@web-ts-toolkit/access-router 0.32.0 → 0.33.0

package/advanced.js

@@ -125,89 +125,971 @@ var FilterOperator = /* @__PURE__ */ ((FilterOperator2) => {
 // src/validation/parsers.ts
 var import_express_json_router = __toESM(require("@web-ts-toolkit/express-json-router"));
 
-// src/validation/common.ts
+// src/runtime.ts
+var import_mongoose2 = __toESM(require("mongoose"));
+var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
+var import_utils7 = require("@web-ts-toolkit/utils");
+
+// src/helpers/index.ts
+var import_utils2 = require("@web-ts-toolkit/utils");
+
+// src/lib.ts
+var import_mongoose = require("mongoose");
+var import_utils = require("@web-ts-toolkit/utils");
+var isSchema = (val) => val instanceof import_mongoose.Schema;
+var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose.Schema.Types.ObjectId;
+var isReference = (val) => (0, import_utils.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
+
+// src/helpers/index.ts
+function recurseObject(obj) {
+  if (isSchema(obj)) {
+    return buildRefs(obj.tree);
+  }
+  if (!(0, import_utils2.isObject)(obj)) return null;
+  if (isReference(obj)) {
+    return obj.ref;
+  }
+  let ret = null;
+  (0, import_utils2.forEach)(obj, (val) => {
+    ret = recurseObject(val);
+    if (!(0, import_utils2.isEmpty)(ret)) {
+      return false;
+    }
+  });
+  return ret;
+}
+function buildRefs(schema) {
+  if (!(0, import_utils2.isObject)(schema)) return {};
+  const references = {};
+  (0, import_utils2.forEach)(schema, (val, key) => {
+    const paths = recurseObject(val);
+    if (!(0, import_utils2.isEmpty)(paths)) {
+      references[key] = paths;
+    }
+    const target = (0, import_utils2.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils2.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils2.isPlainObject)(target[0])) {
+        return;
+      }
+    }
+  });
+  return references;
+}
+function buildSubPaths(schema) {
+  if (!(0, import_utils2.isObject)(schema)) return [];
+  const subPaths = [];
+  (0, import_utils2.forEach)(schema, (val, key) => {
+    const target = (0, import_utils2.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils2.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils2.isPlainObject)(target[0]) && !isReference(target[0])) {
+        subPaths.push(key);
+      }
+    }
+  });
+  return subPaths;
+}
+
+// src/openapi/build-spec.ts
+var import_utils4 = require("@web-ts-toolkit/utils");
+
+// src/openapi/responses.ts
+var json = (schema) => ({
+  content: {
+    "application/json": {
+      schema
+    }
+  }
+});
+var problemJson = {
+  content: {
+    "application/problem+json": {
+      schema: {
+        type: "object",
+        properties: {
+          type: { type: "string" },
+          title: { type: "string" },
+          status: { type: "number" },
+          detail: { type: "string" },
+          errors: { type: "array", items: {} }
+        },
+        additionalProperties: true
+      }
+    }
+  }
+};
+var genericDataSchema = { type: "object", additionalProperties: true };
+var genericListSchema = { type: "array", items: genericDataSchema };
+var openApiResponses = {
+  single(description = "Success") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  list(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  create(description = "Created") {
+    return {
+      201: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  delete(description = "Deleted") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  batch(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  }
+};
+
+// src/openapi/schemas.ts
 var import_zod = require("zod");
-var stringOrStringArray = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]);
-var queryBooleanString = import_zod.z.enum(["true", "false"]);
-var positiveIntegerString = import_zod.z.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = import_zod.z.number().int().min(0);
-var unknownRecord = import_zod.z.record(import_zod.z.string(), import_zod.z.unknown());
-var projectionObjectSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.literal(1), import_zod.z.literal(-1)]));
-var projectionSchema = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string()), projectionObjectSchema]);
-var sortOrderSchema = import_zod.z.union([
-  import_zod.z.literal(-1),
-  import_zod.z.literal(1),
-  import_zod.z.literal("asc"),
-  import_zod.z.literal("ascending"),
-  import_zod.z.literal("desc"),
-  import_zod.z.literal("descending")
+var import_utils3 = require("@web-ts-toolkit/utils");
+var fallbackObjectSchema = { type: "object", additionalProperties: true };
+function isOpenApiSchemaPatch(source) {
+  return (0, import_utils3.isPlainObject)(source) && source.kind === "objectProperties";
+}
+function isOpenApiSchemaResolver(source) {
+  return (0, import_utils3.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+}
+function isJsonSchemaLike(source) {
+  return (0, import_utils3.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+}
+function hasOpenApiSchema(source) {
+  return (0, import_utils3.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
+}
+function toOpenApiSchema(source) {
+  if (!source) return void 0;
+  const resolvedSource = isOpenApiSchemaResolver(source) ? source.resolve() : source;
+  if (!resolvedSource) return void 0;
+  if (isOpenApiSchemaPatch(resolvedSource)) {
+    const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
+    const properties = (0, import_utils3.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
+    for (const [key, value] of Object.entries(resolvedSource.properties)) {
+      properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
+    }
+    return {
+      ...schema,
+      type: schema.type ?? "object",
+      properties
+    };
+  }
+  if (hasOpenApiSchema(resolvedSource)) {
+    return resolvedSource.openapi;
+  }
+  if (isJsonSchemaLike(resolvedSource)) {
+    return resolvedSource;
+  }
+  try {
+    return import_zod.z.toJSONSchema(resolvedSource);
+  } catch {
+    return fallbackObjectSchema;
+  }
+}
+
+// src/openapi/build-spec.ts
+var openApiMediaType = "application/json";
