@web-ts-toolkit/access-router 0.54.0 → 0.56.0

package/README.md

@@ -17,6 +17,8 @@ ACL-aware Express routers and in-memory data services for Mongoose-backed APIs.
 [Virtuals](#virtuals-computed-fields) · [Hook admission](#hook-admission-and-reentrant-service-calls) ·
 [Persistence limits](#persistence-concurrency-and-resource-limits)
 
+**Private virtual inputs:** [Populated dependencies and runnable example](#private-populated-dependencies)
+
 **Migration:** [Removed overrides](#breaking-release-service-overrides-migration) ·
 [Server-owned hydration](#breaking-release-server-owned-hydration) ·
 [Named helpers](#breaking-release-named-helpers-and-default-behavior) ·
@@ -124,7 +126,7 @@ package-managed execution, falling back to `defaultRuntime` outside it.
 
 | Layer / public type                                                             | Where to put it                                                                                         | Scope and examples                                                                                                                                                                                          |
 | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Runtime/global — `GlobalOptions`                                                | `api.setGlobalOptions({...})`, `api.setGlobalOption(key, value)`; `api.set` is an alias for these forms | That runtime's request grants (`globalPermissions`, `requestPermissionField`), logger, registered-populate policy and `requestComplexity`.                                                                  |
+| Runtime/global — `GlobalOptions`                                                | `api.setGlobalOptions({...})`, `api.setGlobalOption(key, value)`; `api.set` is an alias for these forms | That runtime's request grants (`globalPermissions`, `requestPermissionField`), logger, registered-populate/private-input read policy and `requestComplexity`.                                               |
 | Model defaults — `DefaultModelRouterOptions`                                    | `api.setDefaultModelOptions({...})`, `api.setDefaultModelOption(path, value)`                           | Shared model starting values such as `listHardLimit`, IDs, route segments, `operationAccess`, `hydration` and metadata posture. Data/root routers do not inherit them.                                      |
 | Model router — `ModelRouterOptions<Model, Virtuals>`                            | `api.createRouter(Model, {...})`, then `router.setOptions`, `router.setOption` / `router.set`           | One registered model's guards, `permissionSchema`, hooks, virtuals, request schemas, `hydration` and method defaults. Routers for the same model/runtime share its stored options.                          |
 | Data router — `DataRouterOptions<Data>`                                         | `api.createDataRouter(name, {...})`, its setters, or `api.runtime.setDataOptions` / `setDataOption`     | Owned in-memory `data`, list/read guards, request-only fields/filters and decorators. No model `defaults` or model authorization policy. Set `idParam` and `idField` explicitly for data identifier routes. |
@@ -1927,6 +1929,7 @@ Root entrypoint (`@web-ts-toolkit/access-router`):
 - option helpers: `setGlobalOptions`, `setGlobalOption`, `getGlobalOptions`, `getGlobalOption`, `setModelOptions`, `setModelOption`, `getModelOptions`, `getModelOption`, `getModelNames`, `getModelJsonSchema`, `setDefaultModelOptions`, `setDefaultModelOption`, `getDefaultModelOptions`, `getDefaultModelOption`
 - route-policy types: `OperationAccess`, `SubOperationAccess`, `Validation`, `GuardHook`, `RouteVariantAccess`, `ModelRouterOptions`, `DefaultModelRouterOptions`, `DataRouterOptions`, `ExtendedModelRouterOptions`, `ExtendedDefaultModelRouterOptions`, and `ExtendedDataRouterOptions` for typed setters; `PermissionSchema` / `FieldOperationAccess` are separate base-operation field grants. These types are also available from `/advanced`.
 - fetch configuration types (also `/advanced`): `HydrationMode`, `ModelHydrationOptions` — server-owned model/default configuration, never per-call/wire options.
+- virtual types (also `/advanced`): `ModelVirtualGetter`, `ModelVirtualDescriptor`, `ModelVirtualAccessRecord`, `ModelVirtualLeaf`, `ModelVirtuals`, `ModelVirtualDoc`, `ModelVirtualContext`, `ModelVirtualPopulateDependency`, `ModelVirtualPopulateInputs`. Explicit private target maps type only the fourth getter argument; see [Private populated dependencies](#private-populated-dependencies).
 - trusted service policy types (also `/advanced`): `ServiceAuthorization` (reads), `MutationAuthorization` (update/upsert), `CreateAuthorization`, `InputFieldAuthorization`, `InputFieldPath`, `OutputAuthorization`, `FieldAuthorization`, `RowAuthorization`, `OperationAuthorization`, `RelatedAuthorization`, `OutputFieldPath`. Input paths use persisted types only; output paths also include virtuals. Unknown models have an explicit runtime-validated string fallback; grant arrays may be readonly.
 - named helper/result types (also `/advanced`): `OutputPlanningOptions`, `OutputFieldOptions`, `AllowedOutputFieldOptions`, opaque `DocumentAuthorization`, `ServiceOutputContext`, `ServiceOutputDecorator`, `AuthorizedSingleResult`, `AuthorizedListResult`, `NewArgs`, `NewOptions`. Acquire the service from a router/request; there is no standalone `Service` export or public issuer/execution/prepared API.
 
@@ -2484,8 +2487,12 @@ Only returned field values are committed via document-aware helpers;
 `undefined` omits the field; a throw omits it fail-closed with a structural
 log (no raw values or secret-bearing text). Sibling virtual values are never
 visible regardless of completion order, and mutating getter input cannot change
-response data or lifecycle snapshots. Related documents finalize before parent
-getters run, and embedded children finalize before their parent getter.
+response data or lifecycle snapshots implicitly. Public related documents finalize
+before parent getters run, and embedded children finalize before their parent getter.
+The first getter argument retains that ordinary persisted/local/public-related
+view. An opted-in getter receives its declaration-scoped **private populated inputs
+separately in argument four**; see below. A trusted getter may deliberately return
+a value derived from private inputs, subject to the virtual's output authorization.
 
 Coverage: every document-bearing public model output uses its own model's
 definitions, permissions, selection, and effective access — direct
@@ -2524,9 +2531,8 @@ A create-only getter runs only on create/upsert-create responses; an
 update-only getter only on update/upsert-update responses. On other responses
 the name stays a registered virtual: omitted from output and never entering
 persisted projections, write admission, or sort/filter/distinct handling. A
-read-denied virtual (explicit deny, or document grants fail the rule) never
-runs its getter on any path and fetches nothing for it; a document-dependent
-rule defers to post-fetch evaluation with real grants.
+known-denied virtual adds no dependency-only fetch and never runs its getter;
+a document-dependent rule may fetch inputs before real grants deny the getter.
