diff --git a/packages/server/package.json b/packages/server/package.json
index 84e47382..2f6dacdb 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -39,6 +39,16 @@
                 "default": "./dist/api.cjs"
             }
         },
+        "./common": {
+            "import": {
+                "types": "./dist/common.d.ts",
+                "default": "./dist/common.js"
+            },
+            "require": {
+                "types": "./dist/common.d.cts",
+                "default": "./dist/common.cjs"
+            }
+        },
         "./express": {
             "import": {
                 "types": "./dist/express.d.ts",
@@ -118,6 +128,16 @@
                 "types": "./dist/tanstack-start.d.cts",
                 "default": "./dist/tanstack-start.cjs"
             }
+        },
+        "./types": {
+            "import": {
+                "types": "./dist/types.d.ts",
+                "default": "./dist/types.js"
+            },
+            "require": {
+                "types": "./dist/types.d.cts",
+                "default": "./dist/types.cjs"
+            }
         }
     },
     "dependencies": {
diff --git a/packages/server/src/api/index.ts b/packages/server/src/api/index.ts
index 09d9700e..e57e81b8 100644
--- a/packages/server/src/api/index.ts
+++ b/packages/server/src/api/index.ts
@@ -1,2 +1,3 @@
 export { RestApiHandler, type RestApiHandlerOptions } from './rest';
 export { RPCApiHandler, type RPCApiHandlerOptions } from './rpc';
+export * from './utils';
diff --git a/packages/server/src/api/rest/index.ts b/packages/server/src/api/rest/index.ts
index 536a45a5..4df8ee48 100644
--- a/packages/server/src/api/rest/index.ts
+++ b/packages/server/src/api/rest/index.ts
@@ -118,10 +118,10 @@ registerCustomSerializers();
  */
 export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Schema> {
     // resource serializers
-    private serializers = new Map<string, Serializer>();
+    protected serializers = new Map<string, Serializer>();
 
     // error responses
-    private readonly errors: Record<string, { status: number; title: string; detail?: string }> = {
+    protected readonly errors: Record<string, { status: number; title: string; detail?: string }> = {
         unsupportedModel: {
             status: 404,
             title: 'Unsupported model type',
@@ -200,10 +200,10 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         },
     };
 
-    private filterParamPattern = new RegExp(/^filter(?<match>(\[[^[\]]+\])+)$/);
+    protected filterParamPattern = new RegExp(/^filter(?<match>(\[[^[\]]+\])+)$/);
 
     // zod schema for payload of creating and updating a resource
-    private createUpdatePayloadSchema = z
+    protected createUpdatePayloadSchema = z
         .object({
             data: z.object({
                 type: z.string(),
@@ -225,16 +225,16 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         .strict();
 
     // zod schema for updating a single relationship
-    private updateSingleRelationSchema = z.object({
+    protected updateSingleRelationSchema = z.object({
         data: z.object({ type: z.string(), id: z.union([z.string(), z.number()]) }).nullable(),
     });
 
     // zod schema for updating collection relationship
-    private updateCollectionRelationSchema = z.object({
+    protected updateCollectionRelationSchema = z.object({
         data: z.array(z.object({ type: z.string(), id: z.union([z.string(), z.number()]) })),
     });
 
-    private upsertMetaSchema = z.object({
+    protected upsertMetaSchema = z.object({
         meta: z.object({
             operation: z.literal('upsert'),
             matchFields: z.array(z.string()).min(1),
@@ -242,17 +242,17 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
     });
 
     // all known types and their metadata
-    private typeMap: Record<string, ModelInfo> = {};
+    protected typeMap: Record<string, ModelInfo> = {};
 
     // divider used to separate compound ID fields
-    private idDivider;
+    protected idDivider;
 
-    private urlPatternMap: Record<UrlPatterns, UrlPattern>;
-    private modelNameMapping: Record<string, string>;
-    private reverseModelNameMapping: Record<string, string>;
-    private externalIdMapping: Record<string, string>;
+    protected urlPatternMap: Record<UrlPatterns, UrlPattern>;
+    protected modelNameMapping: Record<string, string>;
+    protected reverseModelNameMapping: Record<string, string>;
+    protected externalIdMapping: Record<string, string>;
 