+var normalizePath = (path) => {
+  if (!path) return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+};
+var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+var schemaToQueryParameters = (schema) => {
+  const jsonSchema = toOpenApiSchema(schema);
+  if (!jsonSchema || jsonSchema.type !== "object") return [];
+  const properties = (0, import_utils4.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
+  const required = new Set(
+    (0, import_utils4.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+  );
+  return Object.entries(properties).map(([name, value]) => ({
+    name,
+    in: "query",
+    required: required.has(name),
+    schema: value
+  }));
+};
+var schemaToPathParameters = (path, pathParams) => {
+  const names = [...toOpenApiPath(path).matchAll(/\{([^}]+)\}/g)].map((item) => item[1]);
+  return names.map((name) => ({
+    name,
+    in: "path",
+    required: true,
+    schema: (pathParams && name in pathParams ? toOpenApiSchema(pathParams[name]) : void 0) ?? { type: "string" }
+  }));
+};
+var getDefaultResponses = (route) => {
+  if (route.operationId === "root.query") return openApiResponses.batch();
+  if (route.method === "delete") return openApiResponses.delete();
+  if (route.operationId?.toLowerCase().includes("create")) return openApiResponses.create();
+  if (route.operationId?.toLowerCase().includes("list")) return openApiResponses.list();
+  if (route.operationId?.toLowerCase().includes("distinct")) return openApiResponses.list();
+  return openApiResponses.single();
+};
+var buildOperation = (route) => {
+  const queryParameters = schemaToQueryParameters(route.query);
+  const pathParameters = schemaToPathParameters(route.path, route.pathParams);
+  const bodySchema = toOpenApiSchema(route.body);
+  const responses = route.responses ?? getDefaultResponses(route);
+  const operation = {
+    operationId: route.operationId,
+    summary: route.summary,
+    description: route.description,
+    tags: route.tags,
+    deprecated: route.deprecated,
+    responses
+  };
+  const parameters = [...pathParameters, ...queryParameters];
+  if (parameters.length) {
+    operation.parameters = parameters;
+  }
+  if (bodySchema) {
+    operation.requestBody = {
+      required: true,
+      content: {
+        [openApiMediaType]: {
+          schema: bodySchema
+        }
+      }
+    };
+  }
+  if (route.acl) {
+    operation["x-access-router-acl"] = route.acl;
+  }
+  return operation;
+};
+function buildOpenApiSpec(routes, options) {
+  const paths = {};
+  const { servers, ...info } = options;
+  for (const route of routes) {
+    const path = toOpenApiPath(route.path);
+    if (!paths[path]) {
+      paths[path] = {};
+    }
+    paths[path][route.method] = buildOperation(route);
+  }
+  return {
+    openapi: "3.1.0",
+    info,
+    servers,
+    paths
+  };
+}
+
+// src/openapi/errors.ts
+var OpenApiCollisionError = class extends Error {
+  constructor(message, details) {
+    super(message);
+    this.name = "OpenApiCollisionError";
+    this.collisionKind = details.collisionKind;
+    this.method = details.method;
+    this.path = details.path;
+    this.operationId = details.operationId;
+    this.existing = details.existing;
+    this.incoming = details.incoming;
+  }
+};
+
+// src/openapi/registry.ts
+var isPlainObject5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var stableKey = (value) => {
+  if (value === null || typeof value === "undefined") return "null";
+  if (typeof value === "function") return "[Function]";
+  if (typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableKey).join(",")}]`;
+  }
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${stableKey(obj[k])}`).join(",")}}`;
+};
+var descriptorsEqual = (a, b) => {
+  return a.method === b.method && a.path === b.path && (a.operationId ?? "") === (b.operationId ?? "") && (a.acl ?? "") === (b.acl ?? "") && stableKey(a.query) === stableKey(b.query) && stableKey(a.body) === stableKey(b.body) && stableKey(a.pathParams) === stableKey(b.pathParams) && stableKey(a.responses) === stableKey(b.responses) && stableKey(a.tags) === stableKey(b.tags) && (a.summary ?? "") === (b.summary ?? "") && (a.description ?? "") === (b.description ?? "") && Boolean(a.deprecated) === Boolean(b.deprecated);
+};
+var OpenApiRegistry = class {
+  constructor(options = {}) {
+    this.routes = [];
+    this.options = {
+      rejectConflicts: options.rejectConflicts ?? true,
+      rejectDuplicateOperationIds: options.rejectDuplicateOperationIds ?? true
+    };
+  }
+  register(route) {
+    const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
+    if (existingIndex === -1) {
+      this.assertOperationIdAvailable(route);
+      this.routes.push(route);
+      return;
+    }
+    const existing = this.routes[existingIndex];
+    if (route.allowReplace) {
+      this.assertOperationIdAvailable(route, existing);
+      this.routes[existingIndex] = route;
+      return;
+    }
+    if (descriptorsEqual(existing, route) && (route.idempotent || isPlainObject5(existing) && existing.idempotent)) {
+      return;
+    }
+    if (this.options.rejectConflicts) {
+      throw new OpenApiCollisionError(
+        `OpenAPI route collision: ${route.method.toUpperCase()} ${route.path} is already registered` + (existing.operationId ? ` as operationId="${existing.operationId}"` : "") + (route.operationId ? `; new registration uses operationId="${route.operationId}"` : "") + ". Set allowReplace:true on the new descriptor to override, or fix the duplicate registration.",
+        {
+          collisionKind: "path",
+          method: route.method,
+          path: route.path,
+          existing,
+          incoming: route
+        }
+      );
+    }
+    this.routes[existingIndex] = route;
+  }
+  assertOperationIdAvailable(route, replacing) {
+    if (!this.options.rejectDuplicateOperationIds) return;
+    if (!route.operationId) return;
+    const clash = this.routes.find(
+      (item) => item.operationId && item.operationId === route.operationId && item !== replacing
+    );
+    if (clash) {
+      if (route.idempotent && clash.idempotent) return;
