@web-ts-toolkit/access-router 0.50.0 → 0.52.0

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aj as GuardHook, aI as ModelRequest, d8 as AccessRuntime, V as DataRouterOptions, T as DataRequest, d9 as DataService, a4 as ExtendedDataRouterOptions, a8 as Filter, b2 as Projection, c0 as Sort, a$ as Populate, aJ as ModelRouterOptions, da as Service, db as PublicService, aS as ModelVirtualRecordAccess, aO as ModelVirtualDescriptor, aQ as ModelVirtualGetter, aR as ModelVirtualLeaf, a6 as ExtendedModelRouterOptions, cL as Validation, bQ as RootRouterOptions, dc as OpenApiRouterOptions, dd as OpenApiRegistryOptions, de as OpenApiRouteDescriptor, df as OpenApiDocumentOptions, dg as OpenApiParameter, dh as OpenApiSchema, di as OpenApiResponses, ah as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-DhUuvj9B.mjs';
-export { dj as AccessRouterPermissionMap, dk as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, a7 as FieldOperationAccess, ai as GlobalPermissionValue, am as IoTsContextEntryLike, an as IoTsDecodeErrorLike, ao as IoTsDecoderLike, ap as JoiSchemaLike, aq as JoiValidationErrorDetailLike, aw as MaybePromise, ax as ModelBaseFilterHook, az as ModelDeleteHook, aA as ModelDocPermissionsHook, aC as ModelDocumentHook, aD as ModelHook, aF as ModelIdentifierHook, aG as ModelListHook, aH as ModelOverrideFilterHook, aK as ModelValidateHook, aL as ModelVirtualAccess, aM as ModelVirtualAccessRecord, aN as ModelVirtualContext, aP as ModelVirtualDoc, aT as ModelVirtuals, dl as OpenApiMethod, aU as OperationAccess, aX as PairedRouteAccess, a_ as PermissionSchema, dm as Permissions, bk as RequestSchemaAdapter, bl as RequestSchemaFailure, bm as RequestSchemaIssue, bn as RequestSchemaLike, bo as RequestSchemaOptions, bp as RequestSchemaResult, bq as RequestSchemaSuccess, br as RequestSchemaValidator, bT as RouteBaseAccess, bU as RouteGuardAccess, bV as RouteVariant, bW as RouteVariantAccess, c2 as StandardSchemaFailure, c3 as StandardSchemaInferOutput, c4 as StandardSchemaIssue, c5 as StandardSchemaPathSegment, c6 as StandardSchemaResult, c7 as StandardSchemaSuccess, c8 as StandardSchemaV1, cb as SubOperationAccess, cf as SubRouteGuardOptions, cr as SuperstructFailureLike, cs as SuperstructValidateLike, cF as ValibotIssueLike, cG as ValibotPathItemLike, cH as ValibotSafeParseLike, cI as ValibotSafeParseResult, cN as VineValidationErrorLike, cO as VineValidationMessageLike, cP as VineValidatorLike, cQ as VirtualSubModel, cR as WithVirtuals, cS as YupSchemaLike, cT as YupValidationErrorLike, dn as defaultRuntime, cU as defineRequestSchema, cV as fromAjv, cW as fromArkType, cX as fromIoTs, cY as fromJoi, cZ as fromStandardSchema, c_ as fromSuperstruct, c$ as fromValibot, d0 as fromVine, d1 as fromYup, d2 as fromZod } from './parsers-DhUuvj9B.mjs';
+import { A as AccessRouterBaseRequest, aq as GuardHook, aR as ModelRequest, dN as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dO as DataService, aa as ExtendedDataRouterOptions, af as Filter, bk as Projection, cr as Sort, bg as Populate, aS as ModelRouterOptions, dP as Service, dQ as PublicService, a$ as ModelVirtualRecordAccess, aX as ModelVirtualDescriptor, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dn as Validation, cb as RootRouterOptions, dR as OpenApiRouterOptions, dS as OpenApiRegistryOptions, dT as OpenApiRouteDescriptor, dU as OpenApiDocumentOptions, dV as OpenApiParameter, dW as OpenApiSchema, dX as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-BnmChTfF.mjs';
+export { dY as AccessRouterPermissionMap, dZ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aF as MaybePromise, aG as ModelBaseFilterHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aL as ModelDocumentHook, aM as ModelHook, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aY as ModelVirtualDoc, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, d_ as OpenApiMethod, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, bc as PairedRouteAccess, bf as PermissionSchema, d$ as Permissions, bi as PopulatePlanningOptions, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bF as RelatedAuthorization, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cC as SubOperationAccess, cG as SubRouteGuardOptions, cJ as SubdocumentCreateAuthorization, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, e0 as defaultRuntime, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod } from './parsers-BnmChTfF.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -125,6 +125,12 @@ declare class ModelRouter<TModel = unknown, TVirtuals extends object = Record<ne
     constructor(modelName: string, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime);
     static fromModel<TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime): ModelRouter<TModel, TVirtuals>;
     private getRequestSchema;
+    /**
+     * Acquire the model-generic internal service after this runtime's middleware
+     * initializes req.macl. Supply trusted per-call authorization in service options;
+     * selection/query args stay separate. Successful results carry opaque document
+     * handles in context(s), never data. Use getPublicService for request-only wrappers.
