@web-ts-toolkit/access-router 0.4.0 → 0.5.0

package/index.js

@@ -36,6 +36,7 @@ __export(index_exports, {
   acl: () => acl,
   combineRoutes: () => combineRoutes,
   createAccessRuntime: () => createAccessRuntime,
+  createOpenApiRouter: () => createOpenApiRouter,
   default: () => index_default,
   defineRequestSchema: () => defineRequestSchema,
   fromAjv: () => fromAjv,
@@ -66,19 +67,19 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils22 = require("@web-ts-toolkit/utils");
+var import_utils27 = require("@web-ts-toolkit/utils");
 
 // src/middleware.ts
 var import_express_json_router2 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils17 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 
 // src/core.ts
-var import_utils16 = require("@web-ts-toolkit/utils");
+var import_utils19 = require("@web-ts-toolkit/utils");
 
 // src/runtime.ts
-var import_mongoose2 = __toESM(require("mongoose"));
+var import_mongoose3 = __toESM(require("mongoose"));
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-var import_utils7 = require("@web-ts-toolkit/utils");
+var import_utils10 = require("@web-ts-toolkit/utils");
 
 // src/helpers/collection.ts
 var import_sift = __toESM(require("sift"));
@@ -97,20 +98,11 @@ var findElementById = (collection, id) => {
 };
 
 // src/helpers/document.ts
-var import_utils4 = require("@web-ts-toolkit/utils");
-
-// src/lib.ts
 var import_mongoose = require("mongoose");
-var import_utils2 = require("@web-ts-toolkit/utils");
-var isSchema = (val) => val instanceof import_mongoose.Schema;
-var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose.Schema.Types.ObjectId;
-var isReference = (val) => (0, import_utils2.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
-var isDocument = function isDocument2(doc) {
-  return doc instanceof import_mongoose.Document;
-};
+var import_utils3 = require("@web-ts-toolkit/utils");
 
 // src/helpers/query.ts
-var import_utils3 = require("@web-ts-toolkit/utils");
+var import_utils2 = require("@web-ts-toolkit/utils");
 function genPagination({
   skip,
   limit,
@@ -119,10 +111,10 @@ function genPagination({
 }, hardLimit) {
   let _skip = 0;
   let _limit = Number(limit ?? pageSize);
-  if ((0, import_utils3.isNaN)(_limit) || _limit > hardLimit) _limit = hardLimit;
-  if (!(0, import_utils3.isNil)(skip)) {
+  if ((0, import_utils2.isNaN)(_limit) || _limit > hardLimit) _limit = hardLimit;
+  if (!(0, import_utils2.isNil)(skip)) {
     _skip = Number(skip);
-  } else if (!(0, import_utils3.isNil)(page)) {
+  } else if (!(0, import_utils2.isNil)(page)) {
     const npage = Number(page);
     if (npage > 1) _skip = (npage - 1) * _limit;
   }
@@ -137,9 +129,9 @@ function parseSortString(sortString) {
   }
 }
 function normalizeSelect(select) {
-  if (Array.isArray(select)) return (0, import_utils3.flattenDeep)(select.map(normalizeSelect));
-  if ((0, import_utils3.isPlainObject)(select)) {
-    return (0, import_utils3.reduce)(
+  if (Array.isArray(select)) return (0, import_utils2.flattenDeep)(select.map(normalizeSelect));
+  if ((0, import_utils2.isPlainObject)(select)) {
+    return (0, import_utils2.reduce)(
       select,
       (ret, val, key) => {
         if (val === 1) ret.push(key);
@@ -149,23 +141,27 @@ function normalizeSelect(select) {
       []
     );
   }
-  if ((0, import_utils3.isString)(select)) return select.split(" ").map((v) => v.trim());
+  if ((0, import_utils2.isString)(select)) return select.split(" ").map((v) => v.trim());
   return [];
 }
 
 // src/helpers/document.ts
-function getDocValue(doc, path, defalutValue) {
+var import_utils4 = require("@web-ts-toolkit/utils");
+function isDocument(doc) {
+  return doc instanceof import_mongoose.Document;
+}
+function getDocValue(doc, path, defaultValue) {
   if (isDocument(doc)) {
-    return (0, import_utils4.get)(doc._doc, path, defalutValue);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    return (0, import_utils4.get)(doc, path, defalutValue);
+    return (0, import_utils3.get)(doc._doc, path, defaultValue);
+  } else if ((0, import_utils3.isPlainObject)(doc)) {
+    return (0, import_utils3.get)(doc, path, defaultValue);
   }
 }
 function setDocValue(doc, path, value) {
   if (isDocument(doc)) {
-    (0, import_utils4.set)(doc._doc, path, value);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    (0, import_utils4.set)(doc, path, value);
+    (0, import_utils3.set)(doc._doc, path, value);
+  } else if ((0, import_utils3.isPlainObject)(doc)) {
+    (0, import_utils3.set)(doc, path, value);
   }
 }
 function getDocPermissions(modelName, doc) {
@@ -177,10 +173,10 @@ function toObject(doc) {
 }
 function pickDocFields(doc, fields = []) {
   if (isDocument(doc)) {
-    doc._doc = (0, import_utils4.pick)(doc._doc, fields);
+    doc._doc = (0, import_utils3.pick)(doc._doc, fields);
     return doc;
   } else {
-    return (0, import_utils4.pick)(doc, fields);
+    return (0, import_utils3.pick)(doc, fields);
   }
 }
 async function populateDoc(doc, target) {
@@ -253,35 +249,47 @@ function handleResultError(result) {
 }
 
 // src/helpers/index.ts
+var import_utils6 = require("@web-ts-toolkit/utils");
+
+// src/lib.ts
+var import_mongoose2 = require("mongoose");
 var import_utils5 = require("@web-ts-toolkit/utils");
+var isSchema = (val) => val instanceof import_mongoose2.Schema;
+var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose2.Schema.Types.ObjectId;
+var isReference = (val) => (0, import_utils5.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
+var isDocument2 = function isDocument3(doc) {
+  return doc instanceof import_mongoose2.Document;
+};
+
+// src/helpers/index.ts
 function recurseObject(obj) {
   if (isSchema(obj)) {
     return buildRefs(obj.tree);
   }
-  if (!(0, import_utils5.isObject)(obj)) return null;
+  if (!(0, import_utils6.isObject)(obj)) return null;
   if (isReference(obj)) {
     return obj.ref;
   }
   let ret = null;
-  (0, import_utils5.forEach)(obj, (val) => {
+  (0, import_utils6.forEach)(obj, (val) => {
     ret = recurseObject(val);
-    if (!(0, import_utils5.isEmpty)(ret)) {
+    if (!(0, import_utils6.isEmpty)(ret)) {
       return false;
     }
   });
   return ret;
 }
 function buildRefs(schema) {
-  if (!(0, import_utils5.isObject)(schema)) return {};
+  if (!(0, import_utils6.isObject)(schema)) return {};
   const references = {};
-  (0, import_utils5.forEach)(schema, (val, key) => {
+  (0, import_utils6.forEach)(schema, (val, key) => {
     const paths = recurseObject(val);
-    if (!(0, import_utils5.isEmpty)(paths)) {
+    if (!(0, import_utils6.isEmpty)(paths)) {
       references[key] = paths;
     }
-    const target = (0, import_utils5.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils5.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils5.isPlainObject)(target[0])) {
+    const target = (0, import_utils6.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils6.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils6.isPlainObject)(target[0])) {
         return;
       }
     }
@@ -289,12 +297,12 @@ function buildRefs(schema) {
   return references;
 }
 function buildSubPaths(schema) {
-  if (!(0, import_utils5.isObject)(schema)) return [];
+  if (!(0, import_utils6.isObject)(schema)) return [];
   const subPaths = [];
-  (0, import_utils5.forEach)(schema, (val, key) => {
-    const target = (0, import_utils5.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils5.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils5.isPlainObject)(target[0]) && !isReference(target[0])) {
+  (0, import_utils6.forEach)(schema, (val, key) => {
+    const target = (0, import_utils6.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils6.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils6.isPlainObject)(target[0]) && !isReference(target[0])) {
         subPaths.push(key);
       }
     }
@@ -302,11 +310,11 @@ function buildSubPaths(schema) {
   return subPaths;
 }
 async function iterateQuery(query, handler) {
-  if (!(0, import_utils5.isPlainObject)(query)) return query;
-  if (!handler) return import_utils5.noop;
+  if (!(0, import_utils6.isPlainObject)(query)) return query;
+  if (!handler) return query;
   const queryObject = query;
-  return (0, import_utils5.mapValuesAsync)(queryObject, async (val, key) => {
-    if ((0, import_utils5.isPlainObject)(val)) {
+  return (0, import_utils6.mapValuesAsync)(queryObject, async (val, key) => {
+    if ((0, import_utils6.isPlainObject)(val)) {
       const plainValue = val;
       if (plainValue.$$sq) {
         return handler(0 /* SubQuery */, plainValue.$$sq, key);
@@ -316,7 +324,7 @@ async function iterateQuery(query, handler) {
         return iterateQuery(val, handler);
       }
     }
-    if ((0, import_utils5.isArray)(val)) {
+    if ((0, import_utils6.isArray)(val)) {
       return Promise.all(val.map((v) => iterateQuery(v, handler)));
     }
     return val;
@@ -325,13 +333,259 @@ async function iterateQuery(query, handler) {
 var createValidator = (fn) => {
   const stringHandler = (key) => key.trim().split(" ").every((v) => fn(v));
   const arrayHandler = (arr) => arr.some((item) => {
-    if ((0, import_utils5.isString)(item)) return stringHandler(item);
-    else if ((0, import_utils5.isArray)(item)) return arrayHandler(item);
+    if ((0, import_utils6.isString)(item)) return stringHandler(item);
+    else if ((0, import_utils6.isArray)(item)) return arrayHandler(item);
     else return false;
   });
   return { stringHandler, arrayHandler };
 };
 