 
 Output-only database/write restrictions: registered virtual names for any
 access (including bare `permissionSchema: true` rules and inapplicable
@@ -2548,7 +2554,9 @@ object or logical branch is retained; a wholly virtual ordinary filter becomes `
 
 Trusted `decorate`/`decorateAll`/tasks boundary: virtuals evaluate before
 `decorate`/`decorateAll`/tasks; internal-only dependency fields are stripped
-before those hooks see the object. Trusted hooks may deliberately construct new
+before those hooks see the object. Private fourth-argument maps are never implicitly
+transported there; an authorized getter's deliberate returned value is output.
+Trusted hooks may deliberately construct new
 output from trusted context; no second authorization pass after those hooks is
 promised.
 
@@ -2559,8 +2567,408 @@ data over per-row database calls. On a 24-row list with 2 getters at
 label via `populate: [{ path: 'addrId', select: ['label'] }]` and a getter
 reading the finalized `doc.addrId` object issued 2 driver reads (batched `$in`)
 with identical output and the same peak bound. Bounds do not collapse N+1
-into 1. Parent getters see only finalized related/embedded outputs and must
-not rely on a related model's stripped private fields.
+into 1. Argument one contains finalized public related/embedded outputs; it cannot
+recover stripped related fields. Use an explicit `dependsOnPopulate` declaration
+and the separate fourth argument when an authorized virtual needs private inputs.
+
+### Private populated dependencies
+
+`dependsOnPopulate: [{ path: 'account', select: ['balance', 'creditLimit'] }]`
+is trusted **server virtual configuration**, available from the existing root and
+`/advanced` types. It grants the declaring getter private persisted **input fields**,
+even when source `account` or target `balance`/`creditLimit` output is denied.
+The source ref is retained automatically; repeating it in local `dependsOn` is unnecessary.
+
+- `dependsOn` supplies persisted fields in the current scope through argument one.
+- Ordinary query `populate` requests public related output under source and target
+  authorization, selection and match rules.
+- `dependsOnPopulate` supplies one-hop persisted target values **only to that
+  resolved getter's fourth argument**. It neither requests public population nor
+  grants output. HTTP, root, service query and client options cannot declare it.
+
+#### Runtime private-read mode
+
+`GlobalOptions.requireReadOperationAccessForPopulateDependencies` defaults to **true**.
+True requires the original caller's captured target base `operationAccess.read` before
+private loading. Set **literal boolean false** on the owning runtime to allow declared
+private computation inputs despite that operation denial:
+
+<!-- doc-example: partial -->
+
+```ts
+import { createAccessRuntime, type GlobalOptions } from '@web-ts-toolkit/access-router';
+
+const api = createAccessRuntime();
+api.setGlobalOptions({ requireReadOperationAccessForPopulateDependencies: false });
+// The exact setter and api.set(key, value)/api.set(options) aliases are also typed.
+api.setGlobalOption('requireReadOperationAccessForPopulateDependencies', false);
+const snapshot: GlobalOptions = api.getGlobalOptions();
+const mode: boolean | undefined = api.getGlobalOption('requireReadOperationAccessForPopulateDependencies');
+void [snapshot, mode];
+```
+
+Missing/undefined or malformed JavaScript values (`'false'`, `0`, null, objects)
+use the conservative true mode; typed setters accept only boolean/undefined. An
+omitted property in a shallow object setter preserves the current setting. The
+flag is captured with source/target configuration and query intent **before the first
+await**. Nested related/embedded/subdocument output retains that call's mode; later
+calls see updates. Separate runtimes remain isolated.
+
+This is **server/runtime configuration**, not a model default, service query option,
+HTTP/root/client control or persisted capability. Business fields with the same
+spelling keep ordinary data semantics. It is independent of
+`requireRegisteredPopulateModels`: private targets still require eager registration
+and valid static server declarations in either mode.
+
+False bypasses **only private target-operation read admission**. Source/target
+`permissionSchema` input-field rules are already bypassed by the declaration;
+the virtual's own output authorization still governs its result. Target request-mode
+`baseFilter.read`, `overrideFilter.read` and retained source IDs still constrain every
+private read. False grants no public target read, field, row, query or write authority.
+If only the virtual is output-eligible, false mode adds no operation check solely to
+fetch its private inputs. A potentially visible reference has a separate target-read
+output check in **both** modes, as [specified below](#target-authority-selection-and-reconstruction).
+
+#### Runnable private dependency example
+
+Save as `private-populate-example.mts` and run with Node 22.18+ or compile with
+TypeScript/NodeNext. Install the package, Express and Mongoose as above. This
+self-contained example creates/removes a uniquely named database, registers the
+target **before** the source, and checks population, exact IDs and omission, including
+false-mode computation with a selected/permitted source and denied target. The example
+tenant is server-owned; real applications derive it from their authenticated actor.
+
+<!-- doc-example: complete-runtime -->
+
+```ts
+import assert from 'node:assert/strict';
+import { randomUUID } from 'node:crypto';
+import { once } from 'node:events';
+import type { Server } from 'node:http';
+import express from 'express';
+import mongoose from 'mongoose';
+import { createAccessRuntime, type ModelVirtualDescriptor } from '@web-ts-toolkit/access-router';
+
+interface Account {
+  name: string;
+  balance: number;
+  creditLimit: number;
+  tenantId: string;
+}
+interface Order {
+  total: number;
+  account: mongoose.Types.ObjectId | null; // stays a persisted ref, not an Account
+}
+interface OrderVirtuals {
+  canPlaceOrder: boolean;
+}
+
+async function runPrivatePopulateExample() {
+  const connection = await mongoose
+    .createConnection(process.env.MONGODB_URL ?? 'mongodb://127.0.0.1:27017', {
+      dbName: `private_populate_example_${randomUUID().replaceAll('-', '')}`,
+    })
+    .asPromise();
+  let server: Server | undefined;
+  try {
+    const api = createAccessRuntime();
+    api.setGlobalOptions({ globalPermissions: () => [] });
+    const AccountModel = connection.model<Account>(
+      'PrivateExampleAccount',
+      new mongoose.Schema<Account>({
+        name: String,
+        balance: { type: Number, select: false },
+        creditLimit: Number,
+        tenantId: String,
+      }),
+    );
+    // Both the actual model instance and its options must exist in this runtime first.
+    const accounts = api.createRouter(AccountModel, {
+      operationAccess: { read: true },
+      baseFilter: { read: () => ({ tenantId: 'shop-a' }) },
+      permissionSchema: { name: true, balance: false, creditLimit: false },
+      stripPermissionsField: true,
+    });
+    const OrderModel = connection.model<Order>(
+      'PrivateExampleOrder',
+      new mongoose.Schema<Order>({
+        total: Number,
+        account: { type: mongoose.Schema.Types.ObjectId, ref: AccountModel.modelName },
+      }),
+    );
+    // Explicit target map: an ObjectId alone cannot infer its related model.
