@zerotal/flow 1.7.0 → 1.7.3

package/src/observability.ts

@@ -44,8 +44,15 @@ interface DevtoolsSink {
     meta?: string[];
     warn?: string;
     order?: number;
+    hidden?: boolean;
   }): void;
   record(ctx: object, channel: string, entry: Record<string, unknown>): void;
+  /**
+   * Optional because it postdates the sink: a project can pin a devtools older
+   * than this Flow, and an action that goes untraced is a worse panel, not a
+   * crashed one.
+   */
+  finalise?(ctx: object, meta: { startMs: number; durationMs: number; method?: string }): void;
 }
 
 // Framework/asset noise the panel shouldn't chart as realtime traffic.
@@ -134,6 +141,12 @@ export function installFlowObservability(app: Application): () => void {
 
   const trace = _observer<DevtoolsSink>(app, "devtools.trace");
   if (trace) {
+    // Recorded on the trace, but with no tab of its own: Flow's client panel is
+    // the better home for it. A time-travel frame already names the component,
+    // the action and the fields it changed, so a separate tab could only repeat
+    // that beside a duration the trace header already shows — and the frames and
+    // the actions are the same clicks seen from the two ends. The panel reads
+    // these entries off the trace and prints them on the frame they belong to.
     trace.channel({
       id: "flow",
       label: "Flow",
@@ -142,12 +155,18 @@ export function installFlowObservability(app: Application): () => void {
       meta: ["durationMs", "ip"],
       warn: "failed",
       order: 20,
+      hidden: true,
     });
 
     unsubs.push(
       FrameworkEvents.on(FlowActionHandled, (e) => {
         // An action round-trips over the WebSocket against its own HttpContext,
-        // so it buffers against that context and lands on that action's trace.
+        // so it buffers against that context — and then has to finalise that
+        // context itself. Devtools builds traces from core's request lifecycle,
+        // and a WebSocket action fires none of it, so for as long as this call
+        // was missing every action buffered its evidence and dropped it: the Flow
+        // tab reported "no flow activity" for apps whose every interaction is a
+        // Flow action, and the queries those actions ran showed up nowhere.
         if (!e.ctx) return;
         if (IGNORE_PREFIXES.some((p) => _rawPath(e.ctx as object).startsWith(p))) return;
         trace.record(e.ctx as object, "flow", {
@@ -157,6 +176,14 @@ export function installFlowObservability(app: Application): () => void {
           ip: e.ip,
           ...(e.ok ? {} : { failed: true }),
         });
+        // The synthetic request behind an action is a GET of the page the action
+        // ran on, so labelling it `FLOW` is what keeps it from reading as a second
+        // page load in the request list.
+        trace.finalise?.(e.ctx as object, {
+          startMs: Date.now() - e.durationMs,
+          durationMs: e.durationMs,
+          method: "FLOW",
+        });
       }),
     );
   }

package/src/registry.ts

@@ -107,8 +107,12 @@ export { getRenderlessMethods };
 export interface PageClassWithMeta {
   new (): Component;
   name: string;
-  /** Sets the HTML <title> for this page. */
-  title?: string;
+  /**
+   * Sets the HTML `<title>` for this page — a string, or a function of the component
+   * instance. Resolve it with the component's `_resolveTitle()` rather than reading it
+   * directly, so both forms are handled in one place.
+   */
+  title?: string | ((component: never) => string);
   /** Raw HTML to inject into <head> for this page. */
   head?: string;
   /** Optional model associations for auto-registration. */

package/src/router.ts

@@ -9,6 +9,7 @@ import type { PageClassWithMeta } from "./registry.ts";
 import { registerPage } from "./registry.ts";
 import { dehydrate, warnIfLarge } from "./dehydrate.ts";
 import { _renderFlowPage } from "./jsx-runtime.ts";
+import { escapeHtml } from "@zerotal/core/helpers";
 import { populatePresence } from "./presence.ts";
 import { populateShared } from "./shared.ts";
 import { restoreDurable, persistDurable } from "./durable.ts";
@@ -220,7 +221,12 @@ export function _makeFlowHandler(path: string, PageClass: PageClassWithMeta) {
               bodyContent = flowRoot.html;
             }
 
