npm - @web-ts-toolkit/access-router - Versions diffs - 0.4.0 → 0.6.0 - Mend

@web-ts-toolkit/access-router 0.4.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +93 -7
package/advanced.d.mts +38 -40
package/advanced.d.ts +38 -40
package/advanced.js +5 -5
package/advanced.mjs +5 -4
package/index.d.mts +81 -4
package/index.d.ts +81 -4
package/index.js +1160 -545
package/index.mjs +990 -385
package/llms.txt +53 -0
package/package.json +13 -9
package/{parsers-CsyGHYQR.d.mts → parsers-Cj4r_G4g.d.mts} +35 -17
package/{parsers-CsyGHYQR.d.ts → parsers-Cj4r_G4g.d.ts} +35 -17

package/index.js CHANGED Viewed

@@ -36,6 +36,7 @@ __export(index_exports, {
   acl: () => acl,
   combineRoutes: () => combineRoutes,
   createAccessRuntime: () => createAccessRuntime,
+  createOpenApiRouter: () => createOpenApiRouter,
   default: () => index_default,
   defineRequestSchema: () => defineRequestSchema,
   fromAjv: () => fromAjv,
@@ -66,19 +67,19 @@ __export(index_exports, {
   setModelOptions: () => setModelOptions
 });
 module.exports = __toCommonJS(index_exports);
-var import_utils22 = require("@web-ts-toolkit/utils");
+var import_utils27 = require("@web-ts-toolkit/utils");
 // src/middleware.ts
 var import_express_json_router2 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils17 = require("@web-ts-toolkit/utils");
+var import_utils20 = require("@web-ts-toolkit/utils");
 // src/core.ts
-var import_utils16 = require("@web-ts-toolkit/utils");
+var import_utils19 = require("@web-ts-toolkit/utils");
 // src/runtime.ts
-var import_mongoose2 = __toESM(require("mongoose"));
+var import_mongoose3 = __toESM(require("mongoose"));
 var import_mongoose_schema_jsonschema = __toESM(require("mongoose-schema-jsonschema"));
-var import_utils7 = require("@web-ts-toolkit/utils");
+var import_utils10 = require("@web-ts-toolkit/utils");
 // src/helpers/collection.ts
 var import_sift = __toESM(require("sift"));
@@ -97,20 +98,11 @@ var findElementById = (collection, id) => {
 };
 // src/helpers/document.ts
-var import_utils4 = require("@web-ts-toolkit/utils");
-// src/lib.ts
 var import_mongoose = require("mongoose");
-var import_utils2 = require("@web-ts-toolkit/utils");
-var isSchema = (val) => val instanceof import_mongoose.Schema;
-var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose.Schema.Types.ObjectId;
-var isReference = (val) => (0, import_utils2.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
-var isDocument = function isDocument2(doc) {
-  return doc instanceof import_mongoose.Document;
-};
+var import_utils3 = require("@web-ts-toolkit/utils");
 // src/helpers/query.ts
-var import_utils3 = require("@web-ts-toolkit/utils");
+var import_utils2 = require("@web-ts-toolkit/utils");
 function genPagination({
   skip,
   limit,
@@ -119,10 +111,10 @@ function genPagination({
 }, hardLimit) {
   let _skip = 0;
   let _limit = Number(limit ?? pageSize);
-  if ((0, import_utils3.isNaN)(_limit) || _limit > hardLimit) _limit = hardLimit;
-  if (!(0, import_utils3.isNil)(skip)) {
+  if ((0, import_utils2.isNaN)(_limit) || _limit > hardLimit) _limit = hardLimit;
+  if (!(0, import_utils2.isNil)(skip)) {
     _skip = Number(skip);
-  } else if (!(0, import_utils3.isNil)(page)) {
+  } else if (!(0, import_utils2.isNil)(page)) {
     const npage = Number(page);
     if (npage > 1) _skip = (npage - 1) * _limit;
   }
@@ -137,9 +129,9 @@ function parseSortString(sortString) {
   }
 }
 function normalizeSelect(select) {
-  if (Array.isArray(select)) return (0, import_utils3.flattenDeep)(select.map(normalizeSelect));
-  if ((0, import_utils3.isPlainObject)(select)) {
-    return (0, import_utils3.reduce)(
+  if (Array.isArray(select)) return (0, import_utils2.flattenDeep)(select.map(normalizeSelect));
+  if ((0, import_utils2.isPlainObject)(select)) {
+    return (0, import_utils2.reduce)(
       select,
       (ret, val, key) => {
         if (val === 1) ret.push(key);
@@ -149,23 +141,27 @@ function normalizeSelect(select) {
       []
     );
   }
-  if ((0, import_utils3.isString)(select)) return select.split(" ").map((v) => v.trim());
+  if ((0, import_utils2.isString)(select)) return select.split(" ").map((v) => v.trim());
   return [];
 }
 // src/helpers/document.ts
-function getDocValue(doc, path, defalutValue) {
+var import_utils4 = require("@web-ts-toolkit/utils");
+function isDocument(doc) {
+  return doc instanceof import_mongoose.Document;
+}
+function getDocValue(doc, path, defaultValue) {
   if (isDocument(doc)) {
-    return (0, import_utils4.get)(doc._doc, path, defalutValue);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    return (0, import_utils4.get)(doc, path, defalutValue);
+    return (0, import_utils3.get)(doc._doc, path, defaultValue);
+  } else if ((0, import_utils3.isPlainObject)(doc)) {
+    return (0, import_utils3.get)(doc, path, defaultValue);
   }
 }
 function setDocValue(doc, path, value) {
   if (isDocument(doc)) {
-    (0, import_utils4.set)(doc._doc, path, value);
-  } else if ((0, import_utils4.isPlainObject)(doc)) {
-    (0, import_utils4.set)(doc, path, value);
+    (0, import_utils3.set)(doc._doc, path, value);
+  } else if ((0, import_utils3.isPlainObject)(doc)) {
+    (0, import_utils3.set)(doc, path, value);
   }
 }
 function getDocPermissions(modelName, doc) {
@@ -177,10 +173,10 @@ function toObject(doc) {
 }
 function pickDocFields(doc, fields = []) {
   if (isDocument(doc)) {
-    doc._doc = (0, import_utils4.pick)(doc._doc, fields);
+    doc._doc = (0, import_utils3.pick)(doc._doc, fields);
     return doc;
   } else {
-    return (0, import_utils4.pick)(doc, fields);
+    return (0, import_utils3.pick)(doc, fields);
   }
 }
 async function populateDoc(doc, target) {
@@ -253,35 +249,47 @@ function handleResultError(result) {
 }
 // src/helpers/index.ts
+var import_utils6 = require("@web-ts-toolkit/utils");
+// src/lib.ts
+var import_mongoose2 = require("mongoose");
 var import_utils5 = require("@web-ts-toolkit/utils");
+var isSchema = (val) => val instanceof import_mongoose2.Schema;
+var isObjectIdType = (val) => val === "ObjectId" || val === import_mongoose2.Schema.Types.ObjectId;
+var isReference = (val) => (0, import_utils5.isPlainObject)(val) && !!val.ref && isObjectIdType(val.type);
+var isDocument2 = function isDocument3(doc) {
+  return doc instanceof import_mongoose2.Document;
+};
+// src/helpers/index.ts
 function recurseObject(obj) {
   if (isSchema(obj)) {
     return buildRefs(obj.tree);
   }
-  if (!(0, import_utils5.isObject)(obj)) return null;
+  if (!(0, import_utils6.isObject)(obj)) return null;
   if (isReference(obj)) {
     return obj.ref;
   }
   let ret = null;
-  (0, import_utils5.forEach)(obj, (val) => {
+  (0, import_utils6.forEach)(obj, (val) => {
     ret = recurseObject(val);
-    if (!(0, import_utils5.isEmpty)(ret)) {
+    if (!(0, import_utils6.isEmpty)(ret)) {
       return false;
     }
   });
   return ret;
 }
 function buildRefs(schema) {
-  if (!(0, import_utils5.isObject)(schema)) return {};
+  if (!(0, import_utils6.isObject)(schema)) return {};
   const references = {};
-  (0, import_utils5.forEach)(schema, (val, key) => {
+  (0, import_utils6.forEach)(schema, (val, key) => {
     const paths = recurseObject(val);
-    if (!(0, import_utils5.isEmpty)(paths)) {
+    if (!(0, import_utils6.isEmpty)(paths)) {
       references[key] = paths;
     }
-    const target = (0, import_utils5.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils5.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils5.isPlainObject)(target[0])) {
+    const target = (0, import_utils6.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils6.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils6.isPlainObject)(target[0])) {
         return;
       }
     }
@@ -289,12 +297,12 @@ function buildRefs(schema) {
   return references;
 }
 function buildSubPaths(schema) {
-  if (!(0, import_utils5.isObject)(schema)) return [];
+  if (!(0, import_utils6.isObject)(schema)) return [];
   const subPaths = [];
-  (0, import_utils5.forEach)(schema, (val, key) => {
-    const target = (0, import_utils5.isObject)(val) && "type" in val ? val.type ?? val : val;
-    if ((0, import_utils5.isArray)(target) && target.length > 0) {
-      if (isSchema(target[0]) || (0, import_utils5.isPlainObject)(target[0]) && !isReference(target[0])) {
+  (0, import_utils6.forEach)(schema, (val, key) => {
+    const target = (0, import_utils6.isObject)(val) && "type" in val ? val.type ?? val : val;
+    if ((0, import_utils6.isArray)(target) && target.length > 0) {
+      if (isSchema(target[0]) || (0, import_utils6.isPlainObject)(target[0]) && !isReference(target[0])) {
         subPaths.push(key);
       }
     }
@@ -302,11 +310,11 @@ function buildSubPaths(schema) {
   return subPaths;
 }
 async function iterateQuery(query, handler) {
-  if (!(0, import_utils5.isPlainObject)(query)) return query;
-  if (!handler) return import_utils5.noop;
+  if (!(0, import_utils6.isPlainObject)(query)) return query;
+  if (!handler) return query;
   const queryObject = query;
-  return (0, import_utils5.mapValuesAsync)(queryObject, async (val, key) => {
-    if ((0, import_utils5.isPlainObject)(val)) {
+  return (0, import_utils6.mapValuesAsync)(queryObject, async (val, key) => {
+    if ((0, import_utils6.isPlainObject)(val)) {
       const plainValue = val;
       if (plainValue.$$sq) {
         return handler(0 /* SubQuery */, plainValue.$$sq, key);
@@ -316,7 +324,7 @@ async function iterateQuery(query, handler) {
         return iterateQuery(val, handler);
       }
     }
-    if ((0, import_utils5.isArray)(val)) {
+    if ((0, import_utils6.isArray)(val)) {
       return Promise.all(val.map((v) => iterateQuery(v, handler)));
     }
     return val;
@@ -325,13 +333,259 @@ async function iterateQuery(query, handler) {
 var createValidator = (fn) => {
   const stringHandler = (key) => key.trim().split(" ").every((v) => fn(v));
   const arrayHandler = (arr) => arr.some((item) => {
-    if ((0, import_utils5.isString)(item)) return stringHandler(item);
-    else if ((0, import_utils5.isArray)(item)) return arrayHandler(item);
+    if ((0, import_utils6.isString)(item)) return stringHandler(item);
+    else if ((0, import_utils6.isArray)(item)) return arrayHandler(item);
     else return false;
   });
   return { stringHandler, arrayHandler };
 };
+// src/openapi/build-spec.ts
+var import_utils8 = require("@web-ts-toolkit/utils");
+// src/openapi/responses.ts
+var json = (schema) => ({
+  content: {
+    "application/json": {
+      schema
+    }
+  }
+});
+var problemJson = {
+  content: {
+    "application/problem+json": {
+      schema: {
+        type: "object",
+        properties: {
+          type: { type: "string" },
+          title: { type: "string" },
+          status: { type: "number" },
+          detail: { type: "string" },
+          errors: { type: "array", items: {} }
+        },
+        additionalProperties: true
+      }
+    }
+  }
+};
+var genericDataSchema = { type: "object", additionalProperties: true };
+var genericListSchema = { type: "array", items: genericDataSchema };
+var openApiResponses = {
+  single(description = "Success") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  list(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  create(description = "Created") {
+    return {
+      201: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  },
+  delete(description = "Deleted") {
+    return {
+      200: { description, ...json(genericDataSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson },
+      404: { description: "Not Found", ...problemJson }
+    };
+  },
+  batch(description = "Success") {
+    return {
+      200: { description, ...json(genericListSchema) },
+      400: { description: "Bad Request", ...problemJson },
+      401: { description: "Unauthorized", ...problemJson }
+    };
+  }
+};
+// src/openapi/schemas.ts
+var import_zod = require("zod");
+var import_utils7 = require("@web-ts-toolkit/utils");
+var fallbackObjectSchema = { type: "object", additionalProperties: true };
+function patchOpenApiObjectSchema(source, properties) {
+  return {
+    kind: "objectProperties",
+    source,
+    properties
+  };
+}
+function defineOpenApiSchemaResolver(resolve) {
+  return {
+    kind: "schemaResolver",
+    resolve
+  };
+}
+function getNestedOpenApiSchemaDataSource(source) {
+  return (0, import_utils7.isPlainObject)(source) && "data" in source ? source.data : void 0;
+}
+function unwrapNestedOpenApiSchemaSource(source, fallback) {
+  if ((0, import_utils7.isPlainObject)(source) && ("default" in source || "data" in source)) {
+    return source.default ?? fallback;
+  }
+  return source ?? fallback;
+}
+function isOpenApiSchemaPatch(source) {
+  return (0, import_utils7.isPlainObject)(source) && source.kind === "objectProperties";
+}
+function isOpenApiSchemaResolver(source) {
+  return (0, import_utils7.isPlainObject)(source) && source.kind === "schemaResolver" && typeof source.resolve === "function";
+}
+function isJsonSchemaLike(source) {
+  return (0, import_utils7.isPlainObject)(source) && ("type" in source || "properties" in source || "$ref" in source || "anyOf" in source);
+}
+function hasOpenApiSchema(source) {
+  return (0, import_utils7.isPlainObject)(source) && isJsonSchemaLike(source.openapi);
+}
+function toOpenApiSchema(source) {
+  if (!source) return void 0;
+  const resolvedSource = isOpenApiSchemaResolver(source) ? source.resolve() : source;
+  if (!resolvedSource) return void 0;
+  if (isOpenApiSchemaPatch(resolvedSource)) {
+    const schema = toOpenApiSchema(resolvedSource.source) ?? { ...fallbackObjectSchema };
+    const properties = (0, import_utils7.isPlainObject)(schema.properties) ? { ...schema.properties } : {};
+    for (const [key, value] of Object.entries(resolvedSource.properties)) {
+      properties[key] = toOpenApiSchema(value) ?? fallbackObjectSchema;
+    }
+    return {
+      ...schema,
+      type: schema.type ?? "object",
+      properties
+    };
+  }
+  if (hasOpenApiSchema(resolvedSource)) {
+    return resolvedSource.openapi;
+  }
+  if (isJsonSchemaLike(resolvedSource)) {
+    return resolvedSource;
+  }
+  try {
+    return import_zod.z.toJSONSchema(resolvedSource);
+  } catch {
+    return fallbackObjectSchema;
+  }
+}
+// src/openapi/build-spec.ts
+var openApiMediaType = "application/json";
+var normalizePath = (path) => {
+  if (!path) return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+};
+var toOpenApiPath = (path) => normalizePath(path).replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+var schemaToQueryParameters = (schema) => {
+  const jsonSchema = toOpenApiSchema(schema);
+  if (!jsonSchema || jsonSchema.type !== "object") return [];
+  const properties = (0, import_utils8.isPlainObject)(jsonSchema.properties) ? jsonSchema.properties : {};
+  const required = new Set(
+    (0, import_utils8.isArray)(jsonSchema.required) ? jsonSchema.required.filter((item) => typeof item === "string") : []
+  );
+  return Object.entries(properties).map(([name, value]) => ({
+    name,
+    in: "query",
+    required: required.has(name),
+    schema: value
+  }));
+};
+var schemaToPathParameters = (path, pathParams) => {
+  const names = [...toOpenApiPath(path).matchAll(/\{([^}]+)\}/g)].map((item) => item[1]);
+  return names.map((name) => ({
+    name,
+    in: "path",
+    required: true,
