@web-ts-toolkit/access-router 0.52.0 → 0.54.0

package/index.mjs

@@ -49,7 +49,38 @@ function assertPublicAdmission(input, kind = "envelope") {
     for (const key of ["filter", "match", "data"]) add(record2[key], "data", key);
   }
 }
+function assertHydrationDefaults(defaults) {
+  if (defaults && typeof defaults === "object") {
+    const record2 = defaults;
+    if ("hydration" in record2)
+      throw new TypeError("defaults.hydration is unsupported; use model hydration configuration");
+    for (const bucket of [
+      "publicListOptions",
+      "publicReadOptions",
+      "findOptions",
+      "findOneOptions",
+      "findByIdOptions",
+      "createOptions",
+      "updateOneOptions",
+      "updateByIdOptions",
+      "upsertOptions",
+      "existsOptions",
+      "publicCreateOptions",
+      "publicUpdateOptions"
+    ]) {
+      const options = record2[bucket];
+      if (!options || typeof options !== "object" && typeof options !== "function") continue;
+      for (const key of ["lean", "hydration"]) {
+        if (!(key in options)) continue;
+        const method = bucket.slice(0, -"Options".length);
+        const migration = ["publicList", "publicRead", "find", "findOne", "findById"].includes(method) ? `use model hydration.${method} ('lean' or 'hydrated')` : "this method has a fixed fetch mode";
+        throw new TypeError(`defaults.${bucket}.${key} is unsupported; ${migration}`);
+      }
+    }
+  }
+}
 function assertPublicDefaults(defaults) {
+  assertHydrationDefaults(defaults);
   assertPublicAdmission(defaults);
   if (defaults && typeof defaults === "object") {
     for (const value of Object.values(defaults)) assertPublicAdmission(value);
@@ -113,21 +144,43 @@ var init_public_admission = __esm({
       "includePermissions",
       "includeFieldPermissions",
       "includeCount",
-      "populateAccess",
-      "lean"
-    ];
-    readOptions = [
-      "skim",
-      "includePermissions",
-      "includeFieldPermissions",
-      "tryList",
-      "populateAccess",
-      "lean"
+      "populateAccess"
     ];
+    readOptions = ["skim", "includePermissions", "includeFieldPermissions", "tryList", "populateAccess"];
     requestAuthorization = Object.freeze({ outputFields: Object.freeze({ mode: "request" }) });
   }
 });
 
+// src/options/hydration.ts
+function normalizeHydration(value, path = "hydration") {
+  if (value === void 0) return void 0;
+  if (value === null || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    throw new TypeError(`${path} must be a plain record of model hydration modes`);
+  const result2 = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || !methods.includes(key))
+      throw new TypeError(`${path}.${String(key)} is not a supported hydration method`);
+    const mode = value[key];
+    if (mode !== void 0 && mode !== "lean" && mode !== "hydrated")
+      throw new TypeError(`${path}.${key} must be 'lean', 'hydrated', or undefined`);
+    result2[key] = mode;
+  }
+  return Object.freeze(result2);
+}
+function normalizeHydrationUpdate(current, key, value) {
+  if (key === "hydration") return normalizeHydration(value);
+  const method = key.slice("hydration.".length);
+  if (!methods.includes(method))
+    throw new TypeError(`${key} is not a supported hydration method`);
+  return normalizeHydration({ ...normalizeHydration(current), [method]: value });
+}
+var methods;
+var init_hydration = __esm({
+  "src/options/hydration.ts"() {
+    methods = ["publicList", "publicRead", "find", "findOne", "findById"];
+  }
+});
+
 // src/helpers/collection.ts
 import sift from "sift";
 import { filter, find } from "@web-ts-toolkit/utils";
@@ -257,6 +310,50 @@ var init_concurrency = __esm({
   }
 });
 
+// src/output/permissions-alias.ts
+import { get } from "@web-ts-toolkit/utils";
+function attachPermissionsAlias(output, field) {
+  if ("permissions" in output) return;
+  const metadata = get(output, field);
+  if (metadata === void 0) return;
+  Object.defineProperty(output, "permissions", {
+    value: metadata,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  });
+  aliases.set(output, field);
+}
+function removeGeneratedPermissionsAlias(output) {
+  const field = aliases.get(output);
+  if (field && Object.getOwnPropertyDescriptor(output, "permissions")?.value === get(output, field)) {
+    delete output.permissions;
+  }
+  aliases.delete(output);
+}
+function copyPermissionsAlias(source, target) {
+  if (source && typeof source === "object" && target && typeof target === "object") {
+    const field = aliases.get(source);
+    if (field && Object.getOwnPropertyDescriptor(source, "permissions")?.value === get(source, field))
+      attachPermissionsAlias(target, field);
+  }
+  return target;
+}
+function copyPermissionsAliasGraph(source, target, seen = /* @__PURE__ */ new WeakSet()) {
+  if (!source || !target || typeof source !== "object" || typeof target !== "object" || seen.has(target)) return;
+  seen.add(target);
+  copyPermissionsAlias(source, target);
+  for (const key of Object.keys(target)) {
+    copyPermissionsAliasGraph(source[key], target[key], seen);
+  }
+}
+var aliases;
+var init_permissions_alias = __esm({
+  "src/output/permissions-alias.ts"() {
+    aliases = /* @__PURE__ */ new WeakMap();
+  }
+});
+
 // src/helpers/query.ts
 import { flattenDeep, isNil, isPlainObject as isPlainObject2, isString, reduce } from "@web-ts-toolkit/utils";
 function genPagination({
@@ -323,16 +420,16 @@ var init_query = __esm({
 
 // src/helpers/document.ts
 import { Document, mongo } from "mongoose";
-import { get, isPlainObject as isPlainObject3, pick, set } from "@web-ts-toolkit/utils";
+import { get as get2, isPlainObject as isPlainObject3, pick, set } from "@web-ts-toolkit/utils";
 import { isArray, isPromise, isString as isString2 } from "@web-ts-toolkit/utils";
 function isDocument(doc) {
   return doc instanceof Document;
 }
 function getDocValue(doc, path, defaultValue) {
   if (isDocument(doc)) {
-    return get(doc._doc, path, defaultValue);
+    return get2(doc._doc, path, defaultValue);
   } else if (isPlainObject3(doc)) {
-    return get(doc, path, defaultValue);
+    return get2(doc, path, defaultValue);
   }
 }
 function setDocValue(doc, path, value) {
@@ -347,15 +444,6 @@ function getDocPermissions(modelName, doc) {
   const permissions = getDocValue(doc, docPermissionField, {});
   return isPlainObject3(permissions) ? permissions : {};
 }
-function stripUnexposedDocPermissions(modelName, doc) {
-  const exposed = getModelOption(modelName, "exposedDocPermissionKeys");
-  if (exposed === void 0) return;
-  const docPermissionField = getModelOption(modelName, "documentPermissionField");
-  const current = getDocValue(doc, docPermissionField, void 0);
-  if (!isPlainObject3(current)) return;
-  const keep = /* @__PURE__ */ new Set(["_view", "_edit", ...exposed]);
-  setDocValue(doc, docPermissionField, Object.fromEntries(Object.entries(current).filter(([key]) => keep.has(key))));
-}
 function toObject(doc) {
   return isDocument(doc) ? doc.toObject() : doc;
 }
@@ -375,6 +463,7 @@ async function populateDoc(doc, target) {
 var isMongooseDocument, cloneIsolatedLeaf, deepIsolateValue, isolateDocForOutput, retainedAssociations, retainRawAssociation, getRetainedAssociations, normalizeSubPopulate, genSubPopulate;
 var init_document = __esm({
   "src/helpers/document.ts"() {
+    init_permissions_alias();
     init_public_admission();
     init_options();
     init_query();