-            const titleTag = PageClass.title ? `<title>${PageClass.title}</title>` : "";
+            // Through the component, not `PageClass.title` directly: `static title` may be a
+            // function of the component, and reading the raw static would render its source.
+            // Escaped because a resolved title can carry state — a search term reaching
+            // `<title>` unescaped is an injection, and the old direct interpolation had none.
+            const resolvedTitle = page._resolveTitle();
+            const titleTag = resolvedTitle ? `<title>${escapeHtml(resolvedTitle)}</title>` : "";
             // Component head takes precedence; layout head provides global resources.
             const headExtra = [PageClass.head ?? "", layoutHead].filter(Boolean).join("\n  ");
 

package/src/synths/CollectionSynth.ts

@@ -5,15 +5,10 @@
 // registered model, so plain arrays fall through to the recursive serializer.
 import type { BaseModel } from "@zerotal/orm";
 import { registerSynth } from "./index.ts";
-import { _modelRegistry, _modelClassToName } from "./ModelSynth.ts";
+import { _isModel, _modelKey, _resolveModel } from "./ModelSynth.ts";
 
 function isModelOf(value: unknown, ctor: typeof BaseModel): boolean {
-  return (
-    typeof value === "object" &&
-    value !== null &&
-    (value as object).constructor === ctor &&
-    typeof (value as Record<string, unknown>)["id"] !== "undefined"
-  );
+  return _isModel(value) && (value as object).constructor === ctor;
 }
 
 registerSynth({
@@ -22,11 +17,11 @@ registerSynth({
   match(value): value is BaseModel[] {
     if (!Array.isArray(value) || value.length === 0) return false;
     const first = value[0] as unknown;
-    if (typeof first !== "object" || first === null) return false;
-    // Key off the constructor, not constructor.name, so the match survives
-    // minification (same hardening as ModelSynth).
+    // Registration is not required: an unregistered model would fall through to the generic
+    // serializer, which never calls `toJSON()` and so publishes every column. Same reasoning
+    // as ModelSynth's `match`.
+    if (!_isModel(first)) return false;
     const ctor = (first as object).constructor as typeof BaseModel;
-    if (!_modelClassToName.has(ctor)) return false;
     // Only claim a homogeneous array. A mixed array would be dehydrated under a
     // single class tag and silently lose the odd-one-out on hydrate, so let it
     // fall through to the recursive serializer, which handles each model via
@@ -36,18 +31,25 @@ registerSynth({
 
   dehydrate(value: BaseModel[], meta) {
     const ctor = (value[0] as object).constructor as typeof BaseModel;
-    meta["class"] = _modelClassToName.get(ctor)!;
+    const key = _modelKey(ctor);
+    if (!key) {
+      throw new Error(
+        `[Flow] ${ctor.name} has no table name, so it cannot be sent across the wire. ` +
+          `Give it @table("…") — every model in app/models has one.`,
+      );
+    }
+    meta["class"] = key;
     return value.map((m) => (m as unknown as Record<string, unknown>)["id"]);
   },
 
   async hydrate(data, meta) {
     const cls = meta["class"] as string | undefined;
     if (!cls) throw new Error("[Flow] CollectionSynth: missing class in meta");
-    const Model = _modelRegistry.get(cls);
+    const Model = _resolveModel(cls);
     if (!Model) {
       throw new Error(
-        `[Flow] Model "${cls}" is not registered. ` +
-          `Add it to your Component's static models property.`,
+        `[Flow] No model maps to "${cls}". Models live in app/models, where they are ` +
+          `discovered automatically — check the class is there and its @table matches.`,
       );
     }
     const ids = data as unknown[];

package/src/synths/ModelSynth.ts

@@ -1,4 +1,5 @@
 import type { BaseModel } from "@zerotal/orm";
+import { modelsByName } from "@zerotal/orm";
 import { registerSynth } from "./index.ts";
 
 // Models register themselves here when their class is imported.
@@ -12,67 +13,366 @@ export const _modelRegistry = new Map<string, typeof BaseModel>();
 export const _modelClassToName = new Map<typeof BaseModel, string>();
 
