@web-ts-toolkit/access-router 0.48.0 → 0.50.0

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, ai as GuardHook, aH as ModelRequest, cR as AccessRuntime, V as DataRouterOptions, T as DataRequest, cS as DataService, a7 as Filter, aS as Projection, bN as Sort, aP as Populate, aI as ModelRouterOptions, cT as Service, cU as PublicService, a6 as ExtendedModelRouterOptions, cu as Validation, bE as RootRouterOptions, cV as OpenApiRouterOptions, cW as OpenApiRegistryOptions, cX as OpenApiRouteDescriptor, cY as OpenApiDocumentOptions, cZ as OpenApiParameter, c_ as OpenApiSchema, c$ as OpenApiResponses, ag as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-D6iK8khR.mjs';
-export { d0 as AccessRouterPermissionMap, d1 as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, ah as GlobalPermissionValue, al as IoTsContextEntryLike, am as IoTsDecodeErrorLike, an as IoTsDecoderLike, ao as JoiSchemaLike, ap as JoiValidationErrorDetailLike, av as MaybePromise, aw as ModelBaseFilterHook, ay as ModelDeleteHook, az as ModelDocPermissionsHook, aB as ModelDocumentHook, aC as ModelHook, aE as ModelIdentifierHook, aF as ModelListHook, aG as ModelOverrideFilterHook, aJ as ModelValidateHook, d2 as OpenApiMethod, d3 as Permissions, b8 as RequestSchemaAdapter, b9 as RequestSchemaFailure, ba as RequestSchemaIssue, bb as RequestSchemaLike, bc as RequestSchemaOptions, bd as RequestSchemaResult, be as RequestSchemaSuccess, bf as RequestSchemaValidator, bH as RouteGuardAccess, bP as StandardSchemaFailure, bQ as StandardSchemaInferOutput, bR as StandardSchemaIssue, bS as StandardSchemaPathSegment, bT as StandardSchemaResult, bU as StandardSchemaSuccess, bV as StandardSchemaV1, ca as SuperstructFailureLike, cb as SuperstructValidateLike, co as ValibotIssueLike, cp as ValibotPathItemLike, cq as ValibotSafeParseLike, cr as ValibotSafeParseResult, cw as VineValidationErrorLike, cx as VineValidationMessageLike, cy as VineValidatorLike, cz as YupSchemaLike, cA as YupValidationErrorLike, d4 as defaultRuntime, cB as defineRequestSchema, cC as fromAjv, cD as fromArkType, cE as fromIoTs, cF as fromJoi, cG as fromStandardSchema, cH as fromSuperstruct, cI as fromValibot, cJ as fromVine, cK as fromYup, cL as fromZod } from './parsers-D6iK8khR.mjs';
+import { A as AccessRouterBaseRequest, aj as GuardHook, aI as ModelRequest, d8 as AccessRuntime, V as DataRouterOptions, T as DataRequest, d9 as DataService, a4 as ExtendedDataRouterOptions, a8 as Filter, b2 as Projection, c0 as Sort, a$ as Populate, aJ as ModelRouterOptions, da as Service, db as PublicService, aS as ModelVirtualRecordAccess, aO as ModelVirtualDescriptor, aQ as ModelVirtualGetter, aR as ModelVirtualLeaf, a6 as ExtendedModelRouterOptions, cL as Validation, bQ as RootRouterOptions, dc as OpenApiRouterOptions, dd as OpenApiRegistryOptions, de as OpenApiRouteDescriptor, df as OpenApiDocumentOptions, dg as OpenApiParameter, dh as OpenApiSchema, di as OpenApiResponses, ah as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-DhUuvj9B.mjs';
+export { dj as AccessRouterPermissionMap, dk as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, a7 as FieldOperationAccess, ai as GlobalPermissionValue, am as IoTsContextEntryLike, an as IoTsDecodeErrorLike, ao as IoTsDecoderLike, ap as JoiSchemaLike, aq as JoiValidationErrorDetailLike, aw as MaybePromise, ax as ModelBaseFilterHook, az as ModelDeleteHook, aA as ModelDocPermissionsHook, aC as ModelDocumentHook, aD as ModelHook, aF as ModelIdentifierHook, aG as ModelListHook, aH as ModelOverrideFilterHook, aK as ModelValidateHook, aL as ModelVirtualAccess, aM as ModelVirtualAccessRecord, aN as ModelVirtualContext, aP as ModelVirtualDoc, aT as ModelVirtuals, dl as OpenApiMethod, aU as OperationAccess, aX as PairedRouteAccess, a_ as PermissionSchema, dm as Permissions, bk as RequestSchemaAdapter, bl as RequestSchemaFailure, bm as RequestSchemaIssue, bn as RequestSchemaLike, bo as RequestSchemaOptions, bp as RequestSchemaResult, bq as RequestSchemaSuccess, br as RequestSchemaValidator, bT as RouteBaseAccess, bU as RouteGuardAccess, bV as RouteVariant, bW as RouteVariantAccess, c2 as StandardSchemaFailure, c3 as StandardSchemaInferOutput, c4 as StandardSchemaIssue, c5 as StandardSchemaPathSegment, c6 as StandardSchemaResult, c7 as StandardSchemaSuccess, c8 as StandardSchemaV1, cb as SubOperationAccess, cf as SubRouteGuardOptions, cr as SuperstructFailureLike, cs as SuperstructValidateLike, cF as ValibotIssueLike, cG as ValibotPathItemLike, cH as ValibotSafeParseLike, cI as ValibotSafeParseResult, cN as VineValidationErrorLike, cO as VineValidationMessageLike, cP as VineValidatorLike, cQ as VirtualSubModel, cR as WithVirtuals, cS as YupSchemaLike, cT as YupValidationErrorLike, dn as defaultRuntime, cU as defineRequestSchema, cV as fromAjv, cW as fromArkType, cX as fromIoTs, cY as fromJoi, cZ as fromStandardSchema, c_ as fromSuperstruct, c$ as fromValibot, d0 as fromVine, d1 as fromYup, d2 as fromZod } from './parsers-DhUuvj9B.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -28,6 +28,7 @@ declare class DataRouter<TData = unknown> {
     readonly runtime: AccessRuntime;
     readonly dataName: string;
     readonly router: JsonRouter;
+    /** Frozen construction-time snapshot. Read current policy with runtime.getDataOptions(dataName). */
     readonly options: DataRouterOptions<TData>;
     readonly fullBasePath: string;
     constructor(dataName: string, initialOptions: DataRouterOptions<TData>, runtime?: AccessRuntime);
@@ -37,13 +38,28 @@ declare class DataRouter<TData = unknown> {
     private registerOpenApiRoute;
     private setCollectionRoutes;
     private setDocumentRoutes;
-    set<K extends keyof DataRouterOptions<TData>>(key: K, value: DataRouterOptions<TData>[K]): this;
+    /**
+     * Update live behavior with a typed key/path or an options object. Dotted paths
+     * such as `operationAccess.basicRead` update one key; object assignment replaces
+     * supplied top-level values shallowly. The construction-time options snapshot stays fixed.
+     */
+    set<K extends keyof ExtendedDataRouterOptions<TData>>(key: K, value: ExtendedDataRouterOptions<TData>[K]): this;
     set(options: DataRouterOptions<TData>): this;
-    setOption<K extends keyof DataRouterOptions<TData>>(key: K, option: DataRouterOptions<TData>[K]): this;
+    /** Set one live option/path; `setOption('operationAccess.basicRead', undefined)` restores inheritance. */
+    setOption<K extends keyof ExtendedDataRouterOptions<TData>>(key: K, option: ExtendedDataRouterOptions<TData>[K]): this;
+    /** Shallowly replace supplied top-level options; an operationAccess object replaces that entire rule object. */
     setOptions(options: DataRouterOptions<TData>): this;
     data: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['data']>;
     listHardLimit: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['listHardLimit']>;
+    /** Base-operation field grants; basic/advanced route guards belong to operationAccess. */
     permissionSchema: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['permissionSchema']>;
+    /**
+     * Live list/read guards plus basicList/advancedList/basicRead/advancedRead.
+     * `operationAccess('basicRead', false)` updates one key and denies GET /:id
+     * (and HEAD) with HTTP 401; registered POST reads still inherit `read`.
+     * `operationAccess({ list: true, read: true })` replaces the whole rule object,
+     * not a deep merge. Use setOption with undefined to restore variant inheritance.