+    schema: (pathParams && name in pathParams ? toOpenApiSchema(pathParams[name]) : void 0) ?? { type: "string" }
+  }));
+};
+var getDefaultResponses = (route) => {
+  if (route.operationId === "root.query") return openApiResponses.batch();
+  if (route.method === "delete") return openApiResponses.delete();
+  if (route.operationId?.toLowerCase().includes("create")) return openApiResponses.create();
+  if (route.operationId?.toLowerCase().includes("list")) return openApiResponses.list();
+  if (route.operationId?.toLowerCase().includes("distinct")) return openApiResponses.list();
+  return openApiResponses.single();
+};
+var buildOperation = (route) => {
+  const queryParameters = schemaToQueryParameters(route.query);
+  const pathParameters = schemaToPathParameters(route.path, route.pathParams);
+  const bodySchema = toOpenApiSchema(route.body);
+  const responses = route.responses ?? getDefaultResponses(route);
+  const operation = {
+    operationId: route.operationId,
+    summary: route.summary,
+    description: route.description,
+    tags: route.tags,
+    deprecated: route.deprecated,
+    responses
+  };
+  const parameters = [...pathParameters, ...queryParameters];
+  if (parameters.length) {
+    operation.parameters = parameters;
+  }
+  if (bodySchema) {
+    operation.requestBody = {
+      required: true,
+      content: {
+        [openApiMediaType]: {
+          schema: bodySchema
+        }
+      }
+    };
+  }
+  if (route.acl) {
+    operation["x-access-router-acl"] = route.acl;
+  }
+  return operation;
+};
+function buildOpenApiSpec(routes, options) {
+  const paths = {};
+  const { servers, ...info } = options;
+  for (const route of routes) {
+    const path = toOpenApiPath(route.path);
+    if (!paths[path]) {
+      paths[path] = {};
+    }
+    paths[path][route.method] = buildOperation(route);
+  }
+  return {
+    openapi: "3.1.0",
+    info,
+    servers,
+    paths
+  };
+}
+// src/openapi/registry.ts
+var OpenApiRegistry = class {
+  constructor() {
+    this.routes = [];
+  }
+  register(route) {
+    const existingIndex = this.routes.findIndex((item) => item.method === route.method && item.path === route.path);
+    if (existingIndex === -1) {
+      this.routes.push(route);
+      return;
+    }
+    this.routes[existingIndex] = route;
+  }
+  getRoutes() {
+    return [...this.routes];
+  }
+  getSpec(info) {
+    return buildOpenApiSpec(this.routes, info);
+  }
+};
 // src/logger-default.ts
 var import_node_util = __toESM(require("util"));
 var import_winston = require("winston");
@@ -359,7 +613,7 @@ var defaultLogger = (0, import_winston.createLogger)({
 });
 // src/options/manager.ts
-var import_utils6 = require("@web-ts-toolkit/utils");
+var import_utils9 = require("@web-ts-toolkit/utils");
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -396,26 +650,26 @@ var OptionsManager = class {
     return this;
   }
   get(key, defaultValue) {
-    return (0, import_utils6.get)(this.currentOptions, key, defaultValue);
+    return (0, import_utils9.get)(this.currentOptions, key, defaultValue);
   }
   set(key, value) {
-    (0, import_utils6.set)(this.currentOptions, key, value);
+    (0, import_utils9.set)(this.currentOptions, key, value);
   }
   fetch() {
     return { ...this.currentOptions };
   }
   assign(options) {
-    (0, import_utils6.assign)(this.currentOptions, options);
+    (0, import_utils9.assign)(this.currentOptions, options);
   }
   onchange(key, func) {
-    (0, import_utils6.set)(this.listeners, key, func);
+    (0, import_utils9.set)(this.listeners, key, func);
     return this;
   }
 };
 // src/runtime.ts
-(0, import_mongoose_schema_jsonschema.default)(import_mongoose2.default);
-var pluralize = import_mongoose2.default.pluralize();
+(0, import_mongoose_schema_jsonschema.default)(import_mongoose3.default);
+var pluralize = import_mongoose3.default.pluralize();
 var FIELD_ACCESS_KEYS = ["list", "create", "read", "update"];
 var defaultModelOptions = {
   basePath: null,
@@ -426,44 +680,44 @@ var defaultDataOptions = {
   queryRouteSegment: "__query"
 };
 var normalizeBasePath = (name, value) => {
-  if ((0, import_utils7.isNil)(value)) {
+  if ((0, import_utils10.isNil)(value)) {
     return `/${pluralize(name)}`;
   }
-  return (0, import_utils7.isString)(value) ? (0, import_utils7.addLeadingSlash)(value) : "";
+  return (0, import_utils10.isString)(value) ? (0, import_utils10.addLeadingSlash)(value) : "";
 };
 var hasModelPermission = (value, modelPermissionPrefix) => {
   if (!modelPermissionPrefix) {
     return true;
   }
-  if ((0, import_utils7.isString)(value)) {
+  if ((0, import_utils10.isString)(value)) {
     return value.trim().split(" ").some((item) => item.startsWith(modelPermissionPrefix));
   }
-  if ((0, import_utils7.isArray)(value)) {
+  if ((0, import_utils10.isArray)(value)) {
     return value.some((item) => {
-      if ((0, import_utils7.isString)(item) || (0, import_utils7.isArray)(item)) {
+      if ((0, import_utils10.isString)(item) || (0, import_utils10.isArray)(item)) {
         return hasModelPermission(item, modelPermissionPrefix);
       }
       return true;
     });
   }
-  return (0, import_utils7.isFunction)(value);
+  return (0, import_utils10.isFunction)(value);
 };
 var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
   const schemaKeys = Object.keys(permissionSchema);
   const globalPermissionKeys = {};
   const modelPermissionKeys = {};
-  (0, import_utils7.forEach)(schemaKeys, (schemaKey) => {
+  (0, import_utils10.forEach)(schemaKeys, (schemaKey) => {
     const schemaRule = permissionSchema[schemaKey];
-    const ruleEntries = (0, import_utils7.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
+    const ruleEntries = (0, import_utils10.isPlainObject)(schemaRule) ? Object.entries(schemaRule) : FIELD_ACCESS_KEYS.map((accessKey) => [accessKey, schemaRule]);
     for (let x = 0; x < ruleEntries.length; x++) {
       const [accessKey, value] = ruleEntries[x];
-      if (!(0, import_utils7.isArray)(globalPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(globalPermissionKeys[accessKey])) {
         globalPermissionKeys[accessKey] = [];
       }
-      if (!(0, import_utils7.isArray)(modelPermissionKeys[accessKey])) {
+      if (!(0, import_utils10.isArray)(modelPermissionKeys[accessKey])) {
         modelPermissionKeys[accessKey] = [];
       }
-      if ((0, import_utils7.isBoolean)(value)) {
+      if ((0, import_utils10.isBoolean)(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
         return;
       }
@@ -504,6 +758,16 @@ var AccessRuntime = class {
     this.modelRefs = {};
     this.modelSubs = {};
     this.modelAtts = {};
+    this.openApiRegistry = new OpenApiRegistry();
+  }
+  registerOpenApiRoute(route) {
+    this.openApiRegistry.register(route);
+  }
+  getOpenApiRoutes() {
+    return this.openApiRegistry.getRoutes();
+  }
+  getOpenApiSpec(info) {
+    return this.openApiRegistry.getSpec(info);
   }
   setGlobalOptions(options) {
     this.globalOptions.assign(options);
@@ -530,7 +794,7 @@ var AccessRuntime = class {
     return this.defaultModelOptions.get(key, defaultValue);
   }
   createModelOptions(modelName) {
-    const model = import_mongoose2.default.model(modelName);
+    const model = import_mongoose3.default.model(modelName);
     const manager = new OptionsManager({
       ...defaultModelOptions,
       modelName
@@ -547,7 +811,7 @@ var AccessRuntime = class {
     }).onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         modelName,
-        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     this.modelJsonSchemas[modelName] = model.jsonSchema();
@@ -605,7 +869,7 @@ var AccessRuntime = class {
     manager.onchange("basePath", function(newval, key, target) {
       target[key] = normalizeBasePath(
         dataName,
-        (0, import_utils7.isString)(newval) || (0, import_utils7.isNil)(newval) ? newval : void 0
+        (0, import_utils10.isString)(newval) || (0, import_utils10.isNil)(newval) ? newval : void 0
       );
     }).build();
     return manager;
@@ -646,7 +910,7 @@ var AccessRuntime = class {
     if (modelName in this.modelRefs && modelName in this.modelSubs && modelName in this.modelAtts) {
       return;
     }
-    const model = import_mongoose2.default.models[modelName];
+    const model = import_mongoose3.default.models[modelName];
     if (!model) {
       this.modelRefs[modelName] = this.modelRefs[modelName] ?? {};
       this.modelSubs[modelName] = this.modelSubs[modelName] ?? [];
@@ -656,26 +920,26 @@ var AccessRuntime = class {
     const schema = model.schema;
     this.modelRefs[modelName] = buildRefs(schema.tree);
     this.modelSubs[modelName] = buildSubPaths(schema.tree);
-    this.modelAtts[modelName] = (0, import_utils7.keys)(schema.obj);
+    this.modelAtts[modelName] = (0, import_utils10.keys)(schema.obj);
   }
   getModelRef(modelName, refPath) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelRefs, `${modelName}.${refPath}`, null);
+    return (0, import_utils10.get)(this.modelRefs, `${modelName}.${refPath}`, null);
   }
   getModelSub(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelSubs, modelName, []);
+    return (0, import_utils10.get)(this.modelSubs, modelName, []);
   }
   getModelAtt(modelName) {
     this.ensureModelMeta(modelName);
-    return (0, import_utils7.get)(this.modelAtts, modelName, []);
+    return (0, import_utils10.get)(this.modelAtts, modelName, []);
   }
 };
 var defaultRuntime = new AccessRuntime();
 // src/runtime-context.ts
 var import_node_async_hooks = require("async_hooks");
-var import_mongoose3 = __toESM(require("mongoose"));
+var import_mongoose4 = __toESM(require("mongoose"));
 var ACCESS_RUNTIME = /* @__PURE__ */ Symbol("access-runtime");
 var runtimeStorage = new import_node_async_hooks.AsyncLocalStorage();
 function runWithRuntime(runtime, callback) {
@@ -685,13 +949,13 @@ function getActiveRuntime() {
   return runtimeStorage.getStore() ?? null;
 }
 function attachRuntimeToModel(modelName, runtime) {
-  const model = import_mongoose3.default.models[modelName];
+  const model = import_mongoose4.default.models[modelName];
   if (model) {
     model[ACCESS_RUNTIME] = runtime;
   }
 }
 function getRuntimeForModelName(modelName) {
-  const model = import_mongoose3.default.models[modelName];
+  const model = import_mongoose4.default.models[modelName];
   return model?.[ACCESS_RUNTIME] ?? null;
 }
@@ -768,16 +1032,16 @@ var getModelSub = (modelName) => {
 };
 // src/services/base.ts
-var import_utils8 = require("@web-ts-toolkit/utils");
+var import_utils11 = require("@web-ts-toolkit/utils");
 function validateClientFilter(filter2) {
   const errors = [];
   const blockedOperators = /* @__PURE__ */ new Set(["$where", "$expr", "$function", "$accumulator"]);
   const visit = (value, path) => {
-    if ((0, import_utils8.isArray)(value)) {
+    if ((0, import_utils11.isArray)(value)) {
       value.forEach((item, index) => visit(item, `${path}[${index}]`));
       return;
     }
-    if (!(0, import_utils8.isPlainObject)(value)) return;
+    if (!(0, import_utils11.isPlainObject)(value)) return;
     Object.entries(value).forEach(([key, child]) => {
       const nextPath = path ? `${path}.${key}` : key;
       if (blockedOperators.has(key)) {
@@ -872,17 +1136,17 @@ var Base = class {
     return validateClientFilter(filter2);
   }
   processInclude(include) {
-    const includes = (0, import_utils8.compact)((0, import_utils8.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
+    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include)).filter(({ model, op, path, localField, foreignField }) => {
       return model && op && path && localField && foreignField;
     });
     let includeLocalFields = [];
     let includePaths = [];
-    (0, import_utils8.forEach)(includes, (inc) => {
+    (0, import_utils11.forEach)(includes, (inc) => {
       includeLocalFields.push(inc.localField);
       includePaths.push(inc.path);
     });
-    includeLocalFields = (0, import_utils8.uniq)((0, import_utils8.compact)(includeLocalFields));
-    includePaths = (0, import_utils8.uniq)((0, import_utils8.compact)(includePaths));
+    includeLocalFields = (0, import_utils11.uniq)((0, import_utils11.compact)(includeLocalFields));
+    includePaths = (0, import_utils11.uniq)((0, import_utils11.compact)(includePaths));
     return {
       includes,
       includeLocalFields,
@@ -891,9 +1155,9 @@ var Base = class {
   }
   async includeDocs(docs, include) {
     if (!include) return docs;
-    const includes = (0, import_utils8.compact)((0, import_utils8.castArray)(include));
+    const includes = (0, import_utils11.compact)((0, import_utils11.castArray)(include));
     if (includes.length === 0) return docs;
-    const isSingle = !(0, import_utils8.isArray)(docs);
+    const isSingle = !(0, import_utils11.isArray)(docs);
     if (isSingle) docs = [docs];
     for (let x = 0; x < includes.length; x++) {
       const include2 = includes[x];
@@ -910,10 +1174,10 @@ var Base = class {
     const svc = this.req.macl.getPublicService(model);
     if (!svc) return docs;
     const includeLocalValues = [];
-    (0, import_utils8.forEach)(docs, (doc, i) => {
-      includeLocalValues.push((0, import_utils8.get)(doc, localField));
+    (0, import_utils11.forEach)(docs, (doc, i) => {
+      includeLocalValues.push((0, import_utils11.get)(doc, localField));
     });
-    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils8.flatten)(includeLocalValues) } };
+    const filter2 = { ..._filters ?? {}, [foreignField]: { $in: (0, import_utils11.flatten)(includeLocalValues) } };
     const result = await svc.find(filter2, args, {
       ...options,
       lean: true,
@@ -923,8 +1187,8 @@ var Base = class {
     if (!result.success) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils8.get)(doc, localField);
-      const filterFn = (row) => (0, import_utils8.intersectionBy)((0, import_utils8.castArray)(localValue), (0, import_utils8.castArray)((0, import_utils8.get)(row, foreignField)), String).length > 0;
+      const localValue = (0, import_utils11.get)(doc, localField);
+      const filterFn = (row) => (0, import_utils11.intersectionBy)((0, import_utils11.castArray)(localValue), (0, import_utils11.castArray)((0, import_utils11.get)(row, foreignField)), String).length > 0;
       const matches = result.data.filter(filterFn);
       setDocValue(doc, path, op === "list" ? matches : matches[0]);
     }
@@ -936,7 +1200,7 @@ var Base = class {
     if (!svc) return docs;
     for (let y = 0; y < docs.length; y++) {
       const doc = docs[y];
-      const localValue = (0, import_utils8.get)(doc, localField);
+      const localValue = (0, import_utils11.get)(doc, localField);
       const filter2 = { ..._filters ?? {}, [foreignField]: localValue };
       const result = await svc.count(filter2);
       if (!result.success) continue;
@@ -978,28 +1242,45 @@ var Base = class {
     if (!result.success) return null;
     let ret = result.data;
     if (sqOptions.path) {
-      ret = (0, import_utils8.isArray)(ret) ? (0, import_utils8.flatten)(ret.map((v) => (0, import_utils8.get)(v, sqOptions.path))) : (0, import_utils8.get)(ret, sqOptions.path);
+      ret = (0, import_utils11.isArray)(ret) ? (0, import_utils11.flatten)(ret.map((v) => (0, import_utils11.get)(v, sqOptions.path))) : (0, import_utils11.get)(ret, sqOptions.path);
