@svadmin/core 0.50.0 → 0.52.0

package/src/update-many-hooks.svelte.ts

@@ -0,0 +1,373 @@
+import { createMutation, useQueryClient } from '@tanstack/svelte-query';
+import { captureAdminContext } from './context.svelte';
+import { captureQueryProvider } from './query-snapshot';
+import { snapshotUpdateManyParams, parseUpdateManyParams, decodeUpdateManyReceipt, UpdateManyPartialError,
+  type ContractUpdateManyParams } from './update-many-contract';
+import { contractKey, parseContractRecord, type ContractSchemas, type ContractId, type ContractRecord, type ResourceContract } from './resource-contract';
+import { snapshotPlainData } from './plain-data';
+import { decodeBaseRecord } from './record-decoder';
+import { definedOptions } from './defined-options';
+import { replaceReactiveUnionMembers } from './reactive-projection';
+import { invalidateOwnedQueries } from './query-invalidation';
+import { createQueryResultView } from './query-session.svelte';
+import { createOvertimeTracker, type OvertimeOptions } from './hook-utils.svelte';
+import { getAdminOptions } from './options.svelte';
+import { captureAuthLiveScope, clearAuthQueries, handleAuthError } from './auth-hooks.svelte';
+import { auditWithProvider } from './audit';
+import { HttpError } from './types';
+import { useTranslation } from './i18n.svelte';
+import { toast } from './toast.svelte';
+
+export interface ContractUpdateManyOptions<S extends ContractSchemas> {
+  resource: ResourceContract<S>;
+  enabled?: boolean;
+  overtimeOptions?: OvertimeOptions;
+}
+type Result<S extends ContractSchemas> = { data: ContractRecord<S>[] };
+type Failure = HttpError | UpdateManyPartialError;
+export interface Callbacks<S extends ContractSchemas> {
+  onSuccess?: (data: Result<S>) => void | Promise<void>;
+  onError?: (error: Failure) => void | Promise<void>;
+  onSettled?: (data: Result<S> | undefined, error: Failure | null) => void | Promise<void>;
+}
+function observe(callback: () => void | Promise<void>): void {
+  try { void Promise.resolve(callback()).catch(() => {}); }
+  catch { /* Observers cannot change a completed write's outcome. */ }
+}
+function failure(cause: unknown, dispatched = false): HttpError {
+  let code: unknown;
+  let status: unknown;
+  try {
+    if (typeof cause === 'object' && cause !== null) {
+      code = Object.getOwnPropertyDescriptor(cause, 'code')?.value;
+      status = Object.getOwnPropertyDescriptor(cause, 'statusCode')?.value;
+    }
+  } catch { /* Reflection errors remain private. */ }
+  const input = code === 'INVALID_RESOURCE_INPUT' && !dispatched;
+  const response = code === 'INVALID_PROVIDER_RESPONSE';
+  return new HttpError(input ? 'Invalid batch update input' : response ? 'Invalid provider response' : 'Batch update failed',
+    input ? 422 : response ? 502 : status === 401 || status === 403 ? status : 500, undefined, {
+      code: input ? 'INVALID_RESOURCE_INPUT' : response ? 'INVALID_PROVIDER_RESPONSE' : 'UPDATE_MANY_FAILED',
+      details: { writeMayHaveSucceeded: dispatched },
+    });
+}
+function copyFailure(error: Failure): Failure {
+  if (error instanceof UpdateManyPartialError) {
+    return new UpdateManyPartialError(error.succeededIds, error.failedIds, error.causes.map(cause => failure(cause, true)));
+  }
+  return new HttpError(error.message, error.statusCode, undefined, {
+    ...definedOptions({ code: error.code }), details: snapshotPlainData(error.details ?? {}),
+  });
+}
+
+/** Batch updates and their progress retain the captured resource and auth revision. */
+export function useContractUpdateMany<S extends ContractSchemas>(options: ContractUpdateManyOptions<S>) {
+  contractKey(options.resource);
+  const context = captureAdminContext();
+  const client = useQueryClient();
+  const adminOptions = getAdminOptions();
+  const i18n = useTranslation();
+  let mounted = true;
+  function captureOrigin() {