+     */
     getService(req: ModelRequest): Service<TModel, TVirtuals>;
     getPublicService(req: ModelRequest): PublicService<TModel, TVirtuals>;
     private assertAllowed;
@@ -443,9 +449,19 @@ declare const getDefaultModelOptions: () => DefaultModelRouterOptions<unknown>;
 declare const getDefaultModelOption: <K extends keyof ExtendedDefaultModelRouterOptions>(key: K, defaultValue?: ExtendedDefaultModelRouterOptions[K]) => ExtendedDefaultModelRouterOptions<unknown>[K];
 
 interface Options {
+    /** Hydrated-document getter alias; defaults to `permissions`. */
     virtualPermissionField?: string;
+    /** Registered model whose documentPermissionField setting supplies the metadata slot. */
     modelName: string;
 }
+/**
+ * Optional Mongoose getter alias for existing document permission metadata. Defaults
+ * to `doc.permissions`, reading `_doc[documentPermissionField]` (usually `_permissions`).
+ * Option lookup uses the active runtime, or the default runtime outside managed execution.
+ * This plugin neither computes grants nor enables field enforcement: routers/services
+ * already enforce operationAccess and permissionSchema without it. It is separate from
+ * the package's computed `virtuals` output API and is unnecessary for lean output.
+ */
 declare function permissionsPlugin(schema: Schema, options: Options): void;
 
 type LogLevel = 'debug' | 'info' | 'warn' | 'error';
@@ -471,24 +487,49 @@ interface OpLogContext {
 }
 
 type CreateRouter = {
+    /**
+     * Create a model CRUD router and register this exact Mongoose model/connection
+     * with the owning runtime. Configure operationAccess and permissionSchema, then
+     * mount the returned `.routes` in Express after express.json(). Route middleware
+     * initializes req.macl; field enforcement does not require permissionsPlugin.
+     */
     <TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
+    /**
+     * Create a router for an already-registered model name. Isolated runtimes require
+     * registerModelInstance(name, model) first; default acl also adopts mongoose.model(name).
+     * Prefer the model-instance overload for explicit connection ownership.
+     */
     <TModel, TVirtuals extends object = Record<never, never>>(modelName: string, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
+    /** Create an ordered root batch endpoint for this runtime's targets; mount `.routes`. */
     (options: RootRouterOptions): RootRouter;
 };
 type CreateDataRouter = {
+    /**
+     * Create request-only list/read routes over an owned in-memory dataset. Set
+     * operationAccess, permissionSchema, idParam and idField explicitly. Mount `.routes`;
+     * middleware initializes req.dacl. No MongoDB connection or model defaults are used.
+     * Data replacement affects new services; existing services keep their captured version.