+    const canPlaceOrder: ModelVirtualDescriptor<Order, boolean, { account: Account }> = {
+      dependsOn: ['total'],
+      dependsOnPopulate: [{ path: 'account', select: ['balance', 'creditLimit'] }],
+      get(doc, _permissions, _context, populated = {}) {
+        const account = populated.account;
+        if (doc.total === undefined || account?.balance === undefined || account.creditLimit === undefined)
+          return undefined;
+        return doc.total <= account.balance + account.creditLimit;
+      },
+    };
+    const orders = api.createRouter<Order, OrderVirtuals>(OrderModel, {
+      basePath: '/orders',
+      operationAccess: { read: true },
+      permissionSchema: { total: false, account: true, canPlaceOrder: true },
+      virtuals: { canPlaceOrder }, // assign the separately typed descriptor normally
+      stripPermissionsField: true,
+    });
+    const account = await AccountModel.create({ name: 'Main', balance: 80, creditLimit: 20, tenantId: 'shop-a' });
+    const order = await OrderModel.create({ total: 90, account: account._id });
+    const app = express();
+    app.use(express.json());
+    app.use(orders.routes);
+    server = app.listen(0, '127.0.0.1');
+    await once(server, 'listening');
+    const address = server.address();
+    assert.ok(address && typeof address !== 'string');
+    const url = `http://127.0.0.1:${address.port}/orders/__query/${order._id}`;
+    async function read(args: object) {
+      const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(args),
+      });
+      assert.equal(response.status, 200);
+      return response.json();
+    }
+    const select = ['account', 'canPlaceOrder', '-_id'];
+    // 1. Public population: fetch name + private inputs, return only the public mask.
+    assert.deepEqual(await read({ select, populate: [{ path: 'account', select: 'name -_id' }] }), {
+      account: { name: 'Main' },
+      canPlaceOrder: true,
+    });
+    // 2. No ordinary population: restore the exact selected/permitted original ID.
+    assert.deepEqual(await read({ select }), { account: String(account._id), canPlaceOrder: true });
+    // 3. Unselected reference: compute privately, omit account entirely.
+    assert.deepEqual(await read({ select: ['canPlaceOrder', '-_id'] }), { canPlaceOrder: true });
+    // Readable-but-unrequested private fields still do not join public output.
+    accounts.setOption('permissionSchema', { name: true, balance: true, creditLimit: true });
+    assert.deepEqual(await read({ select, populate: [{ path: 'account', select: 'name -_id' }] }), {
+      account: { name: 'Main' },
+      canPlaceOrder: true,
+    });
+    // Denying the source field also leaves only the authorized virtual result.
+    orders.permissionSchema('account', false);
+    assert.deepEqual(await read({ select }), { canPlaceOrder: true });
+    // Default true: input-field authority does not bypass the target's base read operation.
+    accounts.setOption('operationAccess.read', false);
+    assert.deepEqual(await read({ select: ['canPlaceOrder', '-_id'] }), {});
+    // Select and permit the source ref: denied target read removes even its ID.
+    orders.permissionSchema('account', true);
+    assert.deepEqual(await read({ select }), {});
+    api.setGlobalOptions({ requireReadOperationAccessForPopulateDependencies: false });
+    assert.deepEqual(await read({ select }), { canPlaceOrder: true });
+    // An ordinary list-populate grant cannot override the additional base-read visibility gate.
+    accounts.setOption('operationAccess.list', true);
+    assert.deepEqual(await read({ select, populate: [{ path: 'account', select: 'name -_id', access: 'list' }] }), {
+      canPlaceOrder: true,
+    });
+    // Strict control: denied target read now prevents private computation too.
+    api.setGlobalOption('requireReadOperationAccessForPopulateDependencies', true);
+    assert.deepEqual(await read({ select }), {});
+    // Allowed-target controls in BOTH modes: original public mask or exact original ID.
+    accounts.setOption('operationAccess.read', true);
+    for (const strict of [true, false]) {
+      api.setGlobalOption('requireReadOperationAccessForPopulateDependencies', strict);
+      assert.deepEqual(await read({ select, populate: [{ path: 'account', select: 'name -_id' }] }), {
+        account: { name: 'Main' },
+        canPlaceOrder: true,
+      });
+      assert.deepEqual(await read({ select }), { account: String(account._id), canPlaceOrder: true });
+    }
+  } finally {
+    if (server)
+      await new Promise<void>((resolve, reject) => server!.close((error) => (error ? reject(error) : resolve())));
+    await connection.dropDatabase();
+    await connection.close();
+  }
+}
+runPrivatePopulateExample().catch((error: unknown) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+```
+
+#### Typing and isolated getter inputs
+
+`ModelVirtualGetter`, `ModelVirtualDescriptor`, `ModelVirtualAccessRecord` and
+`ModelVirtualLeaf` accept a third generic `TPopulated`, defaulting to an empty
+shape. `ModelVirtualPopulateInputs<Source, { account: Account }>` is the fourth
+argument's type. Known source keys are checked, scalar/array cardinality follows
+the persisted source field, and unknown cardinality allows both. No target shape
+is guessed without an annotation; the annotation grants no runtime authority.
+Neither persisted/write models nor public selected-output models are widened.
+
+Each mapped key is optional. A scalar is a deeply partial/readonly target or null;
+an array is a readonly array of partial targets/null slots, or null. Guard missing
+fields. Native Date/Buffer/BSON scalar types remain native; mutable methods still
+exist, but every getter, row and repeated array slot receives an isolated copy.
+The runtime always supplies argument four (`{}` without a declaration). Its type
+is optional to preserve existing three-argument callbacks **and direct calls**;
+use `populated = {}` or guard undefined in typed getters.
+
+Argument one remains the ordinary persisted/local-dependency/finalized-public-related
+view for every getter. Automatically fetched private-only refs are not added there;
+an existing local `dependsOn` on that ref keeps its ordinary behavior. Each getter
+sees only its own resolved declarations and target selections in argument four.
+Private maps/raw targets are not implicitly attached to response DTOs, contexts,
+lifecycle snapshots, public permission hooks/metadata, document handles, or ordinary
+decorate/decorateAll/task inputs. **Only an authorized getter's deliberate return
+becomes computed output**; this is not a prohibition on returning derived values.
+
+#### Target authority, selection and reconstruction
+
+Private targets use captured base **`read`** row semantics, including array refs,
+source lists, writes and templates. The original actor's `operationAccess.read` gates
+private loading in default/true mode; false bypasses only that admission. In either
+mode, `overrideFilter.read` (starting with `{}`) and `baseFilter.read` use request row
+authority with their normal exact → default → bare fallback/cache rules (including
+runtime defaults). Mandatory source IDs are ANDed afterward, preserving tenant scope.