+     */
     operationAccess: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['operationAccess']>;
     baseFilter: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['baseFilter']>;
     /**
@@ -98,150 +114,223 @@ type SetTargetOption<TRouter, TOption> = {
     (option: TOption): TRouter;
     (key: string, option: unknown): TRouter;
 };
-declare class ModelRouter<TModel = unknown> {
+declare class ModelRouter<TModel = unknown, TVirtuals extends object = Record<never, never>> {
     readonly runtime: AccessRuntime;
     readonly modelName: string;
     readonly router: JsonRouter;
     readonly model: Model;
-    readonly options: ModelRouterOptions<TModel>;
+    /** Frozen construction-time snapshot. Read current policy with runtime.getModelOptions(modelName). */
+    readonly options: ModelRouterOptions<TModel, TVirtuals>;
     readonly fullBasePath: string;
-    constructor(modelName: string, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime);
-    static fromModel<TModel>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime): ModelRouter<TModel>;
+    constructor(modelName: string, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime);
+    static fromModel<TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime): ModelRouter<TModel, TVirtuals>;
     private getRequestSchema;
-    getService(req: ModelRequest): Service<TModel>;
-    getPublicService(req: ModelRequest): PublicService<TModel>;
+    getService(req: ModelRequest): Service<TModel, TVirtuals>;
+    getPublicService(req: ModelRequest): PublicService<TModel, TVirtuals>;
     private assertAllowed;
     private registerOpenApiRoute;
     private setCollectionRoutes;
     private setDocumentRoutes;
     private setSubDocumentRoutes;
     private logEndpoints;
-    set<K extends keyof ExtendedModelRouterOptions<TModel>>(key: K, value: ExtendedModelRouterOptions<TModel>[K]): this;
-    set(options: ModelRouterOptions<TModel>): this;
-    setOption<K extends keyof ExtendedModelRouterOptions<TModel>>(key: K, option: ExtendedModelRouterOptions<TModel>[K]): this;
-    setOptions(options: ModelRouterOptions<TModel>): this;
+    /**
+     * Update live behavior with a typed key/path or an options object. Dotted paths
+     * such as `operationAccess.basicRead` update one key; object assignment replaces
+     * supplied top-level values shallowly. The construction-time options snapshot stays fixed.
+     */
+    set<K extends Extract<keyof TVirtuals, string> & string, A extends ModelVirtualRecordAccess>(key: `virtuals.${K}.${A}`, value: ModelVirtualDescriptor<TModel, K extends keyof TVirtuals ? TVirtuals[K] : unknown> | ModelVirtualGetter<TModel, K extends keyof TVirtuals ? TVirtuals[K] : unknown>): this;
+    set<K extends Extract<keyof TVirtuals, string> & string>(key: `virtuals.${K}`, value: ModelVirtualLeaf<TModel, K extends keyof TVirtuals ? TVirtuals[K] : unknown>): this;
+    set<K extends keyof ExtendedModelRouterOptions<TModel, TVirtuals>>(key: K, value: ExtendedModelRouterOptions<TModel, TVirtuals>[K]): this;
+    set(options: ModelRouterOptions<TModel, TVirtuals>): this;
+    /** Set one live option/path; `setOption('operationAccess.basicRead', undefined)` restores inheritance. */
+    setOption<K extends keyof ExtendedModelRouterOptions<TModel, TVirtuals>>(key: K, option: ExtendedModelRouterOptions<TModel, TVirtuals>[K]): this;
+    /** Shallowly replace supplied top-level options; an operationAccess object replaces that entire rule object. */
+    setOptions(options: ModelRouterOptions<TModel, TVirtuals>): this;
     /**
      * The maximum limit of the number of documents returned from the `list` operation.
      */
-    listHardLimit: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['listHardLimit']>;
+    listHardLimit: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['listHardLimit']>;
     /**
      * The object schema to define the access control policy for each model field.
+     * Virtual permission keys (`fullAddress`, etc.) are typed via `TVirtuals`.
+     * Basic/advanced route guards belong to operationAccess, not field-rule objects.
+     */
+    permissionSchema: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['permissionSchema']>;
+    /**
+     * Package-level computed fields (VIRT-01, VIRT-00A D1-D8).