     }
     if (sqOptions.compact) {
-      ret = (0, import_utils8.compact)((0, import_utils8.castArray)(ret));
+      ret = (0, import_utils11.compact)((0, import_utils11.castArray)(ret));
     }
     return ret;
   }
-  async handleDate(val, key) {
+  handleDate(val, key) {
+    if (val instanceof Date) return val;
+    if (typeof val === "string" || typeof val === "number") return new Date(val);
     return /* @__PURE__ */ new Date();
   }
 };
 // src/services/service.ts
-var import_utils10 = require("@web-ts-toolkit/utils");
-var import_deep_diff = __toESM(require("deep-diff"));
+var import_utils13 = require("@web-ts-toolkit/utils");
+var import_just_diff = require("just-diff");
+// src/model.ts
+var import_mongoose5 = __toESM(require("mongoose"));
+// src/logger.ts
+var passthrough = (level) => (...args) => {
+  const globalLogger = getGlobalOption("logger");
+  const target = globalLogger?.[level] ?? defaultLogger[level];
+  return target.apply(globalLogger ?? defaultLogger, args);
+};
+var logger = {
+  debug: passthrough("debug"),
+  info: passthrough("info"),
+  warn: passthrough("warn"),
+  error: passthrough("error")
+};
 // src/model.ts
-var import_mongoose4 = __toESM(require("mongoose"));
 var Model = class {
   constructor(modelName) {
     this.modelName = modelName;
-    this.model = import_mongoose4.default.model(modelName);
+    this.model = import_mongoose5.default.model(modelName);
     if (!this.model) return;
     this.model.schema.set("optimisticConcurrency", true);
     const currVersionKey = this.model.schema.get("versionKey");
@@ -1025,12 +1306,15 @@ var Model = class {
     if (lean) builder.lean();
     return builder;
   }
-  // See https://github.com/Automattic/mongoose/blob/65b2d12a8f85f86136cfaf32947f338ba0c5f451/lib/query.js#L3011
-  validateSort(sort, logError = console.error) {
+  validateSort(sort, logError = logger.error) {
     const validSortOrders = [1, -1, "asc", "ascending", "desc", "descending"];
+    const fieldPathPattern = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
+    const isValidFieldPath = (field) => fieldPathPattern.test(field);
     if (sort === null || sort === void 0) return true;
     if (typeof sort === "string") {
-      if (!/^[a-zA-Z0-9\s-]+/.test(sort)) {
+      const fields = sort.trim().split(/\s+/).filter(Boolean);
+      const isValid = fields.every((field) => isValidFieldPath(field.startsWith("-") ? field.slice(1) : field));
+      if (!isValid) {
         logError("Invalid sort string:", sort);
         return false;
       }
@@ -1043,8 +1327,8 @@ var Model = class {
           return false;
         }
         const [key, order] = pair;
-        if (typeof key !== "string") {
-          logError("Invalid sort array key: must be string", key);
+        if (typeof key !== "string" || !isValidFieldPath(key)) {
+          logError("Invalid sort array key: must be a field path string", key);
           return false;
         }
         if (!validSortOrders.includes(order)) {
@@ -1056,7 +1340,11 @@ var Model = class {
       return isValid;
     }
     if (typeof sort === "object" && !(sort instanceof Map)) {
-      const isValid = Object.values(sort).every((order) => {
+      const isValid = Object.entries(sort).every(([key, order]) => {
+        if (!isValidFieldPath(key)) {
+          logError("Invalid sort object key: must be a field path string", key);
+          return false;
+        }
         if (!validSortOrders.includes(order)) {
           logError('Invalid sort object value: must be 1, -1, "asc", or "desc"', order);
           return false;
@@ -1066,7 +1354,11 @@ var Model = class {
       return isValid;
     }
     if (sort instanceof Map) {
-      const isValid = Array.from(sort.values()).every((order) => {
+      const isValid = Array.from(sort.entries()).every(([key, order]) => {
+        if (!isValidFieldPath(key)) {
+          logError("Invalid sort Map key: must be a field path string", key);
+          return false;
+        }
         if (!validSortOrders.includes(order)) {
           logError('Invalid sort Map value: must be 1, -1, "asc", or "desc"', order);
           return false;
@@ -1089,9 +1381,6 @@ var Model = class {
     if (lean) builder.lean();
     return builder;
   }
-  findOneAndDelete(filter2) {
-    return this.model.findOneAndDelete(filter2);
-  }
   exists(filter2) {
     if (!filter2) return null;
     return this.findOne(filter2).select("_id").lean();
@@ -1100,10 +1389,6 @@ var Model = class {
   countDocuments(filter2 = {}) {
     return this.model.countDocuments(filter2);
   }
-  // see https://mongoosejs.com/docs/api.html#model_Model.estimatedDocumentCount
-  estimatedDocumentCount() {
-    return this.model.estimatedDocumentCount();
-  }
   // see https://mongoosejs.com/docs/api.html#model_Model.distinct
   distinct(field, conditions = {}) {
     return this.model.distinct(field, conditions);
@@ -1111,40 +1396,27 @@ var Model = class {
 };
 var model_default = Model;
-// src/logger.ts
-var passthrough = (level) => (...args) => {
-  const globalLogger = getGlobalOption("logger");
-  const target = globalLogger?.[level] ?? defaultLogger[level];
-  return target.apply(globalLogger ?? defaultLogger, args);
-};
-var logger = {
-  debug: passthrough("debug"),
-  info: passthrough("info"),
-  warn: passthrough("warn"),
-  error: passthrough("error")
-};
 // src/services/model-subdocument-service.ts
-var import_utils9 = require("@web-ts-toolkit/utils");
+var import_utils12 = require("@web-ts-toolkit/utils");
 async function listSub(service, id, sub, options) {
   const { filter: ft, select } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "read" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.list`, ft),
     service.genQuerySelect("list", select, false, [sub, "sub"])
   ]);
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  if (subSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subSelect.concat("_id")));
+  if (subSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subSelect.concat("_id")));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function readSub(service, id, sub, subId, options) {
   const { select, populate } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, { populate }, { access: "read" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.read`, { _id: subId }),
     service.genQuerySelect("read", select, false, [sub, "sub"])
@@ -1152,13 +1424,13 @@ async function readSub(service, id, sub, subId, options) {
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  if (subSelect) subdoc = (0, import_utils9.pick)(toObject(subdoc), subSelect.concat(["_id"]));
+  if (subSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function updateSub(service, id, sub, subId, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: subId }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
@@ -1167,16 +1439,16 @@ async function updateSub(service, id, sub, subId, data) {
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   let subdoc = findElement(result, subFilter);
   if (!subdoc) return { success: false, code: "not_found" /* NotFound */ };
-  const allowedData = (0, import_utils9.pick)(data, subUpdateSelect);
+  const allowedData = (0, import_utils12.pick)(data, subUpdateSelect);
   Object.assign(subdoc, allowedData);
   await parentDoc.save();
-  if (subReadSelect) subdoc = (0, import_utils9.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
+  if (subReadSelect) subdoc = (0, import_utils12.pick)(toObject(subdoc), subReadSelect.concat(["_id"]));
   return { success: true, kind: "single", code: "success" /* Success */, data: subdoc };
 }
 async function bulkUpdateSub(service, id, sub, data) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subFilter, subReadSelect, subUpdateSelect] = await Promise.all([
     service.genFilter(`subs.${sub}.update`, { _id: { $in: data.map((v) => v._id) } }),
     service.genQuerySelect("read", null, false, [sub, "sub"]),
@@ -1184,35 +1456,35 @@ async function bulkUpdateSub(service, id, sub, data) {
   ]);
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   result = filterCollection(result, subFilter);
-  (0, import_utils9.forEach)(result, (subdoc) => {
+  (0, import_utils12.forEach)(result, (subdoc) => {
     const tdata = findElementById(data, subdoc._id);
     if (!tdata) return;
-    const allowedData = (0, import_utils9.pick)(tdata, subUpdateSelect);
+    const allowedData = (0, import_utils12.pick)(tdata, subUpdateSelect);
     Object.assign(subdoc, allowedData);
   });
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "success" /* Success */, data: result, count: result.length };
 }
 async function createSub(service, id, sub, data, options) {
   const { addFirst } = options ?? {};
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  let result = (0, import_utils9.get)(parentDoc, sub);
+  let result = (0, import_utils12.get)(parentDoc, sub);
   const [subCreateSelect, subReadSelect] = await Promise.all([
     service.genQuerySelect("create", null, false, [sub, "sub"]),
     service.genQuerySelect("read", null, false, [sub, "sub"])
   ]);
-  const allowedData = (0, import_utils9.pick)(data, subCreateSelect);
+  const allowedData = (0, import_utils12.pick)(data, subCreateSelect);
   addFirst === true ? result.unshift(allowedData) : result.push(allowedData);
   await parentDoc.save();
-  if (subReadSelect) result = result.map((v) => (0, import_utils9.pick)(toObject(v), subReadSelect.concat(["_id"])));
+  if (subReadSelect) result = result.map((v) => (0, import_utils12.pick)(toObject(v), subReadSelect.concat(["_id"])));
   return { success: true, kind: "list", code: "created" /* Created */, data: result, count: result.length };
 }
 async function deleteSub(service, id, sub, subId) {
   const parentDoc = await getParentDoc(service, id, sub, null, { access: "update" });
   if (!parentDoc) return { success: false, code: "not_found" /* NotFound */ };
-  const result = (0, import_utils9.get)(parentDoc, sub);
+  const result = (0, import_utils12.get)(parentDoc, sub);
   const subFilter = await service.genFilter(`subs.${sub}.delete`, { _id: subId });
   if (subFilter === false) return { success: false, code: "forbidden" /* Forbidden */ };
   const subdoc = findElement(result, subFilter);
@@ -1347,7 +1619,7 @@ function resolveExistsOptions(service, options = {}) {
 // src/services/service.ts
 var assertModelDocument = (value, modelName, hookName) => {
-  if (isDocument(value)) {
+  if (isDocument2(value)) {
     return value;
   }
   throw new Error(`${hookName} hook for model=${modelName} must return a Mongoose document instance`);
@@ -1441,7 +1713,7 @@ var Service = class extends Base {
       genPagination({ skip, limit, page, pageSize }, this.options.listHardLimit)
     ]);
     const finalSelect = normalizeSelect(_select);
-    const filteredPopulate = (0, import_utils10.isArray)(finalSelect) && (0, import_utils10.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
+    const filteredPopulate = (0, import_utils13.isArray)(finalSelect) && (0, import_utils13.isArray)(_populate) ? _populate.filter((p) => finalSelect.includes(p.path.split(".")[0])) : _populate;
     const { includes, includeLocalFields, includePaths } = this.processInclude(include);
     const query = {
       filter: _filter,
@@ -1463,7 +1735,7 @@ var Service = class extends Base {
       originalDocumentSnapshot: toObject(doc),
       resolvedQuery: query
     }));
-    const _decorate = (0, import_utils10.isFunction)(decorate) ? decorate : (v) => v;
+    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
     docs = await this.includeDocs(docs, includes);
     const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
@@ -1515,16 +1787,16 @@ var Service = class extends Base {
           resolvedQuery: resolvedPopulate.length > 0 ? { populate: resolvedPopulate } : {}
         };
         const allowedFields = await this.genAllowedFields(item, "create");
-        const allowedData = (0, import_utils10.pick)(item, allowedFields);
+        const allowedData = (0, import_utils13.pick)(item, allowedFields);
         context.allowedFields = allowedFields;
         context.allowedData = allowedData;
         const validated = await this.validate(allowedData, "create", context);
-        if ((0, import_utils10.isBoolean)(validated)) {
+        if ((0, import_utils13.isBoolean)(validated)) {
           if (!validated) {
             validationError = { success: false, code: "bad_request" /* BadRequest */ };
             return;
           }
-        } else if ((0, import_utils10.isArray)(validated)) {
+        } else if ((0, import_utils13.isArray)(validated)) {
           if (validated.length > 0) {
             validationError = { success: false, code: "bad_request" /* BadRequest */, errors: validated };
             return;
@@ -1537,7 +1809,7 @@ var Service = class extends Base {
       })
     );
     if (validationError) return validationError;
-    const _decorate = (0, import_utils10.isFunction)(decorate) ? decorate : (v) => v;
+    const _decorate = (0, import_utils13.isFunction)(decorate) ? decorate : (v) => v;
     const createdDocs = await this.model.create(items);
     const docs = await Promise.all(
       createdDocs.map(async (doc, index) => {
@@ -1608,13 +1880,13 @@ var Service = class extends Base {
     context.docPermissions = this.getDocPermissions(doc);
     context.currentDocument = doc;
     const allowedFields = await this.genAllowedFields(doc, "update");
-    const allowedData = (0, import_utils10.pick)(data, allowedFields);
+    const allowedData = (0, import_utils13.pick)(data, allowedFields);
     context.allowedFields = allowedFields;
     context.allowedData = allowedData;
     const validated = await this.validate(allowedData, "update", context);
-    if ((0, import_utils10.isBoolean)(validated)) {
+    if ((0, import_utils13.isBoolean)(validated)) {
       if (!validated) return { success: false, code: "bad_request" /* BadRequest */ };
-    } else if ((0, import_utils10.isArray)(validated)) {
+    } else if ((0, import_utils13.isArray)(validated)) {
       if (validated.length > 0) return { success: false, code: "bad_request" /* BadRequest */, errors: validated };
     }
     const prepared = await this.prepare(allowedData, "update", context);
@@ -1626,11 +1898,11 @@ var Service = class extends Base {
     doc = await doc.save();
     const diffExcludeFields = [this.options.documentPermissionField, "__v"];
     this.asServiceHookContext(context).diff = (d) => {
-      context.changes = (0, import_deep_diff.default)(
-        (0, import_utils10.omit)(context.originalDocumentSnapshot, diffExcludeFields),
-        (0, import_utils10.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
+      context.changes = (0, import_just_diff.diff)(
+        (0, import_utils13.omit)(context.originalDocumentSnapshot, diffExcludeFields),
+        (0, import_utils13.omit)(d.toObject({ virtuals: false }), diffExcludeFields)
       ) || [];
-      context.modifiedPaths = (0, import_utils10.uniq)(context.changes.map((di) => di.path.length > 0 ? di.path[0] : ""));
+      context.modifiedPaths = (0, import_utils13.uniq)(context.changes.map((di) => di.path.length > 0 ? String(di.path[0]) : ""));
     };
     doc = assertModelDocument(await this.afterPersist(doc, "update", context), this.modelName, "afterPersist");