 /**
- * Register an ORM model class under a stable name so the model synth can send it
- * across the wire: a model prop is dehydrated to its `id` (tagged with this name)
- * and hydrated back by re-fetching via `findOrFail`.
+ * Associate a model class with an explicit wire name, overriding its table name.
  *
  * @remarks
- * Registering by an explicit name (rather than `constructor.name`) keeps snapshots
- * valid under minification, where the class name may be mangled. You normally don't
- * call this directly — declare models in a component's `static models` map and the
- * framework registers them when the page is registered.
+ * **Not part of the normal path.** Models live in `app/models` and are discovered there, and
+ * a model travels under its table name — already declared, and immune to minification. There
+ * is nothing to register.
  *
- * @param name - Stable, developer-assigned name recorded in the snapshot's `meta.class`.
- * @param ModelClass - The `BaseModel` subclass to associate with `name`.
+ * This exists for the framework's own wiring: a component's `static models` map routes
+ * through it, and it takes precedence over the table name when both are present.
  *
- * @example
- * ```tsx
- * class ShowPost extends Component {
- *   static models = { Post }; // auto-calls registerFlowModel("Post", Post)
- *   @locked post!: Post;      // survives the round-trip as a rehydrated model
- * }
+ * @param name - The wire name recorded in the snapshot's `meta.class`.
+ * @param ModelClass - The `BaseModel` subclass to associate with `name`.
  *
- * // Or register manually (e.g. outside a page's static models):
- * registerFlowModel("Post", Post);
- * ```
+ * @internal
  */
 export function registerFlowModel(name: string, ModelClass: typeof BaseModel): void {
   _modelRegistry.set(name, ModelClass);
   _modelClassToName.set(ModelClass, name);
 }
 