+There is no private read-to-list fallback or route-variant gate. `authorization.related` governs only an ordinary
+requested populate/include; its grants/replacement rows, public `match`, `access`
+and `select` cannot redefine private inputs. A related policy naming only a
+dependency-only path is unused/invalid.
+
+Only selected, applicable, not-definitely-denied virtuals add dependency work;
+document-dependent authorization may defer until after fetching. Compatible public
+and private reads share a positive persisted **fetch union**, including internal
+identity/hook/join requirements. Their original authorization/output masks stay
+separate and immutable. Even a readable private field is omitted unless originally
+selected and permitted. Public exclusions and `-_id` remain effective. Different
+public match/access/row scopes require independent queries.
+
+**Independent reference visibility, in both modes:** for paths in an **active selected/
+applicable `dependsOnPopulate` plan**, the captured target base **read** rule and original
+actor/permissions decide visibility separately from private fetch availability. It uses
+the same exact/default/bare/runtime-default semantics, not a route variant or an ordinary
+populate list/custom rule. A public `authorization.related` operation grant cannot
+override it. Strict private admission is reused for this decision; false mode evaluates
+the output-only check only after source selection/field authorization makes output eligible.
+
+| Source field / captured caller target base read / original query                       | Returned dependency-backed reference in either mode                         |
+| -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| Source unselected, excluded or denied                                                  | Omitted entirely                                                            |
+| Source selected/permitted, target read denied or check failed                          | Omitted entirely, **including its ID**, with or without ordinary population |
+| Source selected/permitted, target read allowed, ordinary population requested/admitted | Original requested and authorized populated projection                      |
+| Source selected/permitted, target read allowed, no ordinary population                 | Exact original ID/array of IDs                                              |
+
+The original query includes resolved server defaults. A default populate is ordinary
+population; explicit `populate: []` suppresses it. Allowed ordinary population retains
+its original target projection, match/missing/null/array behavior. Without admitted
+ordinary population, read-allowed refs restore exact pre-populate IDs/arrays, including
+missing target IDs, order, duplicates, nulls, empty arrays and own absence. Denied/failed
+target-read visibility always takes precedence over ID restoration, including after
+private row denial/query failure or getter omission/failure/deferred authorization denial.
+Cleanup runs before output copying/handles and presentation hooks/tasks. **No active
+dependency plan means ordinary reference/populate behavior is unchanged**; this is not
+a new gate on every reference in a model with virtuals.
+
+#### Supported declarations and validation
+
+- Entries accept **only `{ path, select? }`**: no shorthand string, model, match,
+  access, populate or arbitrary Mongoose options. Duplicate paths within a resolved
+  declaration reject. Different virtuals may declare the same path.
+- `path` is a top-level, scope-local ObjectId scalar or one-dimensional ObjectId
+  ref array with a static string ref to an actual same-connection, same-runtime,
+  registered ObjectId-identity model. Embedded object/nested/document-array virtuals
+  use their `.sub` scope (declare `account`, not `contacts.account`). Dotted source
+  paths, Map/Mixed/dynamic refs, refPath, function/model-valued refs, virtual populate,
+  discriminator-varying source scopes or discriminator targets, cross-connection
+  targets, non-ObjectId IDs and multidimensional ref arrays reject explicitly.
+- Target `select` accepts comma/space strings, string arrays, or **1/-1** objects
+  (not Mongo's 1/0). Omitted/undefined/effectively empty (`''`, `[]`, `{}`) means all
+  eligible static persisted fields. Exclusion-only subtracts from that universe;
+  positive paths select eligible descendants, with explicit negatives winning.
+  `_id` is included unless `-_id` (or `{ _id: -1 }`) is declared; association identity
+  is still privately fetched. For example `{ balance: 1, _id: -1 }` supplies only balance.
+- Static embedded/dotted target fields work. Containers expand to eligible stored
+  leaves; stored target refs remain IDs only. Explicit target virtuals/aliases,
+  unknown/unsafe/control/metadata/version paths, dynamic Map/Mixed paths, ref
+  traversal, `+` tokens, non-string array entries and invalid object values reject,
+  including invalid exclusions. No recursive target virtual computation/private
+  population occurs. Target `requireExplicitSelect` and service defaults do not
+  replace the declaration's selection.
+- Shared per-access `dependsOnPopulate` inherits independently of `dependsOn`:
+  exact access getter → default getter; a bare getter inherits its shared lists.
+  A leaf's defined list replaces the shared list wholesale, `[]` clears it,
+  undefined inherits, and null rejects. Descriptor arrays/masks and target policies
+  are captured with the getter before asynchronous work; later calls see updates.
+- Validation is eager and atomic for constructors, bulk and dotted setters. Target
+  model instances **and options must be registered first**, even with
+  `requireRegisteredPopulateModels: false`. For mutually referencing models, register
+  both options before assigning virtuals; self-refs use the proposed source options.
+  Operation capture rechecks schema/target/metadata binding before hooks or writes.
+
+#### Absence, errors, lifecycle and measured work
+
+Absent/undefined source refs omit the virtual without invoking it. Present null and
+empty arrays invoke the getter with null/[] without a target query when private
+admission/row policy permits. Deleted/out-of-scope target rows become scalar null or null array slots;
+private arrays preserve original order, duplicates and null/missing slots. Missing
+target fields remain partial inputs; null/false/zero/empty-string stay present and
+the getter decides what to return.
+
+In true mode, target read denial makes dependencies unavailable; in either mode,
+a terminal false `overrideFilter.read`/`baseFilter.read` does so. Affected virtuals
+are omitted even for null/empty source refs. In false mode, a denied/failed output-only
+read check hides the ref without removing otherwise available private computation. A
+dependency-only query/hook/cast failure also omits them with structural-only logging.
+There is no raw fallback, retry or new retryable write error: a successful write
+stays successful. A failed query that also serves ordinary public population keeps
+that ordinary error path. Getter undefined/throw omits fail-closed; invalid server
+configuration is a preflight error, not an unavailable input.
+
+Support covers direct/root/trusted reads, create/update/both upsert branches, `new`,
+ordinary populated and legacy/correlated included targets, embedded scopes, and
+visible dedicated subdocument list/read/create/update/bulkUpdate outputs. Count,
+distinct, exists, delete identities, include-count and field helpers add no private
+dependency I/O/getters. `SubPopulate` remains path/select-only. Writes capture
+post-save/post-afterPersist refs on detached output copies after lifecycle work;
+hidden mutation rows do not run getters. `new` still ignores `args.select`, uses
+create access, and loads present default refs under the captured private-read mode and
+request read-row scope without saving.