     context.currentDocument = doc;
@@ -1646,7 +1918,7 @@ var Service = class extends Base {
     if (_populate) await populateDoc(doc, _populate);
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
-    if ((0, import_utils10.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
+    if ((0, import_utils13.isFunction)(decorate)) outputDoc = await decorate(outputDoc, context);
     if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
@@ -1810,7 +2082,7 @@ var Service = class extends Base {
     return resolveExistsOptions(this, options);
   }
   async getFieldPermissionAccess(ids) {
-    const uniqueIds = (0, import_utils10.uniq)(ids.map((id) => String(id)).filter(Boolean));
+    const uniqueIds = (0, import_utils13.uniq)(ids.map((id) => String(id)).filter(Boolean));
     if (uniqueIds.length === 0) {
       return {
         readIds: /* @__PURE__ */ new Set(),
@@ -1840,7 +2112,7 @@ var Service = class extends Base {
     return updateSub(this, id, sub, subId, data);
   }
   async bulkUpdateSub(id, sub, data) {
-    return bulkUpdateSub(this, id, sub, (0, import_utils10.castArray)(data));
+    return bulkUpdateSub(this, id, sub, (0, import_utils13.castArray)(data));
   }
   async createSub(id, sub, data, options) {
     return createSub(this, id, sub, data, options);
@@ -1854,7 +2126,7 @@ var Service = class extends Base {
 };
 // src/services/public-service.ts
-var import_utils11 = require("@web-ts-toolkit/utils");
+var import_utils14 = require("@web-ts-toolkit/utils");
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
@@ -1893,7 +2165,7 @@ var PublicService = class extends Service {
         doc = toObject(doc);
         doc = await this.decorate(doc, "create", context);
         doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils11.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
         return doc;
       }
     );
@@ -1988,8 +2260,8 @@ var PublicService = class extends Service {
         doc = toObject(doc);
         doc = await this.decorate(doc, "update", context);
         doc = this.runTasks(doc, tasks);
-        if (select) doc = (0, import_utils11.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
-        else if (!returningAll) doc = (0, import_utils11.pick)(doc, [...Object.keys(data), "_id"]);
+        if (select) doc = (0, import_utils14.pick)(doc, [...normalizeSelect(select), ...this.baseFieldsExt]);
+        else if (!returningAll) doc = (0, import_utils14.pick)(doc, [...Object.keys(data), "_id"]);
         return doc;
       }
     );
@@ -2111,7 +2383,7 @@ var PublicService = class extends Service {
 };
 // src/services/data-service.ts
-var import_utils12 = require("@web-ts-toolkit/utils");
+var import_utils15 = require("@web-ts-toolkit/utils");
 var DataService = class {
   constructor(req, dataName) {
     this.req = req;
@@ -2133,7 +2405,7 @@ var DataService = class {
     let doc = await findElement(this.data, _filter);
     if (!doc) return { success: false, code: "not_found" /* NotFound */, query };
     doc = await this.trimOutputFields(doc, access);
-    if (_select.length > 0) doc = (0, import_utils12.pick)(doc, _select);
+    if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query };
   }
   async findById(id, args, options) {
@@ -2169,13 +2441,13 @@ var DataService = class {
     docs = await Promise.all(
       docs.map(async (doc) => {
         doc = await this.trimOutputFields(doc, "list");
-        if (_select.length > 0) doc = (0, import_utils12.pick)(doc, _select);
+        if (_select.length > 0) doc = (0, import_utils15.pick)(doc, _select);
         return doc;
       })
     );
     if (sort) {
       const { sortKey, sortOrder } = parseSortString(sort);
-      docs = (0, import_utils12.orderBy)(docs, [sortKey], [sortOrder]);
+      docs = (0, import_utils15.orderBy)(docs, [sortKey], [sortOrder]);
     }
     docs = docs.slice(query.skip, query.limit && query.skip + query.limit);
     return {
@@ -2218,29 +2490,29 @@ var DataService = class {
 };
 // src/processors.ts
-var import_utils13 = require("@web-ts-toolkit/utils");
+var import_utils16 = require("@web-ts-toolkit/utils");
 var copyAndDepopulate = (docObject, operations, options = { mutable: true, idField: "_id" }) => {
-  const obj = (0, import_utils13.get)(options, "mutable", true) ? docObject : (0, import_utils13.cloneDeep)(docObject);
-  const idField = (0, import_utils13.get)(options, "idField", "_id");
-  (0, import_utils13.forEach)((0, import_utils13.castArray)(operations), (op) => {
+  const obj = (0, import_utils16.get)(options, "mutable", true) ? docObject : (0, import_utils16.cloneDeep)(docObject);
+  const idField = (0, import_utils16.get)(options, "idField", "_id");
+  (0, import_utils16.forEach)((0, import_utils16.castArray)(operations), (op) => {
     if (!op.src || !op.dest) return;
     let targets = [obj];
     const segs = op.src.split(".");
-    (0, import_utils13.forEach)(segs, (seg, ind) => {
+    (0, import_utils16.forEach)(segs, (seg, ind) => {
       if (segs.length === ind + 1) {
-        (0, import_utils13.forEach)(targets, (target) => {
+        (0, import_utils16.forEach)(targets, (target) => {
           const targetObject = target;
-          (0, import_utils13.set)(targetObject, op.dest, (0, import_utils13.get)(targetObject, seg));
-          (0, import_utils13.set)(
+          (0, import_utils16.set)(targetObject, op.dest, (0, import_utils16.get)(targetObject, seg));
+          (0, import_utils16.set)(
             targetObject,
             seg,
-            (0, import_utils13.isArray)(targetObject[seg]) ? (0, import_utils13.map)(targetObject[seg], idField) : (0, import_utils13.get)(targetObject, `${seg}.${idField}`)
+            (0, import_utils16.isArray)(targetObject[seg]) ? (0, import_utils16.map)(targetObject[seg], idField) : (0, import_utils16.get)(targetObject, `${seg}.${idField}`)
           );
         });
       } else {
         targets = targets.reduce((ret, target) => {
           const targetObject = target;
-          if ((0, import_utils13.isArray)(targetObject[seg])) ret.push(...targetObject[seg]);
+          if ((0, import_utils16.isArray)(targetObject[seg])) ret.push(...targetObject[seg]);
           else ret.push(targetObject[seg]);
           return ret;
         }, []);
@@ -2288,7 +2560,7 @@ var Cache = class {
 };
 // src/core-shared.ts
-var import_utils14 = require("@web-ts-toolkit/utils");
+var import_utils17 = require("@web-ts-toolkit/utils");
 // src/permission.ts
 var Permission = class {
@@ -2326,10 +2598,10 @@ var permission_default = Permission;
 // src/core-shared.ts
 function isAndFilter(filter2) {
-  return !!filter2 && (0, import_utils14.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils14.isArray)(filter2.$and);
+  return !!filter2 && (0, import_utils17.isPlainObject)(filter2) && Object.keys(filter2).length === 1 && (0, import_utils17.isArray)(filter2.$and);
 }
 function isMergeableClause(filter2) {
-  return !!filter2 && (0, import_utils14.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
+  return !!filter2 && (0, import_utils17.isPlainObject)(filter2) && Object.keys(filter2).every((key) => !key.startsWith("$"));
 }
 function optimizeAndFilter(clausesInput) {
   const clauses = [];
@@ -2344,7 +2616,7 @@ function optimizeAndFilter(clausesInput) {
     }
   }
   const dedupedClauses = clauses.filter(
-    (clause, index) => clauses.findIndex((item) => (0, import_utils14.isEqual)(item, clause)) === index
+    (clause, index) => clauses.findIndex((item) => (0, import_utils17.isEqual)(item, clause)) === index
   );
   const mergedClause = {};
   const remainingClauses = [];
@@ -2356,7 +2628,7 @@ function optimizeAndFilter(clausesInput) {
     }
     let canMerge = true;
     for (const [key, value] of Object.entries(clause)) {
-      if (Object.prototype.hasOwnProperty.call(mergedClause, key) && !(0, import_utils14.isEqual)(mergedClause[key], value)) {
+      if (Object.prototype.hasOwnProperty.call(mergedClause, key) && !(0, import_utils17.isEqual)(mergedClause[key], value)) {
         canMerge = false;
         break;
       }
@@ -2367,24 +2639,24 @@ function optimizeAndFilter(clausesInput) {
     }
     Object.assign(mergedClause, clause);
   }
-  const finalClauses = (0, import_utils14.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
+  const finalClauses = (0, import_utils17.isEmpty)(mergedClause) ? remainingClauses : [mergedClause, ...remainingClauses];
   if (finalClauses.length === 0) return null;
   if (finalClauses.length === 1) return finalClauses[0];
   return { $and: finalClauses };
 }
 function normalizeFilter(filter2) {
   if (filter2 === false) return false;
-  if (!filter2 || !(0, import_utils14.isPlainObject)(filter2) || (0, import_utils14.isEmpty)(filter2)) return null;
+  if (!filter2 || !(0, import_utils17.isPlainObject)(filter2) || (0, import_utils17.isEmpty)(filter2)) return null;
   if (!isAndFilter(filter2)) {
     return filter2;
   }
   return optimizeAndFilter(filter2.$and);
 }
 async function resolveIdentifierFilter(req, idField, resolveIdFilter, id) {
-  if ((0, import_utils14.isFunction)(resolveIdFilter)) {
+  if ((0, import_utils17.isFunction)(resolveIdFilter)) {
     return await resolveIdFilter.call(req, id);
   }
-  if ((0, import_utils14.isString)(idField)) {
+  if ((0, import_utils17.isString)(idField)) {
     return { [idField]: id };
   }
   return { _id: id };
@@ -2400,11 +2672,11 @@ async function resolveAccessFilter({
 }) {
   let nextFilter = normalizeFilter(filter2);
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
-  if ((0, import_utils14.isFunction)(overrideFilterFn)) {
+  if ((0, import_utils17.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
   const baseFilterFn = getOption(`baseFilter.${access}`, null);
-  if (!(0, import_utils14.isFunction)(baseFilterFn)) return nextFilter || {};
+  if (!(0, import_utils17.isFunction)(baseFilterFn)) return nextFilter || {};
   const baseFilter = normalizeFilter(
     cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
   );
@@ -2424,33 +2696,33 @@ async function setRequestPermissions(req) {
   const requestPermissionField = getGlobalOption("requestPermissionField");
   if (req[requestPermissionField]) return;
   const globalPermissions = getGlobalOption("globalPermissions");
-  if (!(0, import_utils14.isFunction)(globalPermissions)) return;
+  if (!(0, import_utils17.isFunction)(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
-  if ((0, import_utils14.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
-  else if ((0, import_utils14.isArray)(permissions)) req[requestPermissionField] = (0, import_utils14.arrayToRecord)(permissions);
-  else if ((0, import_utils14.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  if ((0, import_utils17.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
+  else if ((0, import_utils17.isArray)(permissions)) req[requestPermissionField] = (0, import_utils17.arrayToRecord)(permissions);
+  else if ((0, import_utils17.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
   const { stringHandler, arrayHandler } = createValidator(phas);
-  if ((0, import_utils14.isBoolean)(routeGuard)) {
+  if ((0, import_utils17.isBoolean)(routeGuard)) {
     return routeGuard === true;
   }
-  if ((0, import_utils14.isString)(routeGuard)) {
+  if ((0, import_utils17.isString)(routeGuard)) {
     return stringHandler(routeGuard);
   }
-  if ((0, import_utils14.isArray)(routeGuard)) {
+  if ((0, import_utils17.isArray)(routeGuard)) {
     return arrayHandler(routeGuard);
   }
-  if ((0, import_utils14.isFunction)(routeGuard)) {
+  if ((0, import_utils17.isFunction)(routeGuard)) {
     return routeGuard.call(req, permissions);
   }
   return false;
 }
 async function callHookChain(req, hook, doc, permissions, context) {
-  const hooks = (0, import_utils14.castArray)(hook);
+  const hooks = (0, import_utils17.castArray)(hook);
   for (let x = 0; x < hooks.length; x++) {
-    if ((0, import_utils14.isFunction)(hooks[x])) {
+    if ((0, import_utils17.isFunction)(hooks[x])) {
       doc = await hooks[x].call(req, doc, permissions, context);
     }
   }
@@ -2473,13 +2745,13 @@ async function collectSchemaFields({
     if (baseFields.includes(key)) continue;
     const val = permissionSchema[key];
     const value = val && val[access] || val;
-    if ((0, import_utils14.isBoolean)(value)) {
+    if ((0, import_utils17.isBoolean)(value)) {
       if (value) fields.push(key);
-    } else if ((0, import_utils14.isString)(value)) {
+    } else if ((0, import_utils17.isString)(value)) {
       if (stringHandler(value)) fields.push(key);
-    } else if ((0, import_utils14.isArray)(value)) {
+    } else if ((0, import_utils17.isArray)(value)) {
       if (arrayHandler(value)) fields.push(key);
-    } else if ((0, import_utils14.isFunction)(value)) {
+    } else if ((0, import_utils17.isFunction)(value)) {
       if (await value.call(req, ...functionArgs)) fields.push(key);
     }
   }
@@ -2568,7 +2840,7 @@ async function runDecorateAllHook({
 }
 // src/acl/select-resolution.ts
-var import_utils15 = require("@web-ts-toolkit/utils");
+var import_utils18 = require("@web-ts-toolkit/utils");
 async function collectAllowedFieldsForRequest({
   req,
   permissionSchema,
@@ -2636,15 +2908,15 @@ async function resolveSelectForRequest({
       const excludeall = normalizedSelect.every((v) => v.startsWith("-"));
       if (excludeall) {
         normalizedSelect = normalizedSelect.map((v) => v.substring(1));
-        fields = (0, import_utils15.difference)(fields, normalizedSelect);
+        fields = (0, import_utils18.difference)(fields, normalizedSelect);
         if (excludeid) fields.push("-_id");
       } else {
-        fields = (0, import_utils15.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
+        fields = (0, import_utils18.intersection)(normalizedSelect, fields.concat(excludeid ? "-_id" : "_id"));
       }
     }
     return fields.concat(alwaysSelectFields);
   }
-  return (0, import_utils15.intersection)(normalizedSelect, fields);
+  return (0, import_utils18.intersection)(normalizedSelect, fields);
 }
 // src/core.ts
@@ -2658,10 +2930,10 @@ var Core = class {
   getIdentifier(modelName) {
     const resolveIdFilter = getModelOption(modelName, "resolveIdFilter");
     const idField = getModelOption(modelName, "idField");
-    if ((0, import_utils16.isFunction)(resolveIdFilter)) {
+    if ((0, import_utils19.isFunction)(resolveIdFilter)) {
       return null;
     }
-    if ((0, import_utils16.isString)(idField)) {
+    if ((0, import_utils19.isString)(idField)) {
       return idField;
     }
     return "_id";
@@ -2739,11 +3011,11 @@ var Core = class {
   async genPopulate(modelName, access = "read", _populate = null) {
     if (!_populate) return [];
     let populate = Array.isArray(_populate) ? _populate : [_populate];
-    populate = (0, import_utils16.compact)(
+    populate = (0, import_utils19.compact)(
       await Promise.all(
         populate.map(async (p) => {
-          const populateAccess = !(0, import_utils16.isString)(p) && p.access ? p.access : access;
-          const ret = (0, import_utils16.isString)(p) ? { path: p } : {
+          const populateAccess = !(0, import_utils19.isString)(p) && p.access ? p.access : access;
+          const ret = (0, import_utils19.isString)(p) ? { path: p } : {
             path: p.path,