@@ -477,6 +566,7 @@ var init_document = __esm({
             configurable: true
           });
         }
+        copyPermissionsAlias(value, out);
         return out;
       }
       return value;
@@ -1206,7 +1296,7 @@ var init_logger_default = __esm({
 });
 
 // src/options/manager.ts
-import { assign, get as get2, isPlainObject as isPlainObject9, set as set2 } from "@web-ts-toolkit/utils";
+import { assign, get as get3, isPlainObject as isPlainObject9, set as set2 } from "@web-ts-toolkit/utils";
 var toPath, cloneConfigValue, cloneForRead, freezeConfigValue, cloneAndFreezeForStore, getNestedOption, resolveNestedOption, OptionsManager;
 var init_manager = __esm({
   "src/options/manager.ts"() {
@@ -1316,7 +1406,7 @@ var init_manager = __esm({
         return this;
       }
       get(key, defaultValue) {
-        return get2(this.currentOptions, key, defaultValue);
+        return get3(this.currentOptions, key, defaultValue);
       }
       set(key, value) {
         const path = toPath(key);
@@ -1325,7 +1415,7 @@ var init_manager = __esm({
           return;
         }
         const [rootKey, ...nestedPath] = path;
-        const currentRoot = get2(this.currentOptions, [rootKey], void 0);
+        const currentRoot = get3(this.currentOptions, [rootKey], void 0);
         const baseRoot = isPlainObject9(currentRoot) ? currentRoot : {};
         const nextRoot = cloneConfigValue(baseRoot);
         set2(nextRoot, nestedPath, cloneForRead(value));
@@ -1739,7 +1829,7 @@ import mschema2Jsonschema from "mongoose-schema-jsonschema";
 import {
   addLeadingSlash,
   forEach as forEach2,
-  get as get3,
+  get as get4,
   isArray as isArray5,
   isBoolean,
   isFunction,
@@ -1754,6 +1844,7 @@ var mongooseJsonSchemaInitialized, ensureMongooseJsonSchemaInitialized, pluraliz
 var init_runtime = __esm({
   "src/runtime.ts"() {
     init_public_admission();
+    init_hydration();
     init_helpers();
     init_registry();
     init_logger_default();
@@ -1854,8 +1945,8 @@ var init_runtime = __esm({
     virtualPathsOverlap = (virtualPath, permissionField) => {
       if (!virtualPath || !permissionField) return false;
       try {
-        if (get3(set4({}, virtualPath, true), permissionField) !== void 0) return true;
-        if (get3(set4({}, permissionField, true), virtualPath) !== void 0) return true;
+        if (get4(set4({}, virtualPath, true), permissionField) !== void 0) return true;
+        if (get4(set4({}, permissionField, true), virtualPath) !== void 0) return true;
       } catch {
         return false;
       }
@@ -2316,9 +2407,25 @@ var init_runtime = __esm({
       }
       /** Update model starting defaults shallowly; already-stored model values are not broadcast-replaced. */
       setDefaultModelOptions(options) {
+        assertPublicDefaults(options.defaults);
+        if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
         this.defaultModelOptions.assign(options);
       }
       setDefaultModelOption(key, value) {
+        const keyStr = String(key);
+        if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+          this.defaultModelOptions.set(
+            "hydration",
+            normalizeHydrationUpdate(this.getDefaultModelOptions().hydration, keyStr, value)
+          );
+          return;
+        }
+        if (keyStr === "defaults") assertPublicDefaults(value);
+        else if (keyStr.startsWith("defaults.")) {
+          const proposed = {};
+          set4(proposed, keyStr.slice("defaults.".length), value);
+          assertPublicDefaults(proposed);
+        }
         this.defaultModelOptions.set(key, value);
       }
       getDefaultModelOptions() {
@@ -2368,6 +2475,7 @@ var init_runtime = __esm({
        */
       setModelOptions(modelName, options) {
         assertPublicDefaults(options.defaults);
+        if ("hydration" in options) options = { ...options, hydration: normalizeHydration(options.hydration) };
         const manager = this.getOrCreateModelOptions(modelName);
         const defaultOptions = this.getDefaultModelOptions();
         const currentModelOptions = manager.fetch();
@@ -2378,14 +2486,19 @@ var init_runtime = __esm({
         manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
       }
       setModelOption(modelName, key, value) {
-        const manager = this.getOrCreateModelOptions(modelName);
         const keyStr = String(key);
+        if (keyStr === "hydration" || keyStr.startsWith("hydration.")) {
+          const hydration = normalizeHydrationUpdate(this.modelOptions[modelName]?.get("hydration"), keyStr, value);
+          this.getOrCreateModelOptions(modelName).set("hydration", hydration);
+          return;
+        }
         if (keyStr === "defaults") assertPublicDefaults(value);
         else if (keyStr.startsWith("defaults.")) {
           const proposed = {};
           set4(proposed, keyStr.slice("defaults.".length), value);
           assertPublicDefaults(proposed);
         }
+        const manager = this.getOrCreateModelOptions(modelName);
         if (keyStr === "virtuals" || keyStr.startsWith("virtuals.") || keyStr === "documentPermissionField") {
           const model = this.getModelInstance(modelName);
           const currentVirtuals = manager.get("virtuals");
@@ -2590,16 +2703,16 @@ var init_runtime = __esm({
       }
       getModelRef(modelName, refPath) {
         this.ensureModelMeta(modelName);
-        const value = get3(this.modelRefs, `${modelName}.${refPath}`, null);
+        const value = get4(this.modelRefs, `${modelName}.${refPath}`, null);
         return isString4(value) ? value : null;
       }
       getModelSub(modelName) {
         this.ensureModelMeta(modelName);
-        return get3(this.modelSubs, modelName, []);
+        return get4(this.modelSubs, modelName, []);
       }
       getModelAtt(modelName) {
         this.ensureModelMeta(modelName);
-        return get3(this.modelAtts, modelName, []);
+        return get4(this.modelAtts, modelName, []);
       }
     };
     defaultRuntime = new AccessRuntime({ allowGlobalModelLookup: true });
@@ -3652,7 +3765,7 @@ var init_field_authorization = __esm({
 });
 
 // src/acl/virtual-projection.ts
-import { get as get4, isArray as isArray7, isFunction as isFunction2, isPlainObject as isPlainObject13 } from "@web-ts-toolkit/utils";
+import { get as get5, isArray as isArray7, isFunction as isFunction2, isPlainObject as isPlainObject13 } from "@web-ts-toolkit/utils";
 function planVirtualProjection(args) {
   if (args.snapshot.catalog) return planCatalogProjection(args);
   const {
@@ -3923,7 +4036,7 @@ var init_virtual_projection = __esm({
     getScopedPermissionSchema = (root, scopePath) => {
       if (!root || !isPlainObject13(root)) return null;
       if (scopePath.length === 0) return root;
-      const scoped = get4(root, scopePath.join("."));
+      const scoped = get5(root, scopePath.join("."));
       return isPlainObject13(scoped) ? scoped : null;
     };
     resolveAlwaysSelectForAccess = (raw, access) => {
@@ -4173,14 +4286,13 @@ var init_output_projection = __esm({
 });
 
 // src/acl/model-output-planning.ts
-import { get as get5 } from "@web-ts-toolkit/utils";
+import { get as get6 } from "@web-ts-toolkit/utils";
 function getCapturedAuthorizationOption(configuration, key) {
-  return resolveNestedOption((path, fallback) => get5(configuration, path, fallback), key);
+  return resolveNestedOption((path, fallback) => get6(configuration, path, fallback), key);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