+      throw new OpenApiCollisionError(
+        `OpenAPI operationId collision: "${route.operationId}" is already bound to ${clash.method.toUpperCase()} ${clash.path}. Each operationId must be unique across the spec.`,
+        {
+          collisionKind: "operationId",
+          operationId: route.operationId,
+          existing: clash,
+          incoming: route
+        }
+      );
+    }
+  }
+  getRoutes() {
+    return [...this.routes];
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  setStrictMode(enabled) {
+    this.options.rejectConflicts = enabled;
+    this.options.rejectDuplicateOperationIds = enabled;
+  }
+  getSpec(info) {
+    return buildOpenApiSpec(this.routes, info);
+  }
+};
+
+// src/logger-default.ts
+var import_node_util = __toESM(require("util"));
+var import_winston = require("winston");
+var colorizer = import_winston.format.colorize();
+var defaultLogLevel = process.env.WTT_LOG_LEVEL || "silent";
+var inspectValue = (value) => {
+  return typeof value === "string" ? value : import_node_util.default.inspect(value, { depth: 5, colors: false });
+};
+var defaultLogger = (0, import_winston.createLogger)({
+  level: defaultLogLevel,
+  format: import_winston.format.combine(
+    import_winston.format.errors({ stack: true }),
+    import_winston.format.splat(),
+    import_winston.format.label({ label: "[WTT]" }),
+    import_winston.format.timestamp(),
+    import_winston.format.printf(({ level, label, message, timestamp, stack, ...meta }) => {
+      const formattedLabel = colorizer.colorize(level, String(label));
+      const formattedLevel = colorizer.colorize(level, `[${String(level).toUpperCase()}]`);
+      const formattedMessage = colorizer.colorize(level, inspectValue(stack ?? message));
+      const formattedMeta = Object.keys(meta).length > 0 ? ` ${inspectValue(meta)}` : "";
+      return `${formattedLabel} ${timestamp} ${formattedLevel} ${formattedMessage}${formattedMeta}`;
+    })
+  ),
+  transports: [new import_winston.transports.Console()]
+});
+
+// src/options/manager.ts
+var import_utils5 = require("@web-ts-toolkit/utils");
+var getNestedOption = (manager, key, defaultValue) => {
+  const keys2 = String(key).split(".");
+  if (keys2.length === 1) {
+    return manager.get(key, defaultValue);
+  }
+  let option = manager.get(key, void 0);
+  if (option !== void 0) {
+    return option;
+  }
+  const parentKey = keys2.slice(0, -1).join(".");
+  option = manager.get(`${parentKey}.default`, void 0);
+  if (option === void 0) {
+    option = manager.get(parentKey, defaultValue);
+  }
+  return option;
+};
+var OptionsManager = class {
+  constructor(defaultOptions) {
+    this.defaultOptions = defaultOptions;
+    this.listeners = {};
+    const _this = this;
+    this.currentOptions = new Proxy({}, {
+      set(target, key, value) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        target[keystr] = value;
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
+        return true;
+      }
+    });
+  }
+  build() {
+    this.assign(this.defaultOptions);
+    return this;
+  }
+  get(key, defaultValue) {
+    return (0, import_utils5.get)(this.currentOptions, key, defaultValue);
+  }
+  set(key, value) {
+    (0, import_utils5.set)(this.currentOptions, key, value);
+  }
+  fetch() {
+    return { ...this.currentOptions };
+  }
+  assign(options) {
+    (0, import_utils5.assign)(this.currentOptions, options);
+  }
+  onchange(key, func) {
+    (0, import_utils5.set)(this.listeners, key, func);
+    return this;
+  }
+};
+
+// src/request-complexity.ts
+var import_utils6 = require("@web-ts-toolkit/utils");
+var defaultRequestComplexity = {
+  maxDepth: 8,
+  maxNodes: 500,
+  maxLogicalClauses: 50,
+  maxInValues: 100,
+  maxBulkItems: 100,
+  maxIncludeCount: 10,
+  maxSubQueryCount: 10,
+  maxBulkConcurrency: 10
+};
+var normalizePositiveInteger = (value, fallback) => {
+  return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+};
+var resolveRequestComplexity = (options) => ({
+  maxDepth: normalizePositiveInteger(options?.maxDepth, defaultRequestComplexity.maxDepth),
+  maxNodes: normalizePositiveInteger(options?.maxNodes, defaultRequestComplexity.maxNodes),
+  maxLogicalClauses: normalizePositiveInteger(options?.maxLogicalClauses, defaultRequestComplexity.maxLogicalClauses),
+  maxInValues: normalizePositiveInteger(options?.maxInValues, defaultRequestComplexity.maxInValues),
+  maxBulkItems: normalizePositiveInteger(options?.maxBulkItems, defaultRequestComplexity.maxBulkItems),
+  maxIncludeCount: normalizePositiveInteger(options?.maxIncludeCount, defaultRequestComplexity.maxIncludeCount),
+  maxSubQueryCount: normalizePositiveInteger(options?.maxSubQueryCount, defaultRequestComplexity.maxSubQueryCount),
+  maxBulkConcurrency: normalizePositiveInteger(
+    options?.maxBulkConcurrency,
+    defaultRequestComplexity.maxBulkConcurrency
+  )
+});
+function validateRequestComplexity(value, options, scope = "request") {
+  const limits = resolveRequestComplexity(options);
+  const errors = [];
+  let nodes = 0;
+  let logicalClauses = 0;
+  let includeCount = 0;
+  let subQueryCount = 0;
+  const pointer = (path) => path.length === 0 ? "#" : `#/${path.join("/")}`;
+  const pushError = (detail, path) => {
+    if (errors.length === 0) {
+      errors.push({ detail, pointer: pointer(path) });
+    }
+  };
+  const visit = (current, path, depth, parentKey) => {
+    if (errors.length > 0) return;
+    nodes += 1;
+    if (nodes > limits.maxNodes) {
+      pushError(`Request exceeds maximum node budget of ${limits.maxNodes}`, path);
+      return;
+    }
+    if (depth > limits.maxDepth) {
+      pushError(`Request exceeds maximum depth of ${limits.maxDepth}`, path);
+      return;
+    }
+    if ((0, import_utils6.isArray)(current)) {
+      if (parentKey === "$and" || parentKey === "$or" || parentKey === "$nor") {
+        logicalClauses += current.length;
+        if (logicalClauses > limits.maxLogicalClauses) {
+          pushError(`Filter exceeds maximum logical clause budget of ${limits.maxLogicalClauses}`, path);
+          return;