+// src/openapi/build-spec.ts
+var import_utils8 = require("@web-ts-toolkit/utils");
+
+// src/openapi/responses.ts
+var json = (schema) => ({
+  content: {
+    "application/json": {
+      schema
+    }
+  }
+});
+var problemJson = {
+  content: {
+    "application/problem+json": {
+      schema: {
+        type: "object",
+        properties: {
+          type: { type: "string" },
+          title: { type: "string" },
+          status: { type: "number" },
+          detail: { type: "string" },
+          errors: { type: "array", items: {} }
+        },
+        additionalProperties: true
+      }
+    }
+  }
+};
+var genericDataSchema = { type: "object", additionalProperties: true };
+var genericListSchema = { type: "array", items: genericDataSchema };
+var openApiResponses = {
+  single(description = "Success") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  list(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  create(description = "Created") {
+    return {
+      201: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  delete(description = "Deleted") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  batch(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  }
+};
+
+// src/openapi/schemas.ts
+var import_zod = require("zod");
+var import_utils7 = require("@web-ts-toolkit/utils");
+var fallbackObjectSchema = { type: "object", additionalProperties: true };
+function patchOpenApiObjectSchema(source, properties) {
+  return {
+    kind: "objectProperties",
+    source,
+    properties
+  };
+}
+function defineOpenApiSchemaResolver(resolve) {
+  return {
+    kind: "schemaResolver",
+    resolve
+  };
+}
+function getNestedOpenApiSchemaDataSource(source) {
+  return (0, import_utils7.isPlainObject)(source) && "data" in source ? source.data : void 0;
+}
+function unwrapNestedOpenApiSchemaSource(source, fallback) {
+  if ((0, import_utils7.isPlainObject)(source) && ("default" in source || "data" in source)) {
+    return source.default ?? fallback;
+  }
+  return source ?? fallback;
+}
+function isOpenApiSchemaPatch(source) {
+  return (0, import_utils7.isPlainObject)(source) && source.kind === "objectProperties";
+}
+function isOpenApiSchemaResolver(source) {
+  return (0, import_utils7.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+}
+function isJsonSchemaLike(source) {
+  return (0, import_utils7.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+}
+function hasOpenApiSchema(source) {
+  return (0, import_utils7.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
+}
+function toOpenApiSchema(source) {
+  if (!source) return void 0;
+  const resolvedSource = isOpenApiSchemaResolver(source) ? source.resolve() : source;
+  if (!resolvedSource) return void 0;
+  if (isOpenApiSchemaPatch(resolvedSource)) {
+    const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
+    const properties = (0, import_utils7.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
+    for (const [key, value] of Object.entries(resolvedSource.properties)) {
+      properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
+    }
+    return {
+      ...schema,
+      type: schema.type ?? "object",
+      properties
+    };
+  }
+  if (hasOpenApiSchema(resolvedSource)) {
+    return resolvedSource.openapi;
+  }
+  if (isJsonSchemaLike(resolvedSource)) {
+    return resolvedSource;
+  }
+  try {
+    return import_zod.z.toJSONSchema(resolvedSource);
+  } catch {
+    return fallbackObjectSchema;
+  }
+}
+
+// src/openapi/build-spec.ts
+var openApiMediaType = "application/json";
+var normalizePath = (path) => {
+  if (!path) return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+};
+var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+var schemaToQueryParameters = (schema) => {
+  const jsonSchema = toOpenApiSchema(schema);
+  if (!jsonSchema || jsonSchema.type !== "object") return [];
+  const properties = (0, import_utils8.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
+  const required = new Set(
+    (0, import_utils8.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+  );
+  return Object.entries(properties).map(([name, value]) => ({
+    name,
+    in: "query",
+    required: required.has(name),
+    schema: value
+  }));
+};
+var schemaToPathParameters = (path, pathParams) => {
+  const names = [...toOpenApiPath(path).matchAll(/\{([^}]+)\}/g)].map((item) => item[1]);
+  return names.map((name) => ({
+    name,
+    in: "path",
+    required: true,
+    schema: (pathParams && name in pathParams ? toOpenApiSchema(pathParams[name]) : void 0) ?? { type: "string" }
+  }));
+};
+var getDefaultResponses = (route) => {
+  if (route.operationId === "root.query") return openApiResponses.batch();
+  if (route.method === "delete") return openApiResponses.delete();
+  if (route.operationId?.toLowerCase().includes("create")) return openApiResponses.create();
+  if (route.operationId?.toLowerCase().includes("list")) return openApiResponses.list();
+  if (route.operationId?.toLowerCase().includes("distinct")) return openApiResponses.list();
+  return openApiResponses.single();
+};
+var buildOperation = (route) => {
+  const queryParameters = schemaToQueryParameters(route.query);
+  const pathParameters = schemaToPathParameters(route.path, route.pathParams);
+  const bodySchema = toOpenApiSchema(route.body);
+  const responses = route.responses ?? getDefaultResponses(route);
+  const operation = {
+    operationId: route.operationId,
+    summary: route.summary,
+    description: route.description,
+    tags: route.tags,
+    deprecated: route.deprecated,
+    responses
+  };
+  const parameters = [...pathParameters, ...queryParameters];
+  if (parameters.length) {
+    operation.parameters = parameters;
+  }
+  if (bodySchema) {
+    operation.requestBody = {
+      required: true,
+      content: {
+        [openApiMediaType]: {
+          schema: bodySchema
+        }
+      }
+    };
+  }
+  if (route.acl) {
+    operation["x-access-router-acl"] = route.acl;
+  }
+  return operation;
+};
+function buildOpenApiSpec(routes, options) {
+  const paths = {};
+  const { servers, ...info } = options;
+  for (const route of routes) {
+    const path = toOpenApiPath(route.path);
+    if (!paths[path]) {
+      paths[path] = {};
+    }
+    paths[path][route.method] = buildOperation(route);
+  }
+  return {
+    openapi: "3.1.0",
+    info,
+    servers,
+    paths
+  };
+}
+
+// src/openapi/registry.ts
+var OpenApiRegistry = class {
+  constructor() {
+    this.routes = [];
+  }
+  register(route) {
+    const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
+    if (existingIndex === -1) {
+      this.routes.push(route);
+      return;
+    }
+    this.routes[existingIndex] = route;
+  }
+  getRoutes() {
+    return [...this.routes];
+  }
+  getSpec(info) {
+    return buildOpenApiSpec(this.routes, info);
+  }
+};
+
 // src/logger-default.ts
 var import_node_util = __toESM(require("util"));
 var import_winston = require("winston");
@@ -359,7 +613,7 @@ var defaultLogger = (0, import_winston.createLogger)({
 });
 
 // src/options/manager.ts
-var import_utils6 = require("@web-ts-toolkit/utils");
+var import_utils9 = require("@web-ts-toolkit/utils");
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -396,26 +650,26 @@ var OptionsManager = class {
     return this;
   }
   get(key, defaultValue) {
-    return (0, import_utils6.get)(this.currentOptions, key, defaultValue);
+    return (0, import_utils9.get)(this.currentOptions, key, defaultValue);
   }
   set(key, value) {
-    (0, import_utils6.set)(this.currentOptions, key, value);
+    (0, import_utils9.set)(this.currentOptions, key, value);
   }
   fetch() {
     return { ...this.currentOptions };
   }
   assign(options) {
-    (0, import_utils6.assign)(this.currentOptions, options);
+    (0, import_utils9.assign)(this.currentOptions, options);
   }
   onchange(key, func) {
-    (0, import_utils6.set)(this.listeners, key, func);
+    (0, import_utils9.set)(this.listeners, key, func);
     return this;
   }
 };
 
 // src/runtime.ts
-(0, import_mongoose_schema_jsonschema.default)(import_mongoose2.default);
-var pluralize = import_mongoose2.default.pluralize();
+(0, import_mongoose_schema_jsonschema.default)(import_mongoose3.default);
+var pluralize = import_mongoose3.default.pluralize();
 var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
 var defaultModelOptions = {
   basePath: null,
@@ -426,44 +680,44 @@ var defaultDataOptions = {
   queryRouteSegment: "__query"
 };
 var normalizeBasePath = (name, value) => {
-  if ((0, import_utils7.isNil)(value)) {
+  if ((0, import_utils10.isNil)(value)) {
     return `/${pluralize(name)}`;
   }
-  return (0, import_utils7.isString)(value) ? (0, import_utils7.addLeadingSlash)(value) : "";
+  return (0, import_utils10.isString)(value) ? (0, import_utils10.addLeadingSlash)(value) : "";
 };
 var hasModelPermission = (value, modelPermissionPrefix) => {
   if (!modelPermissionPrefix) {
     return true;
   }
-  if ((0, import_utils7.isString)(value)) {
+  if ((0, import_utils10.isString)(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if ((0, import_utils7.isArray)(value)) {
+  if ((0, import_utils10.isArray)(value)) {
     return value.some((item) => {
-      if ((0, import_utils7.isString)(item) || (0, import_utils7.isArray)(item)) {
+      if ((0, import_utils10.isString)(item) || (0, import_utils10.isArray)(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
     });
   }
-  return (0, import_utils7.isFunction)(value);
+  return (0, import_utils10.isFunction)(value);
 };
 var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const schemaKeys = Object.keys(permissionSchema);
   const globalPermissionKeys = {};
   const modelPermissionKeys = {};
-  (0, import_utils7.forEach)(schemaKeys, (schemaKey) => {
+  (0, import_utils10.forEach)(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = (0, import_utils7.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = (0, import_utils10.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!(0, import_utils7.isArray)(globalPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!(0, import_utils7.isArray)(modelPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
-      if ((0, import_utils7.isBoolean)(value)) {
+      if ((0, import_utils10.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
         return;
       }
@@ -504,6 +758,16 @@ var AccessRuntime = class {
     this.modelRefs = {};
     this.modelSubs = {};
     this.modelAtts = {};
+    this.openApiRegistry = new OpenApiRegistry();
+  }
+  registerOpenApiRoute(route) {
+    this.openApiRegistry.register(route);
+  }
+  getOpenApiRoutes() {
+    return this.openApiRegistry.getRoutes();
+  }
+  getOpenApiSpec(info) {
+    return this.openApiRegistry.getSpec(info);
   }
   setGlobalOptions(options) {
     this.globalOptions.assign(options);
@@ -530,7 +794,7 @@ var AccessRuntime = class {
     return this.defaultModelOptions.get(key, defaultValue);
   }
   createModelOptions(modelName) {
-    const model = import_mongoose2.default.model(modelName);
+    const model = import_mongoose3.default.model(modelName);
     const manager = new OptionsManager({
       ...defaultModelOptions,
       modelName
@@ -547,7 +811,7 @@ var AccessRuntime = class {
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
-        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -605,7 +869,7 @@ var AccessRuntime = class {
     manager.onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         dataName,
-        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     return manager;
@@ -646,7 +910,7 @@ var AccessRuntime = class {
     if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
       return;
     }
-    const model = import_mongoose2.default.models[modelName];
+    const model = import_mongoose3.default.models[modelName];
     if (!model) {
       this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
       this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
@@ -656,26 +920,26 @@ var AccessRuntime = class {
     const schema = model.schema;
     this.modelRefs[modelName] = buildRefs(schema.tree);
     this.modelSubs[modelName] = buildSubPaths(schema.tree);
-    this.modelAtts[modelName] = (0, import_utils7.keys)(schema.obj);
+    this.modelAtts[modelName] = (0, import_utils10.keys)(schema.obj);
   }
   getModelRef(modelName, refPath) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils10.get)(this.modelRefs, `${modelName}.${refPath}`, null);
   }
   getModelSub(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelSubs, modelName, []);
+    return (0, import_utils10.get)(this.modelSubs, modelName, []);
   }
   getModelAtt(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelAtts, modelName, []);
+    return (0, import_utils10.get)(this.modelAtts, modelName, []);
   }
 };
 var defaultRuntime = new AccessRuntime();
 
