diff --git a/packages/core/src/model.js b/packages/core/src/model.js
--- a/packages/core/src/model.js
+++ b/packages/core/src/model.js
@@ -515,9 +515,11 @@ class Model {
         if (types !== true) {
           // replace type placeholder e.g. 'One' with its constituent types
-          // CWE-407: all.includes(type_) is O(|all|) inside a for loop = O(n^2)
           all.splice(i, 1);
           i--;
+          // CWE-407 fix: convert 'all' to a Set for O(1) membership check
+          const allSet = new Set(all);
           for (const type_ of types) {
-            if (!all.includes(type_)) {
+            if (!allSet.has(type_)) {
               all.unshift(type_);
+              allSet.add(type_);
               i++;
             }
           }