             select: normalizeSelect(p.select)
           };
@@ -2763,10 +3035,10 @@ var Core = class {
   }
   async validate(modelName, allowedData, access, context) {
     const validate = getModelOption(modelName, `validate.${access}`, null);
-    if ((0, import_utils16.isFunction)(validate)) {
+    if ((0, import_utils19.isFunction)(validate)) {
       const permissions = this.getGlobalPermissions();
       return validate.call(this.req, allowedData, permissions, context);
-    } else if ((0, import_utils16.isBoolean)(validate) || (0, import_utils16.isArray)(validate)) {
+    } else if ((0, import_utils19.isBoolean)(validate) || (0, import_utils19.isArray)(validate)) {
       return validate;
     } else {
       return true;
@@ -2791,7 +3063,7 @@ var Core = class {
     const changeOptions = getModelOption(modelName, `onChange`, {});
     for (let x = 0; x < context.modifiedPaths.length; x++) {
       const mpath = context.modifiedPaths[x];
-      if ((0, import_utils16.isFunction)(changeOptions[mpath])) {
+      if ((0, import_utils19.isFunction)(changeOptions[mpath])) {
         await changeOptions[mpath].call(
           this.req,
           context.originalDocumentSnapshot[mpath],
@@ -2815,7 +3087,7 @@ var Core = class {
   async genDocPermissions(modelName, doc, access, context) {
     const docPermissionsFn = getModelOption(modelName, `docPermissions.${access}`, null);
     let docPermissions = {};
-    if ((0, import_utils16.isFunction)(docPermissionsFn)) {
+    if ((0, import_utils19.isFunction)(docPermissionsFn)) {
       const permissions = this.getGlobalPermissions();
       try {
         docPermissions = await docPermissionsFn.call(this.req, doc, permissions, context);
@@ -2863,7 +3135,7 @@ var Core = class {
       readExists ? this.genAllowedFields(modelName, doc, "read") : [],
       updateExists ? this.genAllowedFields(modelName, doc, "update") : []
     ]);
-    const viewObj = (0, import_utils16.reduce)(
+    const viewObj = (0, import_utils19.reduce)(
       views,
       (ret, view) => {
         ret[view] = true;
@@ -2871,7 +3143,7 @@ var Core = class {
       },
       {}
     );
-    const editObj = (0, import_utils16.reduce)(
+    const editObj = (0, import_utils19.reduce)(
       edits,
       (ret, view) => {
         ret[view] = true;
@@ -2895,9 +3167,9 @@ var Core = class {
     return runDecorateAllHook({ req: this.req, hook: decorateAll, docs, permissions, context });
   }
   runTasks(modelName, docObject, task) {
-    const tasks = (0, import_utils16.compact)((0, import_utils16.castArray)(task));
+    const tasks = (0, import_utils19.compact)((0, import_utils19.castArray)(task));
     if (tasks.length === 0) return docObject;
-    (0, import_utils16.forEach)(tasks, (task2) => {
+    (0, import_utils19.forEach)(tasks, (task2) => {
       const { type, args, options } = task2;
       switch (type) {
         case "COPY_AND_DEPOPULATE":
@@ -2928,9 +3200,9 @@ var Core = class {
       }
       const [, field, op] = keys2;
       const subOption = getExactModelOption(modelName, `operationAccess.${access}`);
-      if ((0, import_utils16.isUndefined)(subOption)) {
+      if ((0, import_utils19.isUndefined)(subOption)) {
         const subFieldOption = getExactModelOption(modelName, `operationAccess.subs.${field}`);
-        if ((0, import_utils16.isUndefined)(subFieldOption)) {
+        if ((0, import_utils19.isUndefined)(subFieldOption)) {
           const opOption = getModelOption(modelName, `operationAccess.${op}`);
           return this.canActivate(opOption);
         }
@@ -2980,25 +3252,25 @@ function guard(condition) {
     const permissions = req[PERMISSIONS];
     let cond = condition;
     let phas = (key) => permissions.has(key);
-    if ((0, import_utils17.isPlainObject)(condition)) {
+    if ((0, import_utils20.isPlainObject)(condition)) {
       const { modelName, id, condition: _cond } = condition;
       const svc = req.macl.getPublicService(modelName);
       const select = getModelOption(modelName, `alwaysSelectFields.read`, void 0);
-      let _id = (0, import_utils17.isString)(id) ? id : null;
-      if ((0, import_utils17.isPlainObject)(id)) {
+      let _id = (0, import_utils20.isString)(id) ? id : null;
+      if ((0, import_utils20.isPlainObject)(id)) {
         const { type = "param", key } = id;
         if (type === "param") {
           const paramValue = req.params[key];
-          _id = (0, import_utils17.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
+          _id = (0, import_utils20.isArray)(paramValue) ? paramValue[0] ?? null : paramValue ?? null;
         } else if (type === "query") {
           const _qval = req.query[key];
-          if ((0, import_utils17.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
+          if ((0, import_utils20.isArray)(_qval)) _id = _qval.length > 0 ? _qval[0] : null;
           else _id = _qval;
         } else {
           _id = null;
         }
       }
-      if (!(0, import_utils17.isString)(_id) || !_id) {
+      if (!(0, import_utils20.isString)(_id) || !_id) {
         return next(new import_express_json_router2.default.clientErrors.BadRequestError());
       }
       const result = await svc._read(_id, { select });
@@ -3010,11 +3282,11 @@ function guard(condition) {
       cond = _cond;
     }
     const { stringHandler, arrayHandler } = createValidator(phas);
-    if ((0, import_utils17.isString)(cond)) {
+    if ((0, import_utils20.isString)(cond)) {
       if (stringHandler(cond)) return next();
-    } else if ((0, import_utils17.isArray)(cond)) {
+    } else if ((0, import_utils20.isArray)(cond)) {
       if (arrayHandler(cond)) return next();
-    } else if ((0, import_utils17.isFunction)(cond)) {
+    } else if ((0, import_utils20.isFunction)(cond)) {
       const result = await cond.call(req, permissions);
       if (!!result) return next();
     }
@@ -3023,11 +3295,11 @@ function guard(condition) {
 }
 // src/routers/index.ts
-var import_express = __toESM(require("express"));
+var import_express2 = __toESM(require("express"));
 // src/routers/model-router.ts
 var import_express_json_router5 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils19 = require("@web-ts-toolkit/utils");
+var import_utils24 = require("@web-ts-toolkit/utils");
 // src/routers/router-mutation.ts
 var MODEL_BUILD_TIME_OPTION_KEYS = /* @__PURE__ */ new Set([
@@ -3119,88 +3391,88 @@ function formatModelUpsertResponse(result) {
 var import_express_json_router4 = __toESM(require("@web-ts-toolkit/express-json-router"));
 // src/validation/common.ts
-var import_zod = require("zod");
-var stringOrStringArray = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string())]);
-var queryBooleanString = import_zod.z.enum(["true", "false"]);
-var positiveIntegerString = import_zod.z.string().regex(/^\d+$/, "Expected a non-negative integer");
-var nonNegativeIntegerSchema = import_zod.z.number().int().min(0);
-var unknownRecord = import_zod.z.record(import_zod.z.string(), import_zod.z.unknown());
-var projectionObjectSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.union([import_zod.z.literal(1), import_zod.z.literal(-1)]));
-var projectionSchema = import_zod.z.union([import_zod.z.string(), import_zod.z.array(import_zod.z.string()), projectionObjectSchema]);
-var sortOrderSchema = import_zod.z.union([
-  import_zod.z.literal(-1),
-  import_zod.z.literal(1),
-  import_zod.z.literal("asc"),
-  import_zod.z.literal("ascending"),
-  import_zod.z.literal("desc"),
-  import_zod.z.literal("descending")
+var import_zod2 = require("zod");
+var stringOrStringArray = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string())]);
+var queryBooleanString = import_zod2.z.enum(["true", "false"]);
+var positiveIntegerString = import_zod2.z.string().regex(/^\d+$/, "Expected a non-negative integer");
+var nonNegativeIntegerSchema = import_zod2.z.number().int().min(0);
+var unknownRecord = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
+var projectionObjectSchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(-1)]));
+var projectionSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), projectionObjectSchema]);
+var sortOrderSchema = import_zod2.z.union([
+  import_zod2.z.literal(-1),
+  import_zod2.z.literal(1),
+  import_zod2.z.literal("asc"),
+  import_zod2.z.literal("ascending"),
+  import_zod2.z.literal("desc"),
+  import_zod2.z.literal("descending")
 ]);
-var sortSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.record(import_zod.z.string(), sortOrderSchema),
-  import_zod.z.array(import_zod.z.tuple([import_zod.z.string(), sortOrderSchema])),
-  import_zod.z.null()
+var sortSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.record(import_zod2.z.string(), sortOrderSchema),
+  import_zod2.z.array(import_zod2.z.tuple([import_zod2.z.string(), sortOrderSchema])),
+  import_zod2.z.null()
 ]);
-var populateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var populateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional(),
-        match: import_zod.z.unknown().optional(),
-        access: import_zod.z.enum(["list", "read"]).optional()
+        match: import_zod2.z.unknown().optional(),
+        access: import_zod2.z.enum(["list", "read"]).optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional(),
-    match: import_zod.z.unknown().optional(),
-    access: import_zod.z.enum(["list", "read"]).optional()
+    match: import_zod2.z.unknown().optional(),
+    access: import_zod2.z.enum(["list", "read"]).optional()
   }).passthrough()
 ]);
-var subPopulateSchema = import_zod.z.union([
-  import_zod.z.string(),
-  import_zod.z.array(
-    import_zod.z.union([
-      import_zod.z.string(),
-      import_zod.z.object({
-        path: import_zod.z.string().min(1),
+var subPopulateSchema = import_zod2.z.union([
+  import_zod2.z.string(),
+  import_zod2.z.array(
+    import_zod2.z.union([
+      import_zod2.z.string(),
+      import_zod2.z.object({
+        path: import_zod2.z.string().min(1),
         select: projectionSchema.optional()
       }).passthrough()
     ])
   ),
-  import_zod.z.object({
-    path: import_zod.z.string().min(1),
+  import_zod2.z.object({
+    path: import_zod2.z.string().min(1),
     select: projectionSchema.optional()
   }).passthrough()
 ]);
-var includeItemSchema = import_zod.z.object({
-  model: import_zod.z.string().min(1),
-  op: import_zod.z.enum(["list", "read", "count"]),
-  path: import_zod.z.string().min(1),
-  filter: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
-  localField: import_zod.z.string().min(1),
-  foreignField: import_zod.z.string().min(1),
-  args: import_zod.z.unknown().optional(),
-  options: import_zod.z.unknown().optional()
+var includeItemSchema = import_zod2.z.object({
+  model: import_zod2.z.string().min(1),
+  op: import_zod2.z.enum(["list", "read", "count"]),
+  path: import_zod2.z.string().min(1),
+  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+  localField: import_zod2.z.string().min(1),
+  foreignField: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown().optional(),
+  options: import_zod2.z.unknown().optional()
 }).passthrough();
-var includeSchema = import_zod.z.union([includeItemSchema, import_zod.z.array(includeItemSchema)]);
-var fieldsSchema = import_zod.z.array(import_zod.z.string().min(1));
-var taskSchema = import_zod.z.object({
-  type: import_zod.z.string().min(1),
-  args: import_zod.z.unknown(),
+var includeSchema = import_zod2.z.union([includeItemSchema, import_zod2.z.array(includeItemSchema)]);
+var fieldsSchema = import_zod2.z.array(import_zod2.z.string().min(1));
+var taskSchema = import_zod2.z.object({
+  type: import_zod2.z.string().min(1),
+  args: import_zod2.z.unknown(),
   options: unknownRecord.optional()
 });
-var tasksSchema = import_zod.z.union([taskSchema, import_zod.z.array(taskSchema)]);
-var objectOrArraySchema = import_zod.z.union([import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()), import_zod.z.array(import_zod.z.unknown())]);
+var tasksSchema = import_zod2.z.union([taskSchema, import_zod2.z.array(taskSchema)]);
+var objectOrArraySchema = import_zod2.z.union([import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()), import_zod2.z.array(import_zod2.z.unknown())]);
 function rejectKeys(body, ctx, keys2) {
   for (const key of keys2) {
     if (key in body) {
       ctx.addIssue({
-        code: import_zod.z.ZodIssueCode.custom,
+        code: import_zod2.z.ZodIssueCode.custom,
         message: `Unsupported field: ${key}`,
         path: [key]
       });
@@ -3289,8 +3561,11 @@ function toRequestSchemaValidator(schema) {
   if (isRequestSchemaValidator(schema)) return schema;
   return schema.validate;
 }
-function defineRequestSchema(validator) {
-  return validator;
+function defineRequestSchema(validator, options = {}) {
+  return {
+    validate: validator,
+    openapi: options.openapi
+  };
 }
 function fromZod(schema) {
   return (value) => {
@@ -3570,8 +3845,8 @@ function buildPointer(path) {
 }
 // src/validation/model-router.ts
-var import_zod2 = require("zod");
-var listQuerySchema = import_zod2.z.object({
+var import_zod3 = require("zod");
+var listQuerySchema = import_zod3.z.object({
   skip: positiveIntegerString.optional(),
   limit: positiveIntegerString.optional(),
   page: positiveIntegerString.optional(),
@@ -3581,122 +3856,122 @@ var listQuerySchema = import_zod2.z.object({
   include_count: queryBooleanString.optional(),
   include_extra_headers: queryBooleanString.optional()
 }).passthrough();
-var createQuerySchema = import_zod2.z.object({
+var createQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var readQuerySchema = import_zod2.z.object({
+var readQuerySchema = import_zod3.z.object({
   include_permissions: queryBooleanString.optional(),
   try_list: queryBooleanString.optional()
 }).passthrough();
-var updateQuerySchema = import_zod2.z.object({
+var updateQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var upsertQuerySchema = import_zod2.z.object({
+var upsertQuerySchema = import_zod3.z.object({
   returning_all: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional()
 }).passthrough();
-var listBodySchema = import_zod2.z.object({
+var listBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  skip: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod2.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    includeCount: import_zod2.z.boolean().optional(),
-    includeExtraHeaders: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    includeCount: import_zod3.z.boolean().optional(),
+    includeExtraHeaders: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var countBodySchema = import_zod2.z.object({
+var countBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
-  options: import_zod2.z.object({
-    access: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    access: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query", "access"]));
-var readFilterBodySchema = import_zod2.z.object({
+var readFilterBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
   sort: sortSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var readByIdBodySchema = import_zod2.z.object({