-  const options = runtime.getModelOptions(modelName);
   const virtuals = options.virtuals;
   return {
     catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
@@ -4198,7 +4310,8 @@ function captureModelAuthorizationConfiguration(runtime, modelName) {
     baseFilter: options.baseFilter,
     idField: options.idField,
     resolveIdFilter: options.resolveIdFilter,
-    operationAccess: options.operationAccess
+    operationAccess: options.operationAccess,
+    hydration: options.hydration
   };
 }
 function planModelOutputForHelper(args) {
@@ -4850,6 +4963,7 @@ function retainOutputMetadata(output, source, configuration, scope2) {
   target[parts[parts.length - 1]] = deepIsolateValue(metadata);
   transferDocumentAuthorizationGraph(output[parts[0]], copy[parts[0]]);
   output[parts[0]] = copy[parts[0]];
+  attachPermissionsAlias(output, parts.join("."));
 }
 function helperPlan(authorization, binding) {
   const { configuration, authorization: policy, access } = readServiceAuthorization(authorization, binding);
@@ -4979,6 +5093,7 @@ async function filterModelOutputForHelper(args) {
 var unresolvedDocuments, owningDocuments;
 var init_output_field_filter = __esm({
   "src/acl/output-field-filter.ts"() {
+    init_permissions_alias();
     init_document();
     init_request_work();
     init_logger_helpers();
@@ -5058,7 +5173,7 @@ __export(finalize_model_output_exports, {
   finalizeModelOutput: () => finalizeModelOutput,
   finalizeModelOutputs: () => finalizeModelOutputs
 });
-import { get as get7, isPlainObject as isPlainObject18, set as set7 } from "@web-ts-toolkit/utils";
+import { get as get8, isPlainObject as isPlainObject18, set as set7 } from "@web-ts-toolkit/utils";
 async function finalizeSingleDoc(args, input) {
   const scopePath = args.scopePath;
   const plan = args.plan;
@@ -5177,7 +5292,7 @@ async function finalizeSingleDoc(args, input) {
   for (const target of relatedTargets) {
     let rawRelated;
     try {
-      rawRelated = target.path.includes(".") ? get7(output, target.path) : output[target.path];
+      rawRelated = target.path.includes(".") ? get8(output, target.path) : output[target.path];
     } catch {
       continue;
     }
@@ -5434,7 +5549,7 @@ var init_finalize_model_output = __esm({
       if (!root || !isPlainObject18(root)) return null;
       if (scopePath.length === 0) return root;
       try {
-        const scoped = get7(root, scopePath.join("."));
+        const scoped = get8(root, scopePath.join("."));
         return isPlainObject18(scoped) ? scoped : null;
       } catch {
         return null;
@@ -5569,7 +5684,7 @@ import {
   compact,
   flatten,
   forEach as forEach3,
-  get as get6,
+  get as get7,
   isArray as isArray9,
   isPlainObject as isPlainObject15,
   set as set6,
@@ -6319,7 +6434,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
   if (sources.length > MAX_GROUPS) invalid(`groups exceed ${MAX_GROUPS}`);
   const budget = new KeyBudget();
   const values = [];
-  const aliases = [];
+  const aliases2 = [];
   const indices = /* @__PURE__ */ new Map();
   const groups = [];
   for (const source of sources) {
@@ -6330,7 +6445,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
       if (index === void 0) {
         index = values.length;
         indices.set(alias, index);
-        aliases.push(alias);
+        aliases2.push(alias);
         values.push(snapshot);
       }
       group.add(index);
@@ -6350,7 +6465,7 @@ function snapshotGroups(sources, valueOf, multipleKeys) {
   }
   return Object.freeze({
     values: Object.freeze(values),
-    aliases: Object.freeze(aliases),
+    aliases: Object.freeze(aliases2),
     groups: Object.freeze((multipleKeys ? groups : values.map((_, i) => [i])).map((group) => Object.freeze(group)))
   });
 }
@@ -6400,7 +6515,7 @@ function getServiceExecutors(receiver) {
   if (!registered) authorizationError("unregistered service receiver");
   return registered;
 }
-function createServiceExecution(receiver, access, authorization, applicability = "service", relatedTargets = [], parent, configuration, requestPermissions) {
+function createServiceExecution(receiver, access, authorization, applicability = "service", relatedTargets = [], parent, configuration, requestPermissions, hydration = access.operation === "list" ? "find" : "findOne") {
   const registered = getServiceExecutors(receiver);
   const receiving = registered.binding();
   const binding = Object.freeze({ ...receiving, scopePath: Object.freeze([...receiving.scopePath ?? []]) });
@@ -6422,11 +6537,23 @@ function createServiceExecution(receiver, access, authorization, applicability =
       binding,
       authorization: call,
       access: readServiceAuthorization(call, binding).access,
-      family: execution
+      family: execution,
+      hydration: resolveHydration(readServiceAuthorization(call, binding).configuration, hydration)
     })
   );
   return execution;
 }
+function resolveHydration(configuration, source) {
+  if (source === "lean" || source === "hydrated") return source;
+  return configuration.hydration?.[source] ?? (source === "publicList" ? "lean" : "hydrated");
+}
+function withExecutionHydration(receiver, parent, source) {
+  const record2 = readServiceExecution(receiver, parent);
+  const { configuration } = readServiceAuthorization(record2.authorization, record2.binding);
+  const execution = Object.freeze(/* @__PURE__ */ Object.create(null));
+  executions.set(execution, Object.freeze({ ...record2, hydration: resolveHydration(configuration, source) }));
+  return execution;
+}
 function readServiceExecution(receiver, execution) {
   const record2 = executions.get(execution);
   if (!record2 || record2.receiver !== receiver) authorizationError("invalid execution receiver/call");
@@ -7015,19 +7142,27 @@ var Base = class {
   relatedExecution(svc, include, parentAuthorization) {
     const op = include.op;
     if (!parentAuthorization)
-      return createServiceExecution(svc, {
-        operation: op,
-        rowAccess: op,
-        virtualAccess: op,
-        outputAccess: op,
-        docPermissionsAccess: op
-      });
-    return createRelatedExecution(
+      return withExecutionHydration(
+        svc,
+        createServiceExecution(svc, {
+          operation: op,
+          rowAccess: op,
+          virtualAccess: op,
+          outputAccess: op,
+          docPermissionsAccess: op
+        }),
+        "lean"
+      );
+    return withExecutionHydration(
       svc,
-      { operation: op, rowAccess: op, virtualAccess: op, outputAccess: op, docPermissionsAccess: op },
-      parentAuthorization,
-      this.relatedBinding(),
-      include.path
+      createRelatedExecution(
+        svc,
+        { operation: op, rowAccess: op, virtualAccess: op, outputAccess: op, docPermissionsAccess: op },
+        parentAuthorization,
+        this.relatedBinding(),
+        include.path
+      ),
+      "lean"
     );
   }
   processInclude(include) {
@@ -7083,7 +7218,7 @@ var Base = class {
   }
   validateIncludeOutputPath(path, modelName) {
     const permissionField = getModelOption(modelName, "documentPermissionField");
-    if (get6(set6({}, path, true), permissionField) !== void 0 || get6(set6({}, permissionField, true), path) !== void 0) {
+    if (get7(set6({}, path, true), permissionField) !== void 0 || get7(set6({}, permissionField, true), path) !== void 0) {
       this.throwClientRequestError(
         "bad_request" /* BadRequest */,