+     */
     <TData>(dataName: string, options: DataRouterOptions<TData>): DataRouter<TData>;
 };
+/** Runtime-bound OpenAPI factory; returns an Express router mounted directly with app.use(). */
 type CreateRuntimeOpenApiRouter = (options?: OpenApiRouterOptions) => Router;
 type WttSet = {
+    /** Set one global option on this API's runtime, not a model option or method default. */
     <K extends keyof GlobalOptions>(key: K, value: GlobalOptions[K]): void;
+    /** Shallowly replace supplied global option values; equivalent to setGlobalOptions(options). */
     (options: {
         [K in keyof GlobalOptions]: GlobalOptions[K];
     }): void;
 };
 interface Wtt {
+    /** Owning options/model/OpenAPI registry; also exposes data and exact option getters/setters. */
     runtime: AccessRuntime;
+    /** Model instance/name + options creates CRUD routes; a single options object creates a root batch. */
     createRouter: CreateRouter;
+    /** Owned in-memory list/read router; no model-default or backend field-grant layer. */
     createDataRouter: CreateDataRouter;
+    /** This runtime's OpenAPI/Swagger UI router. Unlike the standalone export, takes only options. */
     createOpenApiRouter: CreateRuntimeOpenApiRouter;
     combineRoutes: typeof combineRoutes;
     set: WttSet;
@@ -513,8 +554,50 @@ interface Wtt {
     ModelRouter: typeof ModelRouter;
     DataRouter: typeof DataRouter;
 }
+/**
+ * Callable runtime-bound facade returned by createAccessRuntime (also the type of acl).
+ * Calling api() creates model request middleware for custom routes; generated `.routes`
+ * already initialize their own model/data cores. api.runtime is the AccessRuntime owner.
+ * Configuration methods on this facade remain bound to that owner.
+ */
 type AccessRuntimeApi = typeof macl & Wtt;
+/**
+ * Create an isolated Express/Mongoose router API with its own options, model registry,
+ * OpenAPI registry and request-owned work pools. Requires Node >=22, Express >=5 and
+ * Mongoose >=8. Pass a Mongoose model instance to createRouter, or register it before
+ * using a string name; isolated runtimes do not fall back to global mongoose.models.
+ *
+ * The returned callable facade exposes factories/setters; `.runtime` is its owner.
+ * Mount generated `.routes` after express.json(); connect MongoDB before listening.
+ * Model operations default to denied until operationAccess is configured, and field
+ * visibility requires permissionSchema. permissionsPlugin is only an optional alias.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import mongoose from 'mongoose';
+ * import { createAccessRuntime } from '@web-ts-toolkit/access-router';
+ * const api = createAccessRuntime();
+ * const Product = mongoose.model('Product', new mongoose.Schema({ name: String }));
+ * const products = api.createRouter(Product, {
+ *   basePath: '/products',
+ *   operationAccess: { list: true, read: true },
+ *   permissionSchema: { name: true },
+ * });
+ * const app = express();
+ * app.use(express.json());
+ * app.use(products.routes);
+ * // Await mongoose.connect(uri) before app.listen(port).
+ * ```
+ * @returns A fresh AccessRuntimeApi. See the shipped README's Configuration layers.
+ */
 declare function createAccessRuntime(): AccessRuntimeApi;
+/**
+ * Shared default-runtime API. Canonical import: `import acl from '@web-ts-toolkit/access-router'`;
+ * named `{ acl }` is identical. CommonJS uses `require('@web-ts-toolkit/access-router').acl`.
+ * Use createAccessRuntime() for an isolated registry/configuration. Mount factory `.routes`;
+ * calling acl() alone supplies model middleware for custom handlers.
+ */
 declare const acl: AccessRuntimeApi;
 