-    constructor(private readonly options: RestApiHandlerOptions<Schema>) {
+    constructor(protected readonly options: RestApiHandlerOptions<Schema>) {
         this.idDivider = options.idDivider ?? DEFAULT_ID_DIVIDER;
         const segmentCharset = options.urlSegmentCharset ?? 'a-zA-Z0-9-_~ %';
 
@@ -283,7 +283,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return this.options.log;
     }
 
-    private buildUrlPatternMap(urlSegmentNameCharset: string): Record<UrlPatterns, UrlPattern> {
+    protected buildUrlPatternMap(urlSegmentNameCharset: string): Record<UrlPatterns, UrlPattern> {
         const options = { segmentValueCharset: urlSegmentNameCharset };
 
         const buildPath = (segments: string[]) => {
@@ -301,11 +301,11 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private mapModelName(modelName: string): string {
+    protected mapModelName(modelName: string): string {
         return this.modelNameMapping[modelName] ?? modelName;
     }
 
-    private matchUrlPattern(path: string, routeType: UrlPatterns): Match | undefined {
+    protected matchUrlPattern(path: string, routeType: UrlPatterns): Match | undefined {
         const pattern = this.urlPatternMap[routeType];
         if (!pattern) {
             throw new InvalidValueError(`Unknown route type: ${routeType}`);
@@ -469,11 +469,11 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private handleGenericError(err: unknown): Response | PromiseLike<Response> {
+    protected handleGenericError(err: unknown): Response | PromiseLike<Response> {
         return this.makeError('unknownError', err instanceof Error ? `${err.message}\n${err.stack}` : 'Unknown error');
     }
 
-    private async processSingleRead(
+    protected async processSingleRead(
         client: ClientContract<Schema>,
         type: string,
         resourceId: string,
@@ -528,7 +528,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private async processFetchRelated(
+    protected async processFetchRelated(
         client: ClientContract<Schema>,
         type: string,
         resourceId: string,
@@ -617,7 +617,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private async processReadRelationship(
+    protected async processReadRelationship(
         client: ClientContract<Schema>,
         type: string,
         resourceId: string,
@@ -683,7 +683,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private async processCollectionRead(
+    protected async processCollectionRead(
         client: ClientContract<Schema>,
         type: string,
         query: Record<string, string | string[]> | undefined,
@@ -785,7 +785,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private buildPartialSelect(type: string, query: Record<string, string | string[]> | undefined) {
+    protected buildPartialSelect(type: string, query: Record<string, string | string[]> | undefined) {
         const selectFieldsQuery = query?.[`fields[${type}]`];
         if (!selectFieldsQuery) {
             return { select: undefined, error: undefined };
@@ -812,11 +812,11 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private addTotalCountToMeta(meta: any, total: any) {
+    protected addTotalCountToMeta(meta: any, total: any) {
         return meta ? Object.assign(meta, { total }) : Object.assign({}, { total });
     }
 
-    private makePaginator(baseUrl: string, offset: number, limit: number, total: number) {
+    protected makePaginator(baseUrl: string, offset: number, limit: number, total: number) {
         if (limit === Infinity) {
             return undefined;
         }
@@ -845,7 +845,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }));
     }
 
-    private processRequestBody(requestBody: unknown) {
+    protected processRequestBody(requestBody: unknown) {
         let body: any = requestBody;
         if (body.meta?.serialization) {
             // superjson deserialize body if a serialization meta is provided
@@ -868,7 +868,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private async processCreate(
+    protected async processCreate(
         client: ClientContract<Schema>,
         type: string,
         _query: Record<string, string | string[]> | undefined,
@@ -931,7 +931,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private async processUpsert(
+    protected async processUpsert(
         client: ClientContract<Schema>,
         type: string,
         _query: Record<string, string | string[]> | undefined,
@@ -1014,7 +1014,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private getUniqueFieldSets(type: string) {
+    protected getUniqueFieldSets(type: string) {
         const modelDef = this.requireModel(type);
         return Object.entries(modelDef.uniqueFields).map(
             ([k, v]) =>
@@ -1024,7 +1024,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         );
     }
 