         `Include output path ${path} overlaps document permission field ${permissionField} on model ${modelName}`
@@ -7187,7 +7322,7 @@ var Base = class {
   buildForeignKeyIndex(rows, foreignField) {
     const index = /* @__PURE__ */ new Map();
     for (const row of rows) {
-      for (const value of this.getForeignKeyValues(get6(row, foreignField))) {
+      for (const value of this.getForeignKeyValues(get7(row, foreignField))) {
         const key = this.getForeignKey(value);
         const values = index.get(key);
         if (values) values.push(row);
@@ -7255,7 +7390,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, "read", path, parentAuthorization);
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = get6(doc, localField);
+      const localValue = get7(doc, localField);
       const execution = this.relatedExecution(svc, include, parentAuthorization);
       const prepared = await prepareModelQuery(
         svc,
@@ -7269,7 +7404,6 @@ var Base = class {
         skim,
         populateAccess,
         access: "read",
-        lean: true,
         includePermissions: false,
         includeFieldPermissions: false
       });
@@ -7292,7 +7426,7 @@ var Base = class {
     const svc = await this.getAuthorizedTargetService(model, op, path, parentAuthorization);
     const includeLocalValues = [];
     forEach3(docs, (doc) => {
-      includeLocalValues.push(...this.getForeignKeyValues(get6(doc, localField)));
+      includeLocalValues.push(...this.getForeignKeyValues(get7(doc, localField)));
     });
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
@@ -7308,7 +7442,6 @@ var Base = class {
       ...requestOnlyServiceOptions({
         skim,
         populateAccess,
-        lean: true,
         includePermissions: false,
         includeFieldPermissions: false,
         includeCount: false
@@ -7343,7 +7476,7 @@ var Base = class {
     }
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const matches = this.getIndexedMatches(index, get6(doc, localField));
+      const matches = this.getIndexedMatches(index, get7(doc, localField));
       const isolated = matches.map((m) => copyAuthorizedOutput(m));
       attachIncludeOutput(doc, path, op === "list" ? isolated : isolated[0]);
     }
@@ -7352,7 +7485,7 @@ var Base = class {
   async includeDocsCount(docs, include, parentAuthorization) {
     const { model, path, localField, foreignField, filter: _filters } = include;
     const svc = await this.getAuthorizedTargetService(model, "count", path, parentAuthorization);
-    const groups = prepareCountGroups(docs, (doc) => get6(doc, localField));
+    const groups = prepareCountGroups(docs, (doc) => get7(doc, localField));
     const execution = this.relatedExecution(svc, include, parentAuthorization);
     const prepared = await prepareModelQuery(
       svc,
@@ -7483,7 +7616,6 @@ var Base = class {
             },
             requestOnlyServiceOptions({
               access: "read",
-              lean: true,
               includePermissions: false,
               includeFieldPermissions: false
             })
@@ -7558,7 +7690,6 @@ var Base = class {
           },
           requestOnlyServiceOptions({
             access: "read",
-            lean: true,
             includePermissions: false,
             includeFieldPermissions: false
           })
@@ -7643,7 +7774,6 @@ var Base = class {
           },
           requestOnlyServiceOptions({
             includeCount: false,
-            lean: true,
             includePermissions: false,
             includeFieldPermissions: false
           })
@@ -7758,7 +7888,7 @@ var Base = class {
     }
     let ret = result2.data;
     if (sqOptions.path) {
-      ret = isArray9(ret) ? flatten(ret.map((v) => get6(v, sqOptions.path))) : get6(ret, sqOptions.path);
+      ret = isArray9(ret) ? flatten(ret.map((v) => get7(v, sqOptions.path))) : get7(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
       ret = compact(castArray2(ret));
@@ -7777,7 +7907,7 @@ import {
   castArray as castArray3,
   cloneDeep as cloneDeep4,
   compact as compact2,
-  get as get11,
+  get as get12,
   isArray as isArray10,
   isBoolean as isBoolean4,
   isPlainObject as isPlainObject21,
@@ -8140,6 +8270,7 @@ function copySubdocumentParent(parent) {
 init_permission();
 init_core_shared();
 init_finalize_model_output();
+init_permissions_alias();
 
 // src/acl/populate-target.ts
 var POPULATE_TARGET_PLAN = /* @__PURE__ */ Symbol("accessRouter.populateTargetPlan");
@@ -8202,7 +8333,7 @@ init_document();
 init_request_work();
 init_logger_helpers();
 init_request_complexity();
-import { get as get8, isPlainObject as isPlainObject20, set as set9 } from "@web-ts-toolkit/utils";
+import { get as get9, isPlainObject as isPlainObject20, set as set9 } from "@web-ts-toolkit/utils";
 import { mongo as mongo4 } from "mongoose";
 
 // src/acl/select-resolution.ts
@@ -8530,7 +8661,7 @@ async function requestInputFields(args) {
   const prefix = configuration.modelPermissionPrefix ?? "";
   return collectModelRequestFields({
     req: args.binding.request,
-    permissionSchema: args.scopePath ? get8(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
+    permissionSchema: args.scopePath ? get9(configuration.permissionSchema, [args.scopePath, "sub"]) : configuration.permissionSchema,
     access: args.access,
     permissions,
     grants,
@@ -8576,7 +8707,7 @@ init_lib();
 // src/services/model-subdocument-service.ts
 init_helpers();
 init_document();
-import { get as get10 } from "@web-ts-toolkit/utils";
+import { get as get11 } from "@web-ts-toolkit/utils";
 init_public_admission();
 
 // src/acl/subdocument-authorization.ts
@@ -8585,7 +8716,7 @@ init_document();
 init_core_shared();
 init_request_complexity();
 init_public_admission();
-import { get as get9 } from "@web-ts-toolkit/utils";
+import { get as get10 } from "@web-ts-toolkit/utils";
 init_authorization_snapshot();
 init_service_authorization();
 init_field_catalog();
@@ -8767,8 +8898,8 @@ async function subdocumentGateAllowed(service, gate) {
   let guard2;
   if (access.startsWith("subs.")) {
     const [, sub, op] = access.split(".");
-    guard2 = get9(configuration, `operationAccess.${access}`);
-    if (guard2 === void 0) guard2 = get9(configuration, `operationAccess.subs.${sub}`);
+    guard2 = get10(configuration, `operationAccess.${access}`);
+    if (guard2 === void 0) guard2 = get10(configuration, `operationAccess.subs.${sub}`);
     if (guard2 === void 0) guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${op}`);
   } else guard2 = getCapturedAuthorizationOption(configuration, `operationAccess.${access}`);
   return evaluateRouteGuard(
@@ -8840,8 +8971,7 @@ async function mutationParent(service, id, call) {
   const parent = await service.findRawParentDoc({
     filter: filter2,
     select: parentSelection(service, call),
-    populate: [],
-    lean: false
+    populate: []
   });
   return parent ? { parent } : { error: denied2("not_found" /* NotFound */) };
 }
@@ -8890,18 +9020,17 @@ async function visibleMutationRows(service, call, parentId, rows) {
     const identity = { _id: parentId };
     const filter2 = await subdocumentRows(service, visibility.parent, identity, identity);
     if (filter2 === false) return [];
-    const parent = await service.findRawParentDoc({
+    const parent = await getServiceExecutors(service).subdocumentVisibility({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: [],
-      lean: true
+      populate: []