 // src/runtime-context.ts
 var import_node_async_hooks = require("async_hooks");
-var import_mongoose3 = __toESM(require("mongoose"));
+var import_mongoose4 = __toESM(require("mongoose"));
 var ACCESS_RUNTIME = /* @__PURE__ */ Symbol("access-runtime");
 var runtimeStorage = new import_node_async_hooks.AsyncLocalStorage();
 function runWithRuntime(runtime, callback) {
@@ -685,13 +949,13 @@ function getActiveRuntime() {
   return runtimeStorage.getStore() ?? null;
 }
 function attachRuntimeToModel(modelName, runtime) {
-  const model = import_mongoose3.default.models[modelName];
+  const model = import_mongoose4.default.models[modelName];
   if (model) {
     model[ACCESS_RUNTIME] = runtime;
   }
 }
 function getRuntimeForModelName(modelName) {
-  const model = import_mongoose3.default.models[modelName];
+  const model = import_mongoose4.default.models[modelName];
   return model?.[ACCESS_RUNTIME] ?? null;
 }
 
@@ -768,16 +1032,16 @@ var getModelSub = (modelName) => {
 };
 
 // src/services/base.ts
-var import_utils8 = require("@web-ts-toolkit/utils");
+var import_utils11 = require("@web-ts-toolkit/utils");
 function validateClientFilter(filter2) {
   const errors = [];
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils8.isArray)(value)) {
+    if ((0, import_utils11.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils8.isPlainObject)(value)) return;
+    if (!(0, import_utils11.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -872,17 +1136,17 @@ var Base = class {
     return validateClientFilter(filter2);
   }
   processInclude(include) {
-    const includes = (0, import_utils8.compact)((0, import_utils8.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
+    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
       return model && op && path && localField && foreignField;
     });
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils8.forEach)(includes, (inc) => {
+    (0, import_utils11.forEach)(includes, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils8.uniq)((0, import_utils8.compact)(includeLocalFields));
-    includePaths = (0, import_utils8.uniq)((0, import_utils8.compact)(includePaths));
+    includeLocalFields = (0, import_utils11.uniq)((0, import_utils11.compact)(includeLocalFields));
+    includePaths = (0, import_utils11.uniq)((0, import_utils11.compact)(includePaths));
     return {
       includes,
       includeLocalFields,
@@ -891,9 +1155,9 @@ var Base = class {
   }
   async includeDocs(docs, include) {
     if (!include) return docs;
-    const includes = (0, import_utils8.compact)((0, import_utils8.castArray)(include));
+    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils8.isArray)(docs);
+    const isSingle = !(0, import_utils11.isArray)(docs);
     if (isSingle) docs = [docs];
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -910,10 +1174,10 @@ var Base = class {
     const svc = this.req.macl.getPublicService(model);
     if (!svc) return docs;
     const includeLocalValues = [];
-    (0, import_utils8.forEach)(docs, (doc, i) => {
-      includeLocalValues.push((0, import_utils8.get)(doc, localField));
+    (0, import_utils11.forEach)(docs, (doc, i) => {
+      includeLocalValues.push((0, import_utils11.get)(doc, localField));
     });
-    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils8.flatten)(includeLocalValues) } };
+    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils11.flatten)(includeLocalValues) } };
     const result = await svc.find(filter2, args, {
       ...options,
       lean: true,
@@ -923,8 +1187,8 @@ var Base = class {
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils8.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils8.intersectionBy)((0, import_utils8.castArray)(localValue), (0, import_utils8.castArray)((0, import_utils8.get)(row, foreignField)), String).length > 0;
+      const localValue = (0, import_utils11.get)(doc, localField);
+      const filterFn = (row) => (0, import_utils11.intersectionBy)((0, import_utils11.castArray)(localValue), (0, import_utils11.castArray)((0, import_utils11.get)(row, foreignField)), String).length > 0;
       const matches = result.data.filter(filterFn);
       setDocValue(doc, path, op === "list" ? matches : matches[0]);
     }
@@ -936,7 +1200,7 @@ var Base = class {
     if (!svc) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils8.get)(doc, localField);
+      const localValue = (0, import_utils11.get)(doc, localField);
       const filter2 = { ..._filters ?? {}, [foreignField]: localValue };
       const result = await svc.count(filter2);
       if (!result.success) continue;
@@ -978,28 +1242,45 @@ var Base = class {
     if (!result.success) return null;
     let ret = result.data;
     if (sqOptions.path) {
-      ret = (0, import_utils8.isArray)(ret) ? (0, import_utils8.flatten)(ret.map((v) => (0, import_utils8.get)(v, sqOptions.path))) : (0, import_utils8.get)(ret, sqOptions.path);
+      ret = (0, import_utils11.isArray)(ret) ? (0, import_utils11.flatten)(ret.map((v) => (0, import_utils11.get)(v, sqOptions.path))) : (0, import_utils11.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils8.compact)((0, import_utils8.castArray)(ret));
+      ret = (0, import_utils11.compact)((0, import_utils11.castArray)(ret));
     }
     return ret;
   }
-  async handleDate(val, key) {
+  handleDate(val, key) {
+    if (val instanceof Date) return val;
+    if (typeof val === "string" || typeof val === "number") return new Date(val);
     return /* @__PURE__ */ new Date();
   }
 };
 
 // src/services/service.ts
-var import_utils10 = require("@web-ts-toolkit/utils");
+var import_utils13 = require("@web-ts-toolkit/utils");
 var import_deep_diff = __toESM(require("deep-diff"));
 
 // src/model.ts
-var import_mongoose4 = __toESM(require("mongoose"));
+var import_mongoose5 = __toESM(require("mongoose"));
+
+// src/logger.ts
+var passthrough = (level) => (...args) => {
+  const globalLogger = getGlobalOption("logger");
+  const target = globalLogger?.[level] ?? defaultLogger[level];
+  return target.apply(globalLogger ?? defaultLogger, args);
+};
+var logger = {
+  debug: passthrough("debug"),
+  info: passthrough("info"),
+  warn: passthrough("warn"),
+  error: passthrough("error")
+};
+
+// src/model.ts
 var Model = class {
   constructor(modelName) {
     this.modelName = modelName;
-    this.model = import_mongoose4.default.model(modelName);
+    this.model = import_mongoose5.default.model(modelName);
     if (!this.model) return;
     this.model.schema.set("optimisticConcurrency", true);
     const currVersionKey = this.model.schema.get("versionKey");
@@ -1025,12 +1306,15 @@ var Model = class {
     if (lean) builder.lean();
     return builder;
   }
-  // See https://github.com/Automattic/mongoose/blob/65b2d12a8f85f86136cfaf32947f338ba0c5f451/lib/query.js#L3011
-  validateSort(sort, logError = console.error) {
+  validateSort(sort, logError = logger.error) {
     const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
+    const fieldPathPattern = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
+    const isValidFieldPath = (field) => fieldPathPattern.test(field);
     if (sort === null || sort === void 0) return true;
     if (typeof sort === "string") {
-      if (!/^[a-zA-Z0-9\s-]+/.test(sort)) {
+      const fields = sort.trim().split(/\s+/).filter(Boolean);
+      const isValid = fields.every((field) => isValidFieldPath(field.startsWith("-") ? field.slice(1) : field));
+      if (!isValid) {
         logError("Invalid sort string:", sort);
         return false;
       }
@@ -1043,8 +1327,8 @@ var Model = class {
           return false;
         }
         const [key, order] = pair;
-        if (typeof key !== "string") {
-          logError("Invalid sort array key: must be string", key);
+        if (typeof key !== "string" || !isValidFieldPath(key)) {
+          logError("Invalid sort array key: must be a field path string", key);
           return false;
         }
         if (!validSortOrders.includes(order)) {
@@ -1056,7 +1340,11 @@ var Model = class {
       return isValid;
     }
     if (typeof sort === "object" && !(sort instanceof Map)) {
-      const isValid = Object.values(sort).every((order) => {
+      const isValid = Object.entries(sort).every(([key, order]) => {
+        if (!isValidFieldPath(key)) {
+          logError("Invalid sort object key: must be a field path string", key);
+          return false;
+        }
         if (!validSortOrders.includes(order)) {
           logError('Invalid sort object value: must be 1, -1, "asc", or "desc"', order);
           return false;
@@ -1066,7 +1354,11 @@ var Model = class {
       return isValid;
     }
     if (sort instanceof Map) {
-      const isValid = Array.from(sort.values()).every((order) => {
+      const isValid = Array.from(sort.entries()).every(([key, order]) => {
+        if (!isValidFieldPath(key)) {
+          logError("Invalid sort Map key: must be a field path string", key);
+          return false;
+        }
         if (!validSortOrders.includes(order)) {
           logError('Invalid sort Map value: must be 1, -1, "asc", or "desc"', order);
           return false;
@@ -1089,9 +1381,6 @@ var Model = class {
     if (lean) builder.lean();
     return builder;
   }
-  findOneAndDelete(filter2) {
-    return this.model.findOneAndDelete(filter2);
-  }
   exists(filter2) {
     if (!filter2) return null;
     return this.findOne(filter2).select("_id").lean();
@@ -1100,10 +1389,6 @@ var Model = class {
   countDocuments(filter2 = {}) {
     return this.model.countDocuments(filter2);
   }
-  // see https://mongoosejs.com/docs/api.html#model_Model.estimatedDocumentCount
-  estimatedDocumentCount() {
-    return this.model.estimatedDocumentCount();
-  }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
   distinct(field, conditions = {}) {
     return this.model.distinct(field, conditions);
@@ -1111,40 +1396,27 @@ var Model = class {
 };
 var model_default = Model;
 