 export { AccessRuntime, type AccessRuntimeApi, type CombinedRouteInput, DataRouter, DataRouterOptions, DefaultModelRouterOptions, ExtendedDataRouterOptions, ExtendedDefaultModelRouterOptions, ExtendedModelRouterOptions, GlobalOptions, GuardHook, type GuardModelCondition, type GuardModelConditionID, ModelRouter, ModelRouterOptions, ModelVirtualDescriptor, ModelVirtualGetter, ModelVirtualLeaf, ModelVirtualRecordAccess, type OpLogContext, OpenApiCollisionError, OpenApiDocumentOptions, OpenApiRegistry, OpenApiRegistryOptions, OpenApiRouteDescriptor, OpenApiRouterOptions, RootRouter, RootRouterOptions, Validation, acl, combineRoutes, createAccessRuntime, createOpenApiRouter, acl as default, getDefaultModelOption, getDefaultModelOptions, getGlobalOption, getGlobalOptions, getModelInstance, getModelJsonSchema, getModelNames, getModelOption, getModelOptions, guard, hasModelInstance, isLevelEnabled, permissionsPlugin, redactFilter, redactPayload, registerModelInstance, safeStringify, setDefaultModelOption, setDefaultModelOptions, setGlobalOption, setGlobalOptions, setModelOption, setModelOptions };

package/index.d.ts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aj as GuardHook, aI as ModelRequest, d8 as AccessRuntime, V as DataRouterOptions, T as DataRequest, d9 as DataService, a4 as ExtendedDataRouterOptions, a8 as Filter, b2 as Projection, c0 as Sort, a$ as Populate, aJ as ModelRouterOptions, da as Service, db as PublicService, aS as ModelVirtualRecordAccess, aO as ModelVirtualDescriptor, aQ as ModelVirtualGetter, aR as ModelVirtualLeaf, a6 as ExtendedModelRouterOptions, cL as Validation, bQ as RootRouterOptions, dc as OpenApiRouterOptions, dd as OpenApiRegistryOptions, de as OpenApiRouteDescriptor, df as OpenApiDocumentOptions, dg as OpenApiParameter, dh as OpenApiSchema, di as OpenApiResponses, ah as GlobalOptions, Z as DefaultModelRouterOptions, a5 as ExtendedDefaultModelRouterOptions } from './parsers-DhUuvj9B.js';
-export { dj as AccessRouterPermissionMap, dk as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, a7 as FieldOperationAccess, ai as GlobalPermissionValue, am as IoTsContextEntryLike, an as IoTsDecodeErrorLike, ao as IoTsDecoderLike, ap as JoiSchemaLike, aq as JoiValidationErrorDetailLike, aw as MaybePromise, ax as ModelBaseFilterHook, az as ModelDeleteHook, aA as ModelDocPermissionsHook, aC as ModelDocumentHook, aD as ModelHook, aF as ModelIdentifierHook, aG as ModelListHook, aH as ModelOverrideFilterHook, aK as ModelValidateHook, aL as ModelVirtualAccess, aM as ModelVirtualAccessRecord, aN as ModelVirtualContext, aP as ModelVirtualDoc, aT as ModelVirtuals, dl as OpenApiMethod, aU as OperationAccess, aX as PairedRouteAccess, a_ as PermissionSchema, dm as Permissions, bk as RequestSchemaAdapter, bl as RequestSchemaFailure, bm as RequestSchemaIssue, bn as RequestSchemaLike, bo as RequestSchemaOptions, bp as RequestSchemaResult, bq as RequestSchemaSuccess, br as RequestSchemaValidator, bT as RouteBaseAccess, bU as RouteGuardAccess, bV as RouteVariant, bW as RouteVariantAccess, c2 as StandardSchemaFailure, c3 as StandardSchemaInferOutput, c4 as StandardSchemaIssue, c5 as StandardSchemaPathSegment, c6 as StandardSchemaResult, c7 as StandardSchemaSuccess, c8 as StandardSchemaV1, cb as SubOperationAccess, cf as SubRouteGuardOptions, cr as SuperstructFailureLike, cs as SuperstructValidateLike, cF as ValibotIssueLike, cG as ValibotPathItemLike, cH as ValibotSafeParseLike, cI as ValibotSafeParseResult, cN as VineValidationErrorLike, cO as VineValidationMessageLike, cP as VineValidatorLike, cQ as VirtualSubModel, cR as WithVirtuals, cS as YupSchemaLike, cT as YupValidationErrorLike, dn as defaultRuntime, cU as defineRequestSchema, cV as fromAjv, cW as fromArkType, cX as fromIoTs, cY as fromJoi, cZ as fromStandardSchema, c_ as fromSuperstruct, c$ as fromValibot, d0 as fromVine, d1 as fromYup, d2 as fromZod } from './parsers-DhUuvj9B.js';
+import { A as AccessRouterBaseRequest, aq as GuardHook, aR as ModelRequest, dN as AccessRuntime, _ as DataRouterOptions, Y as DataRequest, dO as DataService, aa as ExtendedDataRouterOptions, af as Filter, bk as Projection, cr as Sort, bg as Populate, aS as ModelRouterOptions, dP as Service, dQ as PublicService, a$ as ModelVirtualRecordAccess, aX as ModelVirtualDescriptor, aZ as ModelVirtualGetter, a_ as ModelVirtualLeaf, ac as ExtendedModelRouterOptions, dn as Validation, cb as RootRouterOptions, dR as OpenApiRouterOptions, dS as OpenApiRegistryOptions, dT as OpenApiRouteDescriptor, dU as OpenApiDocumentOptions, dV as OpenApiParameter, dW as OpenApiSchema, dX as OpenApiResponses, ao as GlobalOptions, a2 as DefaultModelRouterOptions, ab as ExtendedDefaultModelRouterOptions } from './parsers-BnmChTfF.js';