     });
     if (!parent) return [];
     const selected = call.method === "create" ? {} : { _id: { $in: rows.map((row) => row._id) } };
     const read = await subdocumentRows(service, visibility.child, selected, selected, call.sub);
     const list = visibility.list ? await subdocumentRows(service, visibility.list, {}, {}, call.sub) : {};
     if (read === false || list === false) return [];
-    const visible = filterCollection(get10(parent, call.sub), intersectFilters(read, list));
+    const visible = filterCollection(get11(parent, call.sub), intersectFilters(read, list));
     return await finalizeSubdocumentRows(service, call.output, parent, visible);
   } catch {
     return [];
@@ -8922,11 +9051,10 @@ async function listSub(service, id, sub, options) {
     const parent = await service.findRawParentDoc({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: [],
-      lean: false
+      populate: []
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const rows = filterCollection(get10(parent, sub), childFilter);
+    const rows = filterCollection(get11(parent, sub), childFilter);
     const data = await finalizeSubdocumentRows(service, call.output, parent, rows);
     return { success: true, kind: "list", code: "success" /* Success */, data, count: data.length };
   });
@@ -8945,11 +9073,10 @@ async function readSub(service, id, sub, subId, options) {
     const parent = await service.findRawParentDoc({
       filter: filter2,
       select: parentSelection(service, call),
-      populate: entries,
-      lean: false
+      populate: entries
     });
     if (!parent) return denied2("not_found" /* NotFound */);
-    const row = findElement(get10(copySubdocumentParent(parent), sub), childFilter);
+    const row = findElement(get11(copySubdocumentParent(parent), sub), childFilter);
     if (!row) return denied2("not_found" /* NotFound */);
     await service.finalizePopulateForSubParent({ [sub]: [row] }, entries, "subRead");
     const data = await finalizeSubdocumentRows(service, call.output, parent, [row]);
@@ -8969,7 +9096,7 @@ async function updateSub(service, persist, id, sub, subId, data, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement(get10(parent, sub), filter2);
+    const row = findElement(get11(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     const original = isolateDocForOutput(row);
     const admit = await inputAdmission(service, call, parent);
@@ -8996,7 +9123,7 @@ async function bulkUpdateSub(service, persist, id, sub, data, options) {
     const selected = { _id: { $in: data.map((row) => row._id) } };
     const filter2 = await subdocumentRows(service, call.child, selected, selected, sub);
     if (filter2 === false) return denied2();
-    const rows = filterCollection(get10(parent, sub), filter2);
+    const rows = filterCollection(get11(parent, sub), filter2);
     const originals = rows.map((row) => isolateDocForOutput(row));
     const admit = await inputAdmission(service, call, parent);
     for (const [index, row] of rows.entries()) {
@@ -9024,7 +9151,7 @@ async function createSub(service, persist, id, sub, data, options) {
     const lookup = await mutationParent(service, id, call);
     if ("error" in lookup) return lookup.error;
     const { parent } = lookup;
-    const rows = get10(parent, sub);
+    const rows = get11(parent, sub);
     const admit = await inputAdmission(service, call, parent);
     const allowed = (Array.isArray(data) ? data : [data]).map((row) => admit(row).allowedData);
     if (options?.addFirst) rows.unshift(...allowed);
@@ -9045,7 +9172,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
     const identity = { _id: subId };
     const filter2 = await subdocumentRows(service, call.child, identity, identity, sub);
     if (filter2 === false) return denied2();
-    const row = findElement(get10(parent, sub), filter2);
+    const row = findElement(get11(parent, sub), filter2);
     if (!row) return denied2("not_found" /* NotFound */);
     await ("deleteOne" in row ? row.deleteOne?.() : row.remove?.());
     await persist(() => parent.save());
@@ -9054,7 +9181,7 @@ async function deleteSub(service, persist, id, sub, subId, options) {
 }
 async function getParentDoc(service, id, sub, args, options) {
   assertPublicAdmission({ args, options });
-  const { access = "read", lean = false } = options ?? {};
+  const { access = "read" } = options ?? {};
   const identity = deepIsolateValue(await service.genIDFilter(id));
   const filter2 = intersectFilters(identity, await service.genFilter(access, deepIsolateValue(identity)));
   if (filter2 === false) return null;
@@ -9062,8 +9189,7 @@ async function getParentDoc(service, id, sub, args, options) {
   return service.findRawParentDoc({
     filter: filter2,
     select: access === "read" ? "" : sub,
-    populate,
-    lean
+    populate
   });
 }
 
@@ -9093,8 +9219,7 @@ function resolveFindOneOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOneOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findOneOptions?.access ?? "read",
-    populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess,
-    lean: options.lean ?? service.defaults.findOneOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess
   });
 }
 function resolveFindByIdArgs(service, args = {}) {
@@ -9111,8 +9236,7 @@ function resolveFindByIdOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findByIdOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findByIdOptions?.access ?? "read",
-    populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess,
-    lean: options.lean ?? service.defaults.findByIdOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess
   });
 }
 function resolveFindArgs(service, args = {}) {
@@ -9134,8 +9258,7 @@ function resolveFindOptions(service, options = {}) {
     includePermissions,
     includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOptions?.includeFieldPermissions ?? includePermissions,
     includeCount: options.includeCount ?? service.defaults.findOptions?.includeCount ?? false,
-    populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read",
-    lean: options.lean ?? service.defaults.findOptions?.lean ?? false
+    populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read"
   });
 }
 function resolveCreateArgs(service, args = {}) {
@@ -9249,7 +9372,7 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, this.options) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -9293,26 +9416,37 @@ var Service = class extends Base {
         data: await this.model.countDocuments(filter2),
         query: { filter: filter2 }
       }),
-      groupedCount: (filter2, field, input) => this.countPreparedByFieldValueGroups(field, input, filter2)
+      groupedCount: (filter2, field, input) => this.countPreparedByFieldValueGroups(field, input, filter2),
+      subdocumentVisibility: ({ filter: filter2, select, populate }) => this.model.findOne({ filter: filter2, select, populate, lean: true })
     });
   }
   get options() {
     return modelServiceOptions(this, () => this.getModelRouterOptions(this.modelName));
   }
+  /**
+   * Presentation/query defaults for this service instance; an explicit assignment
+   * replaces the runtime defaults bag, not a per-bucket merge. Fetch mode belongs
+   * to the owning model's hydration configuration and affects all its services.
+   * Legacy method-option lean/hydration keys throw on assignment and before calls
+   * if an assigned JavaScript bag is later mutated.