-// src/logger.ts
-var passthrough = (level) => (...args) => {
-  const globalLogger = getGlobalOption("logger");
-  const target = globalLogger?.[level] ?? defaultLogger[level];
-  return target.apply(globalLogger ?? defaultLogger, args);
-};
-var logger = {
-  debug: passthrough("debug"),
-  info: passthrough("info"),
-  warn: passthrough("warn"),
-  error: passthrough("error")
-};
-
 // src/services/model-subdocument-service.ts
-var import_utils9 = require("@web-ts-toolkit/utils");
+var import_utils12 = require("@web-ts-toolkit/utils");
 async function listSub(service, id, sub, options) {
   const { filter: ft, select } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "read" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.list`, ft),
     service.genQuerySelect("list", select, false, [sub, "sub"])
   ]);
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  if (subSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subSelect.concat("_id")));
+  if (subSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subSelect.concat("_id")));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function readSub(service, id, sub, subId, options) {
   const { select, populate } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, { populate }, { access: "read" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.read`, { _id: subId }),
     service.genQuerySelect("read", select, false, [sub, "sub"])
@@ -1152,13 +1424,13 @@ async function readSub(service, id, sub, subId, options) {
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  if (subSelect) subdoc = (0, import_utils9.pick)(toObject(subdoc), subSelect.concat(["_id"]));
+  if (subSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function updateSub(service, id, sub, subId, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: subId }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
@@ -1167,16 +1439,16 @@ async function updateSub(service, id, sub, subId, data) {
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  const allowedData = (0, import_utils9.pick)(data, subUpdateSelect);
+  const allowedData = (0, import_utils12.pick)(data, subUpdateSelect);
   Object.assign(subdoc, allowedData);
   await parentDoc.save();
-  if (subReadSelect) subdoc = (0, import_utils9.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
+  if (subReadSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function bulkUpdateSub(service, id, sub, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
@@ -1184,35 +1456,35 @@ async function bulkUpdateSub(service, id, sub, data) {
   ]);
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  (0, import_utils9.forEach)(result, (subdoc) => {
+  (0, import_utils12.forEach)(result, (subdoc) => {
     const tdata = findElementById(data, subdoc._id);
     if (!tdata) return;
-    const allowedData = (0, import_utils9.pick)(tdata, subUpdateSelect);
+    const allowedData = (0, import_utils12.pick)(tdata, subUpdateSelect);
     Object.assign(subdoc, allowedData);
   });
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function createSub(service, id, sub, data, options) {
   const { addFirst } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subCreateSelect, subReadSelect] = await Promise.all([
     service.genQuerySelect("create", null, false, [sub, "sub"]),
     service.genQuerySelect("read", null, false, [sub, "sub"])
   ]);
-  const allowedData = (0, import_utils9.pick)(data, subCreateSelect);
+  const allowedData = (0, import_utils12.pick)(data, subCreateSelect);
   addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
 }
 async function deleteSub(service, id, sub, subId) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const subFilter = await service.genFilter(`subs.${sub}.delete`, { _id: subId });
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   const subdoc = findElement(result, subFilter);
@@ -1347,7 +1619,7 @@ function resolveExistsOptions(service, options = {}) {
 
 // src/services/service.ts
 var assertModelDocument = (value, modelName, hookName) => {
-  if (isDocument(value)) {
+  if (isDocument2(value)) {
     return value;
   }
   throw new Error(`${hookName} hook for model=${modelName} must return a Mongoose document instance`);
@@ -1441,7 +1713,7 @@ var Service = class extends Base {
       genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
     ]);
     const finalSelect = normalizeSelect(_select);
-    const filteredPopulate = (0, import_utils10.isArray)(finalSelect) && (0, import_utils10.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const filteredPopulate = (0, import_utils13.isArray)(finalSelect) && (0, import_utils13.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, includeLocalFields, includePaths } = this.processInclude(include);
     const query = {
       filter: _filter,
@@ -1463,7 +1735,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     }));
-    const _decorate = (0, import_utils10.isFunction)(decorate) ? decorate : (v) => v;
+    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
     docs = await this.includeDocs(docs, includes);
     const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
@@ -1515,16 +1787,16 @@ var Service = class extends Base {
           resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
         };
         const allowedFields = await this.genAllowedFields(item, "create");
-        const allowedData = (0, import_utils10.pick)(item, allowedFields);
+        const allowedData = (0, import_utils13.pick)(item, allowedFields);
         context.allowedFields = allowedFields;
         context.allowedData = allowedData;
         const validated = await this.validate(allowedData, "create", context);
-        if ((0, import_utils10.isBoolean)(validated)) {
+        if ((0, import_utils13.isBoolean)(validated)) {
           if (!validated) {
             validationError = { success: false, code: "bad_request" /* BadRequest */ };
             return;
           }
-        } else if ((0, import_utils10.isArray)(validated)) {
+        } else if ((0, import_utils13.isArray)(validated)) {
           if (validated.length > 0) {
             validationError = { success: false, code: "bad_request" /* BadRequest */, errors: validated };
             return;
@@ -1537,7 +1809,7 @@ var Service = class extends Base {
       })
     );
     if (validationError) return validationError;
-    const _decorate = (0, import_utils10.isFunction)(decorate) ? decorate : (v) => v;
+    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
     const createdDocs = await this.model.create(items);
     const docs = await Promise.all(
       createdDocs.map(async (doc, index) => {
@@ -1608,13 +1880,13 @@ var Service = class extends Base {
     context.docPermissions = this.getDocPermissions(doc);
     context.currentDocument = doc;
     const allowedFields = await this.genAllowedFields(doc, "update");
-    const allowedData = (0, import_utils10.pick)(data, allowedFields);
+    const allowedData = (0, import_utils13.pick)(data, allowedFields);
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils10.isBoolean)(validated)) {
+    if ((0, import_utils13.isBoolean)(validated)) {
       if (!validated) return { success: false, code: "bad_request" /* BadRequest */ };
-    } else if ((0, import_utils10.isArray)(validated)) {
+    } else if ((0, import_utils13.isArray)(validated)) {
       if (validated.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: validated };
     }
     const prepared = await this.prepare(allowedData, "update", context);
@@ -1627,10 +1899,10 @@ var Service = class extends Base {
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
       context.changes = (0, import_deep_diff.default)(
-        (0, import_utils10.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils10.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+        (0, import_utils13.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils13.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils10.uniq)(context.changes.map((di) => di.path.length > 0 ? di.path[0] : ""));
+      context.modifiedPaths = (0, import_utils13.uniq)(context.changes.map((di) => di.path.length > 0 ? di.path[0] : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -1646,7 +1918,7 @@ var Service = class extends Base {
     if (_populate) await populateDoc(doc, _populate);
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
-    if ((0, import_utils10.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
+    if ((0, import_utils13.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
     if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
@@ -1810,7 +2082,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils10.uniq)(ids.map((id) => String(id)).filter(Boolean));
+    const uniqueIds = (0, import_utils13.uniq)(ids.map((id) => String(id)).filter(Boolean));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -1840,7 +2112,7 @@ var Service = class extends Base {
     return updateSub(this, id, sub, subId, data);
   }
   async bulkUpdateSub(id, sub, data) {
-    return bulkUpdateSub(this, id, sub, (0, import_utils10.castArray)(data));
+    return bulkUpdateSub(this, id, sub, (0, import_utils13.castArray)(data));
   }
   async createSub(id, sub, data, options) {
     return createSub(this, id, sub, data, options);
@@ -1854,7 +2126,7 @@ var Service = class extends Base {
 };
 
 // src/services/public-service.ts
-var import_utils11 = require("@web-ts-toolkit/utils");
+var import_utils14 = require("@web-ts-toolkit/utils");
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
@@ -1893,7 +2165,7 @@ var PublicService = class extends Service {
         doc = toObject(doc);
         doc = await this.decorate(doc, "create", context);
         doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils11.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
         return doc;
       }
     );
@@ -1988,8 +2260,8 @@ var PublicService = class extends Service {
         doc = toObject(doc);
         doc = await this.decorate(doc, "update", context);
         doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils11.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) doc = (0, import_utils11.pick)(doc, [...Object.keys(data), "_id"]);
+        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) doc = (0, import_utils14.pick)(doc, [...Object.keys(data), "_id"]);
         return doc;
       }
     );
@@ -2111,7 +2383,7 @@ var PublicService = class extends Service {
 };
 
 // src/services/data-service.ts
-var import_utils12 = require("@web-ts-toolkit/utils");
+var import_utils15 = require("@web-ts-toolkit/utils");
 var DataService = class {
   constructor(req, dataName) {
     this.req = req;
@@ -2133,7 +2405,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils12.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
   }
   async findById(id, args, options) {
@@ -2169,13 +2441,13 @@ var DataService = class {
     docs = await Promise.all(
       docs.map(async (doc) => {
         doc = await this.trimOutputFields(doc, "list");
-        if (_select.length > 0) doc = (0, import_utils12.pick)(doc, _select);
+        if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
         return doc;
       })
     );
     if (sort) {
       const { sortKey, sortOrder } = parseSortString(sort);
-      docs = (0, import_utils12.orderBy)(docs, [sortKey], [sortOrder]);
+      docs = (0, import_utils15.orderBy)(docs, [sortKey], [sortOrder]);
     }
     docs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     return {
@@ -2218,29 +2490,29 @@ var DataService = class {
 };
 
 // src/processors.ts
-var import_utils13 = require("@web-ts-toolkit/utils");
+var import_utils16 = require("@web-ts-toolkit/utils");
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
-  const obj = (0, import_utils13.get)(options, "mutable", true) ? docObject : (0, import_utils13.cloneDeep)(docObject);
-  const idField = (0, import_utils13.get)(options, "idField", "_id");
-  (0, import_utils13.forEach)((0, import_utils13.castArray)(operations), (op) => {
+  const obj = (0, import_utils16.get)(options, "mutable", true) ? docObject : (0, import_utils16.cloneDeep)(docObject);
+  const idField = (0, import_utils16.get)(options, "idField", "_id");
+  (0, import_utils16.forEach)((0, import_utils16.castArray)(operations), (op) => {
     if (!op.src || !op.dest) return;
     let targets = [obj];
     const segs = op.src.split(".");
-    (0, import_utils13.forEach)(segs, (seg, ind) => {
+    (0, import_utils16.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils13.forEach)(targets, (target) => {
+        (0, import_utils16.forEach)(targets, (target) => {
           const targetObject = target;
-          (0, import_utils13.set)(targetObject, op.dest, (0, import_utils13.get)(targetObject, seg));
-          (0, import_utils13.set)(
+          (0, import_utils16.set)(targetObject, op.dest, (0, import_utils16.get)(targetObject, seg));
+          (0, import_utils16.set)(
             targetObject,
             seg,
-            (0, import_utils13.isArray)(targetObject[seg]) ? (0, import_utils13.map)(targetObject[seg], idField) : (0, import_utils13.get)(targetObject, `${seg}.${idField}`)
+            (0, import_utils16.isArray)(targetObject[seg]) ? (0, import_utils16.map)(targetObject[seg], idField) : (0, import_utils16.get)(targetObject, `${seg}.${idField}`)
           );
         });
       } else {
         targets = targets.reduce((ret, target) => {
           const targetObject = target;
-          if ((0, import_utils13.isArray)(targetObject[seg])) ret.push(...targetObject[seg]);
+          if ((0, import_utils16.isArray)(targetObject[seg])) ret.push(...targetObject[seg]);
           else ret.push(targetObject[seg]);
           return ret;
         }, []);
@@ -2288,7 +2560,7 @@ var Cache = class {
 };
 