-    private async processRelationshipCRUD(
+    protected async processRelationshipCRUD(
         client: ClientContract<Schema>,
         mode: 'create' | 'update' | 'delete',
         type: string,
@@ -1119,7 +1119,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private async processUpdate(
+    protected async processUpdate(
         client: ClientContract<Schema>,
         type: any,
         resourceId: string,
@@ -1186,7 +1186,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private async processDelete(client: ClientContract<Schema>, type: any, resourceId: string): Promise<Response> {
+    protected async processDelete(client: ClientContract<Schema>, type: any, resourceId: string): Promise<Response> {
         const typeInfo = this.getModelInfo(type);
         if (!typeInfo) {
             return this.makeUnsupportedModelError(type);
@@ -1203,7 +1203,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
 
     //#region utilities
 
-    private requireModel(model: string): ModelDef {
+    protected requireModel(model: string): ModelDef {
         const modelDef = this.schema.models[model];
         if (!modelDef) {
             throw new Error(`Model ${model} is not defined in the schema`);
@@ -1211,7 +1211,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return modelDef;
     }
 
-    private getIdFields(model: string): FieldDef[] {
+    protected getIdFields(model: string): FieldDef[] {
         const modelDef = this.requireModel(model);
         const modelLower = lowerCaseFirst(model);
         if (!(modelLower in this.externalIdMapping)) {
@@ -1235,7 +1235,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         throw new Error(`Model ${model} does not have unique key ${externalIdName}`);
     }
 
-    private requireField(model: string, field: string): FieldDef {
+    protected requireField(model: string, field: string): FieldDef {
         const modelDef = this.requireModel(model);
         const fieldDef = modelDef.fields[field];
         if (!fieldDef) {
@@ -1244,7 +1244,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return fieldDef;
     }
 
-    private buildTypeMap() {
+    protected buildTypeMap() {
         this.typeMap = {};
         for (const [model, { fields }] of Object.entries(this.schema.models)) {
             const idFields = this.getIdFields(model);
@@ -1284,15 +1284,15 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private getModelInfo(model: string): ModelInfo | undefined {
+    protected getModelInfo(model: string): ModelInfo | undefined {
         return this.typeMap[lowerCaseFirst(model)];
     }
 
-    private makeLinkUrl(path: string) {
+    protected makeLinkUrl(path: string) {
         return `${this.options.endpoint}${path}`;
     }
 
-    private buildSerializers() {
+    protected buildSerializers() {
         const linkers: Record<string, Linker<any>> = {};
 
         for (const model of Object.keys(this.schema.models)) {
@@ -1382,7 +1382,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private getId(model: string, data: any) {
+    protected getId(model: string, data: any) {
         if (!data) {
             return undefined;
         }
@@ -1394,7 +1394,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private async serializeItems(model: string, items: unknown, options?: Partial<SerializerOptions<any>>) {
+    protected async serializeItems(model: string, items: unknown, options?: Partial<SerializerOptions<any>>) {
         model = lowerCaseFirst(model);
         const serializer = this.serializers.get(model);
         if (!serializer) {
@@ -1421,7 +1421,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return result;
     }
 
-    private injectCompoundId(model: string, items: unknown) {
+    protected injectCompoundId(model: string, items: unknown) {
         const typeInfo = this.getModelInfo(model);
         if (!typeInfo) {
             return;
@@ -1446,7 +1446,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         });
     }
 
-    private toPlainObject(data: any): any {
+    protected toPlainObject(data: any): any {
         if (data === undefined || data === null) {
             return data;
         }
@@ -1478,7 +1478,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return data;
     }
 
-    private replaceURLSearchParams(url: string, params: Record<string, string | number>) {
+    protected replaceURLSearchParams(url: string, params: Record<string, string | number>) {
         const r = new URL(url);
         for (const [key, value] of Object.entries(params)) {
             r.searchParams.set(key, value.toString());
@@ -1486,7 +1486,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return r.toString();
     }
 