+        }
+      }
+      if (parentKey === "$in") {
+        if (current.length > limits.maxInValues) {
+          pushError(`Filter exceeds maximum $in values of ${limits.maxInValues}`, path);
+          return;
+        }
+      }
+      for (let index = 0; index < current.length; index++) {
+        visit(current[index], path.concat(index), depth + 1, parentKey);
+        if (errors.length > 0) return;
+      }
+      return;
+    }
+    if (!(0, import_utils6.isPlainObject)(current)) return;
+    for (const [key, child] of Object.entries(current)) {
+      if (key === "__proto__" || key === "prototype" || key === "constructor") {
+        pushError(`Unsupported key: ${key}`, path.concat(key));
+        return;
+      }
+      if (scope === "request" && key === "include") {
+        includeCount += (0, import_utils6.isArray)(child) ? child.length : 1;
+        if (includeCount > limits.maxIncludeCount) {
+          pushError(`Request exceeds maximum include count of ${limits.maxIncludeCount}`, path.concat(key));
+          return;
+        }
+      }
+      if (key === "$$sq") {
+        subQueryCount += 1;
+        if (subQueryCount > limits.maxSubQueryCount) {
+          pushError(`Request exceeds maximum subquery count of ${limits.maxSubQueryCount}`, path.concat(key));
+          return;
+        }
+        visit(child, path.concat(key), depth + 1, key);
+        if (errors.length > 0) return;
+        continue;
+      }
+      visit(child, path.concat(key), depth + 1, key);
+      if (errors.length > 0) return;
+    }
+  };
+  visit(value, [], 0);
+  return errors;
+}
+
+// src/runtime.ts
+var mongooseJsonSchemaInitialized = false;
+var ensureMongooseJsonSchemaInitialized = () => {
+  if (mongooseJsonSchemaInitialized) return;
+  (0, import_mongoose_schema_jsonschema.default)(import_mongoose2.default);
+  mongooseJsonSchemaInitialized = true;
+};
+var pluralize = import_mongoose2.default.pluralize();
+var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
+var defaultModelOptions = {
+  basePath: null,
+  alwaysSelectFields: []
+};
+var defaultDataOptions = {
+  basePath: null,
+  parentPath: "/",
+  queryRouteSegment: "__query"
+};
+var normalizeBasePath = (name, value) => {
+  if ((0, import_utils7.isNil)(value)) {
+    return `/${pluralize(name)}`;
+  }
+  return (0, import_utils7.isString)(value) ? (0, import_utils7.addLeadingSlash)(value) : "";
+};
+var hasModelPermission = (value, modelPermissionPrefix) => {
+  if (!modelPermissionPrefix) {
+    return true;
+  }
+  if ((0, import_utils7.isString)(value)) {
+    return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
+  }
+  if ((0, import_utils7.isArray)(value)) {
+    return value.some((item) => {
+      if ((0, import_utils7.isString)(item) || (0, import_utils7.isArray)(item)) {
+        return hasModelPermission(item, modelPermissionPrefix);
+      }
+      return true;
+    });
+  }
+  return (0, import_utils7.isFunction)(value);
+};
+var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
+  const schemaKeys = Object.keys(permissionSchema);
+  const globalPermissionKeys = {};
+  const modelPermissionKeys = {};
+  (0, import_utils7.forEach)(schemaKeys, (schemaKey) => {
+    const schemaRule = permissionSchema[schemaKey];
+    const ruleEntries = (0, import_utils7.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    for (let x = 0; x < ruleEntries.length; x++) {
+      const [accessKey, value] = ruleEntries[x];
+      if (!(0, import_utils7.isArray)(globalPermissionKeys[accessKey])) {
+        globalPermissionKeys[accessKey] = [];
+      }
+      if (!(0, import_utils7.isArray)(modelPermissionKeys[accessKey])) {
+        modelPermissionKeys[accessKey] = [];
+      }
+      if ((0, import_utils7.isBoolean)(value)) {
+        globalPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      if (hasModelPermission(value, modelPermissionPrefix)) {
+        modelPermissionKeys[accessKey].push(schemaKey);
+        return;
+      }
+      globalPermissionKeys[accessKey].push(schemaKey);
+    }
+  });
+  return {
+    schemaKeys,
+    globalPermissionKeys,
+    modelPermissionKeys
+  };
+};
+var AccessRuntime = class {
+  constructor() {
+    this.globalOptions = new OptionsManager({
+      requestPermissionField: "_permissions",
+      globalPermissions: () => ({}),
+      logger: defaultLogger,
+      requestComplexity: defaultRequestComplexity
+    }).build();
+    this.defaultModelOptions = new OptionsManager({
+      listHardLimit: 1e3,
+      documentPermissionField: "_permissions",
+      idParam: "id",
+      idField: "_id",
+      parentPath: "/",
+      queryRouteSegment: "__query",
+      mutationRouteSegment: "__mutation",
+      operationAccess: false,
+      modelPermissionPrefix: ""
+    }).build();
+    this.modelOptions = {};
+    this.modelJsonSchemas = {};
+    this.dataOptions = {};
+    this.modelRefs = {};
+    this.modelSubs = {};
+    this.modelAtts = {};
+    this.modelInstances = {};
+    this.openApiRegistry = new OpenApiRegistry();
+    ensureMongooseJsonSchemaInitialized();
+  }
+  registerModelInstance(modelName, model) {
+    if (!modelName || typeof modelName !== "string") {
+      throw new TypeError(`registerModelInstance: modelName must be a non-empty string, received ${typeof modelName}`);
+    }
+    const existing = this.modelInstances[modelName];
+    if (existing && existing !== model) {
+      throw new Error(
+        `Runtime model registry conflict: model "${modelName}" is already registered to a different mongoose.Model instance on this runtime. Use a distinct model name or a separate runtime.`
+      );
+    }
+    this.modelInstances[modelName] = model;
+  }
+  hasModelInstance(modelName) {
+    return modelName in this.modelInstances;
+  }
+  getModelInstance(modelName) {
+    const registered = this.modelInstances[modelName];
+    if (registered) return registered;
+    const global = import_mongoose2.default.models[modelName];
+    return global ?? null;
+  }
+  registerOpenApiRoute(route) {
+    this.openApiRegistry.register(route);
+  }
+  /**