+export { dY as AccessRouterPermissionMap, dZ as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as AllowedOutputFieldOptions, p as ArkTypeErrorsLike, q as ArkTypeLike, s as AuthorizedListResult, t as AuthorizedSingleResult, H as CreateAuthorization, N as DataFieldOptions, a7 as DocumentAuthorization, ad as FieldAuthorization, ae as FieldOperationAccess, ap as GlobalPermissionValue, at as InputFieldAuthorization, au as InputFieldPath, av as IoTsContextEntryLike, aw as IoTsDecodeErrorLike, ax as IoTsDecoderLike, ay as JoiSchemaLike, az as JoiValidationErrorDetailLike, aF as MaybePromise, aG as ModelBaseFilterHook, aI as ModelDeleteHook, aJ as ModelDocPermissionsHook, aL as ModelDocumentHook, aM as ModelHook, aO as ModelIdentifierHook, aP as ModelListHook, aQ as ModelOverrideFilterHook, aT as ModelValidateHook, aU as ModelVirtualAccess, aV as ModelVirtualAccessRecord, aW as ModelVirtualContext, aY as ModelVirtualDoc, b0 as ModelVirtuals, b1 as MutationAuthorization, b2 as NewArgs, b3 as NewOptions, d_ as OpenApiMethod, b4 as OperationAccess, b5 as OperationAuthorization, b6 as OutputAuthorization, b7 as OutputFieldOptions, b8 as OutputFieldPath, b9 as OutputPlanningOptions, bc as PairedRouteAccess, bf as PermissionSchema, d$ as Permissions, bi as PopulatePlanningOptions, bw as PublicSubdocumentCreateOptions, bx as PublicSubdocumentListOptions, by as PublicSubdocumentMutationOptions, bz as PublicSubdocumentReadOptions, bF as RelatedAuthorization, bH as RequestSchemaAdapter, bI as RequestSchemaFailure, bJ as RequestSchemaIssue, bK as RequestSchemaLike, bL as RequestSchemaOptions, bM as RequestSchemaResult, bN as RequestSchemaSuccess, bO as RequestSchemaValidator, ce as RouteBaseAccess, cf as RouteGuardAccess, cg as RouteVariant, ch as RouteVariantAccess, ci as RowAuthorization, cm as ServiceAuthorization, cn as ServiceOutputContext, co as ServiceOutputDecorator, ct as StandardSchemaFailure, cu as StandardSchemaInferOutput, cv as StandardSchemaIssue, cw as StandardSchemaPathSegment, cx as StandardSchemaResult, cy as StandardSchemaSuccess, cz as StandardSchemaV1, cC as SubOperationAccess, cG as SubRouteGuardOptions, cJ as SubdocumentCreateAuthorization, cL as SubdocumentCreateOptions, cM as SubdocumentCreateVisibilityAuthorization, cN as SubdocumentDeleteAuthorization, cO as SubdocumentDeleteOptions, cP as SubdocumentGateAuthorization, cR as SubdocumentInputAuthorization, cS as SubdocumentListOptions, cT as SubdocumentModel, cU as SubdocumentMutationAuthorization, cV as SubdocumentName, cW as SubdocumentOutputAuthorization, cZ as SubdocumentReadAuthorization, c_ as SubdocumentReadOptions, d0 as SubdocumentUpdateOptions, d1 as SubdocumentVirtuals, d2 as SubdocumentVisibilityAuthorization, d3 as SuperstructFailureLike, d4 as SuperstructValidateLike, dh as ValibotIssueLike, di as ValibotPathItemLike, dj as ValibotSafeParseLike, dk as ValibotSafeParseResult, dq as VineValidationErrorLike, dr as VineValidationMessageLike, ds as VineValidatorLike, dt as VirtualSubModel, du as WithVirtuals, dv as YupSchemaLike, dw as YupValidationErrorLike, e0 as defaultRuntime, dx as defineRequestSchema, dy as fromAjv, dz as fromArkType, dA as fromIoTs, dB as fromJoi, dC as fromStandardSchema, dD as fromSuperstruct, dE as fromValibot, dF as fromVine, dG as fromYup, dH as fromZod } from './parsers-BnmChTfF.js';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -125,6 +125,12 @@ declare class ModelRouter<TModel = unknown, TVirtuals extends object = Record<ne
     constructor(modelName: string, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime);
     static fromModel<TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel, TVirtuals>, runtime?: AccessRuntime): ModelRouter<TModel, TVirtuals>;
     private getRequestSchema;
+    /**
+     * Acquire the model-generic internal service after this runtime's middleware
+     * initializes req.macl. Supply trusted per-call authorization in service options;
+     * selection/query args stay separate. Successful results carry opaque document
+     * handles in context(s), never data. Use getPublicService for request-only wrappers.
