, cL as SubdocumentCreateAuthorization, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, e2 as defaultRuntime, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod } from './parsers-ZSrF7SNu.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -460,7 +460,10 @@ interface Options {
  * Option lookup uses the active runtime, or the default runtime outside managed execution.
  * This plugin neither computes grants nor enables field enforcement: routers/services
  * already enforce operationAccess and permissionSchema without it. It is separate from
- * the package's computed `virtuals` output API and is unnecessary for lean output.
+ * the package's computed `virtuals` output API. Finalized rows already get their
+ * own non-enumerable `permissions` alias from exposed metadata in both modes without
+ * this plugin. virtualPermissionField only names this raw getter; its literal _doc
+ * lookup does not traverse dotted metadata paths.
  */
 declare function permissionsPlugin(schema: Schema, options: Options): void;
 
@@ -570,7 +573,7 @@ type AccessRuntimeApi = typeof macl & Wtt;
  * The returned callable facade exposes factories/setters; `.runtime` is its owner.
  * Mount generated `.routes` after express.json(); connect MongoDB before listening.
  * Model operations default to denied until operationAccess is configured, and field
- * visibility requires permissionSchema. permissionsPlugin is only an optional alias.
+ * visibility requires permissionSchema. permissionsPlugin is only an optional raw-document alias.
  *
  * @example
  * ```ts

package/index.d.ts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aq as GuardHook, aR as ModelRequest, dN as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dO as DataService, aa as ExtendedDataRouterOptions, af as Filter, bk as Projection, cr as Sort, bg as Populate, aS as ModelRouterOptions, dP as Service, dQ as PublicService, a$ as ModelVirtualRecordAccess, aX as ModelVirtualDescriptor, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dn as Validation, cb as RootRouterOptions, dR as OpenApiRouterOptions, dS as OpenApiRegistryOptions, dT as OpenApiRouteDescriptor, dU as OpenApiDocumentOptions, dV as OpenApiParameter, dW as OpenApiSchema, dX as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-BnmChTfF.js';
-export { dY as AccessRouterPermissionMap, dZ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aF as MaybePromise, aG as ModelBaseFilterHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aL as ModelDocumentHook, aM as ModelHook, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aY as ModelVirtualDoc, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, d_ as OpenApiMethod, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, bc as PairedRouteAccess, bf as PermissionSchema, d$ as Permissions, bi as PopulatePlanningOptions, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bF as RelatedAuthorization, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cC as SubOperationAccess, cG as SubRouteGuardOptions, cJ as SubdocumentCreateAuthorization, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, e0 as defaultRuntime, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod } from './parsers-BnmChTfF.js';
+import { A as AccessRouterBaseRequest, aq as GuardHook, aT as ModelRequest, dP as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dQ as DataService, aa as ExtendedDataRouterOptions, af as Filter, bm as Projection, ct as Sort, bi as Populate, aU as ModelRouterOptions, dR as Service, dS as PublicService, b1 as ModelVirtualRecordAccess, aZ as ModelVirtualDescriptor, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dq as Validation, cd as RootRouterOptions, dT as OpenApiRouterOptions, dU as OpenApiRegistryOptions, dV as OpenApiRouteDescriptor, dW as OpenApiDocumentOptions, dX as OpenApiParameter, dY as OpenApiSchema, dZ as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-ZSrF7SNu.js';
+export { d_ as AccessRouterPermissionMap, d$ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, ar as HydrationMode, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aG as MaybePromise, aH as ModelBaseFilterHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aM as ModelDocumentHook, aN as ModelHook, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, a_ as ModelVirtualDoc, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, e0 as OpenApiMethod, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, be as PairedRouteAccess, bh as PermissionSchema, e1 as Permissions, bk as PopulatePlanningOptions, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bH as RelatedAuthorization, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cE as SubOperationAccess, cI as SubRouteGuardOptions, cL as SubdocumentCreateAuthorization, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, e2 as defaultRuntime, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod } from './parsers-ZSrF7SNu.js';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -460,7 +460,10 @@ interface Options {
  * Option lookup uses the active runtime, or the default runtime outside managed execution.
  * This plugin neither computes grants nor enables field enforcement: routers/services
  * already enforce operationAccess and permissionSchema without it. It is separate from
- * the package's computed `virtuals` output API and is unnecessary for lean output.
+ * the package's computed `virtuals` output API. Finalized rows already get their
+ * own non-enumerable `permissions` alias from exposed metadata in both modes without
+ * this plugin. virtualPermissionField only names this raw getter; its literal _doc
+ * lookup does not traverse dotted metadata paths.
  */
 declare function permissionsPlugin(schema: Schema, options: Options): void;
 
@@ -570,7 +573,7 @@ type AccessRuntimeApi = typeof macl & Wtt;
  * The returned callable facade exposes factories/setters; `.runtime` is its owner.
  * Mount generated `.routes` after express.json(); connect MongoDB before listening.
  * Model operations default to denied until operationAccess is configured, and field
- * visibility requires permissionSchema. permissionsPlugin is only an optional alias.
+ * visibility requires permissionSchema. permissionsPlugin is only an optional raw-document alias.
  *
  * @example
  * ```ts