 // src/core-shared.ts
-var import_utils14 = require("@web-ts-toolkit/utils");
+var import_utils17 = require("@web-ts-toolkit/utils");
 
 // src/permission.ts
 var Permission = class {
@@ -2326,10 +2598,10 @@ var permission_default = Permission;
 
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils14.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils14.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils17.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils17.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils14.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils17.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -2344,7 +2616,7 @@ function optimizeAndFilter(clausesInput) {
     }
   }
   const dedupedClauses = clauses.filter(
-    (clause, index) => clauses.findIndex((item) => (0, import_utils14.isEqual)(item, clause)) === index
+    (clause, index) => clauses.findIndex((item) => (0, import_utils17.isEqual)(item, clause)) === index
   );
   const mergedClause = {};
   const remainingClauses = [];
@@ -2356,7 +2628,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if (Object.prototype.hasOwnProperty.call(mergedClause, key) && !(0, import_utils14.isEqual)(mergedClause[key], value)) {
+      if (Object.prototype.hasOwnProperty.call(mergedClause, key) && !(0, import_utils17.isEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -2367,24 +2639,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils14.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils17.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils14.isPlainObject)(filter2) || (0, import_utils14.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils17.isPlainObject)(filter2) || (0, import_utils17.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils14.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils17.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils14.isString)(idField)) {
+  if ((0, import_utils17.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -2400,11 +2672,11 @@ async function resolveAccessFilter({
 }) {
   let nextFilter = normalizeFilter(filter2);
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
-  if ((0, import_utils14.isFunction)(overrideFilterFn)) {
+  if ((0, import_utils17.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   const baseFilterFn = getOption(`baseFilter.${access}`, null);
-  if (!(0, import_utils14.isFunction)(baseFilterFn)) return nextFilter || {};
+  if (!(0, import_utils17.isFunction)(baseFilterFn)) return nextFilter || {};
   const baseFilter = normalizeFilter(
     cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
   );
@@ -2424,33 +2696,33 @@ async function setRequestPermissions(req) {
   const requestPermissionField = getGlobalOption("requestPermissionField");
   if (req[requestPermissionField]) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  if (!(0, import_utils14.isFunction)(globalPermissions)) return;
+  if (!(0, import_utils17.isFunction)(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
-  if ((0, import_utils14.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils14.isArray)(permissions)) req[requestPermissionField] = (0, import_utils14.arrayToRecord)(permissions);
-  else if ((0, import_utils14.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  if ((0, import_utils17.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils17.isArray)(permissions)) req[requestPermissionField] = (0, import_utils17.arrayToRecord)(permissions);
+  else if ((0, import_utils17.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils14.isBoolean)(routeGuard)) {
+  if ((0, import_utils17.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils14.isString)(routeGuard)) {
+  if ((0, import_utils17.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils14.isArray)(routeGuard)) {
+  if ((0, import_utils17.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils14.isFunction)(routeGuard)) {
+  if ((0, import_utils17.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils14.castArray)(hook);
+  const hooks = (0, import_utils17.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils14.isFunction)(hooks[x])) {
+    if ((0, import_utils17.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -2473,13 +2745,13 @@ async function collectSchemaFields({
     if (baseFields.includes(key)) continue;
     const val = permissionSchema[key];
     const value = val && val[access] || val;
-    if ((0, import_utils14.isBoolean)(value)) {
+    if ((0, import_utils17.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils14.isString)(value)) {
+    } else if ((0, import_utils17.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils14.isArray)(value)) {
+    } else if ((0, import_utils17.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils14.isFunction)(value)) {
+    } else if ((0, import_utils17.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
@@ -2568,7 +2840,7 @@ async function runDecorateAllHook({
 }
 
 // src/acl/select-resolution.ts
-var import_utils15 = require("@web-ts-toolkit/utils");
+var import_utils18 = require("@web-ts-toolkit/utils");
 async function collectAllowedFieldsForRequest({
   req,
   permissionSchema,
@@ -2636,15 +2908,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils15.difference)(fields, normalizedSelect);
+        fields = (0, import_utils18.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils15.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils18.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(alwaysSelectFields);
   }
-  return (0, import_utils15.intersection)(normalizedSelect, fields);
+  return (0, import_utils18.intersection)(normalizedSelect, fields);
 }
 
 // src/core.ts
@@ -2658,10 +2930,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils16.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils19.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils16.isString)(idField)) {
+    if ((0, import_utils19.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -2739,11 +3011,11 @@ var Core = class {
   async genPopulate(modelName, access = "read", _populate = null) {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
-    populate = (0, import_utils16.compact)(
+    populate = (0, import_utils19.compact)(
       await Promise.all(
         populate.map(async (p) => {
-          const populateAccess = !(0, import_utils16.isString)(p) && p.access ? p.access : access;
-          const ret = (0, import_utils16.isString)(p) ? { path: p } : {
+          const populateAccess = !(0, import_utils19.isString)(p) && p.access ? p.access : access;
+          const ret = (0, import_utils19.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -2763,10 +3035,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils16.isFunction)(validate)) {
+    if ((0, import_utils19.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils16.isBoolean)(validate) || (0, import_utils16.isArray)(validate)) {
+    } else if ((0, import_utils19.isBoolean)(validate) || (0, import_utils19.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -2791,7 +3063,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils16.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils19.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -2815,7 +3087,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils16.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils19.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
@@ -2863,7 +3135,7 @@ var Core = class {
       readExists ? this.genAllowedFields(modelName, doc, "read") : [],
       updateExists ? this.genAllowedFields(modelName, doc, "update") : []
     ]);
-    const viewObj = (0, import_utils16.reduce)(
+    const viewObj = (0, import_utils19.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -2871,7 +3143,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils16.reduce)(
+    const editObj = (0, import_utils19.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -2895,9 +3167,9 @@ var Core = class {
     return runDecorateAllHook({ req: this.req, hook: decorateAll, docs, permissions, context });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils16.compact)((0, import_utils16.castArray)(task));
+    const tasks = (0, import_utils19.compact)((0, import_utils19.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils16.forEach)(tasks, (task2) => {
+    (0, import_utils19.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -2928,9 +3200,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils16.isUndefined)(subOption)) {
+      if ((0, import_utils19.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils16.isUndefined)(subFieldOption)) {
+        if ((0, import_utils19.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -2980,25 +3252,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils17.isPlainObject)(condition)) {
+    if ((0, import_utils20.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils17.isString)(id) ? id : null;
-      if ((0, import_utils17.isPlainObject)(id)) {
+      let _id = (0, import_utils20.isString)(id) ? id : null;
+      if ((0, import_utils20.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils17.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils20.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils17.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils20.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils17.isString)(_id) || !_id) {
+      if (!(0, import_utils20.isString)(_id) || !_id) {
         return next(new import_express_json_router2.default.clientErrors.BadRequestError());
       }
       const result = await svc._read(_id, { select });
@@ -3010,11 +3282,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils17.isString)(cond)) {
+    if ((0, import_utils20.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils17.isArray)(cond)) {
+    } else if ((0, import_utils20.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils17.isFunction)(cond)) {
+    } else if ((0, import_utils20.isFunction)(cond)) {
       const result = await cond.call(req, permissions);
       if (!!result) return next();
     }
@@ -3023,11 +3295,11 @@ function guard(condition) {
 }
 
 // src/routers/index.ts
-var import_express = __toESM(require("express"));
+var import_express2 = __toESM(require("express"));
 
 // src/routers/model-router.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 
 // src/routers/router-mutation.ts
 var MODEL_BUILD_TIME_OPTION_KEYS = /* @__PURE__ */ new Set([
@@ -3119,88 +3391,88 @@ function formatModelUpsertResponse(result) {
 var import_express_json_router4 = __toESM(require("@web-ts-toolkit/express-json-router"));
 