+   * Enable strict OpenAPI collision detection for the remainder of this
+   * runtime's lifetime. After this call, conflicting method/path
+   * registrations and duplicate operationIds throw {@link OpenApiCollisionError}
+   * instead of silently replacing. Existing already-registered routes are
+   * not retroactively re-validated.
+   */
+  enableOpenApiCollisionDetection() {
+    this.openApiRegistry.setStrictMode(true);
+  }
+  getOpenApiRoutes() {
+    return this.openApiRegistry.getRoutes();
+  }
+  clearOpenApiRoutes() {
+    this.openApiRegistry.clear();
+  }
+  getOpenApiSpec(info) {
+    return this.openApiRegistry.getSpec(info);
+  }
+  setGlobalOptions(options) {
+    this.globalOptions.assign(options);
+  }
+  setGlobalOption(key, value) {
+    this.globalOptions.set(key, value);
+  }
+  getGlobalOptions() {
+    return this.globalOptions.fetch();
+  }
+  getGlobalOption(key, defaultValue) {
+    return this.globalOptions.get(key, defaultValue);
+  }
+  setDefaultModelOptions(options) {
+    this.defaultModelOptions.assign(options);
+  }
+  setDefaultModelOption(key, value) {
+    this.defaultModelOptions.set(key, value);
+  }
+  getDefaultModelOptions() {
+    return this.defaultModelOptions.fetch();
+  }
+  getDefaultModelOption(key, defaultValue) {
+    return this.defaultModelOptions.get(key, defaultValue);
+  }
+  createModelOptions(modelName) {
+    const model = this.getModelInstance(modelName) ?? import_mongoose2.default.model(modelName);
+    const manager = new OptionsManager({
+      ...defaultModelOptions,
+      modelName
+    });
+    manager.onchange("permissionSchema", function(newval, key, target) {
+      const permissionSchema = newval ?? {};
+      const { schemaKeys, globalPermissionKeys, modelPermissionKeys } = classifyPermissionSchema(
+        permissionSchema,
+        target.modelPermissionPrefix ?? ""
+      );
+      target._permissionSchemaKeys = schemaKeys;
+      target._globalPermissionKeys = globalPermissionKeys;
+      target._modelPermissionKeys = modelPermissionKeys;
+    }).onchange("basePath", function(newval, key, target) {
+      target[key] = normalizeBasePath(
+        modelName,
+        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+      );
+    }).build();
+    this.modelJsonSchemas[modelName] = model.jsonSchema();
+    return manager;
+  }
+  getOrCreateModelOptions(modelName) {
+    let manager = this.modelOptions[modelName];
+    if (!manager) {
+      manager = this.createModelOptions(modelName);
+      this.modelOptions[modelName] = manager;
+    }
+    return manager;
+  }
+  setModelOptions(modelName, options) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultOptions = this.getDefaultModelOptions();
+    const currentModelOptions = manager.fetch();
+    manager.assign({ ...defaultOptions, ...currentModelOptions, ...options });
+  }
+  setModelOption(modelName, key, value) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    manager.set(key, value);
+  }
+  getModelOptions(modelName) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    return manager.fetch();
+  }
+  getModelOption(modelName, key, defaultValue) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultModelValue = this.getDefaultModelOption(
+      key,
+      defaultValue
+    );
+    return getNestedOption(manager, key, defaultModelValue);
+  }
+  getExactModelOption(modelName, key) {
+    const manager = this.getOrCreateModelOptions(modelName);
+    const defaultModelValue = this.getDefaultModelOption(key);
+    return manager.get(key, defaultModelValue);
+  }
+  getModelNames() {
+    return Object.keys(this.modelOptions);
+  }
+  hasModel(modelName) {
+    return modelName in this.modelOptions;
+  }
+  getModelJsonSchema(modelName) {
+    return this.modelJsonSchemas[modelName];
+  }
+  createDataOptions(dataName) {
+    const manager = new OptionsManager({
+      ...defaultDataOptions,
+      dataName
+    });
+    manager.onchange("basePath", function(newval, key, target) {
+      target[key] = normalizeBasePath(
+        dataName,
+        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+      );
+    }).build();
+    return manager;
+  }
+  getOrCreateDataOptions(dataName) {
+    let manager = this.dataOptions[dataName];
+    if (!manager) {
+      manager = this.createDataOptions(dataName);
+      this.dataOptions[dataName] = manager;
+    }
+    return manager;
+  }
+  setDataOptions(dataName, options) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const currentDataOptions = manager.fetch();
+    manager.assign({ ...currentDataOptions, ...options });
+  }
+  setDataOption(dataName, key, value) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    manager.set(key, value);
+  }
+  getDataOptions(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return manager.fetch();
+  }
+  getDataOption(dataName, key, defaultValue) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return getNestedOption(manager, key, defaultValue);
+  }
+  getExactDataOption(dataName, key) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    return manager.get(key);
+  }
+  getDataNames() {
+    return Object.keys(this.dataOptions);
+  }
+  ensureModelMeta(modelName) {
+    if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
+      return;
+    }
+    const model = this.getModelInstance(modelName);
+    if (!model) {
+      this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
+      this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
+      this.modelAtts[modelName] = this.modelAtts[modelName] ?? [];
+      return;
+    }
+    const schema = model.schema;
+    this.modelRefs[modelName] = buildRefs(schema.tree);
+    this.modelSubs[modelName] = buildSubPaths(schema.tree);
+    this.modelAtts[modelName] = (0, import_utils7.keys)(schema.obj);
+  }
+  getModelRef(modelName, refPath) {
+    this.ensureModelMeta(modelName);
+    const value = (0, import_utils7.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils7.isString)(value) ? value : null;
+  }
+  getModelSub(modelName) {
+    this.ensureModelMeta(modelName);
+    return (0, import_utils7.get)(this.modelSubs, modelName, []);