+   */
   get defaults() {
     return this.defaultsOverride ?? this.options.defaults ?? {};
   }
   set defaults(value) {
+    assertHydrationDefaults(value);
     this.defaultsOverride = value;
   }
   get baseFieldsExt() {
     return this.baseFields.concat(this.options.documentPermissionField);
   }
+  /** Raw hydrated parent/null. Fetch mode is fixed, independent of model read settings. */
   findRawParentDoc(args) {
     return this.model.findOne({
-      ...args,
       filter: args.filter,
-      populate: args.populate
+      select: args.select,
+      populate: args.populate,
+      lean: false
     });
   }
   createModelAdapter(modelName) {
@@ -9417,6 +9551,7 @@ var Service = class extends Base {
       }
     });
     const output = deepIsolateValue(finalized);
+    removeGeneratedPermissionsAlias(output);
     const includeOrigins = restoreIncludeOutput(args.doc, output);
     const field = configuration.documentPermissionField ?? "_permissions";
     unsetDocPath(output, field);
@@ -9430,10 +9565,20 @@ var Service = class extends Base {
         const map2 = (paths) => paths.length ? Object.fromEntries(paths.map((path) => [path, true])) : { $: "_" };
         set10(output, `${field}._view`, map2(views));
         set10(output, `${field}._edit`, map2(edits));
-      } else if (!args.includePermissions) this.addEmptyPermissions(output);
-      stripUnexposedDocPermissions(this.modelName, output);
+      } else if (!args.includePermissions) set10(output, field, { _view: { $: "_" }, _edit: { $: "_" } });
+      const exposed = configuration.exposedDocPermissionKeys;
+      if (exposed) {
+        const metadata = get12(output, field);
+        set10(
+          output,
+          field,
+          Object.fromEntries(
+            Object.entries(metadata).filter(([key]) => key === "_view" || key === "_edit" || exposed.includes(key))
+          )
+        );
+      }
+      attachPermissionsAlias(output, field);
     }
-    this.preservePermissionsVirtual(getIncludeOriginal(args.doc), output, args.lean);
     transferDocumentAuthorizationGraph(finalized, output, includeOrigins);
     return {
       data: output,
@@ -9648,36 +9793,6 @@ var Service = class extends Base {
   stripVirtualsFromFilterForSnapshot(filter2, snapshot) {
     return stripVirtualKeysFromFilter(filter2, snapshot);
   }
-  /**
-   * Preserve the `permissions` Mongoose virtual (from `permissionsPlugin`) for
-   * hydrated outputs. `isolateDocForOutput` uses `toObject({ virtuals: false })`
-   * so Mongoose getter virtuals never leak into package-virtual planning;
-   * `lean: true` therefore drops them (explicit parity rule). For `lean: false`
-   * (hydrated Mongoose documents) the historical contract exposes
-   * `doc.permissions` as an alias of the document-permission field. The shared
-   * finalizer keeps only the document-permission field, so restore the alias
-   * here for backward compatibility when the input was hydrated and the
-   * virtual existed. Lean outputs stay without the virtual. Models without
-   * the plugin never had the virtual and stay unchanged.
-   */
-  preservePermissionsVirtual(originalDoc, finalized, lean) {
-    try {
-      if (lean) return;
-      if (!isDocument2(originalDoc)) return;
-      const schema = originalDoc.schema;
-      if (!schema?.virtualpath("permissions")) return;
-      const docField = this.options?.documentPermissionField ?? "_permissions";
-      if (docField in finalized && !("permissions" in finalized)) {
-        Object.defineProperty(finalized, "permissions", {
-          value: finalized[docField],
-          enumerable: false,
-          writable: true,
-          configurable: true
-        });
-      }
-    } catch {
-    }
-  }
   /**
    * VIRT-05 populate + association helpers.
    *
@@ -9714,7 +9829,7 @@ var Service = class extends Base {
     return docs.map((doc) => {
       try {
         const plain = toObject(doc);
-        const val = get11(plain, associationField);
+        const val = get12(plain, associationField);
         return deepIsolateValue(val);
       } catch {
         return void 0;
@@ -9899,7 +10014,7 @@ var Service = class extends Base {
       child = getDocValue(current, key);
       if (child === void 0) {
         try {
-          child = get11(current, key);
+          child = get12(current, key);
         } catch {
           return;
         }
@@ -10035,7 +10150,7 @@ var Service = class extends Base {
   async findOnePrepared(execution, filter2, args, options) {
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
     const { select: requestedSelect, sort, populate, include } = this.resolveFindOneArgs(args);
-    const { includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
+    const { includePermissions, includeFieldPermissions, access, populateAccess } = this.resolveFindOneOptions(options);
     const state = readServiceExecution(this, execution);
     const virtualSnapshot = readServiceAuthorization(state.authorization, state.binding).configuration;
     let processedInclude;
@@ -10097,7 +10212,7 @@ var Service = class extends Base {
         return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: sortErrors, query };
       }
     }
-    let doc = await this.model.findOne({ ...query, select: dbSelect, lean });
+    let doc = await this.model.findOne({ ...query, select: dbSelect, lean: state.hydration === "lean" });
     if (!doc) {
       this.completeOp("findOne", startedAt, "not_found" /* NotFound */, _filter);
       return { success: false, kind: "error", code: "not_found" /* NotFound */, query };
@@ -10160,7 +10275,6 @@ var Service = class extends Base {
         context,
         includePermissions,
         includeFieldPermissions,
-        lean,
         sharedGate: findOneGate
       });
     } catch (error2) {
@@ -10185,7 +10299,7 @@ var Service = class extends Base {
     try {
       this.admitServiceCall(args, options);
       const { select, populate, include } = this.resolveFindByIdArgs(args);
-      const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
+      const { skim, includePermissions, includeFieldPermissions, access, populateAccess } = this.resolveFindByIdOptions(options);
       const execution = createServiceExecution(
         this,
         {
@@ -10197,7 +10311,11 @@ var Service = class extends Base {
         },
         options?.authorization,
         "service",
-        this.captureRelated(args, this.defaults.findByIdArgs)
+        this.captureRelated(args, this.defaults.findByIdArgs),
+        void 0,
+        void 0,
+        void 0,
+        "findById"
       );
       const filter2 = readModelIdentifier(this, execution, await resolveModelIdentifier(this, execution, id));
       const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
@@ -10210,7 +10328,7 @@ var Service = class extends Base {
           populate,
           include
         },
-        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess }
       );
     } catch (error2) {
       const result2 = this.getClientRequestErrorResult(error2);
@@ -10256,7 +10374,7 @@ var Service = class extends Base {
       page,
       pageSize
     } = this.resolveFindArgs(args);
-    const { includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
+    const { includePermissions, includeFieldPermissions, includeCount, populateAccess } = this.resolveFindOptions(options);
     let processedInclude;
     try {
       processedInclude = this.processInclude(include);
@@ -10331,7 +10449,7 @@ var Service = class extends Base {
       ...query,
       select: dbSelect,
       hardLimit: this.options.listHardLimit,
-      lean
+      lean: state.hydration === "lean"
     });
     const capturedAssociation = findAssociationField ? this.captureAssociationValues(docs, findAssociationField) : void 0;
     const correlatedSnapshots = docs.map((doc) => cloneDeep4(toObject(doc)));
@@ -10406,7 +10524,6 @@ var Service = class extends Base {
         context: contexts[i],
         includePermissions,
         includeFieldPermissions,
-        lean,
         sharedGate,
         privateAssociationField
       });
@@ -10596,7 +10713,6 @@ var Service = class extends Base {
         context: contexts[index],
         includePermissions,
         includeFieldPermissions,
-        lean: false,
         sharedGate: createGate
       });
       outputContexts[index] = output.context;
@@ -10659,8 +10775,7 @@ var Service = class extends Base {
         doc: data,
         plan: newPlan,
         context: newContext,
-        includePermissions,
-        lean: false
+        includePermissions
       });
       return {
         success: true,
@@ -10828,8 +10943,7 @@ var Service = class extends Base {
       plan: updatePlan,
       context,
       includePermissions,