-    private makeIdFilter(idFields: FieldDef[], resourceId: string, nested: boolean = true) {
+    protected makeIdFilter(idFields: FieldDef[], resourceId: string, nested: boolean = true) {
         const decodedId = decodeURIComponent(resourceId);
         if (idFields.length === 1) {
             return { [idFields[0]!.name]: this.coerce(idFields[0]!, decodedId) };
@@ -1512,14 +1512,14 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private makeIdSelect(idFields: FieldDef[]) {
+    protected makeIdSelect(idFields: FieldDef[]) {
         if (idFields.length === 0) {
             throw this.errors['noId'];
         }
         return idFields.reduce((acc, curr) => ({ ...acc, [curr.name]: true }), {});
     }
 
-    private makeIdConnect(idFields: FieldDef[], id: string | number) {
+    protected makeIdConnect(idFields: FieldDef[], id: string | number) {
         if (idFields.length === 1) {
             return { [idFields[0]!.name]: this.coerce(idFields[0]!, id) };
         } else {
@@ -1535,20 +1535,20 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private makeIdKey(idFields: FieldDef[]) {
+    protected makeIdKey(idFields: FieldDef[]) {
         return idFields.map((idf) => idf.name).join(this.idDivider);
     }
 
-    private makeDefaultIdKey(idFields: FieldDef[]) {
+    protected makeDefaultIdKey(idFields: FieldDef[]) {
         // TODO: support `@@id` with custom name
         return idFields.map((idf) => idf.name).join(DEFAULT_ID_DIVIDER);
     }
 
-    private makeCompoundId(idFields: FieldDef[], item: any) {
+    protected makeCompoundId(idFields: FieldDef[], item: any) {
         return idFields.map((idf) => item[idf.name]).join(this.idDivider);
     }
 
-    private makeUpsertWhere(matchFields: any[], attributes: any, typeInfo: ModelInfo) {
+    protected makeUpsertWhere(matchFields: any[], attributes: any, typeInfo: ModelInfo) {
         const where = matchFields.reduce((acc: any, field: string) => {
             acc[field] = attributes[field] ?? null;
             return acc;
@@ -1566,7 +1566,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return where;
     }
 
-    private includeRelationshipIds(model: string, args: any, mode: 'select' | 'include') {
+    protected includeRelationshipIds(model: string, args: any, mode: 'select' | 'include') {
         const typeInfo = this.getModelInfo(model);
         if (!typeInfo) {
             return;
@@ -1576,7 +1576,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private coerce(fieldDef: FieldDef, value: any) {
+    protected coerce(fieldDef: FieldDef, value: any) {
         if (typeof value === 'string') {
             if (fieldDef.attributes?.some((attr) => attr.name === '@json')) {
                 try {
@@ -1624,7 +1624,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return value;
     }
 
-    private makeNormalizedUrl(path: string, query: Record<string, string | string[]> | undefined) {
+    protected makeNormalizedUrl(path: string, query: Record<string, string | string[]> | undefined) {
         const url = new URL(this.makeLinkUrl(path));
         for (const [key, value] of Object.entries(query ?? {})) {
             if (
@@ -1642,7 +1642,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return url.toString();
     }
 
-    private getPagination(query: Record<string, string | string[]> | undefined) {
+    protected getPagination(query: Record<string, string | string[]> | undefined) {
         if (!query) {
             return { offset: 0, limit: this.options.pageSize ?? DEFAULT_PAGE_SIZE };
         }
@@ -1676,7 +1676,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return { offset, limit };
     }
 
-    private buildFilter(
+    protected buildFilter(
         type: string,
         query: Record<string, string | string[]> | undefined,
     ): { filter: any; error: any } {
@@ -1780,7 +1780,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private buildSort(type: string, query: Record<string, string | string[]> | undefined) {
+    protected buildSort(type: string, query: Record<string, string | string[]> | undefined) {
         if (!query?.['sort']) {
             return { sort: undefined, error: undefined };
         }
@@ -1857,7 +1857,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return { sort: result, error: undefined };
     }
 
-    private buildRelationSelect(
+    protected buildRelationSelect(
         type: string,
         include: string | string[],
         query: Record<string, string | string[]> | undefined,
@@ -1917,7 +1917,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         return { select: result, error: undefined, allIncludes };
     }
 