+     * Mutable post-construction (not a build-time key). Supports
+     * `virtuals({...})`, `virtuals(name, descriptor)`, and dotted
+     * `set('virtuals.<name>.<access>', descriptor)` forms. Exact →
+     * `.default` → bare resolution applies; inapplicable registered names stay
+     * virtual. Configuration is validated before commit against the receiving
+     * Mongoose schema + child scopes, protected permission-field overlaps,
+     * `_id`/reserved paths, and dotted names; rejected mutations preserve the
+     * previous valid configuration.
+     *
+     * Reachable from the root (`@web-ts-toolkit/access-router`) and the
+     * existing `./advanced` interface barrel; no new subpaths. Selected
+     * virtual outputs are optional (`Partial`) because authorization, absent
+     * dependencies, `undefined`, and fail-closed errors can omit them.
+     *
+     * @example Shortest typed happy-path (persisted model lacks `fullAddress`):
+     * ```ts
+     * import acl from '@web-ts-toolkit/access-router';
+     * interface User { name: string; address: string; }
+     * interface UserVirtuals { fullAddress: string; }
+     * const router = acl.createRouter<User, UserVirtuals>('User', {
+     *   permissionSchema: {
+     *     name: { read: true },
+     *     address: { read: 'canViewAddress' },
+     *     fullAddress: { read: 'canViewAddress' },
+     *   },
+     *   virtuals: {
+     *     fullAddress: {
+     *       dependsOn: ['address'],
+     *       read: async function (doc) {
+     *         if (doc.address === undefined) return undefined;
+     *         return `addr:${doc.address}`;
+     *       },
+     *     },
+     *   },
+     * });
+     * router.virtuals({
+     *   fullAddress: {
+     *     dependsOn: ['address'],
+     *     read: async function (doc) {
+     *       if (doc.address === undefined) return undefined;
+     *       return `addr:${doc.address}`;
+     *     },
+     *   },
+     * });
+     * router.set('virtuals.fullAddress.read', {
+     *   get: async function (doc) {
+     *     if (doc.address === undefined) return undefined;
+     *     return `addr:${doc.address}`;
+     *   },
+     *   dependsOn: ['address'],
+     * });
+     * void router;
+     * ```
      */
-    permissionSchema: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['permissionSchema']>;
+    virtuals: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['virtuals']>;
     /**
      * The object field to store the document permissions.
      */
-    documentPermissionField: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['documentPermissionField']>;
+    documentPermissionField: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['documentPermissionField']>;
     /**
      * The model fields always selected for ACL and response shaping.
      */
-    alwaysSelectFields: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['alwaysSelectFields']>;
+    alwaysSelectFields: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['alwaysSelectFields']>;
     /**
      * The function called in the process of generating document permissions.
      */
-    docPermissions: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['docPermissions']>;
+    docPermissions: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['docPermissions']>;
     /**
-     * The access control policy for router operations.
-     * @operation `create`, `list`, `read`, `update`, `delete`
+     * Configure live base and basic/advanced route guards. Only undefined inherits;
+     * selected false denies with HTTP 401 without removing routes or OpenAPI entries.
+     * `operationAccess('basicRead', false)` updates one key, and
+     * `operationAccess('subs.comments.basicRead', false)` updates a field-specific key.
+     * `operationAccess({ list: true, read: true })` replaces the whole rule object,
+     * not a deep merge. Use setOption with undefined to restore variant inheritance.
      */
-    operationAccess: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['operationAccess']>;
+    operationAccess: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['operationAccess']>;
     /**
      * The base filter definitions applied in every query transaction.
      * @operation `list`, `read`, `update`, `delete`
      */
-    baseFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['baseFilter']>;
+    baseFilter: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['baseFilter']>;
     /**
      * Trusted filter replacements applied before base-filter composition.
      * They may replace ordinary filters, but cannot replace an existing `false` denial.
      * Returning `false` denies the transaction.
      * @operation `list`, `read`, `update`, `delete`
      */
-    overrideFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['overrideFilter']>;
+    overrideFilter: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['overrideFilter']>;
     /**
      * Hook
      *
      * The function called before a new/update document data is processed in `prepare` hooks. This method is used to validate `write data` and throw an error if not valid.