+     */
     getService(req: ModelRequest): Service<TModel, TVirtuals>;
     getPublicService(req: ModelRequest): PublicService<TModel, TVirtuals>;
     private assertAllowed;
@@ -443,9 +449,19 @@ declare const getDefaultModelOptions: () => DefaultModelRouterOptions<unknown>;
 declare const getDefaultModelOption: <K extends keyof ExtendedDefaultModelRouterOptions>(key: K, defaultValue?: ExtendedDefaultModelRouterOptions[K]) => ExtendedDefaultModelRouterOptions<unknown>[K];
 
 interface Options {
+    /** Hydrated-document getter alias; defaults to `permissions`. */
     virtualPermissionField?: string;
+    /** Registered model whose documentPermissionField setting supplies the metadata slot. */
     modelName: string;
 }
+/**
+ * Optional Mongoose getter alias for existing document permission metadata. Defaults
+ * to `doc.permissions`, reading `_doc[documentPermissionField]` (usually `_permissions`).
+ * Option lookup uses the active runtime, or the default runtime outside managed execution.
+ * This plugin neither computes grants nor enables field enforcement: routers/services
+ * already enforce operationAccess and permissionSchema without it. It is separate from
+ * the package's computed `virtuals` output API and is unnecessary for lean output.
+ */
 declare function permissionsPlugin(schema: Schema, options: Options): void;
 
 type LogLevel = 'debug' | 'info' | 'warn' | 'error';
@@ -471,24 +487,49 @@ interface OpLogContext {
 }
 
 type CreateRouter = {
+    /**
+     * Create a model CRUD router and register this exact Mongoose model/connection
+     * with the owning runtime. Configure operationAccess and permissionSchema, then
+     * mount the returned `.routes` in Express after express.json(). Route middleware
+     * initializes req.macl; field enforcement does not require permissionsPlugin.
+     */
     <TModel, TVirtuals extends object = Record<never, never>>(model: mongoose.Model<TModel>, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
+    /**
+     * Create a router for an already-registered model name. Isolated runtimes require
+     * registerModelInstance(name, model) first; default acl also adopts mongoose.model(name).
+     * Prefer the model-instance overload for explicit connection ownership.
+     */
     <TModel, TVirtuals extends object = Record<never, never>>(modelName: string, options: ModelRouterOptions<TModel, TVirtuals>): ModelRouter<TModel, TVirtuals>;
+    /** Create an ordered root batch endpoint for this runtime's targets; mount `.routes`. */
     (options: RootRouterOptions): RootRouter;
 };
 type CreateDataRouter = {
+    /**
+     * Create request-only list/read routes over an owned in-memory dataset. Set
+     * operationAccess, permissionSchema, idParam and idField explicitly. Mount `.routes`;
+     * middleware initializes req.dacl. No MongoDB connection or model defaults are used.
+     * Data replacement affects new services; existing services keep their captured version.