+
+Private fetches use the receiving output's captured hydration: source read mode for
+direct reads/populate, fixed lean for include targets, hydrated for dedicated child
+read/list and ordinary writes/templates, fixed lean for child mutation visibility.
+Restoration is exact relative to that pre-populate materialized value, not raw BSON
+parity across modes. Defaults/getters/transforms/init hooks and dotted projection's
+omitted null containers can differ; see the [hydration caveat](#breaking-release-server-owned-hydration).
+
+Measured batching: with two compatible target groups, **1 and 24 source rows both
+issued 1 parent find + 2 target finds**, in lean and hydrated modes. Getter counts
+were 4 and 96; observed persistence/getter peaks were 1/1 or 2/2 at matching limits.
+Compatible rows/virtuals/scopes batch and deduplicate fetched IDs, not reconstructed
+slots or public authorization. Covered raw work can be reused only within its
+captured request/runtime/family/private-read mode, hydration and ID/projection coverage. Different scopes
+still query separately; ordinary per-parent correlated public queries remain
+per-parent. This is not a constant-query-count promise for independent includes.
+
+**Compatibility:** existing bare/descriptor/per-access getters and local `dependsOn`
+keep their first-argument and three-argument direct-call contract. Opt in by adding
+the declaration and a separately typed descriptor/default fourth argument; no new
+router-wide generic, entrypoint, client API or persisted-field migration is required.
+The declaration's opt-in constraints are eager target registration and strict static
+reference/target-selection validation; ordinary public populate grammar is unchanged.
+
+#### Release compatibility: dependency-reference omission
+
+This release intentionally tightens the earlier private-dependency **D1** contract:
+for active dependency-backed refs, denied/failed caller target base read now removes
+the **entire field, including IDs**, even in default/true mode. Earlier denied ordinary
+population could leave IDs behind; that fallback is superseded in this scope, even
+without an ordinary populate descriptor and even with public list/custom access or a
+trusted related-operation grant. No active plan/no feature retains ordinary behavior.
+
+Consumers must handle absent dependency-backed refs rather than assuming a denied
+population leaves an ID. Keep the default true for strict private admission, or set
+false explicitly when the authorized virtual is intended to compute despite target
+operation denial. False does **not** restore denied IDs or relax row filters. To return
+references, independently permit the source field and caller-context target base read;
+ordinary population still applies its original requested/authorized mask. Existing local
+views, fourth-argument isolation, registration, static-ref and hydration limitations remain.
 
 ### Hook admission and reentrant service calls
 

package/advanced.d.mts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualRecordAccess, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, bc as PERMISSIONS, bd as PERMISSION_KEYS, be as PairedRouteAccess, bf as ParentRef, bg as PathValue, bh as PermissionSchema, bi as Populate, bj as PopulateAccess, bk as PopulatePlanningOptions, bl as PrepareAccess, bm as Projection, bn as PublicCreateArgs, bo as PublicCreateOptions, bp as PublicErrorResult, bq as PublicListArgs, br as PublicListOptions, bs as PublicListResult, bt as PublicOutput, bu as PublicReadArgs, bv as PublicReadOptions, bw as PublicServiceResult, bx as PublicSingleResult, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bC as PublicUpdateArgs, bD as PublicUpdateOptions, bE as PublicUpsertArgs, bF as PublicUpsertOptions, bG as ReadQueryInput, bH as RelatedAuthorization, bI as Request, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, bR as RequestSchemas, bS as RootDataListQueryEntry, bT as RootDataOperation, bU as RootDataReadByFilterQueryEntry, bV as RootDataReadByIdQueryEntry, bW as RootModelCountQueryEntry, bX as RootModelCreateQueryEntry, bY as RootModelDeleteQueryEntry, bZ as RootModelDistinctQueryEntry, b_ as RootModelListQueryEntry, b$ as RootModelNewQueryEntry, c0 as RootModelOperation, c1 as RootModelReadByFilterQueryEntry, c2 as RootModelReadByIdQueryEntry, c3 as RootModelSubBulkUpdateQueryEntry, c4 as RootModelSubCreateQueryEntry, c5 as RootModelSubDeleteQueryEntry, c6 as RootModelSubListQueryEntry, c7 as RootModelSubReadQueryEntry, c8 as RootModelSubUpdateQueryEntry, c9 as RootModelUpdateQueryEntry, ca as RootModelUpsertQueryEntry, cb as RootOperationResult, cc as RootQueryEntry, cd as RootRouterOptions, ce as RootSubOperation, cf as RootTarget, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, cl as SelectAccess, cm as SelectedPopulatedPublicOutput, cn as SelectedPublicOutput, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cr as ServiceResult, cs as SingleResult, ct as Sort, cu as SortOrder, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cC as StatusCodes, cD as SubListBody, cE as SubOperationAccess, cF as SubPopulate, cG as SubQueryEntry, cH as SubReadBody, cI as SubRouteGuardOptions, cJ as SubdocumentBulkRecord, cK as SubdocumentBulkUpdateInput, cL as SubdocumentCreateAuthorization, cM as SubdocumentCreateInput, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cS as SubdocumentId, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, cZ as SubdocumentParentArgs, c_ as SubdocumentParentOptions, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d1 as SubdocumentRecord, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, d7 as Task, d8 as TaskType, d9 as TransformAccess, da as TypedFilter, db as UpdateByIdArgs, dc