+var readByIdBodySchema = import_zod3.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    skim: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    tryList: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    skim: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    tryList: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var advancedCreateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var advancedCreateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var createBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var createBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var updateBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpdateBodySchema = import_zod2.z.object({
-  data: import_zod2.z.unknown(),
+var updateBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpdateBodySchema = import_zod3.z.object({
+  data: import_zod3.z.unknown(),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var upsertBodySchema = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown());
-var advancedUpsertBodySchema = import_zod2.z.object({
-  data: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
+var upsertBodySchema = import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown());
+var advancedUpsertBodySchema = import_zod3.z.object({
+  data: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional(),
-  options: import_zod2.z.object({
-    returningAll: import_zod2.z.boolean().optional(),
-    includePermissions: import_zod2.z.boolean().optional(),
-    populateAccess: import_zod2.z.unknown().optional()
+  options: import_zod3.z.object({
+    returningAll: import_zod3.z.boolean().optional(),
+    includePermissions: import_zod3.z.boolean().optional(),
+    populateAccess: import_zod3.z.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
-var distinctBodySchema = import_zod2.z.object({
+var distinctBodySchema = import_zod3.z.object({
   filter: objectOrArraySchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["query"]));
-var subListBodySchema = import_zod2.z.object({
-  filter: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+var subListBodySchema = import_zod3.z.object({
+  filter: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
   select: fieldsSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
-var subMutationBodySchema = import_zod2.z.union([
-  import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()),
-  import_zod2.z.array(import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()))
+var subMutationBodySchema = import_zod3.z.union([
+  import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+  import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
 ]);
-var subReadBodySchema = import_zod2.z.object({
+var subReadBodySchema = import_zod3.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["fields"]));
@@ -3709,54 +3984,54 @@ var requestSchemas = {
 };
 // src/validation/data-router.ts
-var import_zod3 = require("zod");
-var dataListBodySchema = import_zod3.z.object({
+var import_zod4 = require("zod");
+var dataListBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional(),
-  sort: import_zod3.z.string().optional(),
-  skip: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod3.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  options: import_zod3.z.object({
-    includeCount: import_zod3.z.boolean().optional(),
-    includeExtraHeaders: import_zod3.z.boolean().optional()
+  sort: import_zod4.z.string().optional(),
+  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  options: import_zod4.z.object({
+    includeCount: import_zod4.z.boolean().optional(),
+    includeExtraHeaders: import_zod4.z.boolean().optional()
   }).passthrough().optional()
 }).passthrough();
-var dataReadFilterBodySchema = import_zod3.z.object({
+var dataReadFilterBodySchema = import_zod4.z.object({
   filter: objectOrArraySchema.optional(),
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
-var dataReadByIdBodySchema = import_zod3.z.object({
+var dataReadByIdBodySchema = import_zod4.z.object({
   select: projectionSchema.optional()
 }).passthrough().superRefine((body, ctx) => rejectKeys(body, ctx, ["options"]));
 // src/validation/root-router.ts
-var import_zod4 = require("zod");
+var import_zod5 = require("zod");
 var rootEntryBaseSchema = {
-  target: import_zod4.z.enum(["model", "data"]),
-  name: import_zod4.z.string().min(1),
-  order: import_zod4.z.number().int().optional()
+  target: import_zod5.z.enum(["model", "data"]),
+  name: import_zod5.z.string().min(1),
+  order: import_zod5.z.number().int().optional()
 };
-var rootModelListArgsSchema = import_zod4.z.object({
+var rootModelListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
   sort: sortSchema.optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelListOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  includeCount: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelListOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  includeCount: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelReadArgsSchema = import_zod4.z.object({
+var rootModelReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   include: includeSchema.optional(),
@@ -3765,228 +4040,244 @@ var rootModelReadArgsSchema = import_zod4.z.object({
 var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
   sort: sortSchema.optional()
 });
-var rootModelReadOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  tryList: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional(),
-  lean: import_zod4.z.boolean().optional()
+var rootModelReadOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  tryList: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional(),
+  lean: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootModelCreateArgsSchema = import_zod4.z.object({
+var rootModelCreateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelCreateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelCreateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
-var rootModelUpdateArgsSchema = import_zod4.z.object({
+var rootModelUpdateArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
   populate: populateSchema.optional(),
   tasks: tasksSchema.optional()
 }).passthrough();
-var rootModelUpdateOptionsSchema = import_zod4.z.object({
-  skim: import_zod4.z.boolean().optional(),
-  returningAll: import_zod4.z.boolean().optional(),
-  includePermissions: import_zod4.z.boolean().optional(),
-  populateAccess: import_zod4.z.unknown().optional()
+var rootModelUpdateOptionsSchema = import_zod5.z.object({
+  skim: import_zod5.z.boolean().optional(),
+  returningAll: import_zod5.z.boolean().optional(),
+  includePermissions: import_zod5.z.boolean().optional(),
+  populateAccess: import_zod5.z.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
 var rootModelUpsertOptionsSchema = rootModelUpdateOptionsSchema;
-var rootModelSubListArgsSchema = import_zod4.z.object({
+var rootModelSubListArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional()
 }).passthrough();
-var rootModelSubReadArgsSchema = import_zod4.z.object({
+var rootModelSubReadArgsSchema = import_zod5.z.object({
   select: fieldsSchema.optional(),
   populate: subPopulateSchema.optional()
 }).passthrough();
-var rootModelCountOptionsSchema = import_zod4.z.object({
-  access: import_zod4.z.unknown().optional()
+var rootModelCountOptionsSchema = import_zod5.z.object({
+  access: import_zod5.z.unknown().optional()
 }).passthrough();
-var rootDataListArgsSchema = import_zod4.z.object({
+var rootDataListArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional(),
-  sort: import_zod4.z.string().optional(),
-  skip: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  limit: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  page: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
-  pageSize: import_zod4.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
+  sort: import_zod5.z.string().optional(),
+  skip: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  limit: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  page: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional(),
+  pageSize: import_zod5.z.union([nonNegativeIntegerSchema, positiveIntegerString]).optional()
 }).passthrough();
-var rootDataListOptionsSchema = import_zod4.z.object({
-  includeCount: import_zod4.z.boolean().optional()
+var rootDataListOptionsSchema = import_zod5.z.object({
+  includeCount: import_zod5.z.boolean().optional()
 }).passthrough();
-var rootDataReadArgsSchema = import_zod4.z.object({
+var rootDataReadArgsSchema = import_zod5.z.object({
   select: projectionSchema.optional()
 }).passthrough();
-var rootModelQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("new") }).passthrough(),
-  import_zod4.z.object({
+var rootModelQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("new") }).passthrough(),
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootModelListArgsSchema.optional(),
     options: rootModelListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootModelReadArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootModelReadFilterArgsSchema.optional(),
     options: rootModelReadOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("create"),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("create"),
+    data: import_zod5.z.unknown(),
     args: rootModelCreateArgsSchema.optional(),
     options: rootModelCreateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("update"),
-    id: import_zod4.z.string().min(1),
-    data: import_zod4.z.unknown(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("update"),
+    id: import_zod5.z.string().min(1),
+    data: import_zod5.z.unknown(),
     args: rootModelUpdateArgsSchema.optional(),
     options: rootModelUpdateOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("upsert"),
-    data: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("upsert"),
+    data: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()),
     args: rootModelUpsertArgsSchema.optional(),
     options: rootModelUpsertOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({ ...rootEntryBaseSchema, target: import_zod4.z.literal("model"), op: import_zod4.z.literal("delete"), id: import_zod4.z.string().min(1) }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({ ...rootEntryBaseSchema, target: import_zod5.z.literal("model"), op: import_zod5.z.literal("delete"), id: import_zod5.z.string().min(1) }).passthrough(),
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subList"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    filter: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional(),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subList"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    filter: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional(),
     args: rootModelSubListArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subRead"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subRead"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
     args: rootModelSubReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subCreate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subCreate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subBulkUpdate"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    data: import_zod4.z.union([import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()), import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))])
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subBulkUpdate"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    data: import_zod5.z.union([import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()), import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()))])
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("subDelete"),
-    id: import_zod4.z.string().min(1),
-    sub: import_zod4.z.string().min(1),
-    subId: import_zod4.z.string().min(1)
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("subDelete"),
+    id: import_zod5.z.string().min(1),
+    sub: import_zod5.z.string().min(1),
+    subId: import_zod5.z.string().min(1)
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("distinct"),
-    field: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("distinct"),
+    field: import_zod5.z.string().min(1),
     filter: objectOrArraySchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("model"),
-    op: import_zod4.z.literal("count"),
+    target: import_zod5.z.literal("model"),
+    op: import_zod5.z.literal("count"),
     filter: objectOrArraySchema.optional(),
     options: rootModelCountOptionsSchema.optional()
   }).passthrough()
 ]);
-var rootDataQueryEntrySchema = import_zod4.z.union([
-  import_zod4.z.object({
+var rootDataQueryEntrySchema = import_zod5.z.union([
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("list"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("list"),
     filter: objectOrArraySchema.optional(),
     args: rootDataListArgsSchema.optional(),
     options: rootDataListOptionsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
-    id: import_zod4.z.string().min(1),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
+    id: import_zod5.z.string().min(1),
     args: rootDataReadArgsSchema.optional()
   }).passthrough(),
-  import_zod4.z.object({
+  import_zod5.z.object({
     ...rootEntryBaseSchema,
-    target: import_zod4.z.literal("data"),
-    op: import_zod4.z.literal("read"),
+    target: import_zod5.z.literal("data"),
+    op: import_zod5.z.literal("read"),
     filter: objectOrArraySchema,
     args: rootDataReadArgsSchema.optional()
   }).passthrough()
 ]);
-var rootQuerySchema = import_zod4.z.array(import_zod4.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
+var rootQuerySchema = import_zod5.z.array(import_zod5.z.union([rootModelQueryEntrySchema, rootDataQueryEntrySchema]));
 // src/routers/shared.ts
-var parseBooleanString = (str, defaultValue) => str ? str === "true" : defaultValue;
+var import_utils21 = require("@web-ts-toolkit/utils");
 // src/routers/model-router-collection-routes.ts
 function setModelCollectionRoutes(context) {
   const { router, options } = context;
+  const getAdvancedCreateOpenApiBody = () => {
+    const advancedCreateSchema = context.getRequestSchema("requestSchemas.advancedCreate");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedCreate.data") ?? getNestedOpenApiSchemaDataSource(advancedCreateSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedCreate.default") ?? advancedCreateSchema,
+      advancedCreateBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
   router.get("", async (req) => {
     await context.assertAllowed(req, "list");
     const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
-    const includeCount = parseBooleanString(include_count);
-    const includeExtraHeaders = parseBooleanString(include_extra_headers);
+    const includeCount = (0, import_utils21.parseBooleanString)(include_count);
+    const includeExtraHeaders = (0, import_utils21.parseBooleanString)(include_extra_headers);
     const result = await svc._list(
       {},
       { skip, limit, page, pageSize: page_size },
       {
-        skim: parseBooleanString(skim),
-        includePermissions: parseBooleanString(include_permissions),
+        skim: (0, import_utils21.parseBooleanString)(skim),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions),
         includeCount
       }
     );
     handleResultError(result);
     return formatModelListResponse(req, result, includeCount, includeExtraHeaders);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "",