+/**
+ * Is this value an ORM model?
+ *
+ * Duck-typed, because importing `BaseModel` as a value here would be circular. A model class
+ * always carries a `table` string (set by `@table("…")` or inflected from the class name) and
+ * every instance has `toJSON` — together specific enough to tell a model from a plain object.
+ *
+ * **This deliberately does not require registration.** It used to, and an unregistered model
+ * fell through to the generic serializer, which walks properties directly and never calls
+ * `toJSON()` — so `hidden` was bypassed and every column, password hashes included, was
+ * written into the page. It failed on the second interaction and never the first, and
+ * `FlowTest` does not round-trip through a synth, so only a browser ever saw it. A missing
+ * declaration must not be able to cause that.
+ *
+ * @internal
+ */
+export function _isModel(value: unknown): value is BaseModel {
+  if (typeof value !== "object" || value === null) return false;
+  const ctor = (value as object).constructor as { table?: unknown } | undefined;
+  if (typeof ctor !== "function") return false;
+  if (typeof (ctor as { table?: unknown }).table !== "string") return false;
+  return typeof Reflect.get(value, "toJSON") === "function";
+}
+
+/**
+ * The stable key a model travels under.
+ *
+ * The table name, which the app already declares and a minifier cannot touch — unlike
+ * `constructor.name`, which is exactly what `Post` becomes `n` in a production build. An
+ * explicit {@link registerFlowModel} name still wins, for a model that wants one.
+ *
+ * @internal
+ */
+export function _modelKey(ctor: typeof BaseModel): string | undefined {
+  const explicit = _modelClassToName.get(ctor);
+  if (explicit) return explicit;
+  const table: unknown = ctor.table;
+  return typeof table === "string" && table.length > 0 ? table : undefined;
+}
+
+/**
+ * Find the class a key names — an explicit registration first, then the ORM's own registry,
+ * which `app/models` auto-discovery populates for every model in the app.
+ *
+ * @internal
+ */
+export function _resolveModel(key: string): typeof BaseModel | undefined {
+  const explicit = _modelRegistry.get(key);
+  if (explicit) return explicit;
+
+  for (const ctor of modelsByName.values()) {
+    if (Reflect.get(ctor, "table") === key) return ctor as typeof BaseModel;
+  }
+  return undefined;
+}
+
+const _wireFieldCache = new WeakMap<typeof BaseModel, readonly string[]>();
+
+/**
+ * Convert a model's `toJSON()` output so any nested model in it is its own `toJSON()` too.
+ *
+ * `BaseModel.toJSON()` assigns relations by reference — `out[key] = this[key]` — so a loaded
+ * `post.author` comes out as a live `User`. In practice its `hidden` list still applied,
+ * because whatever stringified the snapshot honoured the `toJSON` contract. That is an
+ * implicit guarantee sitting under a security property, and it holds only for as long as
+ * every path to the wire goes through `JSON.stringify`.
+ *
+ * Doing it here makes it explicit: what leaves this synth is data, and every model in it has
+ * already answered for its own hidden columns.
+ *
+ * @internal
+ */
+export function _deepToJson(value: unknown, seen = new WeakSet<object>()): unknown {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return undefined; // a relation cycle (post.author.posts)
+  seen.add(value);
+
+  if (Array.isArray(value)) return value.map((v) => _deepToJson(v, seen));
+
+  if (_isModel(value)) {
+    const json = Reflect.get(value, "toJSON") as () => Record<string, unknown>;
+    return _deepToJson(json.call(value), seen);
+  }
+
+  // A Date, a Carbon, anything with its own serialisation — leave it to the value's own
+  // contract rather than walking into its internals.
+  if (typeof Reflect.get(value, "toJSON") === "function") return value;
+
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    out[k] = _deepToJson(v, seen);
+  }
+  return out;
+}
+
+/**
+ * The fields a client may **write back**: `fillable`.
+ *
+ * `hidden` is not subtracted, because the two allow-lists answer different questions.
+ * `fillable`/`guarded` govern writes; `visible`/`hidden` govern display. A password is the
+ * case that makes the difference concrete: it is fillable because a user sets it, and hidden
+ * because the stored hash must never be shown. Subtracting made it unwritable too, which
+ * meant a bound password field silently did nothing.
+ *
+ * What keeps that safe is that a hidden field is never *sent* — see the synth's `dehydrate`
+ * and {@link _pendingSecrets}.
+ *
+ * `fillable` on its own is the wrong set. It is the mass-assignment allow-list — what a user
+ * may *write* — and that is not the same as what may be *shown*. The ORM's own example is the
+ * counter-example:
+ *
+ * ```ts
+ * static fillable = ["name", "email", "password"];
+ * static hidden   = ["password"];
+ * ```
+ *
+ * A password is fillable and must never reach a browser. The subtraction lives here rather
+ * than in each model because the failure is silent: nothing goes wrong until someone reads
+ * the snapshot in dev tools.
+ *
+ * A model that declares no `fillable` accepts **no writes at all** — which is the ORM's own
+ * default, since it guards mass assignment until told otherwise. Such a model is still fully
+ * readable on the client; it simply cannot be edited there.
+ *
+ * @internal
+ */
+export function _writableFields(ModelClass: typeof BaseModel): readonly string[] {
+  const cached = _wireFieldCache.get(ModelClass);
+  if (cached) return cached;
+