as UpdateByIdOptions, dd as UpdateOneArgs, de as UpdateOneOptions, df as UpdateQueryInput, dg as UpsertArgs, dh as UpsertOptions, di as UpsertQueryInput, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, dn as ValidateAccess, dp as ValidateRule, dq as Validation, dr as ValidationError, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod, dK as parseBody, dL as parseBodyWithSchema, dM as parseNestedBodyWithSchema, dN as parsePathParam, dO as parseQuery } from './parsers-ZSrF7SNu.mjs';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualPopulateDependency, b2 as ModelVirtualPopulateInputs, b3 as ModelVirtualRecordAccess, b4 as ModelVirtuals, b5 as MutationAuthorization, b6 as NewArgs, b7 as NewOptions, b8 as OperationAccess, b9 as OperationAuthorization, ba as OutputAuthorization, bb as OutputFieldOptions, bc as OutputFieldPath, bd as OutputPlanningOptions, be as PERMISSIONS, bf as PERMISSION_KEYS, bg as PairedRouteAccess, bh as ParentRef, bi as PathValue, bj as PermissionSchema, bk as Populate, bl as PopulateAccess, bm as PopulatePlanningOptions, bn as PrepareAccess, bo as Projection, bp as PublicCreateArgs, bq as PublicCreateOptions, br as PublicErrorResult, bs as PublicListArgs, bt as PublicListOptions, bu as PublicListResult, bv as PublicOutput, bw as PublicReadArgs, bx as PublicReadOptions, by as PublicServiceResult, bz as PublicSingleResult, bA as PublicSubdocumentCreateOptions, bB as PublicSubdocumentListOptions, bC as PublicSubdocumentMutationOptions, bD as PublicSubdocumentReadOptions, bE as PublicUpdateArgs, bF as PublicUpdateOptions, bG as PublicUpsertArgs, bH as PublicUpsertOptions, bI as ReadQueryInput, bJ as RelatedAuthorization, bK as Request, bL as RequestSchemaAdapter, bM as RequestSchemaFailure, bN as RequestSchemaIssue, bO as RequestSchemaLike, bP as RequestSchemaOptions, bQ as RequestSchemaResult, bR as RequestSchemaSuccess, bS as RequestSchemaValidator, bT as RequestSchemas, bU as RootDataListQueryEntry, bV as RootDataOperation, bW as RootDataReadByFilterQueryEntry, bX as RootDataReadByIdQueryEntry, bY as RootModelCountQueryEntry, bZ as RootModelCreateQueryEntry, b_ as RootModelDeleteQueryEntry, b$ as RootModelDistinctQueryEntry, c0 as RootModelListQueryEntry, c1 as RootModelNewQueryEntry, c2 as RootModelOperation, c3 as RootModelReadByFilterQueryEntry, c4 as RootModelReadByIdQueryEntry, c5 as RootModelSubBulkUpdateQueryEntry, c6 as RootModelSubCreateQueryEntry, c7 as RootModelSubDeleteQueryEntry, c8 as RootModelSubListQueryEntry, c9 as RootModelSubReadQueryEntry, ca as RootModelSubUpdateQueryEntry, cb as RootModelUpdateQueryEntry, cc as RootModelUpsertQueryEntry, cd as RootOperationResult, ce as RootQueryEntry, cf as RootRouterOptions, cg as RootSubOperation, ch as RootTarget, ci as RouteBaseAccess, cj as RouteGuardAccess, ck as RouteVariant, cl as RouteVariantAccess, cm as RowAuthorization, cn as SelectAccess, co as SelectedPopulatedPublicOutput, cp as SelectedPublicOutput, cq as ServiceAuthorization, cr as ServiceOutputContext, cs as ServiceOutputDecorator, ct as ServiceResult, cu as SingleResult, cv as Sort, cw as SortOrder, cx as StandardSchemaFailure, cy as StandardSchemaInferOutput, cz as StandardSchemaIssue, cA as StandardSchemaPathSegment, cB as StandardSchemaResult, cC as StandardSchemaSuccess, cD as StandardSchemaV1, cE as StatusCodes, cF as SubListBody, cG as SubOperationAccess, cH as SubPopulate, cI as SubQueryEntry, cJ as SubReadBody, cK as SubRouteGuardOptions, cL as SubdocumentBulkRecord, cM as SubdocumentBulkUpdateInput, cN as SubdocumentCreateAuthorization, cO as SubdocumentCreateInput, cP as SubdocumentCreateOptions, cQ as SubdocumentCreateVisibilityAuthorization, cR as SubdocumentDeleteAuthorization, cS as SubdocumentDeleteOptions, cT as SubdocumentGateAuthorization, cU as SubdocumentId, cV as SubdocumentInputAuthorization, cW as SubdocumentListOptions, cX as SubdocumentModel, cY as SubdocumentMutationAuthorization, cZ as SubdocumentName, c_ as SubdocumentOutputAuthorization, c$ as SubdocumentParentArgs, d0 as SubdocumentParentOptions, d1 as SubdocumentReadAuthorization, d2 as SubdocumentReadOptions, d3 as SubdocumentRecord, d4 as SubdocumentUpdateOptions, d5 as SubdocumentVirtuals, d6 as SubdocumentVisibilityAuthorization, d7 as SuperstructFailureLike, d8 as SuperstructValidateLike, d9 as Task, da as TaskType, db as TransformAccess, dc as TypedFilter, dd as UpdateByIdArgs, de as UpdateByIdOptions, df as UpdateOneArgs, dg as UpdateOneOptions, dh as UpdateQueryInput, di as UpsertArgs, dj as UpsertOptions, dk as UpsertQueryInput, dl as ValibotIssueLike, dm as ValibotPathItemLike, dn as ValibotSafeParseLike, dp as ValibotSafeParseResult, dq as ValidateAccess, dr as ValidateRule, ds as Validation, dt as ValidationError, du as VineValidationErrorLike, dv as VineValidationMessageLike, dw as VineValidatorLike, dx as VirtualSubModel, dy as WithVirtuals, dz as YupSchemaLike, dA as YupValidationErrorLike, dB as defineRequestSchema, dC as fromAjv, dD as fromArkType, dE as fromIoTs, dF as fromJoi, dG as fromStandardSchema, dH as fromSuperstruct, dI as fromValibot, dJ as fromVine, dK as fromYup, dL as fromZod, dM as parseBody, dN as parseBodyWithSchema, dO as parseNestedBodyWithSchema, dP as parsePathParam, dQ as parseQuery } from './parsers-BXKoUKMa.mjs';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualRecordAccess, b2 as ModelVirtuals, b3 as MutationAuthorization, b4 as NewArgs, b5 as NewOptions, b6 as OperationAccess, b7 as OperationAuthorization, b8 as OutputAuthorization, b9 as OutputFieldOptions, ba as OutputFieldPath, bb as OutputPlanningOptions, bc as PERMISSIONS, bd as PERMISSION_KEYS, be as PairedRouteAccess, bf as ParentRef, bg as PathValue, bh as PermissionSchema, bi as Populate, bj as