-      includeFieldPermissions,
-      lean: false
+      includeFieldPermissions
     });
     const outputDoc = decorate ? await this.hookGate.run(() => decorate(output.data, output.context)) : output.data;
     this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
@@ -11411,6 +11525,7 @@ var Service = class extends Base {
   async deleteSub(id, sub, subId, options) {
     return deleteSub(this, this.persist, id, sub, subId, options);
   }
+  /** Raw hydrated parent/null, with row policy and populate; no finalized permission metadata. */
   async getParentDoc(id, sub, args, options) {
     return getParentDoc(this, id, sub, args, options);
   }
@@ -11418,6 +11533,7 @@ var Service = class extends Base {
 
 // src/services/public-service.ts
 init_helpers();
+init_permissions_alias();
 import { pick as pick3 } from "@web-ts-toolkit/utils";
 init_public_admission();
 var PublicService = class extends Service {
@@ -11456,36 +11572,61 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options, filter: filter2 });
     if (admission) return admission;
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
-    const result2 = await this.find(
-      filter2,
-      { select, populate, include, sort, skip, limit, page, pageSize },
-      requestOnlyServiceOptions({
-        skim,
-        includePermissions,
-        includeFieldPermissions,
-        includeCount,
-        populateAccess,
-        lean
-      }),
-      async (doc, context) => {
-        doc = toObject(doc);
-        return this.decorate(doc, "list", context);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess } = this.resolvePublicListOptions(options);
+    try {
+      const execution = withExecutionHydration(
+        this,
+        createServiceExecution(
+          this,
+          {
+            operation: "list",
+            rowAccess: "list",
+            virtualAccess: "list",
+            outputAccess: "list",
+            docPermissionsAccess: "list"
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findArgs)
+        ),
+        "publicList"
+      );
+      const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+      const result2 = await executePreparedFind(
+        this,
+        execution,
+        query,
+        { select, populate, include, sort, skip, limit, page, pageSize },
+        requestOnlyServiceOptions({
+          skim,
+          includePermissions,
+          includeFieldPermissions,
+          includeCount,
+          populateAccess
+        }),
+        async (doc, context) => {
+          doc = toObject(doc);
+          return this.decorate(doc, "list", context);
+        }
+      );
+      if (!result2.success) {
+        return result2;
       }
-    );
-    if (!result2.success) {
-      return result2;
+      const docs = await this.decorateAll(result2.data, "list", {
+        mongooseModel: this.model.mongooseModel,
+        modelName: this.modelName,
+        operation: "list",
+        resolvedQuery: result2.query
+      });
+      const transformedDocs = docs.map(
+        (row) => this.runTasks(row, tasks)
+      );
+      return { ...result2, data: transformedDocs };
+    } catch (error2) {
+      const result2 = this.getClientRequestErrorResult(error2);
+      if (result2) return result2;
+      throw error2;
     }
-    const docs = await this.decorateAll(result2.data, "list", {
-      mongooseModel: this.model.mongooseModel,
-      modelName: this.modelName,
-      operation: "list",
-      resolvedQuery: result2.query
-    });
-    const transformedDocs = docs.map(
-      (row) => this.runTasks(row, tasks)
-    );
-    return { ...result2, data: transformedDocs };
   }
   async _create(data, args, options) {
     const admission = this.admitPublicCall({ args, options, data });
@@ -11501,7 +11642,7 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
         d = this.runTasks(d, tasks);
-        if (select) d = pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        if (select) d = copyPermissionsAlias(d, pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
         return d;
       }
     );
@@ -11522,21 +11663,25 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options });
     if (admission) return admission;
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = this.resolvePublicReadOptions(options);
     try {
       let access = "read";
-      let execution = createServiceExecution(
+      let execution = withExecutionHydration(
         this,
-        {
-          operation: "read",
-          rowAccess: access,
-          virtualAccess: access,
-          outputAccess: access,
-          docPermissionsAccess: access
-        },
-        requestOnlyServiceOptions({}).authorization,
-        "service",
-        this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        createServiceExecution(
+          this,
+          {
+            operation: "read",
+            rowAccess: access,
+            virtualAccess: access,
+            outputAccess: access,
+            docPermissionsAccess: access
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        ),
+        "publicRead"
       );
       const identifier = await resolveModelIdentifier(this, execution, id);
       const query = await prepareModelQuery(this, execution, {
@@ -11548,7 +11693,7 @@ var PublicService = class extends Service {
         execution,
         query,
         { select, populate, include },
-        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
+        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
       );
       if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
       if (tryList && (!result2.success || !result2.data)) {
@@ -11578,8 +11723,7 @@ var PublicService = class extends Service {
             includePermissions,
             includeFieldPermissions,
             access,
-            populateAccess,
-            lean
+            populateAccess
           })
         );
       }
@@ -11600,43 +11744,79 @@ var PublicService = class extends Service {
     const admission = this.admitPublicCall({ args, options, filter: filter2 });
     if (admission) return admission;
     const { select, sort, populate, include, tasks } = this.resolvePublicReadFilterArgs(args);
-    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = this.resolvePublicReadOptions(options);
     let access = "read";
-    let result2 = await this.findOne(
-      filter2,
-      {
-        select,
-        sort,
-        populate,
-        include
-      },
-      requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
-    );
-    if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
-    if (tryList && (!result2.success || !result2.data)) {
-      const listAllowed = await this.requestCore.isAllowed(this.modelName, "list");
-      if (!listAllowed) {
-        return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
-      }
-      access = "list";
-      result2 = await this.findOne(
-        filter2,
+    try {
+      let execution = withExecutionHydration(
+        this,
+        createServiceExecution(
+          this,
+          {
+            operation: "read",
+            rowAccess: access,
+            virtualAccess: access,
+            outputAccess: access,
+            docPermissionsAccess: access
+          },
+          requestOnlyServiceOptions({}).authorization,
+          "service",
+          this.captureRelated({ populate, include }, this.defaults.findOneArgs)
+        ),
+        "publicRead"
+      );
+      const query = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+      let result2 = await executePreparedFindOne(
+        this,
+        execution,
+        query,
         {
           select,
           sort,
           populate,
           include
         },
-        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess, lean })
+        requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
       );
+      if (!result2.success && (result2.code === "bad_request" /* BadRequest */ || result2.code === "forbidden" /* Forbidden */)) return result2;
+      if (tryList && (!result2.success || !result2.data)) {
+        const listAllowed = await this.requestCore.isAllowed(this.modelName, "list");
+        if (!listAllowed) {
+          return { success: false, kind: "error", code: "unauthorized" /* Unauthorized */, errors: ["Unauthorized"] };
+        }
+        access = "list";
+        execution = deriveServiceExecution(this, execution, {
+          operation: "read",
+          rowAccess: access,
+          virtualAccess: access,
+          outputAccess: access,
+          docPermissionsAccess: access
+        });
+        const fallback = await prepareModelQuery(this, execution, { kind: "client-read", filter: filter2 });
+        result2 = await executePreparedFindOne(
+          this,