 // src/validation/common.ts
-var import_zod = require("zod");
-var stringOrStringArray = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]);
-var queryBooleanString = import_zod.z.enum(["true", "false"]);
-var positiveIntegerString = import_zod.z.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = import_zod.z.number().int().min(0);
-var unknownRecord = import_zod.z.record(import_zod.z.string(), import_zod.z.unknown());
-var projectionObjectSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.literal(1), import_zod.z.literal(-1)]));
-var projectionSchema = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string()), projectionObjectSchema]);
-var sortOrderSchema = import_zod.z.union([
-  import_zod.z.literal(-1),
-  import_zod.z.literal(1),
-  import_zod.z.literal("asc"),
-  import_zod.z.literal("ascending"),
-  import_zod.z.literal("desc"),
-  import_zod.z.literal("descending")
+var import_zod2 = require("zod");
+var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
+var queryBooleanString = import_zod2.z.enum(["true", "false"]);
+var positiveIntegerString = import_zod2.z.string().regex(/^\d+$/, "Expected a non-negative integer");
+var nonNegativeIntegerSchema = import_zod2.z.number().int().min(0);
+var unknownRecord = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
+var projectionObjectSchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(-1)]));
+var projectionSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), projectionObjectSchema]);
+var sortOrderSchema = import_zod2.z.union([
+  import_zod2.z.literal(-1),
+  import_zod2.z.literal(1),
+  import_zod2.z.literal("asc"),
+  import_zod2.z.literal("ascending"),
+  import_zod2.z.literal("desc"),
+  import_zod2.z.literal("descending")
 ]);
-var sortSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.record(import_zod.z.string(), sortOrderSchema),
-  import_zod.z.array(import_zod.z.tuple([import_zod.z.string(), sortOrderSchema])),
-  import_zod.z.null()
+var sortSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.record(import_zod2.z.string(), sortOrderSchema),
+  import_zod2.z.array(import_zod2.z.tuple([import_zod2.z.string(), sortOrderSchema])),
+  import_zod2.z.null()
 ]);
-var populateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var populateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional(),
-        match: import_zod.z.unknown().optional(),
-        access: import_zod.z.enum(["list", "read"]).optional()
+        match: import_zod2.z.unknown().optional(),
+        access: import_zod2.z.enum(["list", "read"]).optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional(),
-    match: import_zod.z.unknown().optional(),
-    access: import_zod.z.enum(["list", "read"]).optional()
+    match: import_zod2.z.unknown().optional(),
+    access: import_zod2.z.enum(["list", "read"]).optional()
   }).passthrough()
 ]);
-var subPopulateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var subPopulateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional()
   }).passthrough()
 ]);
-var includeItemSchema = import_zod.z.object({
-  model: import_zod.z.string().min(1),
-  op: import_zod.z.enum(["list", "read", "count"]),
-  path: import_zod.z.string().min(1),
-  filter: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
-  localField: import_zod.z.string().min(1),
-  foreignField: import_zod.z.string().min(1),
-  args: import_zod.z.unknown().optional(),
-  options: import_zod.z.unknown().optional()
+var includeItemSchema = import_zod2.z.object({
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.enum(["list", "read", "count"]),
+  path: import_zod2.z.string().min(1),
+  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+  localField: import_zod2.z.string().min(1),
+  foreignField: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown().optional(),
+  options: import_zod2.z.unknown().optional()
 }).passthrough();
-var includeSchema = import_zod.z.union([includeItemSchema, import_zod.z.array(includeItemSchema)]);
-var fieldsSchema = import_zod.z.array(import_zod.z.string().min(1));
-var taskSchema = import_zod.z.object({
-  type: import_zod.z.string().min(1),
-  args: import_zod.z.unknown(),
+var includeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
+var fieldsSchema = import_zod2.z.array(import_zod2.z.string().min(1));
+var taskSchema = import_zod2.z.object({
+  type: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown(),
   options: unknownRecord.optional()
 });
-var tasksSchema = import_zod.z.union([taskSchema, import_zod.z.array(taskSchema)]);
-var objectOrArraySchema = import_zod.z.union([import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()), import_zod.z.array(import_zod.z.unknown())]);
+var tasksSchema = import_zod2.z.union([taskSchema, import_zod2.z.array(taskSchema)]);
+var objectOrArraySchema = import_zod2.z.union([import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()), import_zod2.z.array(import_zod2.z.unknown())]);
 function rejectKeys(body, ctx, keys2) {
   for (const key of keys2) {
     if (key in body) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `Unsupported field: ${key}`,
         path: [key]
       });
@@ -3289,8 +3561,11 @@ function toRequestSchemaValidator(schema) {
   if (isRequestSchemaValidator(schema)) return schema;
   return schema.validate;
 }
-function defineRequestSchema(validator) {
-  return validator;
+function defineRequestSchema(validator, options = {}) {
+  return {
+    validate: validator,
+    openapi: options.openapi
+  };
 }
 function fromZod(schema) {
   return (value) => {
@@ -3570,8 +3845,8 @@ function buildPointer(path) {
 }
 
 // src/validation/model-router.ts
-var import_zod2 = require("zod");
-var listQuerySchema = import_zod2.z.object({
+var import_zod3 = require("zod");
+var listQuerySchema = import_zod3.z.object({
   skip: positiveIntegerString.optional(),
   limit: positiveIntegerString.optional(),
   page: positiveIntegerString.optional(),
@@ -3581,122 +3856,122 @@ var listQuerySchema = import_zod2.z.object({
   include_count: queryBooleanString.optional(),
   include_extra_headers: queryBooleanString.optional()
 }).passthrough();
-var createQuerySchema = import_zod2.z.object({
+var createQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var readQuerySchema = import_zod2.z.object({
+var readQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional(),
   try_list: queryBooleanString.optional()
 }).passthrough();
-var updateQuerySchema = import_zod2.z.object({
+var updateQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var upsertQuerySchema = import_zod2.z.object({
+var upsertQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var listBodySchema = import_zod2.z.object({
+var listBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    includeCount: import_zod2.z.boolean().optional(),
-    includeExtraHeaders: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    includeCount: import_zod3.z.boolean().optional(),
+    includeExtraHeaders: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = import_zod2.z.object({
+var countBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
-  options: import_zod2.z.object({
-    access: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    access: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
-var readFilterBodySchema = import_zod2.z.object({
+var readFilterBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var readByIdBodySchema = import_zod2.z.object({
+var readByIdBodySchema = import_zod3.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var advancedCreateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var advancedCreateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var createBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var createBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var updateBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpdateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var updateBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpdateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var upsertBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpsertBodySchema = import_zod2.z.object({
-  data: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
+var upsertBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpsertBodySchema = import_zod3.z.object({
+  data: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var distinctBodySchema = import_zod2.z.object({
+var distinctBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = import_zod2.z.object({
-  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+var subListBodySchema = import_zod3.z.object({
+  filter: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
   select: fieldsSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var subMutationBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var subReadBodySchema = import_zod2.z.object({
+var subReadBodySchema = import_zod3.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
@@ -3709,54 +3984,54 @@ var requestSchemas = {
 };
 
 // src/validation/data-router.ts
-var import_zod3 = require("zod");
-var dataListBodySchema = import_zod3.z.object({
+var import_zod4 = require("zod");
+var dataListBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
-  sort: import_zod3.z.string().optional(),
-  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod3.z.object({
-    includeCount: import_zod3.z.boolean().optional(),
-    includeExtraHeaders: import_zod3.z.boolean().optional()
+  sort: import_zod4.z.string().optional(),
+  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod4.z.object({
+    includeCount: import_zod4.z.boolean().optional(),
+    includeExtraHeaders: import_zod4.z.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
-var dataReadFilterBodySchema = import_zod3.z.object({
+var dataReadFilterBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
-var dataReadByIdBodySchema = import_zod3.z.object({
+var dataReadByIdBodySchema = import_zod4.z.object({
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
 
 // src/validation/root-router.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 var rootEntryBaseSchema = {
-  target: import_zod4.z.enum(["model", "data"]),
-  name: import_zod4.z.string().min(1),
-  order: import_zod4.z.number().int().optional()
+  target: import_zod5.z.enum(["model", "data"]),
+  name: import_zod5.z.string().min(1),
+  order: import_zod5.z.number().int().optional()
 };
-var rootModelListArgsSchema = import_zod4.z.object({
+var rootModelListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelListOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  includeCount: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelListOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  includeCount: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelReadArgsSchema = import_zod4.z.object({
+var rootModelReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
@@ -3765,228 +4040,244 @@ var rootModelReadArgsSchema = import_zod4.z.object({
 var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
   sort: sortSchema.optional()
 });
-var rootModelReadOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  tryList: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelReadOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  tryList: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelCreateArgsSchema = import_zod4.z.object({
+var rootModelCreateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelCreateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelCreateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
-var rootModelUpdateArgsSchema = import_zod4.z.object({
+var rootModelUpdateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelUpdateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  returningAll: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelUpdateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  returningAll: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;
-var rootModelSubListArgsSchema = import_zod4.z.object({
+var rootModelSubListArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional()
 }).passthrough();
-var rootModelSubReadArgsSchema = import_zod4.z.object({
+var rootModelSubReadArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = import_zod4.z.object({
-  access: import_zod4.z.unknown().optional()
+var rootModelCountOptionsSchema = import_zod5.z.object({
+  access: import_zod5.z.unknown().optional()
 }).passthrough();
-var rootDataListArgsSchema = import_zod4.z.object({
+var rootDataListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
-  sort: import_zod4.z.string().optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  sort: import_zod5.z.string().optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
-var rootDataListOptionsSchema = import_zod4.z.object({
-  includeCount: import_zod4.z.boolean().optional()
+var rootDataListOptionsSchema = import_zod5.z.object({
+  includeCount: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootDataReadArgsSchema = import_zod4.z.object({
+var rootDataReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional()
 }).passthrough();
-var rootModelQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("new") }).passthrough(),
-  import_zod4.z.object({
+var rootModelQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("new") }).passthrough(),
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootModelListArgsSchema.optional(),
     options: rootModelListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootModelReadArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootModelReadFilterArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("create"),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("create"),
+    data: import_zod5.z.unknown(),
     args: rootModelCreateArgsSchema.optional(),
     options: rootModelCreateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("update"),
-    id: import_zod4.z.string().min(1),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("update"),
+    id: import_zod5.z.string().min(1),
+    data: import_zod5.z.unknown(),
     args: rootModelUpdateArgsSchema.optional(),
     options: rootModelUpdateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("upsert"),
-    data: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("upsert"),
+    data: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()),
     args: rootModelUpsertArgsSchema.optional(),
     options: rootModelUpsertOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("delete"), id: import_zod4.z.string().min(1) }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("delete"), id: import_zod5.z.string().min(1) }).passthrough(),
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subList"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    filter: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subList"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    filter: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional(),
     args: rootModelSubListArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subRead"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subRead"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
     args: rootModelSubReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subCreate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subCreate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subBulkUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subBulkUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subDelete"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1)
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subDelete"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1)
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("distinct"),
-    field: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("distinct"),
+    field: import_zod5.z.string().min(1),
     filter: objectOrArraySchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("count"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
   }).passthrough()
 ]);
-var rootDataQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({
+var rootDataQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootDataListArgsSchema.optional(),
     options: rootDataListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootDataReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = import_zod4.z.array(import_zod4.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 
 // src/routers/shared.ts
-var parseBooleanString = (str, defaultValue) => str ? str === "true" : defaultValue;
+var import_utils21 = require("@web-ts-toolkit/utils");
 