PopulateAccess, bk as PopulatePlanningOptions, bl as PrepareAccess, bm as Projection, bn as PublicCreateArgs, bo as PublicCreateOptions, bp as PublicErrorResult, bq as PublicListArgs, br as PublicListOptions, bs as PublicListResult, bt as PublicOutput, bu as PublicReadArgs, bv as PublicReadOptions, bw as PublicServiceResult, bx as PublicSingleResult, by as PublicSubdocumentCreateOptions, bz as PublicSubdocumentListOptions, bA as PublicSubdocumentMutationOptions, bB as PublicSubdocumentReadOptions, bC as PublicUpdateArgs, bD as PublicUpdateOptions, bE as PublicUpsertArgs, bF as PublicUpsertOptions, bG as ReadQueryInput, bH as RelatedAuthorization, bI as Request, bJ as RequestSchemaAdapter, bK as RequestSchemaFailure, bL as RequestSchemaIssue, bM as RequestSchemaLike, bN as RequestSchemaOptions, bO as RequestSchemaResult, bP as RequestSchemaSuccess, bQ as RequestSchemaValidator, bR as RequestSchemas, bS as RootDataListQueryEntry, bT as RootDataOperation, bU as RootDataReadByFilterQueryEntry, bV as RootDataReadByIdQueryEntry, bW as RootModelCountQueryEntry, bX as RootModelCreateQueryEntry, bY as RootModelDeleteQueryEntry, bZ as RootModelDistinctQueryEntry, b_ as RootModelListQueryEntry, b$ as RootModelNewQueryEntry, c0 as RootModelOperation, c1 as RootModelReadByFilterQueryEntry, c2 as RootModelReadByIdQueryEntry, c3 as RootModelSubBulkUpdateQueryEntry, c4 as RootModelSubCreateQueryEntry, c5 as RootModelSubDeleteQueryEntry, c6 as RootModelSubListQueryEntry, c7 as RootModelSubReadQueryEntry, c8 as RootModelSubUpdateQueryEntry, c9 as RootModelUpdateQueryEntry, ca as RootModelUpsertQueryEntry, cb as RootOperationResult, cc as RootQueryEntry, cd as RootRouterOptions, ce as RootSubOperation, cf as RootTarget, cg as RouteBaseAccess, ch as RouteGuardAccess, ci as RouteVariant, cj as RouteVariantAccess, ck as RowAuthorization, cl as SelectAccess, cm as SelectedPopulatedPublicOutput, cn as SelectedPublicOutput, co as ServiceAuthorization, cp as ServiceOutputContext, cq as ServiceOutputDecorator, cr as ServiceResult, cs as SingleResult, ct as Sort, cu as SortOrder, cv as StandardSchemaFailure, cw as StandardSchemaInferOutput, cx as StandardSchemaIssue, cy as StandardSchemaPathSegment, cz as StandardSchemaResult, cA as StandardSchemaSuccess, cB as StandardSchemaV1, cC as StatusCodes, cD as SubListBody, cE as SubOperationAccess, cF as SubPopulate, cG as SubQueryEntry, cH as SubReadBody, cI as SubRouteGuardOptions, cJ as SubdocumentBulkRecord, cK as SubdocumentBulkUpdateInput, cL as SubdocumentCreateAuthorization, cM as SubdocumentCreateInput, cN as SubdocumentCreateOptions, cO as SubdocumentCreateVisibilityAuthorization, cP as SubdocumentDeleteAuthorization, cQ as SubdocumentDeleteOptions, cR as SubdocumentGateAuthorization, cS as SubdocumentId, cT as SubdocumentInputAuthorization, cU as SubdocumentListOptions, cV as SubdocumentModel, cW as SubdocumentMutationAuthorization, cX as SubdocumentName, cY as SubdocumentOutputAuthorization, cZ as SubdocumentParentArgs, c_ as SubdocumentParentOptions, c$ as SubdocumentReadAuthorization, d0 as SubdocumentReadOptions, d1 as SubdocumentRecord, d2 as SubdocumentUpdateOptions, d3 as SubdocumentVirtuals, d4 as SubdocumentVisibilityAuthorization, d5 as SuperstructFailureLike, d6 as SuperstructValidateLike, d7 as Task, d8 as TaskType, d9 as TransformAccess, da as TypedFilter, db as UpdateByIdArgs, dc as UpdateByIdOptions, dd as UpdateOneArgs, de as UpdateOneOptions, df as UpdateQueryInput, dg as UpsertArgs, dh as UpsertOptions, di as UpsertQueryInput, dj as ValibotIssueLike, dk as ValibotPathItemLike, dl as ValibotSafeParseLike, dm as ValibotSafeParseResult, dn as ValidateAccess, dp as ValidateRule, dq as Validation, dr as ValidationError, ds as VineValidationErrorLike, dt as VineValidationMessageLike, du as VineValidatorLike, dv as VirtualSubModel, dw as WithVirtuals, dx as YupSchemaLike, dy as YupValidationErrorLike, dz as defineRequestSchema, dA as fromAjv, dB as fromArkType, dC as fromIoTs, dD as fromJoi, dE as fromStandardSchema, dF as fromSuperstruct, dG as fromValibot, dH as fromVine, dI as fromYup, dJ as fromZod, dK as parseBody, dL as parseBodyWithSchema, dM as parseNestedBodyWithSchema, dN as parsePathParam, dO as parseQuery } from './parsers-ZSrF7SNu.js';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, r as ArkTypeProblemLike, s as AuthorizedListResult, t as AuthorizedSingleResult, B as BaseFilterAccess, C as Change, u as Codes, v as CorrelatedCountInclude, w as CorrelatedFilter, x as CorrelatedInclude, y as CorrelatedIncludeArgs, z as CorrelatedListInclude, D as CorrelatedReadByFilterInclude, E as CorrelatedReadByIdInclude, F as CountBody, G as CreateArgs, H as CreateAuthorization, I as CreateOptions, J as CreateQueryInput, K as CustomHeaders, L as DATA_MIDDLEWARE, M as DataBaseFilterHook, N as DataFieldOptions, O as DataFilter, P as DataFindArgs, Q as DataFindOneArgs, R as DataFindOneOptions, S as DataFindOptions, T as DataHook, U as DataHookContext, V as DataIdentifierHook, W as DataListHook, X as DataOverrideFilterHook, Y as DataRequest, Z as DataRequestSchemas, _ as DataRouterOptions, $ as DecorateAccess, a0 as DecorateAllAccess, a1 as DeepFieldPath, a2 as DefaultModelRouterOptions, a3 as Defaults, a4 as DistinctArgs, a5 as DistinctBody, a6 as DocPermissionsAccess, a7 as DocumentAuthorization, a8 as ErrorResult, a9 as ExistsOptions, aa as ExtendedDataRouterOptions, ab as ExtendedDefaultModelRouterOptions, ac as ExtendedModelRouterOptions, ad as FieldAuthorization, ae as FieldOperationAccess, af as Filter, ag as FilterOperator, ah as FindAccess, ai as FindArgs, aj as FindByIdArgs, ak as FindByIdOptions, al as FindOneArgs, am as FindOneOptions, an as FindOptions, ao as GlobalOptions, ap as GlobalPermissionValue, aq