+          execution,
+          fallback,
+          {
+            select,
+            sort,
+            populate,
+            include
+          },
+          requestOnlyServiceOptions({ skim, includePermissions, includeFieldPermissions, access, populateAccess })
+        );
+      }
+      if (!result2.success) {
+        return result2;
+      }
+      let doc = toObject(result2.data);
+      doc = await this.decorate(doc, access, result2.context);
+      doc = this.runTasks(doc, tasks);
+      return { ...result2, data: doc };
+    } catch (error2) {
+      const result2 = this.getClientRequestErrorResult(error2);
+      if (result2) return result2;
+      throw error2;
     }
-    if (!result2.success) {
-      return result2;
-    }
-    let doc = toObject(result2.data);
-    doc = await this.decorate(doc, access, result2.context);
-    doc = this.runTasks(doc, tasks);
-    return { ...result2, data: doc };
   }
   async _update(id, data, args, options) {
     const admission = this.admitPublicCall({ args, options, data });
@@ -11657,8 +11837,8 @@ var PublicService = class extends Service {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
         d = this.runTasks(d, tasks);
-        if (select) d = pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) d = pick3(d, [...Object.keys(data), "_id"]);
+        if (select) d = copyPermissionsAlias(d, pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
+        else if (!returningAll) d = copyPermissionsAlias(d, pick3(d, [...Object.keys(data), "_id"]));
         return d;
       }
     );
@@ -11738,8 +11918,8 @@ var PublicService = class extends Service {
             let d = toObject(doc);
             d = await this.decorate(d, "update", context);
             d = this.runTasks(d, tasks2);
-            if (select2) d = pick3(d, [...normalizeSelect(select2), ...this.baseFieldsExt]);
-            else if (!returningAll) d = pick3(d, [...Object.keys(otherData), "_id"]);
+            if (select2) d = copyPermissionsAlias(d, pick3(d, [...normalizeSelect(select2), ...this.baseFieldsExt]));
+            else if (!returningAll) d = copyPermissionsAlias(d, pick3(d, [...Object.keys(otherData), "_id"]));
             return d;
           }
         );
@@ -11768,7 +11948,7 @@ var PublicService = class extends Service {
           let d = toObject(doc);
           d = await this.decorate(d, "create", context);
           d = this.runTasks(d, tasks);
-          if (select) d = pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]);
+          if (select) d = copyPermissionsAlias(d, pick3(d, [...normalizeSelect(select), ...this.baseFieldsExt]));
           return d;
         }
       );
@@ -11829,8 +12009,7 @@ var PublicService = class extends Service {
       includePermissions,
       includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicListOptions?.includeFieldPermissions ?? includePermissions,
       includeCount: options.includeCount ?? this.defaults.publicListOptions?.includeCount ?? false,
-      populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read",
-      lean: options.lean ?? this.defaults.publicListOptions?.lean ?? true
+      populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read"
     };
   }
   resolvePublicCreateArgs(args = {}) {
@@ -11871,8 +12050,7 @@ var PublicService = class extends Service {
       includePermissions,
       includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicReadOptions?.includeFieldPermissions ?? includePermissions,
       tryList: options.tryList ?? this.defaults.publicReadOptions?.tryList ?? true,
-      populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess,
-      lean: options.lean ?? this.defaults.publicReadOptions?.lean ?? false
+      populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess
     };
   }
   resolvePublicUpdateArgs(args = {}) {
@@ -12054,7 +12232,13 @@ var DataService = class {
 init_helpers();
 
 // src/processors.ts
-import { cloneDeep as cloneDeep5, forEach as forEach5, get as get12, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject22, map, set as set11 } from "@web-ts-toolkit/utils";
+init_permissions_alias();
+import { cloneDeep as cloneDeep5, forEach as forEach5, get as get13, hasOwn as hasOwn3, isArray as isArray11, isPlainObject as isPlainObject22, map, set as set11 } from "@web-ts-toolkit/utils";
+function cloneProcessorValue(value) {
+  const copy = cloneDeep5(value);
+  copyPermissionsAliasGraph(value, copy);
+  return copy;
+}
 var UNSAFE_PATH_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
 var DEFAULT_MAX_SLICE = 1e3;
 var DEFAULT_MASK_REPLACEMENT = "***";
@@ -12111,7 +12295,7 @@ function resolveLeafParents(obj, src) {
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
   const mutable = options.mutable !== false;
   const idField = options.idField ?? "_id";
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
@@ -12143,7 +12327,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
               return;
             }
           } else if (isPlainObject22(leaf)) {
-            const id = get12(leaf, idField);
+            const id = get13(leaf, idField);
             if (id === void 0) {
               failMissingId(src);
             }
@@ -12173,7 +12357,7 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
 };
 var copyPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
@@ -12184,14 +12368,14 @@ var copyPaths = (docObject, operations, options = { mutable: true }) => {
     if (src === dest) return;
     forEach5(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       if (!hasOwn3(parent, leaf)) return;
-      set11(parent, dest, cloneDeep5(parent[leaf]));
+      set11(parent, dest, cloneProcessorValue(parent[leaf]));
     });
   });
   return obj;
 };
 var movePaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
@@ -12202,7 +12386,7 @@ var movePaths = (docObject, operations, options = { mutable: true }) => {
     if (src === dest) return;
     forEach5(resolveLeafParents(obj, src), ({ parent, leaf }) => {
       if (!hasOwn3(parent, leaf)) return;
-      const value = cloneDeep5(parent[leaf]);
+      const value = cloneProcessorValue(parent[leaf]);
       set11(parent, dest, value);
       if (dest === leaf || dest.startsWith(`${leaf}.`)) return;
       delete parent[leaf];
@@ -12214,7 +12398,7 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
   const mutable = options.mutable !== false;
   const maxSlice = options.maxSlice ?? DEFAULT_MAX_SLICE;
   assertNonNegativeSafeInteger(maxSlice, "maxSlice", "sliceArrays");
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
@@ -12248,7 +12432,7 @@ var sliceArrays = (docObject, operations, options = { mutable: true, maxSlice: D
 };
 var countPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string" || typeof op.dest !== "string") return;
     const src = op.src;
@@ -12276,7 +12460,7 @@ var countPaths = (docObject, operations, options = { mutable: true }) => {
 };
 var maskPaths = (docObject, operations, options = { mutable: true }) => {
   const mutable = options.mutable !== false;
-  const obj = mutable ? docObject : cloneDeep5(docObject);
+  const obj = mutable ? docObject : cloneProcessorValue(docObject);
   forEach5(Array.isArray(operations) ? operations : [], (op) => {
     if (!op || typeof op.src !== "string") return;
     const src = op.src;
@@ -14062,8 +14246,7 @@ var rootModelListOptionsSchema = z5.object({
   includePermissions: z5.boolean().optional(),
   includeFieldPermissions: z5.boolean().optional(),
   includeCount: z5.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: z5.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelReadArgsSchema = z5.object({
   select: projectionSchema.optional(),
@@ -14079,8 +14262,7 @@ var rootModelReadOptionsSchema = z5.object({
   includePermissions: z5.boolean().optional(),
   includeFieldPermissions: z5.boolean().optional(),
   tryList: z5.boolean().optional(),
-  populateAccess: populateAccessSchema.optional(),
-  lean: z5.boolean().optional()
+  populateAccess: populateAccessSchema.optional()
 }).passthrough();
 var rootModelCreateArgsSchema = z5.object({
   select: projectionSchema.optional(),
@@ -15712,8 +15894,8 @@ var RootRouter = class {
     const presentation = ["skim", "includePermissions", "includeFieldPermissions"];
     const optionKeys = {
       new: presentation,
-      list: [...presentation, "includeCount", "populateAccess", "lean"],
-      read: [...presentation, "populateAccess", "lean", "tryList"],
+      list: [...presentation, "includeCount", "populateAccess"],
+      read: [...presentation, "populateAccess", "tryList"],
       create: [...presentation, "populateAccess"],
       update: [...presentation, "populateAccess", "returningAll"],
       upsert: [...presentation, "populateAccess", "returningAll"]