 // src/routers/model-router-collection-routes.ts
 function setModelCollectionRoutes(context) {
   const { router, options } = context;
+  const getAdvancedCreateOpenApiBody = () => {
+    const advancedCreateSchema = context.getRequestSchema("requestSchemas.advancedCreate");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedCreate.data") ?? getNestedOpenApiSchemaDataSource(advancedCreateSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedCreate.default") ?? advancedCreateSchema,
+      advancedCreateBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
   router.get("", async (req) => {
     await context.assertAllowed(req, "list");
     const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = parseBooleanString(include_count);
-    const includeExtraHeaders = parseBooleanString(include_extra_headers);
+    const includeCount = (0, import_utils21.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils21.parseBooleanString)(include_extra_headers);
     const result = await svc._list(
       {},
       { skip, limit, page, pageSize: page_size },
       {
-        skim: parseBooleanString(skim),
-        includePermissions: parseBooleanString(include_permissions),
+        skim: (0, import_utils21.parseBooleanString)(skim),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions),
         includeCount
       }
     );
     handleResultError(result);
     return formatModelListResponse(req, result, includeCount, includeExtraHeaders);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "",
+    operationId: `${context.modelName}.list`,
+    summary: `List ${context.modelName} documents`,
+    query: requestSchemas.listQuery
+  });
   router.post(`/${options.queryRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "list");
     const body = await parseBodyWithSchema(
@@ -4012,6 +4303,13 @@ function setModelCollectionRoutes(context) {
     handleResultError(result);
     return formatModelListResponse(req, result, includeCount, includeExtraHeaders);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}`,
+    operationId: `${context.modelName}.listAdvanced`,
+    summary: `Advanced list ${context.modelName} documents`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.advancedList") ?? listBodySchema)
+  });
   router.post("", async (req) => {
     await context.assertAllowed(req, "create");
     const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
@@ -4021,10 +4319,18 @@ function setModelCollectionRoutes(context) {
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: parseBooleanString(include_permissions) });
+    const result = await svc._create(data, {}, { includePermissions: (0, import_utils21.parseBooleanString)(include_permissions) });
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "",
+    operationId: `${context.modelName}.create`,
+    summary: `Create a ${context.modelName} document`,
+    query: requestSchemas.createQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.create") ?? createBodySchema)
+  });
   router.post(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "create");
     const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
@@ -4047,24 +4353,56 @@ function setModelCollectionRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.mutationRouteSegment}`,
+    operationId: `${context.modelName}.createAdvanced`,
+    summary: `Advanced create a ${context.modelName} document`,
+    query: requestSchemas.createQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedCreateOpenApiBody)
+  });
   router.get("/new", async (req) => {
     const svc = context.getPublicService(req);
     const result = await svc._new();
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/new",
+    operationId: `${context.modelName}.new`,
+    summary: `Get a new ${context.modelName} document template`
+  });
 }
 
 // src/routers/model-router-document-routes.ts
 function setModelDocumentRoutes(context) {
   const { router, options, modelName } = context;
+  const getAdvancedUpdateOpenApiBody = () => {
+    const advancedUpdateSchema = context.getRequestSchema("requestSchemas.advancedUpdate");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedUpdate.data") ?? getNestedOpenApiSchemaDataSource(advancedUpdateSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedUpdate.default") ?? advancedUpdateSchema,
+      advancedUpdateBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
+  const getAdvancedUpsertOpenApiBody = () => {
+    const advancedUpsertSchema = context.getRequestSchema("requestSchemas.advancedUpsert");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedUpsert.data") ?? getNestedOpenApiSchemaDataSource(advancedUpsertSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedUpsert.default") ?? advancedUpsertSchema,
+      advancedUpsertBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
   router.get("/count", async (req) => {
     await context.assertAllowed(req, "count");
     const svc = context.getPublicService(req);
@@ -4072,6 +4410,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/count",
+    operationId: `${modelName}.count`,
+    summary: `Count ${modelName} documents`
+  });
   router.post("/count", async (req) => {
     await context.assertAllowed(req, "count");
     const { filter: filter2, options: countOptions = {} } = await parseBodyWithSchema(
@@ -4087,6 +4431,13 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "/count",
+    operationId: `${modelName}.countWithFilter`,
+    summary: `Count ${modelName} documents with a filter`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.count") ?? countBodySchema)
+  });
   router.get(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4096,13 +4447,20 @@ function setModelDocumentRoutes(context) {
       id,
       {},
       {
-        includePermissions: parseBooleanString(include_permissions),
-        tryList: parseBooleanString(try_list)
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions),
+        tryList: (0, import_utils21.parseBooleanString)(try_list)
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.read`,
+    summary: `Read a ${modelName} document`,
+    query: requestSchemas.readQuery
+  });
   router.post(`/${options.queryRouteSegment}/__filter`, async (req) => {
     await context.assertAllowed(req, "read");
     const body = await parseBodyWithSchema(
@@ -4122,6 +4480,15 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}/__filter`,
+    operationId: `${modelName}.readByFilterAdvanced`,
+    summary: `Read a ${modelName} document by filter`,
+    body: defineOpenApiSchemaResolver(
+      () => context.getRequestSchema("requestSchemas.advancedReadFilter") ?? readFilterBodySchema
+    )
+  });
   router.post(`/${options.queryRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4142,6 +4509,15 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}/:${options.idParam}`,
+    operationId: `${modelName}.readAdvanced`,
+    summary: `Read a ${modelName} document with advanced options`,
+    body: defineOpenApiSchemaResolver(
+      () => context.getRequestSchema("requestSchemas.advancedRead") ?? readByIdBodySchema
+    )
+  });
   router.patch(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4157,13 +4533,21 @@ function setModelDocumentRoutes(context) {
       data,
       {},
       {
-        returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        returningAll: (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "patch",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.update`,
+    summary: `Update a ${modelName} document`,
+    query: requestSchemas.updateQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.update") ?? updateBodySchema)
+  });
   router.patch(`/${options.mutationRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4188,14 +4572,22 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? parseBooleanString(returning_all),
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        returningAll: returningAll ?? (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "patch",
+    path: `/${options.mutationRouteSegment}/:${options.idParam}`,
+    operationId: `${modelName}.updateAdvanced`,
+    summary: `Advanced update a ${modelName} document`,
+    query: requestSchemas.updateQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedUpdateOpenApiBody)
+  });
   router.put(`/`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
@@ -4209,13 +4601,21 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        returningAll: (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
     return formatModelUpsertResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "put",
+    path: "/",
+    operationId: `${modelName}.upsert`,
+    summary: `Upsert a ${modelName} document`,
+    query: requestSchemas.upsertQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.upsert") ?? upsertBodySchema)
+  });
   router.put(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
@@ -4238,14 +4638,22 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? parseBooleanString(returning_all),
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        returningAll: returningAll ?? (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return formatModelUpsertResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "put",
+    path: `/${options.mutationRouteSegment}`,
+    operationId: `${modelName}.upsertAdvanced`,
+    summary: `Advanced upsert a ${modelName} document`,
+    query: requestSchemas.upsertQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedUpsertOpenApiBody)
+  });
   router.delete(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "delete");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4254,6 +4662,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "delete",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.delete`,
+    summary: `Delete a ${modelName} document`
+  });
   router.get("/distinct/:field", async (req) => {
     await context.assertAllowed(req, "distinct");
     const field = parsePathParam(req.params.field, "field");
@@ -4262,6 +4676,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/distinct/:field",
+    operationId: `${modelName}.distinct`,
+    summary: `Get distinct values for a ${modelName} field`
+  });
   router.post("/distinct/:field", async (req) => {
     await context.assertAllowed(req, "distinct");
     const field = parsePathParam(req.params.field, "field");
@@ -4275,10 +4695,17 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "/distinct/:field",
+    operationId: `${modelName}.distinctWithFilter`,
+    summary: `Get distinct values for a ${modelName} field with a filter`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.distinct") ?? distinctBodySchema)
+  });
 }
 
 // src/routers/model-router-subdocument-routes.ts
-var import_utils18 = require("@web-ts-toolkit/utils");
+var import_utils22 = require("@web-ts-toolkit/utils");
 function setModelSubDocumentRoutes(context) {
   const subs = getModelSub(context.modelName);
   for (let x = 0; x < subs.length; x++) {
@@ -4291,6 +4718,12 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "get",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.list`,
+      summary: `List ${sub} subdocuments`
+    });
     context.router.post(
       `/:${context.options.idParam}/${sub}/${context.options.queryRouteSegment}`,
       async (req) => {
@@ -4307,6 +4740,13 @@ function setModelSubDocumentRoutes(context) {
         return unwrapServiceData(result);
       }
     );
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}/${context.options.queryRouteSegment}`,
+      operationId: `${context.modelName}.${sub}.listAdvanced`,
+      summary: `Advanced list ${sub} subdocuments`,
+      body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.subList") ?? subListBodySchema)
+    });
     context.router.patch(`/:${context.options.idParam}/${sub}`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.update`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4320,6 +4760,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "patch",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.bulkUpdate`,
+      summary: `Bulk update ${sub} subdocuments`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subBulkUpdate") ?? subMutationBodySchema
+      )
+    });
     context.router.get(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.read`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4329,6 +4778,12 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "get",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.read`,
+      summary: `Read a ${sub} subdocument`
+    });
     context.router.post(
       `/:${context.options.idParam}/${sub}/:subId/${context.options.queryRouteSegment}`,
       async (req) => {
@@ -4341,13 +4796,20 @@ function setModelSubDocumentRoutes(context) {
           context.getRequestSchema("requestSchemas.subRead")
         );
         const populate = body.populate;
-        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => (0, import_utils18.isString)(item) ? { path: item } : item) : (0, import_utils18.isString)(populate) ? { path: populate } : populate ?? [];
+        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => (0, import_utils22.isString)(item) ? { path: item } : item) : (0, import_utils22.isString)(populate) ? { path: populate } : populate ?? [];
         const svc = context.getPublicService(req);
         const result = await svc.readSub(id, sub, subId, { select: body.select ?? [], populate: normalizedPopulate });
         handleResultError(result);
         return unwrapServiceData(result);
       }
     );
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}/:subId/${context.options.queryRouteSegment}`,
+      operationId: `${context.modelName}.${sub}.readAdvanced`,
+      summary: `Advanced read a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.subRead") ?? subReadBodySchema)
+    });
     context.router.patch(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.update`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4362,6 +4824,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "patch",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.update`,
+      summary: `Update a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subUpdate") ?? subMutationBodySchema
+      )
+    });
     context.router.post(`/:${context.options.idParam}/${sub}`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.create`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4375,6 +4846,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return formatModelCreatedResponse(result);
     });
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.create`,
+      summary: `Create a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subCreate") ?? subMutationBodySchema
+      )
+    });
     context.router.delete(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.delete`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4384,14 +4864,30 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "delete",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.delete`,
+      summary: `Delete a ${sub} subdocument`
+    });
   }
 }
 