as GuardHook, ar as HydrationMode, as as IdentifierHook, at as Include, au as InputFieldAuthorization, av as InputFieldPath, aw as IoTsContextEntryLike, ax as IoTsDecodeErrorLike, ay as IoTsDecoderLike, az as JoiSchemaLike, aA as JoiValidationErrorDetailLike, aB as KeyValueProjection, aC as LegacyInclude, aD as ListQueryInput, aE as ListResult, aF as MIDDLEWARE, aG as MaybePromise, aH as ModelBaseFilterHook, aI as ModelChangeHook, aJ as ModelDeleteHook, aK as ModelDocPermissionsHook, aL as ModelDocument, aM as ModelDocumentHook, aN as ModelHook, aO as ModelHookContext, aP as ModelHydrationOptions, aQ as ModelIdentifierHook, aR as ModelListHook, aS as ModelOverrideFilterHook, aT as ModelRequest, aU as ModelRouterOptions, aV as ModelValidateHook, aW as ModelVirtualAccess, aX as ModelVirtualAccessRecord, aY as ModelVirtualContext, aZ as ModelVirtualDescriptor, a_ as ModelVirtualDoc, a$ as ModelVirtualGetter, b0 as ModelVirtualLeaf, b1 as ModelVirtualPopulateDependency, b2 as ModelVirtualPopulateInputs, b3 as ModelVirtualRecordAccess, b4 as ModelVirtuals, b5 as MutationAuthorization, b6 as NewArgs, b7 as NewOptions, b8 as OperationAccess, b9 as OperationAuthorization, ba as OutputAuthorization, bb as OutputFieldOptions, bc as OutputFieldPath, bd as OutputPlanningOptions, be as PERMISSIONS, bf as PERMISSION_KEYS, bg as PairedRouteAccess, bh as ParentRef, bi as PathValue, bj as PermissionSchema, bk as Populate, bl as PopulateAccess, bm as PopulatePlanningOptions, bn as PrepareAccess, bo as Projection, bp as PublicCreateArgs, bq as PublicCreateOptions, br as PublicErrorResult, bs as PublicListArgs, bt as PublicListOptions, bu as PublicListResult, bv as PublicOutput, bw as PublicReadArgs, bx as PublicReadOptions, by as PublicServiceResult, bz as PublicSingleResult, bA as PublicSubdocumentCreateOptions, bB as PublicSubdocumentListOptions, bC as PublicSubdocumentMutationOptions, bD as PublicSubdocumentReadOptions, bE as PublicUpdateArgs, bF as PublicUpdateOptions, bG as PublicUpsertArgs, bH as PublicUpsertOptions, bI as ReadQueryInput, bJ as RelatedAuthorization, bK as Request, bL as RequestSchemaAdapter, bM as RequestSchemaFailure, bN as RequestSchemaIssue, bO as RequestSchemaLike, bP as RequestSchemaOptions, bQ as RequestSchemaResult, bR as RequestSchemaSuccess, bS as RequestSchemaValidator, bT as RequestSchemas, bU as RootDataListQueryEntry, bV as RootDataOperation, bW as RootDataReadByFilterQueryEntry, bX as RootDataReadByIdQueryEntry, bY as RootModelCountQueryEntry, bZ as RootModelCreateQueryEntry, b_ as RootModelDeleteQueryEntry, b$ as RootModelDistinctQueryEntry, c0 as RootModelListQueryEntry, c1 as RootModelNewQueryEntry, c2 as RootModelOperation, c3 as RootModelReadByFilterQueryEntry, c4 as RootModelReadByIdQueryEntry, c5 as RootModelSubBulkUpdateQueryEntry, c6 as RootModelSubCreateQueryEntry, c7 as RootModelSubDeleteQueryEntry, c8 as RootModelSubListQueryEntry, c9 as RootModelSubReadQueryEntry, ca as RootModelSubUpdateQueryEntry, cb as RootModelUpdateQueryEntry, cc as RootModelUpsertQueryEntry, cd as RootOperationResult, ce as RootQueryEntry, cf as RootRouterOptions, cg as RootSubOperation, ch as RootTarget, ci as RouteBaseAccess, cj as RouteGuardAccess, ck as RouteVariant, cl as RouteVariantAccess, cm as RowAuthorization, cn as SelectAccess, co as SelectedPopulatedPublicOutput, cp as SelectedPublicOutput, cq as ServiceAuthorization, cr as ServiceOutputContext, cs as ServiceOutputDecorator, ct as ServiceResult, cu as SingleResult, cv as Sort, cw as SortOrder, cx as StandardSchemaFailure, cy as StandardSchemaInferOutput, cz as StandardSchemaIssue, cA as StandardSchemaPathSegment, cB as StandardSchemaResult, cC as StandardSchemaSuccess, cD as StandardSchemaV1, cE as StatusCodes, cF as SubListBody, cG as SubOperationAccess, cH as SubPopulate, cI as SubQueryEntry, cJ as SubReadBody, cK as SubRouteGuardOptions, cL as SubdocumentBulkRecord, cM as SubdocumentBulkUpdateInput, cN as SubdocumentCreateAuthorization, cO as SubdocumentCreateInput, cP as SubdocumentCreateOptions, cQ as SubdocumentCreateVisibilityAuthorization, cR as SubdocumentDeleteAuthorization, cS as SubdocumentDeleteOptions, cT as SubdocumentGateAuthorization, cU as SubdocumentId, cV as SubdocumentInputAuthorization, cW as SubdocumentListOptions, cX as SubdocumentModel, cY as SubdocumentMutationAuthorization, cZ as SubdocumentName, c_ as SubdocumentOutputAuthorization, c$ as SubdocumentParentArgs, d0 as SubdocumentParentOptions, d1 as SubdocumentReadAuthorization, d2 as SubdocumentReadOptions, d3 as SubdocumentRecord, d4 as SubdocumentUpdateOptions, d5 as SubdocumentVirtuals, d6 as SubdocumentVisibilityAuthorization, d7 as SuperstructFailureLike, d8 as SuperstructValidateLike, d9 as Task, da as TaskType, db as TransformAccess, dc as TypedFilter, dd as UpdateByIdArgs, de as UpdateByIdOptions, df as UpdateOneArgs, dg as UpdateOneOptions, dh as UpdateQueryInput, di as UpsertArgs, dj as UpsertOptions, dk as UpsertQueryInput, dl as ValibotIssueLike, dm as ValibotPathItemLike, dn as ValibotSafeParseLike, dp as ValibotSafeParseResult, dq as ValidateAccess, dr as ValidateRule, ds as Validation, dt as ValidationError, du as VineValidationErrorLike, dv as VineValidationMessageLike, dw as VineValidatorLike, dx as VirtualSubModel, dy as WithVirtuals, dz as YupSchemaLike, dA as YupValidationErrorLike, dB as defineRequestSchema, dC as fromAjv, dD as fromArkType, dE as fromIoTs, dF as fromJoi, dG as fromStandardSchema, dH as fromSuperstruct, dI as fromValibot, dJ as fromVine, dK as fromYup, dL as fromZod, dM as parseBody, dN as parseBodyWithSchema, dO as parseNestedBodyWithSchema, dP as parsePathParam, dQ as parseQuery } from './parsers-BXKoUKMa.js';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';