+  }
+  getModelAtt(modelName) {
+    this.ensureModelMeta(modelName);
+    return (0, import_utils7.get)(this.modelAtts, modelName, []);
+  }
+};
+var defaultRuntime = new AccessRuntime();
+
+// src/runtime-context.ts
+var import_node_async_hooks = require("async_hooks");
+var runtimeStorage = new import_node_async_hooks.AsyncLocalStorage();
+function getActiveRuntime() {
+  return runtimeStorage.getStore() ?? null;
+}
+
+// src/options/global-options.ts
+var getRuntime = () => getActiveRuntime() ?? defaultRuntime;
+var getGlobalOption = (key, defaultValue) => {
+  return getRuntime().getGlobalOption(key, defaultValue);
+};
+
+// src/validation/common.ts
+var import_zod2 = require("zod");
+var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
+var safeIntegerString = (min, message) => import_zod2.z.string().regex(/^\d+$/, message).refine((value) => Number.isSafeInteger(Number(value)), "Expected a safe integer").refine((value) => Number(value) >= min, message);
+var queryBooleanString = import_zod2.z.enum(["true", "false"]);
+var nonNegativeIntegerString = safeIntegerString(0, "Expected a non-negative integer");
+var positiveIntegerString = safeIntegerString(1, "Expected a positive integer");
+var nonNegativeIntegerSchema = import_zod2.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var positiveIntegerSchema = import_zod2.z.number().int().min(1).max(Number.MAX_SAFE_INTEGER);
+var unknownRecord = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
+var projectionObjectSchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(-1)]));
+var projectionSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), projectionObjectSchema]);
+var sortOrderSchema = import_zod2.z.union([
+  import_zod2.z.literal(-1),
+  import_zod2.z.literal(1),
+  import_zod2.z.literal("asc"),
+  import_zod2.z.literal("ascending"),
+  import_zod2.z.literal("desc"),
+  import_zod2.z.literal("descending")
 ]);
-var sortSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.record(import_zod.z.string(), sortOrderSchema),
-  import_zod.z.array(import_zod.z.tuple([import_zod.z.string(), sortOrderSchema])),
-  import_zod.z.null()
+var sortSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.record(import_zod2.z.string(), sortOrderSchema),
+  import_zod2.z.array(import_zod2.z.tuple([import_zod2.z.string(), sortOrderSchema])),
+  import_zod2.z.null()
 ]);
-var populateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var populateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional(),
-        match: import_zod.z.unknown().optional(),
-        access: import_zod.z.enum(["list", "read"]).optional()
+        match: import_zod2.z.unknown().optional(),
+        access: import_zod2.z.enum(["list", "read"]).optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional(),
-    match: import_zod.z.unknown().optional(),
-    access: import_zod.z.enum(["list", "read"]).optional()
+    match: import_zod2.z.unknown().optional(),
+    access: import_zod2.z.enum(["list", "read"]).optional()
   }).passthrough()
 ]);
-var subPopulateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var subPopulateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional()
   }).passthrough()
 ]);
-var includeItemSchema = import_zod.z.object({
-  model: import_zod.z.string().min(1),
-  op: import_zod.z.enum(["list", "read", "count"]),
-  path: import_zod.z.string().min(1),
-  filter: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
-  localField: import_zod.z.string().min(1),
-  foreignField: import_zod.z.string().min(1),
-  args: import_zod.z.unknown().optional(),
-  options: import_zod.z.unknown().optional()
+var includeItemSchema = import_zod2.z.object({
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.enum(["list", "read", "count"]),
+  path: import_zod2.z.string().min(1),
+  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+  localField: import_zod2.z.string().min(1),
+  foreignField: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown().optional(),
+  options: import_zod2.z.unknown().optional()
 }).passthrough();
-var includeSchema = import_zod.z.union([includeItemSchema, import_zod.z.array(includeItemSchema)]);
-var fieldsSchema = import_zod.z.array(import_zod.z.string().min(1));
-var taskSchema = import_zod.z.object({
-  type: import_zod.z.string().min(1),
-  args: import_zod.z.unknown(),
+var includeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
+var fieldsSchema = import_zod2.z.array(import_zod2.z.string().min(1));
+var taskSchema = import_zod2.z.object({
+  type: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown(),
   options: unknownRecord.optional()
 });
-var tasksSchema = import_zod.z.union([taskSchema, import_zod.z.array(taskSchema)]);
-var objectOrArraySchema = import_zod.z.union([import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()), import_zod.z.array(import_zod.z.unknown())]);
-function rejectKeys(body, ctx, keys) {
-  for (const key of keys) {
+var tasksSchema = import_zod2.z.union([taskSchema, import_zod2.z.array(taskSchema)]);
+var objectOrArraySchema = import_zod2.z.union([import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()), import_zod2.z.array(import_zod2.z.unknown())]);
+function rejectKeys(body, ctx, keys2) {
+  for (const key of keys2) {
     if (key in body) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `Unsupported field: ${key}`,
         path: [key]
       });
@@ -231,6 +1113,10 @@ function parsePathParam(value, parameter) {
   return param;
 }
 function parseQuery(schema, value) {
+  const complexityErrors = validateRequestComplexity(value, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value);
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "parameter");
@@ -238,6 +1124,10 @@ function parseQuery(schema, value) {
   return result.data;
 }
 function parseBody(schema, value) {
+  const complexityErrors = validateRequestComplexity(value ?? {}, getGlobalOption("requestComplexity"), "request");
+  if (complexityErrors.length > 0) {
+    throw new clientErrors.BadRequestError("Bad Request", { errors: complexityErrors });
+  }