+// src/openapi/route-registration.ts
+var import_utils23 = require("@web-ts-toolkit/utils");
+function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
+  runtime.registerOpenApiRoute({
+    ...route,
+    path: (0, import_utils23.normalizeUrlPath)(basePath + route.path),
+    tags: route.tags ?? [defaultTag]
+  });
+}
+
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router5.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils19.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils19.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils24.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils24.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(this.modelName, key, value);
   return this;
@@ -4552,7 +5048,7 @@ var ModelRouter = class {
     this.runtime.setModelOptions(modelName, initialOptions);
     attachRuntimeToModel(modelName, this.runtime);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils19.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils24.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router5.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName);
@@ -4577,6 +5073,9 @@ var ModelRouter = class {
     const allowed = await req.macl.isAllowed(this.modelName, access);
     if (!allowed) throw new clientErrors2.UnauthorizedError();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, this.fullBasePath, this.modelName, route);
+  }
   ///////////////////////
   // Collection Routes //
   ///////////////////////
@@ -4587,7 +5086,8 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   /////////////////////
@@ -4600,7 +5100,8 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   /////////////////////////
@@ -4613,18 +5114,19 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils19.forEach)(this.router.endpoints, ({ method, path }) => {
-        logger.info(`${(0, import_utils19.padEnd)(method, 6)} ${(0, import_utils19.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils24.forEach)(this.router.endpoints, ({ method, path }) => {
+        logger.info(`${(0, import_utils24.padEnd)(method, 6)} ${(0, import_utils24.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils19.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils24.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -4632,7 +5134,7 @@ var ModelRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils19.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils24.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(this.modelName, keyOrOptions);
     }
@@ -4655,7 +5157,7 @@ var ModelRouter = class {
 
 // src/routers/root-router.ts
 var import_express_json_router6 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils20 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 
 // src/core-data.ts
 var DataCore = class {
@@ -4828,7 +5330,7 @@ var createErrorResult = (code, detail) => ({
   code,
   errors: [{ detail }]
 });
-var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => (0, import_utils20.isString)(item) ? { path: item } : item) : (0, import_utils20.isString)(populate) ? { path: populate } : populate ?? [];
+var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => (0, import_utils25.isString)(item) ? { path: item } : item) : (0, import_utils25.isString)(populate) ? { path: populate } : populate ?? [];
 var RootRouter = class {
   constructor(options = { basePath: "", operationAccess: true }, runtime = defaultRuntime) {
     this.modelOperations = {
@@ -4901,6 +5403,9 @@ var RootRouter = class {
     );
     this.setRoutes();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, (0, import_utils25.normalizeUrlPath)(this.basename), "root", route);
+  }
   wrapResult(index, item, result) {
     return {
       index,
@@ -4960,7 +5465,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     return items.reduce((acc, item, index) => {
       let order = 0;
-      if ((0, import_utils20.isNumber)(item.order)) {
+      if ((0, import_utils25.isNumber)(item.order)) {
         order = item.order < 0 ? 0 : item.order;
       }
       if (!acc[order]) {
@@ -4984,7 +5489,14 @@ var RootRouter = class {
         const arrResult = await Promise.all(groupedItems[x].map(({ item, index }) => this.processOp(req, item, index)));
         results.push(...arrResult);
       }
-      return (0, import_utils20.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils25.orderBy)(results, ["index"], ["asc"]);
+    });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: "",
+      operationId: "root.query",
+      summary: "Execute batched model and data operations",
+      body: rootQuerySchema
     });
   }
   get routes() {
@@ -4994,11 +5506,11 @@ var RootRouter = class {
 
 // src/routers/data-router.ts
 var import_express_json_router7 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils21 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 var clientErrors4 = import_express_json_router7.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils21.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils21.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils26.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils26.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -5034,7 +5546,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils21.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils26.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router7.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -5053,6 +5565,9 @@ var DataRouter = class {
     const allowed = await req.dacl.isAllowed(this.dataName, access);
     if (!allowed) throw new clientErrors4.UnauthorizedError();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, this.fullBasePath, this.dataName, route);
+  }
   ///////////////////////
   // Collection Routes //
   ///////////////////////
@@ -5064,8 +5579,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = parseBooleanString(include_count);
-      const includeExtraHeaders = parseBooleanString(include_extra_headers);
+      const includeCount = (0, import_utils21.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils21.parseBooleanString)(include_extra_headers);
       const result = await svc.find(
         {},
         { skip, limit, page, pageSize: page_size },
@@ -5077,6 +5592,13 @@ var DataRouter = class {
       const decoratedResult = await decorateDataListResult(svc, result);
       return formatListResponse(req, decoratedResult, includeCount, includeExtraHeaders);
     });
+    this.registerOpenApiRoute({
+      method: "get",
+      path: "",
+      operationId: `${this.dataName}.list`,
+      summary: `List ${this.dataName} records`,
+      query: requestSchemas.listQuery
+    });
     this.router.post(`/${this.options.queryRouteSegment}`, async (req) => {
       await this.assertAllowed(req, "list");
       let {
@@ -5100,6 +5622,15 @@ var DataRouter = class {
       const decoratedResult = await decorateDataListResult(svc, result);
       return formatListResponse(req, decoratedResult, includeCount, includeExtraHeaders);
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}`,
+      operationId: `${this.dataName}.listAdvanced`,
+      summary: `Advanced list ${this.dataName} records`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedList") ?? dataListBodySchema
+      )
+    });
   }
   /////////////////////
   // Document Routes //
@@ -5114,6 +5645,12 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "get",
+      path: `/:${this.options.idParam}`,
+      operationId: `${this.dataName}.read`,
+      summary: `Read a ${this.dataName} record`
+    });
     this.router.post(`/${this.options.queryRouteSegment}/__filter`, async (req) => {
       await this.assertAllowed(req, "read");
       let { filter: filter2, select } = await parseBodyWithSchema(
@@ -5127,6 +5664,15 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}/__filter`,
+      operationId: `${this.dataName}.readByFilter`,
+      summary: `Read a ${this.dataName} record by filter`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedReadFilter") ?? dataReadFilterBodySchema
+      )
+    });
     this.router.post(`/${this.options.queryRouteSegment}/:${this.options.idParam}`, async (req) => {
       await this.assertAllowed(req, "read");
       const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
@@ -5141,13 +5687,22 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}/:${this.options.idParam}`,
+      operationId: `${this.dataName}.readAdvanced`,
+      summary: `Advanced read a ${this.dataName} record`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedRead") ?? dataReadByIdBodySchema
+      )
+    });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils21.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils26.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(this.dataName, keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils21.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils26.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -5170,6 +5725,62 @@ var DataRouter = class {
 
 // src/routers/index.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
+
+// src/openapi/router.ts
+var import_express = __toESM(require("express"));
+var import_node_path = require("path");
+var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(title)}</title>
+  <link rel="stylesheet" href="${escapeHtml(cssUrl)}" />
+</head>
+<body>
+  <div id="swagger-ui"></div>
+  <script src="${escapeHtml(bundleUrl)}"></script>
+  <script>
+    window.ui = SwaggerUIBundle({
+      url: ${JSON.stringify(specPath)},
+      dom_id: '#swagger-ui',
+      deepLinking: true,
+      presets: [SwaggerUIBundle.presets.apis],
+      layout: 'BaseLayout',
+    });
+  </script>
+</body>
+</html>`;
+var getRelativeSpecPath = (docsPath, jsonPath) => {
+  const docsDir = import_node_path.posix.dirname(docsPath.startsWith("/") ? docsPath : `/${docsPath}`);
+  const normalizedJsonPath = jsonPath.startsWith("/") ? jsonPath : `/${jsonPath}`;
+  return import_node_path.posix.relative(docsDir, normalizedJsonPath) || import_node_path.posix.basename(normalizedJsonPath);
+};
+function createOpenApiRouter(runtime, options = {}) {
+  const router = import_express.default.Router();
+  const jsonPath = options.jsonPath ?? "/openapi.json";
+  const docsPath = options.docsPath ?? "/docs";
+  const swaggerUiCssUrl = options.swaggerUiCssUrl ?? "https://unpkg.com/swagger-ui-dist@5/swagger-ui.css";
+  const swaggerUiBundleUrl = options.swaggerUiBundleUrl ?? "https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js";
+  const info = {
+    title: options.title ?? "Access Router API",
+    version: options.version ?? "0.0.0",
+    description: options.description,
+    servers: options.servers
+  };
+  router.get(jsonPath, (_req, res) => {
+    res.json(runtime.getOpenApiSpec(info));
+  });
+  if (docsPath !== false) {
+    router.get(docsPath, (_req, res) => {
+      res.type("html").send(renderDocsHtml(getRelativeSpecPath(docsPath, jsonPath), info.title, swaggerUiCssUrl, swaggerUiBundleUrl));
+    });
+  }
+  return router;
+}
+
+// src/routers/index.ts
 var hasRoutes = (input) => {
   return typeof input === "object" && input !== null && "routes" in input;
 };
@@ -5177,7 +5788,7 @@ var resolveRoutes = (input) => {
   return hasRoutes(input) ? input.routes : input;
 };
 function combineRoutes(...inputs) {
-  const router = import_express.default.Router();
+  const router = import_express2.default.Router();
   inputs.forEach((input) => {
     router.use(resolveRoutes(input));
   });
@@ -5189,7 +5800,7 @@ var accessRouterResponseHandler = import_express_json_router8.default.createHand
 });
 accessRouterResponseHandler.errorMessageProvider = function(error) {
   const errorLike = error;
-  console.error(error);
+  logger.error(error);
   return errorLike.message || errorLike._message || String(error);
 };
 
@@ -5211,17 +5822,20 @@ function createRuntimeApi(runtime) {
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
     const resolvedModelName = typeof modelName === "string" ? modelName : modelName && "modelName" in modelName ? modelName.modelName : modelName;
-    return (0, import_utils22.isUndefined)(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
+    return (0, import_utils27.isUndefined)(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
   };
   wtt2.createDataRouter = function(dataName, options) {
     return new DataRouter(dataName, options, runtime);
   };
+  wtt2.createOpenApiRouter = function(options) {
+    return createOpenApiRouter(runtime, options);
+  };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils22.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils27.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils22.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils27.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };
@@ -5259,6 +5873,7 @@ var index_default = acl;
   acl,
   combineRoutes,
   createAccessRuntime,
+  createOpenApiRouter,
   defineRequestSchema,
   fromAjv,
   fromArkType,