+     */
     <TData>(dataName: string, options: DataRouterOptions<TData>): DataRouter<TData>;
 };
+/** Runtime-bound OpenAPI factory; returns an Express router mounted directly with app.use(). */
 type CreateRuntimeOpenApiRouter = (options?: OpenApiRouterOptions) => Router;
 type WttSet = {
+    /** Set one global option on this API's runtime, not a model option or method default. */
     <K extends keyof GlobalOptions>(key: K, value: GlobalOptions[K]): void;
+    /** Shallowly replace supplied global option values; equivalent to setGlobalOptions(options). */
     (options: {
         [K in keyof GlobalOptions]: GlobalOptions[K];
     }): void;
 };
 interface Wtt {
+    /** Owning options/model/OpenAPI registry; also exposes data and exact option getters/setters. */
     runtime: AccessRuntime;
+    /** Model instance/name + options creates CRUD routes; a single options object creates a root batch. */
     createRouter: CreateRouter;
+    /** Owned in-memory list/read router; no model-default or backend field-grant layer. */
     createDataRouter: CreateDataRouter;
+    /** This runtime's OpenAPI/Swagger UI router. Unlike the standalone export, takes only options. */
     createOpenApiRouter: CreateRuntimeOpenApiRouter;
     combineRoutes: typeof combineRoutes;
     set: WttSet;
@@ -513,8 +554,50 @@ interface Wtt {
     ModelRouter: typeof ModelRouter;
     DataRouter: typeof DataRouter;
 }
+/**
+ * Callable runtime-bound facade returned by createAccessRuntime (also the type of acl).
+ * Calling api() creates model request middleware for custom routes; generated `.routes`
+ * already initialize their own model/data cores. api.runtime is the AccessRuntime owner.
+ * Configuration methods on this facade remain bound to that owner.
+ */
 type AccessRuntimeApi = typeof macl & Wtt;
+/**
+ * Create an isolated Express/Mongoose router API with its own options, model registry,
+ * OpenAPI registry and request-owned work pools. Requires Node >=22, Express >=5 and
+ * Mongoose >=8. Pass a Mongoose model instance to createRouter, or register it before
+ * using a string name; isolated runtimes do not fall back to global mongoose.models.
+ *
+ * The returned callable facade exposes factories/setters; `.runtime` is its owner.
+ * Mount generated `.routes` after express.json(); connect MongoDB before listening.
+ * Model operations default to denied until operationAccess is configured, and field
+ * visibility requires permissionSchema. permissionsPlugin is only an optional alias.
+ *
+ * @example
+ * ```ts
+ * import express from 'express';
+ * import mongoose from 'mongoose';
+ * import { createAccessRuntime } from '@web-ts-toolkit/access-router';
+ * const api = createAccessRuntime();
+ * const Product = mongoose.model('Product', new mongoose.Schema({ name: String }));
+ * const products = api.createRouter(Product, {
+ *   basePath: '/products',
+ *   operationAccess: { list: true, read: true },
+ *   permissionSchema: { name: true },
+ * });
+ * const app = express();
+ * app.use(express.json());
+ * app.use(products.routes);
+ * // Await mongoose.connect(uri) before app.listen(port).
+ * ```
+ * @returns A fresh AccessRuntimeApi. See the shipped README's Configuration layers.
+ */
 declare function createAccessRuntime(): AccessRuntimeApi;
+/**
+ * Shared default-runtime API. Canonical import: `import acl from '@web-ts-toolkit/access-router'`;
+ * named `{ acl }` is identical. CommonJS uses `require('@web-ts-toolkit/access-router').acl`.
+ * Use createAccessRuntime() for an isolated registry/configuration. Mount factory `.routes`;
+ * calling acl() alone supplies model middleware for custom handlers.
+ */
 declare const acl: AccessRuntimeApi;
 
 export { AccessRuntime, type AccessRuntimeApi, type CombinedRouteInput, DataRouter, DataRouterOptions, DefaultModelRouterOptions, ExtendedDataRouterOptions, ExtendedDefaultModelRouterOptions, ExtendedModelRouterOptions, GlobalOptions, GuardHook, type GuardModelCondition, type GuardModelConditionID, ModelRouter, ModelRouterOptions, ModelVirtualDescriptor, ModelVirtualGetter, ModelVirtualLeaf, ModelVirtualRecordAccess, type OpLogContext, OpenApiCollisionError, OpenApiDocumentOptions, OpenApiRegistry, OpenApiRegistryOptions, OpenApiRouteDescriptor, OpenApiRouterOptions, RootRouter, RootRouterOptions, Validation, acl, combineRoutes, createAccessRuntime, createOpenApiRouter, acl as default, getDefaultModelOption, getDefaultModelOptions, getGlobalOption, getGlobalOptions, getModelInstance, getModelJsonSchema, getModelNames, getModelOption, getModelOptions, guard, hasModelInstance, isLevelEnabled, permissionsPlugin, redactFilter, redactPayload, registerModelInstance, safeStringify, setDefaultModelOption, setDefaultModelOptions, setGlobalOption, setGlobalOptions, setModelOption, setModelOptions };