+    operationId: `${context.modelName}.list`,
+    summary: `List ${context.modelName} documents`,
+    query: requestSchemas.listQuery
+  });
   router.post(`/${options.queryRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "list");
     const body = await parseBodyWithSchema(
@@ -4012,6 +4303,13 @@ function setModelCollectionRoutes(context) {
     handleResultError(result);
     return formatModelListResponse(req, result, includeCount, includeExtraHeaders);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}`,
+    operationId: `${context.modelName}.listAdvanced`,
+    summary: `Advanced list ${context.modelName} documents`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.advancedList") ?? listBodySchema)
+  });
   router.post("", async (req) => {
     await context.assertAllowed(req, "create");
     const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
@@ -4021,10 +4319,18 @@ function setModelCollectionRoutes(context) {
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: parseBooleanString(include_permissions) });
+    const result = await svc._create(data, {}, { includePermissions: (0, import_utils21.parseBooleanString)(include_permissions) });
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "",
+    operationId: `${context.modelName}.create`,
+    summary: `Create a ${context.modelName} document`,
+    query: requestSchemas.createQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.create") ?? createBodySchema)
+  });
   router.post(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "create");
     const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
@@ -4047,24 +4353,56 @@ function setModelCollectionRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.mutationRouteSegment}`,
+    operationId: `${context.modelName}.createAdvanced`,
+    summary: `Advanced create a ${context.modelName} document`,
+    query: requestSchemas.createQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedCreateOpenApiBody)
+  });
   router.get("/new", async (req) => {
     const svc = context.getPublicService(req);
     const result = await svc._new();
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/new",
+    operationId: `${context.modelName}.new`,
+    summary: `Get a new ${context.modelName} document template`
+  });
 }
 // src/routers/model-router-document-routes.ts
 function setModelDocumentRoutes(context) {
   const { router, options, modelName } = context;
+  const getAdvancedUpdateOpenApiBody = () => {
+    const advancedUpdateSchema = context.getRequestSchema("requestSchemas.advancedUpdate");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedUpdate.data") ?? getNestedOpenApiSchemaDataSource(advancedUpdateSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedUpdate.default") ?? advancedUpdateSchema,
+      advancedUpdateBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
+  const getAdvancedUpsertOpenApiBody = () => {
+    const advancedUpsertSchema = context.getRequestSchema("requestSchemas.advancedUpsert");
+    const dataSchema = context.getRequestSchema("requestSchemas.advancedUpsert.data") ?? getNestedOpenApiSchemaDataSource(advancedUpsertSchema);
+    const bodySchema = unwrapNestedOpenApiSchemaSource(
+      context.getRequestSchema("requestSchemas.advancedUpsert.default") ?? advancedUpsertSchema,
+      advancedUpsertBodySchema
+    );
+    return dataSchema ? patchOpenApiObjectSchema(bodySchema, { data: dataSchema }) : bodySchema;
+  };
   router.get("/count", async (req) => {
     await context.assertAllowed(req, "count");
     const svc = context.getPublicService(req);
@@ -4072,6 +4410,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/count",
+    operationId: `${modelName}.count`,
+    summary: `Count ${modelName} documents`
+  });
   router.post("/count", async (req) => {
     await context.assertAllowed(req, "count");
     const { filter: filter2, options: countOptions = {} } = await parseBodyWithSchema(
@@ -4087,6 +4431,13 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "/count",
+    operationId: `${modelName}.countWithFilter`,
+    summary: `Count ${modelName} documents with a filter`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.count") ?? countBodySchema)
+  });
   router.get(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4096,13 +4447,20 @@ function setModelDocumentRoutes(context) {
       id,
       {},
       {
-        includePermissions: parseBooleanString(include_permissions),
-        tryList: parseBooleanString(try_list)
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions),
+        tryList: (0, import_utils21.parseBooleanString)(try_list)
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.read`,
+    summary: `Read a ${modelName} document`,
+    query: requestSchemas.readQuery
+  });
   router.post(`/${options.queryRouteSegment}/__filter`, async (req) => {
     await context.assertAllowed(req, "read");
     const body = await parseBodyWithSchema(
@@ -4122,6 +4480,15 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}/__filter`,
+    operationId: `${modelName}.readByFilterAdvanced`,
+    summary: `Read a ${modelName} document by filter`,
+    body: defineOpenApiSchemaResolver(
+      () => context.getRequestSchema("requestSchemas.advancedReadFilter") ?? readFilterBodySchema
+    )
+  });
   router.post(`/${options.queryRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4142,6 +4509,15 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: `/${options.queryRouteSegment}/:${options.idParam}`,
+    operationId: `${modelName}.readAdvanced`,
+    summary: `Read a ${modelName} document with advanced options`,
+    body: defineOpenApiSchemaResolver(
+      () => context.getRequestSchema("requestSchemas.advancedRead") ?? readByIdBodySchema
+    )
+  });
   router.patch(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4157,13 +4533,21 @@ function setModelDocumentRoutes(context) {
       data,
       {},
       {
-        returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        returningAll: (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "patch",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.update`,
+    summary: `Update a ${modelName} document`,
+    query: requestSchemas.updateQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.update") ?? updateBodySchema)
+  });
   router.patch(`/${options.mutationRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4188,14 +4572,22 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? parseBooleanString(returning_all),
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        returningAll: returningAll ?? (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "patch",
+    path: `/${options.mutationRouteSegment}/:${options.idParam}`,
+    operationId: `${modelName}.updateAdvanced`,
+    summary: `Advanced update a ${modelName} document`,
+    query: requestSchemas.updateQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedUpdateOpenApiBody)
+  });
   router.put(`/`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
@@ -4209,13 +4601,21 @@ function setModelDocumentRoutes(context) {
       body,
       {},
       {
-        returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        returningAll: (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: (0, import_utils21.parseBooleanString)(include_permissions)
       }
     );
     handleResultError(result);
     return formatModelUpsertResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "put",
+    path: "/",
+    operationId: `${modelName}.upsert`,
+    summary: `Upsert a ${modelName} document`,
+    query: requestSchemas.upsertQuery,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.upsert") ?? upsertBodySchema)
+  });
   router.put(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
@@ -4238,14 +4638,22 @@ function setModelDocumentRoutes(context) {
       data,
       { select, populate, tasks },
       {
-        returningAll: returningAll ?? parseBooleanString(returning_all),
-        includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        returningAll: returningAll ?? (0, import_utils21.parseBooleanString)(returning_all),
+        includePermissions: includePermissions ?? (0, import_utils21.parseBooleanString)(include_permissions),
         populateAccess
       }
     );
     handleResultError(result);
     return formatModelUpsertResponse(result);
   });
+  context.registerOpenApiRoute({
+    method: "put",
+    path: `/${options.mutationRouteSegment}`,
+    operationId: `${modelName}.upsertAdvanced`,
+    summary: `Advanced upsert a ${modelName} document`,
+    query: requestSchemas.upsertQuery,
+    body: defineOpenApiSchemaResolver(getAdvancedUpsertOpenApiBody)
+  });
   router.delete(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "delete");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
@@ -4254,6 +4662,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "delete",
+    path: `/:${options.idParam}`,
+    operationId: `${modelName}.delete`,
+    summary: `Delete a ${modelName} document`
+  });
   router.get("/distinct/:field", async (req) => {
     await context.assertAllowed(req, "distinct");
     const field = parsePathParam(req.params.field, "field");
@@ -4262,6 +4676,12 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "get",
+    path: "/distinct/:field",
+    operationId: `${modelName}.distinct`,
+    summary: `Get distinct values for a ${modelName} field`
+  });
   router.post("/distinct/:field", async (req) => {
     await context.assertAllowed(req, "distinct");
     const field = parsePathParam(req.params.field, "field");
@@ -4275,10 +4695,17 @@ function setModelDocumentRoutes(context) {
     handleResultError(result);
     return unwrapServiceData(result);
   });
+  context.registerOpenApiRoute({
+    method: "post",
+    path: "/distinct/:field",
+    operationId: `${modelName}.distinctWithFilter`,
+    summary: `Get distinct values for a ${modelName} field with a filter`,
+    body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.distinct") ?? distinctBodySchema)
+  });
 }
 // src/routers/model-router-subdocument-routes.ts
-var import_utils18 = require("@web-ts-toolkit/utils");
+var import_utils22 = require("@web-ts-toolkit/utils");
 function setModelSubDocumentRoutes(context) {
   const subs = getModelSub(context.modelName);
   for (let x = 0; x < subs.length; x++) {
@@ -4291,6 +4718,12 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "get",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.list`,
+      summary: `List ${sub} subdocuments`
+    });
     context.router.post(
       `/:${context.options.idParam}/${sub}/${context.options.queryRouteSegment}`,
       async (req) => {
@@ -4307,6 +4740,13 @@ function setModelSubDocumentRoutes(context) {
         return unwrapServiceData(result);
       }
     );
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}/${context.options.queryRouteSegment}`,
+      operationId: `${context.modelName}.${sub}.listAdvanced`,
+      summary: `Advanced list ${sub} subdocuments`,
+      body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.subList") ?? subListBodySchema)
+    });
     context.router.patch(`/:${context.options.idParam}/${sub}`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.update`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4320,6 +4760,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "patch",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.bulkUpdate`,
+      summary: `Bulk update ${sub} subdocuments`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subBulkUpdate") ?? subMutationBodySchema
+      )
+    });
     context.router.get(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.read`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4329,6 +4778,12 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "get",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.read`,
+      summary: `Read a ${sub} subdocument`
+    });
     context.router.post(
       `/:${context.options.idParam}/${sub}/:subId/${context.options.queryRouteSegment}`,
       async (req) => {
@@ -4341,13 +4796,20 @@ function setModelSubDocumentRoutes(context) {
           context.getRequestSchema("requestSchemas.subRead")
         );
         const populate = body.populate;
-        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => (0, import_utils18.isString)(item) ? { path: item } : item) : (0, import_utils18.isString)(populate) ? { path: populate } : populate ?? [];
+        const normalizedPopulate = Array.isArray(populate) ? populate.map((item) => (0, import_utils22.isString)(item) ? { path: item } : item) : (0, import_utils22.isString)(populate) ? { path: populate } : populate ?? [];
         const svc = context.getPublicService(req);
         const result = await svc.readSub(id, sub, subId, { select: body.select ?? [], populate: normalizedPopulate });
         handleResultError(result);
         return unwrapServiceData(result);
       }
     );
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}/:subId/${context.options.queryRouteSegment}`,
+      operationId: `${context.modelName}.${sub}.readAdvanced`,
+      summary: `Advanced read a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(() => context.getRequestSchema("requestSchemas.subRead") ?? subReadBodySchema)
+    });
     context.router.patch(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.update`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4362,6 +4824,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "patch",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.update`,
+      summary: `Update a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subUpdate") ?? subMutationBodySchema
+      )
+    });
     context.router.post(`/:${context.options.idParam}/${sub}`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.create`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4375,6 +4846,15 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return formatModelCreatedResponse(result);
     });
+    context.registerOpenApiRoute({
+      method: "post",
+      path: `/:${context.options.idParam}/${sub}`,
+      operationId: `${context.modelName}.${sub}.create`,
+      summary: `Create a ${sub} subdocument`,
+      body: defineOpenApiSchemaResolver(
+        () => context.getRequestSchema("requestSchemas.subCreate") ?? subMutationBodySchema
+      )
+    });
     context.router.delete(`/:${context.options.idParam}/${sub}/:subId`, async (req) => {
       await context.assertAllowed(req, `subs.${sub}.delete`);
       const id = parsePathParam(req.params[context.options.idParam], context.options.idParam);
@@ -4384,14 +4864,30 @@ function setModelSubDocumentRoutes(context) {
       handleResultError(result);
       return unwrapServiceData(result);
     });
+    context.registerOpenApiRoute({
+      method: "delete",
+      path: `/:${context.options.idParam}/${sub}/:subId`,
+      operationId: `${context.modelName}.${sub}.delete`,
+      summary: `Delete a ${sub} subdocument`
+    });
   }
 }
+// src/openapi/route-registration.ts
+var import_utils23 = require("@web-ts-toolkit/utils");
+function registerOpenApiRoute(runtime, basePath, defaultTag, route) {
+  runtime.registerOpenApiRoute({
+    ...route,
+    path: (0, import_utils23.normalizeUrlPath)(basePath + route.path),
+    tags: route.tags ?? [defaultTag]
+  });
+}
 // src/routers/model-router.ts