-    private makeFilterValue(fieldDef: FieldDef, value: string, op: FilterOperationType): any {
+    protected makeFilterValue(fieldDef: FieldDef, value: string, op: FilterOperationType): any {
         // TODO: inequality filters?
         if (fieldDef.relation) {
             // relation filter is converted to an ID filter
@@ -1976,7 +1976,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private injectRelationQuery(
+    protected injectRelationQuery(
         type: string,
         injectTarget: any,
         injectKey: string,
@@ -2015,7 +2015,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         }
     }
 
-    private handleORMError(err: ORMError) {
+    protected handleORMError(err: ORMError) {
         return match(err.reason)
             .with(ORMErrorReason.INVALID_INPUT, () => {
                 return this.makeError('validationError', err.message, 422);
@@ -2036,7 +2036,7 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
             });
     }
 
-    private makeError(
+    protected makeError(
         code: keyof typeof this.errors,
         detail?: string,
         status?: number,
@@ -2063,11 +2063,11 @@ export class RestApiHandler<Schema extends SchemaDef> implements ApiHandler<Sche
         };
     }
 
-    private makeUnsupportedModelError(model: string) {
+    protected makeUnsupportedModelError(model: string) {
         return this.makeError('unsupportedModel', `Model ${model} doesn't exist`);
     }
 
-    private makeUnsupportedRelationshipError(model: string, relationship: string, status: number) {
+    protected makeUnsupportedRelationshipError(model: string, relationship: string, status: number) {
         return this.makeError('unsupportedRelationship', `Relationship ${model}.${relationship} doesn't exist`, status);
     }
 
diff --git a/packages/server/src/api/rpc/index.ts b/packages/server/src/api/rpc/index.ts
index 586fea33..0fb5dc30 100644
--- a/packages/server/src/api/rpc/index.ts
+++ b/packages/server/src/api/rpc/index.ts
@@ -27,7 +27,7 @@ export type RPCApiHandlerOptions<Schema extends SchemaDef> = {
  * RPC style API request handler that mirrors the ZenStackClient API
  */
 export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schema> {
-    constructor(private readonly options: RPCApiHandlerOptions<Schema>) {}
+    constructor(protected readonly options: RPCApiHandlerOptions<Schema>) {}
 
     get schema(): Schema {
         return this.options.schema;
@@ -163,11 +163,11 @@ export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schem
         }
     }
 
-    private isValidModel(client: ClientContract<Schema>, model: string) {
+    protected isValidModel(client: ClientContract<Schema>, model: string) {
         return Object.keys(client.$schema.models).some((m) => lowerCaseFirst(m) === lowerCaseFirst(model));
     }
 
-    private makeBadInputErrorResponse(message: string) {
+    protected makeBadInputErrorResponse(message: string) {
         const resp = {
             status: 400,
             body: { error: { message } },
@@ -176,7 +176,7 @@ export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schem
         return resp;
     }
 
-    private makeGenericErrorResponse(err: unknown) {
+    protected makeGenericErrorResponse(err: unknown) {
         const resp = {
             status: 500,
             body: { error: { message: err instanceof Error ? err.message : 'unknown error' } },
@@ -189,7 +189,7 @@ export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schem
         return resp;
     }
 
-    private makeORMErrorResponse(err: ORMError) {
+    protected makeORMErrorResponse(err: ORMError) {
         let status = 400;
         const error: any = { message: err.message, reason: err.reason };
 
@@ -220,7 +220,7 @@ export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schem
         return resp;
     }
 
-    private async processRequestPayload(args: any) {
+    protected async processRequestPayload(args: any) {
         const { meta, ...rest } = args;
         if (meta?.serialization) {
             try {
@@ -233,7 +233,7 @@ export class RPCApiHandler<Schema extends SchemaDef> implements ApiHandler<Schem
         return { result: args, error: undefined };
     }
 