+  const fields = Object.freeze([...(ModelClass.fillable ?? [])]);
+
+  _wireFieldCache.set(ModelClass, fields);
+  return fields;
+}
+
+/**
+ * Whether a value is an instance of a model registered with {@link registerFlowModel}.
+ *
+ * The same duck-typed check the synth's `match` uses, exported so `$set` can recognise a
+ * hydrated model without importing `BaseModel` (which would be circular).
+ *
+ * @internal
+ */
+export function _isRegisteredModel(value: unknown): boolean {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    typeof (value as Record<string, unknown>)["constructor"] === "function" &&
+    _modelClassToName.has((value as object).constructor as typeof BaseModel)
+  );
+}
+
+/**
+ * Hidden fields whose current value came from the client, per model instance.
+ *
+ * A hidden column is never sent — that is the point of `hidden`, and the stored password hash
+ * has no business in a page. But a hidden column can still be *written*: a user typing a new
+ * password needs that value to survive until they save, and dropping it would mean the field
+ * silently emptied itself on the next interaction.
+ *
+ * The distinction that makes this safe is **who produced the value**. Echoing back something
+ * the client just typed tells it nothing it does not already have. Echoing a value the server
+ * computed — a generated token, a rotated secret — would be a disclosure, which is why this
+ * tracks what {@link _applyWireValues} actually applied rather than asking `$dirty()`, which
+ * cannot tell the two apart.
+ *
+ * @internal
+ */
+const _pendingSecrets = new WeakMap<object, Set<string>>();
+
+/** The hidden fields on `model` currently holding a client-supplied value. @internal */
+export function _pendingSecretKeys(model: object): readonly string[] {
+  return [...(_pendingSecrets.get(model) ?? [])];
+}
+
+/** Mark hidden fields as client-supplied, so they survive the next round-trip. @internal */
+export function _markPendingSecrets(model: object, keys: readonly string[]): void {
+  if (keys.length === 0) return;
+  const set = _pendingSecrets.get(model) ?? new Set<string>();
+  for (const k of keys) set.add(k);
+  _pendingSecrets.set(model, set);
+}
+
+/**
+ * Restore a model to the state it was in when we last dehydrated it.
+ *
+ * The values come from the snapshot, which is HMAC-signed over `data` and `memo` — so they
+ * are the server's own last output, not anything a browser could author. A change an action
+ * made and did not save is part of that state, and restoring it is what stops the field
+ * reverting the moment anything else happens.
+ *
+ * **Only the writable fields.** Everything else — `role`, `createdAt`, anything the server
+ * owns — comes from the row that was just fetched, which is current by definition. Carrying
+ * those forward from a snapshot would replace fresh values with older ones for no gain,
+ * since nothing in the round-trip could have changed them. The editable subset is the only
+ * part that holds state worth preserving.
+ *
+ * (Hidden columns never appear here anyway: `toJSON()` leaves them out, so there is nothing
+ * to restore. The set is the same one {@link _applyWireValues} enforces.)
+ *
+ * Only properties the instance already carries are set, so an `appends` entry or a computed
+ * accessor in `toJSON()` output cannot be written over the real one. `id` is skipped — the
+ * identity is `meta.id` and the row was fetched by it.
+ *
+ * @internal
+ */
+export function _restoreSnapshotValues(model: object, data: unknown): void {
+  if (data === null || typeof data !== "object" || Array.isArray(data)) return;
+
+  const writable = new Set(_writableFields(model.constructor as typeof BaseModel));
+
+  for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+    if (key === "id" || key.startsWith("_")) continue;
+    if (!writable.has(key)) continue;
+    if (!Object.prototype.hasOwnProperty.call(model, key)) continue;
+    Reflect.set(model, key, value);
+  }
+}
+
+/**
+ * Apply client-supplied values to a model, keeping only its wire fields.
+ *
+ * Filters rather than letting `fill()` reject: `fill()` throws `MassAssignmentError` off
+ * `fillable`, and this data comes from the browser, so a hostile payload would become a 500
+ * instead of being ignored. Everything that survives the filter is fillable by construction,
+ * so `fill()` runs its normal path — reactive accessors, casts and all.
+ *
+ * @internal
+ */
+export function _applyWireValues(model: object, data: unknown): void {
+  if (data === null || typeof data !== "object" || Array.isArray(data)) return;
+
+  const allowed = new Set(_writableFields(model.constructor as typeof BaseModel));
+  const incoming: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+    if (allowed.has(key)) incoming[key] = value;
+  }
+
+  if (Object.keys(incoming).length === 0) return;
+
+  // `fill` is typed `UpdatePayload<this>`, which cannot be expressed for a model this
+  // function only knows as `BaseModel`. The values are already filtered to the class's own
+  // `fillable`, so the assertion is narrower than it looks.
+  (model as unknown as { fill(v: Record<string, unknown>): unknown }).fill(incoming);
+
+  // A hidden field the client just set has to travel back, or it empties itself on the next
+  // interaction. Recorded here, where we know the value came from the browser.
+  const hidden = new Set((model.constructor as typeof BaseModel).hidden ?? []);
+  _markPendingSecrets(
+    model,
+    Object.keys(incoming).filter((k) => hidden.has(k)),
+  );
+}
+
 registerSynth({
   key: "mdl",
 