   const result = schema.safeParse(value ?? {});
   if (!result.success) {
     throwValidationError(normalizeIssues(result.error.issues), void 0, "pointer");
@@ -580,133 +1470,130 @@ function buildPointer(path) {
 }
 
 // src/validation/model-router.ts
-var import_zod2 = require("zod");
-var listQuerySchema = import_zod2.z.object({
-  skip: positiveIntegerString.optional(),
+var import_zod3 = require("zod");
+var listQuerySchema = import_zod3.z.object({
+  skip: nonNegativeIntegerString.optional(),
   limit: positiveIntegerString.optional(),
-  page: positiveIntegerString.optional(),
+  page: nonNegativeIntegerString.optional(),
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
   include_count: queryBooleanString.optional(),
   include_extra_headers: queryBooleanString.optional()
 }).passthrough();
-var createQuerySchema = import_zod2.z.object({
+var createQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var readQuerySchema = import_zod2.z.object({
+var readQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional(),
   try_list: queryBooleanString.optional()
 }).passthrough();
-var updateQuerySchema = import_zod2.z.object({
+var updateQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var upsertQuerySchema = import_zod2.z.object({
+var upsertQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var listBodySchema = import_zod2.z.object({
+var listBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    includeCount: import_zod2.z.boolean().optional(),
-    includeExtraHeaders: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  skip: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod3.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod3.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    includeCount: import_zod3.z.boolean().optional(),
+    includeExtraHeaders: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = import_zod2.z.object({
-  filter: objectOrArraySchema.optional(),
-  options: import_zod2.z.object({
-    access: import_zod2.z.unknown().optional()
-  }).passthrough().optional()
-}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
-var readFilterBodySchema = import_zod2.z.object({
+var countBodySchema = import_zod3.z.object({
+  filter: objectOrArraySchema.optional()
+}).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access", "options"]));
+var readFilterBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var readByIdBodySchema = import_zod2.z.object({
+var readByIdBodySchema = import_zod3.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var advancedCreateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var advancedCreateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var createBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var createBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var updateBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpdateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var updateBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpdateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var upsertBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpsertBodySchema = import_zod2.z.object({
-  data: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
+var upsertBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpsertBodySchema = import_zod3.z.object({
+  data: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var distinctBodySchema = import_zod2.z.object({
+var distinctBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = import_zod2.z.object({
-  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+var subListBodySchema = import_zod3.z.object({
+  filter: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
   select: fieldsSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var subMutationBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var subReadBodySchema = import_zod2.z.object({
+var subReadBodySchema = import_zod3.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
@@ -719,54 +1606,54 @@ var requestSchemas = {
 };
 
 // src/validation/data-router.ts
-var import_zod3 = require("zod");
-var dataListBodySchema = import_zod3.z.object({
+var import_zod4 = require("zod");
+var dataListBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
-  sort: import_zod3.z.string().optional(),
-  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod3.z.object({
-    includeCount: import_zod3.z.boolean().optional(),
-    includeExtraHeaders: import_zod3.z.boolean().optional()
+  sort: import_zod4.z.string().optional(),
+  skip: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod4.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod4.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod4.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod4.z.object({
+    includeCount: import_zod4.z.boolean().optional(),
+    includeExtraHeaders: import_zod4.z.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
-var dataReadFilterBodySchema = import_zod3.z.object({
+var dataReadFilterBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
-var dataReadByIdBodySchema = import_zod3.z.object({
+var dataReadByIdBodySchema = import_zod4.z.object({
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
 
 // src/validation/root-router.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 var rootEntryBaseSchema = {
-  target: import_zod4.z.enum(["model", "data"]),
-  name: import_zod4.z.string().min(1),
-  order: import_zod4.z.number().int().optional()
+  target: import_zod5.z.enum(["model", "data"]),
+  name: import_zod5.z.string().min(1),
+  order: nonNegativeIntegerSchema.optional()
 };
-var rootModelListArgsSchema = import_zod4.z.object({
+var rootModelListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelListOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  includeCount: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelListOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  includeCount: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelReadArgsSchema = import_zod4.z.object({
+var rootModelReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
@@ -775,203 +1662,214 @@ var rootModelReadArgsSchema = import_zod4.z.object({