      * @operation `create`, `update`
      */
-    validate: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['validate']>;
+    validate: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['validate']>;
     /**
      * Hook
      *
      * The function called before a new document is created or an existing document is updated. This method is used to process raw data passed into the API endpoints.
      * @operation `create`, `update`
      */
-    prepare: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['prepare']>;
+    prepare: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['prepare']>;
     /**
      * Hook
      *
      * The function called before an updated document is saved.
      * @operation `update`
      */
-    transform: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['transform']>;
+    transform: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['transform']>;
     /**
      * Hook
      *
      * The function called after a new document is created or an updated document is saved.
      * @operation `create`, `update`
      */
-    afterPersist: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['afterPersist']>;
+    afterPersist: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['afterPersist']>;
     /**
      * Hook
      *
      * The function called after an updated document changes have been finalized.
      * @operation `update`
      */
-    onChange: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['onChange']>;
+    onChange: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['onChange']>;
     /**
      * Hook
      *
      * The function called before a document is deleted.
      * @operation `delete`
      */
-    beforeDelete: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['beforeDelete']>;
+    beforeDelete: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['beforeDelete']>;
     /**
      * Hook
      *
      * The function called after a document is deleted.
      * @operation `delete`
      */
-    afterDelete: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['afterDelete']>;
+    afterDelete: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['afterDelete']>;
     /**
      * Hook
      *
      * The function called before response data is sent. This method is used to process raw data to apply custom logic before sending the result.
      * @operation `list`, `read`, `create`, `update`
      */
-    decorate: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['decorate']>;
+    decorate: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['decorate']>;
     /**
      * Hook
      *
      * The functions are called before response data is sent and after `decorate` hooks run. This method is used to process and filter multiple document objects before sending the result.
      * @operation `list`
      */
-    decorateAll: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['decorateAll']>;
+    decorateAll: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['decorateAll']>;
     /**
      * The field matched against the `id` route param.
      * @operation `read`, `update`, `delete`
      */
-    idField: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['idField']>;
+    idField: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['idField']>;
     /**
      * The function used to resolve the `id` route param into a document filter.
      * @operation `read`, `update`, `delete`
      */
-    resolveIdFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['resolveIdFilter']>;
+    resolveIdFilter: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['resolveIdFilter']>;
     /**
      * The route segment used for advanced query endpoints.
      */
-    queryRouteSegment: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['queryRouteSegment']>;
+    queryRouteSegment: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['queryRouteSegment']>;
     /**
      * The route segment used for advanced mutation endpoints.
      */
-    mutationRouteSegment: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['mutationRouteSegment']>;
+    mutationRouteSegment: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['mutationRouteSegment']>;
     /**
      * The default values used when missing in the operations.
      */
-    defaults: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['defaults']>;
+    defaults: SetTargetOption<ModelRouter<TModel, TVirtuals>, ModelRouterOptions<TModel, TVirtuals>['defaults']>;
     get routes(): Router;
 }
 
@@ -338,10 +427,10 @@ declare const setGlobalOption: <K extends keyof GlobalOptions>(key: K, value: Gl
 declare const getGlobalOptions: () => GlobalOptions;