-    private unmarshalQ(value: string, meta: string | undefined) {
+    protected unmarshalQ(value: string, meta: string | undefined) {
         let parsedValue: any;
         try {
             parsedValue = JSON.parse(value);
diff --git a/packages/server/test/adapter/custom.test.ts b/packages/server/test/adapter/custom.test.ts
new file mode 100644
index 00000000..08362b24
--- /dev/null
+++ b/packages/server/test/adapter/custom.test.ts
@@ -0,0 +1,119 @@
+import type { ClientContract } from '@zenstackhq/orm';
+import type { SchemaDef } from '@zenstackhq/orm/schema';
+import { describe, expect, it, vi } from 'vitest';
+import { logInternalError, type CommonAdapterOptions } from '../../src/adapter/common';
+import { type ApiHandler, type RequestContext, type Response } from '../../src/types';
+
+type AdapterRequest<Schema extends SchemaDef> = {
+    method: string;
+    path: string;
+    query?: Record<string, string | string[]>;
+    body?: unknown;
+    client: ClientContract<Schema>;
+};
+
+class RecordingHandler implements ApiHandler<SchemaDef> {
+    constructor(
+        protected readonly schemaDef: SchemaDef,
+        protected readonly response: Response,
+        protected readonly logger?: (...args: any[]) => void,
+    ) {}
+
+    readonly contexts: Array<RequestContext<SchemaDef>> = [];
+
+    get schema(): SchemaDef {
+        return this.schemaDef;
+    }
+
+    get log() {
+        return this.logger;
+    }
+
+    async handleRequest(context: RequestContext<SchemaDef>): Promise<Response> {
+        this.contexts.push(context);
+        return this.response;
+    }
+}
+
+class ThrowingHandler implements ApiHandler<SchemaDef> {
+    constructor(protected readonly schemaDef: SchemaDef, protected readonly logger: (...args: any[]) => void) {}
+
+    get schema(): SchemaDef {
+        return this.schemaDef;
+    }
+
+    get log() {
+        return this.logger;
+    }
+
+    async handleRequest(): Promise<Response> {
+        throw new Error('adapter failure');
+    }
+}
+
+function createCustomAdapter<Schema extends SchemaDef>(
+    options: CommonAdapterOptions<Schema>,
+): (request: AdapterRequest<Schema>) => Promise<Response> {
+    return async (request) => {
+        const context: RequestContext<Schema> = {
+            client: request.client,
+            method: request.method,
+            path: request.path,
+            query: request.query,
+            requestBody: request.body,
+        };
+
+        try {
+            return await options.apiHandler.handleRequest(context);
+        } catch (err) {
+            logInternalError(options.apiHandler.log, err);
+            throw err;
+        }
+    };
+}
+
+describe('Custom adapter test', () => {
+    const schema = {} as SchemaDef;
+    const client = { $schema: schema } as unknown as ClientContract<SchemaDef>;
+
+    it('delegates to api handler', async () => {
+        const response: Response = { status: 201, body: { ok: true } };
+        const handler = new RecordingHandler(schema, response);
+        const adapter = createCustomAdapter({ apiHandler: handler });
+
+        const result = await adapter({
+            method: 'get',
+            path: '/something',
+            query: { foo: 'bar' },
+            body: { value: 1 },
+            client,
+        });
+
+        expect(result).toEqual(response);
+        expect(handler.contexts).toHaveLength(1);
+        const captured = handler.contexts[0];
+        expect(captured.method).toBe('get');
+        expect(captured.path).toBe('/something');
+        expect(captured.query).toEqual({ foo: 'bar' });
+        expect(captured.requestBody).toEqual({ value: 1 });
+        expect(captured.client).toBe(client);
+    });
+
+    it('logs internal error when handler throws', async () => {
+        const logger = vi.fn();
+        const handler = new ThrowingHandler(schema, logger);
+        const adapter = createCustomAdapter({ apiHandler: handler });
+
+        await expect(
+            adapter({
+                method: 'post',
+                path: '/fail',
+                client,
+            }),
+        ).rejects.toThrow('adapter failure');
+        expect(logger).toHaveBeenCalledTimes(1);
+        const call = logger.mock.calls[0];
+        expect(call[0]).toBe('error');
+        expect(call[1]).toContain('An unhandled error occurred while processing the request: Error: adapter failure');
+    });
+});
diff --git a/packages/server/test/api/custom.test.ts b/packages/server/test/api/custom.test.ts
new file mode 100644
index 00000000..d51d7b9f
--- /dev/null
+++ b/packages/server/test/api/custom.test.ts
@@ -0,0 +1,62 @@
+import type { ClientContract } from '@zenstackhq/orm';
+import type { SchemaDef } from '@zenstackhq/orm/schema';
+import { Decimal } from 'decimal.js';
+import SuperJSON from 'superjson';
+import { describe, expect, it, vi } from 'vitest';
+import { log, registerCustomSerializers } from '../../src/api/utils';
+import { type ApiHandler, type LogConfig, type RequestContext, type Response } from '../../src/types';
+
+class CustomApiHandler implements ApiHandler<SchemaDef> {
+    protected readonly handled: Array<RequestContext<SchemaDef>> = [];
+
+    constructor(protected readonly schemaDef: SchemaDef, protected readonly logger: LogConfig) {}