 var clientErrors2 = import_express_json_router5.default.clientErrors;
 function setOption(parentKey, optionKey, option) {
-  const key = (0, import_utils19.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils19.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils24.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils24.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("model", key);
   this.runtime.setModelOption(this.modelName, key, value);
   return this;
@@ -4552,7 +5048,7 @@ var ModelRouter = class {
     this.runtime.setModelOptions(modelName, initialOptions);
     attachRuntimeToModel(modelName, this.runtime);
     this.options = this.runtime.getModelOptions(modelName);
-    this.fullBasePath = (0, import_utils19.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils24.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.modelName = modelName;
     this.router = new import_express_json_router5.default(this.options.basePath, createSetCore(this.runtime), accessRouterResponseHandler);
     this.model = new model_default(modelName);
@@ -4577,6 +5073,9 @@ var ModelRouter = class {
     const allowed = await req.macl.isAllowed(this.modelName, access);
     if (!allowed) throw new clientErrors2.UnauthorizedError();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, this.fullBasePath, this.modelName, route);
+  }
   ///////////////////////
   // Collection Routes //
   ///////////////////////
@@ -4587,7 +5086,8 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   /////////////////////
@@ -4600,7 +5100,8 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   /////////////////////////
@@ -4613,18 +5114,19 @@ var ModelRouter = class {
       options: this.options,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
-      assertAllowed: this.assertAllowed.bind(this)
+      assertAllowed: this.assertAllowed.bind(this),
+      registerOpenApiRoute: this.registerOpenApiRoute.bind(this)
     });
   }
   logEndpoints() {
     runWithRuntime(this.runtime, () => {
-      (0, import_utils19.forEach)(this.router.endpoints, ({ method, path }) => {
-        logger.info(`${(0, import_utils19.padEnd)(method, 6)} ${(0, import_utils19.normalizeUrlPath)(this.options.parentPath + path)}`);
+      (0, import_utils24.forEach)(this.router.endpoints, ({ method, path }) => {
+        logger.info(`${(0, import_utils24.padEnd)(method, 6)} ${(0, import_utils24.normalizeUrlPath)(this.options.parentPath + path)}`);
       });
     });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils19.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils24.isString)(keyOrOptions)) {
       assertMutableRouterOption("model", keyOrOptions);
       this.runtime.setModelOption(
         this.modelName,
@@ -4632,7 +5134,7 @@ var ModelRouter = class {
         value
       );
     }
-    if (arguments.length === 1 && (0, import_utils19.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils24.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("model", keyOrOptions);
       this.runtime.setModelOptions(this.modelName, keyOrOptions);
     }
@@ -4655,7 +5157,7 @@ var ModelRouter = class {
 // src/routers/root-router.ts
 var import_express_json_router6 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils20 = require("@web-ts-toolkit/utils");
+var import_utils25 = require("@web-ts-toolkit/utils");
 // src/core-data.ts
 var DataCore = class {
@@ -4828,7 +5330,7 @@ var createErrorResult = (code, detail) => ({
   code,
   errors: [{ detail }]
 });
-var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => (0, import_utils20.isString)(item) ? { path: item } : item) : (0, import_utils20.isString)(populate) ? { path: populate } : populate ?? [];
+var normalizeSubPopulate = (populate) => Array.isArray(populate) ? populate.map((item) => (0, import_utils25.isString)(item) ? { path: item } : item) : (0, import_utils25.isString)(populate) ? { path: populate } : populate ?? [];
 var RootRouter = class {
   constructor(options = { basePath: "", operationAccess: true }, runtime = defaultRuntime) {
     this.modelOperations = {
@@ -4901,6 +5403,9 @@ var RootRouter = class {
     );
     this.setRoutes();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, (0, import_utils25.normalizeUrlPath)(this.basename), "root", route);
+  }
   wrapResult(index, item, result) {
     return {
       index,
@@ -4960,7 +5465,7 @@ var RootRouter = class {
   groupItemsByOrder(items) {
     return items.reduce((acc, item, index) => {
       let order = 0;
-      if ((0, import_utils20.isNumber)(item.order)) {
+      if ((0, import_utils25.isNumber)(item.order)) {
         order = item.order < 0 ? 0 : item.order;
       }
       if (!acc[order]) {
@@ -4984,7 +5489,14 @@ var RootRouter = class {
         const arrResult = await Promise.all(groupedItems[x].map(({ item, index }) => this.processOp(req, item, index)));
         results.push(...arrResult);
       }
-      return (0, import_utils20.orderBy)(results, ["index"], ["asc"]);
+      return (0, import_utils25.orderBy)(results, ["index"], ["asc"]);
+    });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: "",
+      operationId: "root.query",
+      summary: "Execute batched model and data operations",
+      body: rootQuerySchema
     });
   }
   get routes() {
@@ -4994,11 +5506,11 @@ var RootRouter = class {
 // src/routers/data-router.ts
 var import_express_json_router7 = __toESM(require("@web-ts-toolkit/express-json-router"));
-var import_utils21 = require("@web-ts-toolkit/utils");
+var import_utils26 = require("@web-ts-toolkit/utils");
 var clientErrors4 = import_express_json_router7.default.clientErrors;
 function setOption2(parentKey, optionKey, option) {
-  const key = (0, import_utils21.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
-  const value = (0, import_utils21.isUndefined)(option) ? optionKey : option;
+  const key = (0, import_utils26.isUndefined)(option) ? parentKey : `${parentKey}.${optionKey}`;
+  const value = (0, import_utils26.isUndefined)(option) ? optionKey : option;
   assertMutableRouterOption("data", key);
   this.runtime.setDataOption(this.dataName, key, value);
   return this;
@@ -5034,7 +5546,7 @@ var DataRouter = class {
     this.runtime = runtime;
     this.runtime.setDataOptions(dataName, initialOptions);
     this.options = this.runtime.getDataOptions(dataName);
-    this.fullBasePath = (0, import_utils21.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
+    this.fullBasePath = (0, import_utils26.normalizeUrlPath)(this.options.parentPath + this.options.basePath);
     this.dataName = dataName;
     this.router = new import_express_json_router7.default(this.options.basePath, createSetDataCore(this.runtime), accessRouterResponseHandler);
     this.setCollectionRoutes();
@@ -5053,6 +5565,9 @@ var DataRouter = class {
     const allowed = await req.dacl.isAllowed(this.dataName, access);
     if (!allowed) throw new clientErrors4.UnauthorizedError();
   }
+  registerOpenApiRoute(route) {
+    registerOpenApiRoute(this.runtime, this.fullBasePath, this.dataName, route);
+  }
   ///////////////////////
   // Collection Routes //
   ///////////////////////
@@ -5064,8 +5579,8 @@ var DataRouter = class {
         req.query
       );
       const svc = this.getService(req);
-      const includeCount = parseBooleanString(include_count);
-      const includeExtraHeaders = parseBooleanString(include_extra_headers);
+      const includeCount = (0, import_utils21.parseBooleanString)(include_count);
+      const includeExtraHeaders = (0, import_utils21.parseBooleanString)(include_extra_headers);
       const result = await svc.find(
         {},
         { skip, limit, page, pageSize: page_size },
@@ -5077,6 +5592,13 @@ var DataRouter = class {
       const decoratedResult = await decorateDataListResult(svc, result);
       return formatListResponse(req, decoratedResult, includeCount, includeExtraHeaders);
     });
+    this.registerOpenApiRoute({
+      method: "get",
+      path: "",
+      operationId: `${this.dataName}.list`,
+      summary: `List ${this.dataName} records`,
+      query: requestSchemas.listQuery
+    });
     this.router.post(`/${this.options.queryRouteSegment}`, async (req) => {
       await this.assertAllowed(req, "list");
       let {
@@ -5100,6 +5622,15 @@ var DataRouter = class {
       const decoratedResult = await decorateDataListResult(svc, result);
       return formatListResponse(req, decoratedResult, includeCount, includeExtraHeaders);
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}`,
+      operationId: `${this.dataName}.listAdvanced`,
+      summary: `Advanced list ${this.dataName} records`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedList") ?? dataListBodySchema
+      )
+    });
   }
   /////////////////////
   // Document Routes //
@@ -5114,6 +5645,12 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "get",
+      path: `/:${this.options.idParam}`,
+      operationId: `${this.dataName}.read`,
+      summary: `Read a ${this.dataName} record`
+    });
     this.router.post(`/${this.options.queryRouteSegment}/__filter`, async (req) => {
       await this.assertAllowed(req, "read");
       let { filter: filter2, select } = await parseBodyWithSchema(
@@ -5127,6 +5664,15 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}/__filter`,
+      operationId: `${this.dataName}.readByFilter`,
+      summary: `Read a ${this.dataName} record by filter`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedReadFilter") ?? dataReadFilterBodySchema
+      )
+    });
     this.router.post(`/${this.options.queryRouteSegment}/:${this.options.idParam}`, async (req) => {
       await this.assertAllowed(req, "read");
       const id = parsePathParam(req.params[this.options.idParam], this.options.idParam);
@@ -5141,13 +5687,22 @@ var DataRouter = class {
       const decoratedResult = await decorateDataSingleResult(svc, result);
       return decoratedResult.data;
     });
+    this.registerOpenApiRoute({
+      method: "post",
+      path: `/${this.options.queryRouteSegment}/:${this.options.idParam}`,
+      operationId: `${this.dataName}.readAdvanced`,
+      summary: `Advanced read a ${this.dataName} record`,
+      body: defineOpenApiSchemaResolver(
+        () => this.getRequestSchema("requestSchemas.advancedRead") ?? dataReadByIdBodySchema
+      )
+    });
   }
   set(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils21.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils26.isString)(keyOrOptions)) {
       assertMutableRouterOption("data", keyOrOptions);
       this.runtime.setDataOption(this.dataName, keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils21.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils26.isPlainObject)(keyOrOptions)) {
       assertMutableRouterOptions("data", keyOrOptions);
       this.runtime.setDataOptions(this.dataName, keyOrOptions);
     }
@@ -5170,6 +5725,62 @@ var DataRouter = class {
 // src/routers/index.ts
 var import_express_json_router8 = __toESM(require("@web-ts-toolkit/express-json-router"));
+// src/openapi/router.ts
+var import_express = __toESM(require("express"));
+var import_node_path = require("path");
+var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+var renderDocsHtml = (specPath, title, cssUrl, bundleUrl) => `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(title)}</title>
+  <link rel="stylesheet" href="${escapeHtml(cssUrl)}" />
+</head>
+<body>
+  <div id="swagger-ui"></div>
+  <script src="${escapeHtml(bundleUrl)}"></script>
+  <script>
+    window.ui = SwaggerUIBundle({
+      url: ${JSON.stringify(specPath)},
+      dom_id: '#swagger-ui',
+      deepLinking: true,
+      presets: [SwaggerUIBundle.presets.apis],
+      layout: 'BaseLayout',
+    });
+  </script>
+</body>
+</html>`;
+var getRelativeSpecPath = (docsPath, jsonPath) => {
+  const docsDir = import_node_path.posix.dirname(docsPath.startsWith("/") ? docsPath : `/${docsPath}`);
+  const normalizedJsonPath = jsonPath.startsWith("/") ? jsonPath : `/${jsonPath}`;
+  return import_node_path.posix.relative(docsDir, normalizedJsonPath) || import_node_path.posix.basename(normalizedJsonPath);
+};
+function createOpenApiRouter(runtime, options = {}) {
+  const router = import_express.default.Router();
+  const jsonPath = options.jsonPath ?? "/openapi.json";
+  const docsPath = options.docsPath ?? "/docs";
+  const swaggerUiCssUrl = options.swaggerUiCssUrl ?? "https://unpkg.com/swagger-ui-dist@5/swagger-ui.css";
+  const swaggerUiBundleUrl = options.swaggerUiBundleUrl ?? "https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js";
+  const info = {
+    title: options.title ?? "Access Router API",
+    version: options.version ?? "0.0.0",
+    description: options.description,
+    servers: options.servers
+  };
+  router.get(jsonPath, (_req, res) => {
+    res.json(runtime.getOpenApiSpec(info));
+  });
+  if (docsPath !== false) {
+    router.get(docsPath, (_req, res) => {
+      res.type("html").send(renderDocsHtml(getRelativeSpecPath(docsPath, jsonPath), info.title, swaggerUiCssUrl, swaggerUiBundleUrl));
+    });
+  }
+  return router;
+}
+// src/routers/index.ts
 var hasRoutes = (input) => {
   return typeof input === "object" && input !== null && "routes" in input;
 };
@@ -5177,7 +5788,7 @@ var resolveRoutes = (input) => {
   return hasRoutes(input) ? input.routes : input;
 };
 function combineRoutes(...inputs) {
-  const router = import_express.default.Router();
+  const router = import_express2.default.Router();
   inputs.forEach((input) => {
     router.use(resolveRoutes(input));
   });
@@ -5189,7 +5800,7 @@ var accessRouterResponseHandler = import_express_json_router8.default.createHand
 });
 accessRouterResponseHandler.errorMessageProvider = function(error) {
   const errorLike = error;
-  console.error(error);
+  logger.error(error);
   return errorLike.message || errorLike._message || String(error);
 };
@@ -5211,17 +5822,20 @@ function createRuntimeApi(runtime) {
   wtt2.runtime = runtime;
   wtt2.createRouter = function(modelName, options) {
     const resolvedModelName = typeof modelName === "string" ? modelName : modelName && "modelName" in modelName ? modelName.modelName : modelName;
-    return (0, import_utils22.isUndefined)(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
+    return (0, import_utils27.isUndefined)(options) ? new RootRouter(modelName, runtime) : new ModelRouter(resolvedModelName, options, runtime);
   };
   wtt2.createDataRouter = function(dataName, options) {
     return new DataRouter(dataName, options, runtime);
   };
+  wtt2.createOpenApiRouter = function(options) {
+    return createOpenApiRouter(runtime, options);
+  };
   wtt2.combineRoutes = combineRoutes;
   wtt2.set = function(keyOrOptions, value) {
-    if (arguments.length === 2 && (0, import_utils22.isString)(keyOrOptions)) {
+    if (arguments.length === 2 && (0, import_utils27.isString)(keyOrOptions)) {
       return runtime.setGlobalOption(keyOrOptions, value);
     }
-    if (arguments.length === 1 && (0, import_utils22.isPlainObject)(keyOrOptions)) {
+    if (arguments.length === 1 && (0, import_utils27.isPlainObject)(keyOrOptions)) {
       return runtime.setGlobalOptions(keyOrOptions);
     }
   };
@@ -5259,6 +5873,7 @@ var index_default = acl;
   acl,
   combineRoutes,
   createAccessRuntime,
+  createOpenApiRouter,
   defineRequestSchema,
   fromAjv,
   fromArkType,