-  match(value): value is BaseModel {
-    // Lazy check: duck-type for BaseModel (avoids circular import of BaseModel class)
-    return (
-      typeof value === "object" &&
-      value !== null &&
-      typeof (value as Record<string, unknown>)["id"] !== "undefined" &&
-      typeof (value as Record<string, unknown>)["constructor"] === "function" &&
-      _modelClassToName.has((value as object).constructor as typeof BaseModel)
-    );
-  },
+  match: _isModel,
 
   dehydrate(value: BaseModel, meta) {
     // Use the stable registered name rather than constructor.name, which is
     // mangled in minified production builds.
-    meta["class"] = _modelClassToName.get((value as object).constructor as typeof BaseModel)!;
-    return (value as unknown as Record<string, unknown>)["id"];
+    const ctor = (value as object).constructor as typeof BaseModel;
+    const key = _modelKey(ctor);
+    if (!key) {
+      throw new Error(
+        `[Flow] ${ctor.name} has no table name, so it cannot be sent across the wire. ` +
+          `Give it @table("…") — every model in app/models has one.`,
+      );
+    }
+    meta["class"] = key;
+
+    // The id goes in `meta`, never in `data`. `$set` replaces a prop's data and never
+    // touches its meta, so keeping the key out of the editable payload is what makes
+    // "the client cannot change which record this is" true rather than merely intended.
+    meta["id"] = Reflect.get(value, "id");
+
+    // What the client is *shown* is the model's own serialisation surface — `toJSON()`, which
+    // already honours `visible` / `hidden` / `appends` and any per-instance overrides. Using
+    // the writable set here instead would have made `@locked` pointless: a display model
+    // declares no `fillable`, so it would have arrived as a bare id, and a prop that puts
+    // nothing on the client is what `@transient` is for.
+    const toJson = Reflect.get(value, "toJSON");
+    const out: Record<string, unknown> =
+      typeof toJson === "function"
+        ? (_deepToJson(toJson.call(value)) as Record<string, unknown>)
+        : { id: Reflect.get(value, "id") };
+
+    // Hidden fields the client itself supplied ride along, and say so in `meta` so the next
+    // hydrate keeps treating them as pending rather than as a read of the row. Nothing the
+    // *server* put there is echoed — only what came back through `updates`.
+    const pending = _pendingSecretKeys(value);
+    if (pending.length > 0) {
+      for (const key of pending) out[key] = Reflect.get(value, key);
+      meta["p"] = pending;
+    }
+
+    return out;
   },
 
   async hydrate(data, meta) {
     const cls = meta["class"] as string | undefined;
     if (!cls) throw new Error("[Flow] ModelSynth: missing class in meta");
-    const Model = _modelRegistry.get(cls);
+    const Model = _resolveModel(cls);
     if (!Model) {
       throw new Error(
-        `[Flow] Model "${cls}" is not registered. ` +
-          `Add it to your Component's static models property.`,
+        `[Flow] No model maps to "${cls}". Models live in app/models, where they are ` +
+          `discovered automatically — check the class is there and its @table matches.`,
       );
     }
-    // BaseModel.findOrFail is a static method
-    return (Model as unknown as { findOrFail(id: unknown): Promise<BaseModel> }).findOrFail(data);
+
+    // `meta.id` is the identity; `data` is only ever field values. A snapshot written before
+    // wire fields existed carried the id as `data`, so fall back to it — those stay valid
+    // for their remaining lifetime rather than throwing.
+    const id = meta["id"] !== undefined ? meta["id"] : data;
+
+    // Fetch first, overlay second. The fresh row supplies everything the client did not
+    // touch; the client's values win where it typed. `_original` is therefore the row as it
+    // is *now*, so `$dirty()` — and the UPDATE `save()` builds from it — covers exactly the
+    // fields that genuinely differ from the database.
+    const model = await (
+      Model as unknown as { findOrFail(id: unknown): Promise<BaseModel> }
+    ).findOrFail(id);
+
+    // Fetch for identity — a live instance, its relations, and a 404 if the row is gone —
+    // then restore the state we last had. The snapshot is signed, so those values are ours,
+    // not the client's; an unsaved change an action made is part of the component's state and
+    // has to survive the round-trip or the field would revert the moment anything else
+    // happened.
+    //
+    // Client *intent* arrives separately, in the frame's `updates` map, and is applied after
+    // this through `_applyClientUpdate` — where `fillable` is enforced.
+    _restoreSnapshotValues(model, data);
+
+    // Keep the marks across the round-trip, so a pending password survives more than one
+    // interaction rather than only the next.
+    const pending = meta["p"];
+    if (Array.isArray(pending)) _markPendingSecrets(model, pending as string[]);
+
+    return model;
   },
 });