+
+    get schema(): SchemaDef {
+        return this.schemaDef;
+    }
+
+    get log(): LogConfig {
+        return this.logger;
+    }
+
+    get contexts(): ReadonlyArray<RequestContext<SchemaDef>> {
+        return this.handled;
+    }
+
+    async handleRequest(context: RequestContext<SchemaDef>): Promise<Response> {
+        this.handled.push(context);
+        log(this.logger, 'info', () => `received ${context.method.toUpperCase()} ${context.path}`);
+        return { status: 202, body: { handled: true } };
+    }
+}
+
+describe('Custom API handler test', () => {
+    const schema = {} as SchemaDef;
+    const client = { $schema: schema } as unknown as ClientContract<SchemaDef>;
+
+    it('allows building custom handlers with logging helpers', async () => {
+        const logger = vi.fn();
+        const handler = new CustomApiHandler(schema, logger);
+
+        const response = await handler.handleRequest({
+            method: 'post',
+            path: '/custom',
+            query: { foo: 'bar' },
+            requestBody: { value: 1 },
+            client,
+        });
+
+        expect(response).toEqual({ status: 202, body: { handled: true } });
+        expect(handler.contexts).toHaveLength(1);
+        expect(handler.contexts[0].query).toEqual({ foo: 'bar' });
+        expect(logger).toHaveBeenCalledWith('info', 'received POST /custom', undefined);
+    });
+
+    it('provides serialization helpers for custom handlers', () => {
+        registerCustomSerializers();
+        const serialized = SuperJSON.serialize({ value: new Decimal('3.14159') });
+        const roundTripped = SuperJSON.deserialize(serialized) as { value: Decimal };
+        expect(Decimal.isDecimal(roundTripped.value)).toBe(true);
+        expect(roundTripped.value.toString()).toBe('3.14159');
+    });
+});
diff --git a/packages/server/test/api/rest.test.ts b/packages/server/test/api/rest.test.ts
index b40ff604..32a39f8d 100644
--- a/packages/server/test/api/rest.test.ts
+++ b/packages/server/test/api/rest.test.ts
@@ -3163,4 +3163,79 @@ describe('REST server tests', () => {
             });
         });
     });
+
+    describe('REST server tests - handler extension', () => {
+        const schema = `
+            model Post {
+                id String @id
+                title String
+            }
+        `;
+
+        class CustomRestApiHandler extends RestApiHandler<SchemaDef> {
+            public readonly buildFilterCalls: Array<{
+                type: string;
+                query: Record<string, string | string[]> | undefined;
+                filter: unknown;
+            }> = [];
+
+            protected override buildFilter(
+                type: string,
+                query: Record<string, string | string[]> | undefined,
+            ) {
+                const result = super.buildFilter(type, query);
+                if (type !== 'post') {
+                    this.buildFilterCalls.push({ type, query, filter: result.filter });
+                    return result;
+                }
+
+                const baseFilter =
+                    result.filter && typeof result.filter === 'object' && !Array.isArray(result.filter)
+                        ? { ...(result.filter as Record<string, unknown>) }
+                        : {};
+
+                const modified = {
+                    ...result,
+                    filter: {
+                        ...baseFilter,
+                        title: 'second',
+                    },
+                };
+
+                this.buildFilterCalls.push({ type, query, filter: modified.filter });
+                return modified;
+            }
+        }
+
+        beforeEach(async () => {
+            client = await createTestClient(schema);
+            await client.post.create({ data: { id: 'post-first', title: 'first' } });
+            await client.post.create({ data: { id: 'post-second', title: 'second' } });
+        });
+
+        it('allows extending RestApiHandler to customize filtering', async () => {
+            const customHandler = new CustomRestApiHandler({
+                schema: client.$schema,
+                endpoint: 'http://localhost/api',
+            });
+
+            const response = await customHandler.handleRequest({
+                method: 'get',
+                path: '/post',
+                query: {},
+                client,
+            });
+
+            expect(customHandler.buildFilterCalls).toHaveLength(1);
+            expect(customHandler.buildFilterCalls[0].type).toBe('post');
+            expect(customHandler.buildFilterCalls[0].filter).toMatchObject({ title: 'second' });
+
+            expect(response.status).toBe(200);
+            const body = response.body as {
+                data: Array<{ attributes: { title: string } }>;
+            };
+            expect(body.data).toHaveLength(1);
+            expect(body.data[0].attributes.title).toBe('second');
+        });
+    });
 });
diff --git a/packages/server/test/api/rpc.test.ts b/packages/server/test/api/rpc.test.ts
index 19e44ca0..2f50bf5d 100644
--- a/packages/server/test/api/rpc.test.ts
+++ b/packages/server/test/api/rpc.test.ts
@@ -508,6 +508,64 @@ describe('RPC API Handler Tests', () => {
         expect(r.data).toBeNull();
     });
 