 var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
   sort: sortSchema.optional()
 });
-var rootModelReadOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  tryList: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelReadOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  tryList: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelCreateArgsSchema = import_zod4.z.object({
+var rootModelCreateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelCreateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelCreateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
-var rootModelUpdateArgsSchema = import_zod4.z.object({
+var rootModelUpdateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelUpdateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  returningAll: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelUpdateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  returningAll: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;
-var rootModelSubListArgsSchema = import_zod4.z.object({
+var rootModelSubListArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional()
 }).passthrough();
-var rootModelSubReadArgsSchema = import_zod4.z.object({
+var rootModelSubReadArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = import_zod4.z.object({
-  access: import_zod4.z.unknown().optional()
-}).passthrough();
-var rootDataListArgsSchema = import_zod4.z.object({
+var rootModelCountOptionsSchema = import_zod5.z.object({}).strict().optional();
+var rootDataListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
-  sort: import_zod4.z.string().optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  sort: import_zod5.z.string().optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  limit: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, nonNegativeIntegerString]).optional(),
+  pageSize: import_zod5.z.union([positiveIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
-var rootDataListOptionsSchema = import_zod4.z.object({
-  includeCount: import_zod4.z.boolean().optional()
+var rootDataListOptionsSchema = import_zod5.z.object({
+  includeCount: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootDataReadArgsSchema = import_zod4.z.object({
+var rootDataReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional()
 }).passthrough();
-var rootModelQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("new") }).passthrough(),
-  import_zod4.z.object({
+var rootModelNewArgsSchema = import_zod5.z.object({
+  select: projectionSchema.optional()
+}).passthrough();
+var rootModelNewOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional()
+}).passthrough();
+var rootModelQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("new"),
+    args: rootModelNewArgsSchema.optional(),
+    options: rootModelNewOptionsSchema.optional()
+  }).passthrough(),
+  import_zod5.z.object({
+    ...rootEntryBaseSchema,
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootModelListArgsSchema.optional(),
     options: rootModelListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootModelReadArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootModelReadFilterArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("create"),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("create"),
+    data: import_zod5.z.unknown(),
     args: rootModelCreateArgsSchema.optional(),
     options: rootModelCreateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("update"),
-    id: import_zod4.z.string().min(1),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("update"),
+    id: import_zod5.z.string().min(1),
+    data: import_zod5.z.unknown(),
     args: rootModelUpdateArgsSchema.optional(),
     options: rootModelUpdateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("upsert"),
-    data: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("upsert"),
+    data: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()),
     args: rootModelUpsertArgsSchema.optional(),
     options: rootModelUpsertOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("delete"), id: import_zod4.z.string().min(1) }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("delete"), id: import_zod5.z.string().min(1) }).passthrough(),
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subList"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    filter: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subList"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    filter: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional(),
     args: rootModelSubListArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subRead"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subRead"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
     args: rootModelSubReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subCreate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subCreate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subBulkUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subBulkUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subDelete"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1)
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subDelete"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1)
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("distinct"),
-    field: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("distinct"),
+    field: import_zod5.z.string().min(1),
     filter: objectOrArraySchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("count"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
-  }).passthrough()
+  }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["access"]))
 ]);
-var rootDataQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({
+var rootDataQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootDataListArgsSchema.optional(),
     options: rootDataListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootDataReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = import_zod4.z.array(import_zod4.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Codes,