 declare const getGlobalOption: <K extends keyof GlobalOptions>(key: K, defaultValue?: GlobalOptions[K]) => GlobalOptions[K];
 
-declare const setModelOptions: <TModel = unknown>(modelName: string, options: ModelRouterOptions<TModel>) => void;
-declare const setModelOption: <K extends keyof ExtendedModelRouterOptions<TModel>, TModel = unknown>(modelName: string, key: K, value: ExtendedModelRouterOptions<TModel>[K]) => void;
-declare const getModelOptions: <TModel = unknown>(modelName: string) => ModelRouterOptions<TModel>;
-declare const getModelOption: <K extends keyof ExtendedModelRouterOptions<TModel>, TModel = unknown>(modelName: string, key: K | string, defaultValue?: ExtendedModelRouterOptions<TModel>[K]) => ExtendedModelRouterOptions<TModel>[K];
+declare const setModelOptions: <TModel = unknown, TVirtuals extends object = Record<never, never>>(modelName: string, options: ModelRouterOptions<TModel, TVirtuals>) => void;
+declare const setModelOption: <K extends keyof ExtendedModelRouterOptions<TModel, TVirtuals>, TModel = unknown, TVirtuals extends object = Record<never, never>>(modelName: string, key: K, value: ExtendedModelRouterOptions<TModel, TVirtuals>[K]) => void;
+declare const getModelOptions: <TModel = unknown, TVirtuals extends object = Record<never, never>>(modelName: string) => ModelRouterOptions<TModel, TVirtuals>;
+declare const getModelOption: <K extends keyof ExtendedModelRouterOptions<TModel, TVirtuals>, TModel = unknown, TVirtuals extends object = Record<never, never>>(modelName: string, key: K | string, defaultValue?: ExtendedModelRouterOptions<TModel, TVirtuals>[K]) => ExtendedModelRouterOptions<TModel, TVirtuals>[K];
 declare const getModelNames: () => string[];
 declare const getModelJsonSchema: (modelName: string) => Record<string, unknown>;
 declare const registerModelInstance: <TModel>(modelName: string, model: mongoose.Model<TModel>) => void;
@@ -382,8 +471,8 @@ interface OpLogContext {
 }
 
 type CreateRouter = {
-    <TModel>(model: mongoose.Model<TModel>, options: ModelRouterOptions<TModel>): ModelRouter<TModel>;
-    <TModel>(modelName: string, options: ModelRouterOptions<TModel>): ModelRouter<TModel>;
+    <TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
+    <TModel, TVirtuals extends object = Record<never, never>>(modelName: string, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
     (options: RootRouterOptions): RootRouter;
 };
 type CreateDataRouter = {
@@ -428,4 +517,4 @@ type AccessRuntimeApi = typeof macl & Wtt;
 declare function createAccessRuntime(): AccessRuntimeApi;
 declare const acl: AccessRuntimeApi;
 
-export { AccessRuntime, type AccessRuntimeApi, type CombinedRouteInput, DataRouter, DataRouterOptions, ExtendedDefaultModelRouterOptions, ExtendedModelRouterOptions, GlobalOptions, GuardHook, type GuardModelCondition, type GuardModelConditionID, ModelRouter, ModelRouterOptions, type OpLogContext, OpenApiCollisionError, OpenApiDocumentOptions, OpenApiRegistry, OpenApiRegistryOptions, OpenApiRouteDescriptor, OpenApiRouterOptions, RootRouter, RootRouterOptions, Validation, acl, combineRoutes, createAccessRuntime, createOpenApiRouter, acl as default, getDefaultModelOption, getDefaultModelOptions, getGlobalOption, getGlobalOptions, getModelInstance, getModelJsonSchema, getModelNames, getModelOption, getModelOptions, guard, hasModelInstance, isLevelEnabled, permissionsPlugin, redactFilter, redactPayload, registerModelInstance, safeStringify, setDefaultModelOption, setDefaultModelOptions, setGlobalOption, setGlobalOptions, setModelOption, setModelOptions };
+export { AccessRuntime, type AccessRuntimeApi, type CombinedRouteInput, DataRouter, DataRouterOptions, DefaultModelRouterOptions, ExtendedDataRouterOptions, ExtendedDefaultModelRouterOptions, ExtendedModelRouterOptions, GlobalOptions, GuardHook, type GuardModelCondition, type GuardModelConditionID, ModelRouter, ModelRouterOptions, ModelVirtualDescriptor, ModelVirtualGetter, ModelVirtualLeaf, ModelVirtualRecordAccess, type OpLogContext, OpenApiCollisionError, OpenApiDocumentOptions, OpenApiRegistry, OpenApiRegistryOptions, OpenApiRouteDescriptor, OpenApiRouterOptions, RootRouter, RootRouterOptions, Validation, acl, combineRoutes, createAccessRuntime, createOpenApiRouter, acl as default, getDefaultModelOption, getDefaultModelOptions, getGlobalOption, getGlobalOptions, getModelInstance, getModelJsonSchema, getModelNames, getModelOption, getModelOptions, guard, hasModelInstance, isLevelEnabled, permissionsPlugin, redactFilter, redactPayload, registerModelInstance, safeStringify, setDefaultModelOption, setDefaultModelOptions, setGlobalOption, setGlobalOptions, setModelOption, setModelOptions };