+    it('allows extending RPCApiHandler to customize query unmarshalling', async () => {
+        await rawClient.post.deleteMany();
+        await rawClient.user.deleteMany();
+
+        await rawClient.user.create({
+            data: {
+                id: 'ext-user',
+                email: 'ext@example.com',
+                posts: {
+                    create: [
+                        { id: 'ext-post-1', title: 'first', published: true },
+                        { id: 'ext-post-2', title: 'second', published: true },
+                    ],
+                },
+            },
+        });
+
+        class CustomHandler extends RPCApiHandler<SchemaDef> {
+            public readonly unmarshalCalls: Array<{ value: string; meta: string | undefined; result: unknown }> = [];
+            protected override unmarshalQ(value: string, meta: string | undefined) {
+                const result = super.unmarshalQ(value, meta);
+                this.unmarshalCalls.push({ value, meta, result });
+                const asRecord = (result ?? {}) as Record<string, unknown>;
+                const baseWhere = (asRecord.where ?? {}) as Record<string, unknown>;
+                return {
+                    ...asRecord,
+                    where: {
+                        ...baseWhere,
+                        title: 'second',
+                    },
+                };
+            }
+        }
+
+        const handler = new CustomHandler({ schema: client.$schema });
+        const callHandler = (args: Parameters<typeof handler.handleRequest>[0]) => handler.handleRequest(args);
+
+        const response = await callHandler({
+            method: 'get',
+            path: '/post/findMany',
+            client: rawClient,
+            query: {
+                q: JSON.stringify({ where: {} }),
+            },
+        });
+
+        expect(handler.unmarshalCalls).toHaveLength(1);
+        expect(handler.unmarshalCalls[0].value).toBeDefined();
+        expect(handler.unmarshalCalls[0].result).toEqual({ where: {} });
+        expect(response.status).toBe(200);
+        const responseBody = response.body as { data: Array<{ title: string }> };
+        expect(responseBody.data).toHaveLength(1);
+        expect(responseBody.data[0].title).toBe('second');
+
+        await rawClient.post.deleteMany();
+        await rawClient.user.deleteMany();
+    });
+
     function makeHandler() {
         const handler = new RPCApiHandler({ schema: client.$schema });
         return async (args: any) => {
diff --git a/packages/server/tsup.config.ts b/packages/server/tsup.config.ts
index 4c236d2f..70009f51 100644
--- a/packages/server/tsup.config.ts
+++ b/packages/server/tsup.config.ts
@@ -2,7 +2,9 @@ import { defineConfig } from 'tsup';
 
 export default defineConfig({
     entry: {
+        types: 'src/types.ts',
         api: 'src/api/index.ts',
+        common: 'src/adapter/common.ts',
         express: 'src/adapter/express/index.ts',
         next: 'src/adapter/next/index.ts',
         fastify: 'src/adapter/fastify/index.ts',