+    const auth = context.authProvider;
+    return {
+      auth, authScope: captureAuthLiveScope(auth), router: context.routerProvider,
+      tenant: context.tenantCacheKey?.__svadminTenant, contract: options.resource,
+    };
+  }
+  function originCurrent(origin: ReturnType<typeof captureOrigin>): boolean {
+    try {
+      return mounted && options.enabled !== false && origin.auth === context.authProvider &&
+        origin.authScope.isCurrent() && origin.router === context.routerProvider &&
+        origin.tenant === context.tenantCacheKey?.__svadminTenant && origin.contract === options.resource;
+    } catch { return false; }
+  }
+  function captureScope(input: ReturnType<typeof snapshotUpdateManyParams>) {
+    const origin = captureOrigin();
+    const contract = origin.contract;
+    const captured = captureQueryProvider(context, {
+      resource: contract.name, ...definedOptions({ meta: input.meta, dataProviderName: input.dataProviderName }),
+    });
+    const name = context.resolveDataProviderName(contract.name, input.dataProviderName);
+    const raw = context.providers?.[name];
+    if (!raw) throw new HttpError('Data provider unavailable', 400);
+    return {
+      ...origin, ...captured, update: raw.update.bind(raw), updateMany: raw.updateMany?.bind(raw),
+      matcher: { ...context.queryKeyMatcher(contract.name, input.dataProviderName), contract: contractKey(contract) },
+      notification: context.notificationProvider, audit: context.auditLogProvider, live: context.liveProvider,
+      key: JSON.stringify([contractKey(contract), name, captured.source, context.tenantCacheKey?.__svadminTenant, captured.meta]),
+    };
+  }
+  function capture(params: ContractUpdateManyParams<S>) {
+    const input = snapshotUpdateManyParams(params);
+    const scope = captureScope(input);
+    const { ids, variables } = parseUpdateManyParams(scope.contract, input);
+    if (options.enabled !== undefined && typeof options.enabled !== 'boolean') {
+      throw new HttpError('Invalid enabled value', 422, undefined, { code: 'INVALID_RESOURCE_INPUT' });
+    }
+    return { ...scope, input, ids, variables, signature: JSON.stringify([scope.key, scope.authScope.cacheKey, ids, variables]) };
+  }
+  type Scope = ReturnType<typeof capture>;
+  type Progress = { attempted: ContractId<S>[]; succeeded: ContractId<S>[]; failed: ContractId<S>[] };
+  const newProgress = (): Progress => ({ attempted: [], succeeded: [], failed: [] });
+  type Invocation = {
+    scope: Scope | undefined; origin: ReturnType<typeof captureOrigin>;
+    token: object; callbacks: Callbacks<S>; readScope(): Scope; readProgress(): Progress;
+  };
+  let latest = $state.raw<Scope>();
+  let latestToken: object | undefined;
+  let active: { scope: Scope; promise: Promise<Result<S>>; token: object; progress: Progress } | undefined;
+  function targetCurrent(scope: Scope): boolean {
+    if (!mounted || options.enabled === false) return false;
+    try {
+      return captureScope(scope.input).key === scope.key &&
+        context.authProvider === scope.auth && context.routerProvider === scope.router;
+    } catch { return false; }
+  }
+  const sessionCurrent = (scope: Scope) => {
+    try { return context.authProvider === scope.auth && scope.authScope.isCurrent(); }
+    catch { return false; }
+  };
+  const isCurrent = (scope: Scope) => targetCurrent(scope) && sessionCurrent(scope);
+  function cancelled(scope: Scope | undefined, progress: Progress): HttpError {
+    return new HttpError('Batch update scope changed', 409, undefined, {
+      code: 'UPDATE_MANY_CANCELLED', details: {
+        writeMayHaveSucceeded: progress.attempted.length > 0,
+        attemptedIds: [...progress.attempted], failedIds: [...progress.failed],
+        ...definedOptions({
+          succeededIds: scope && sessionCurrent(scope) ? [...progress.succeeded] : undefined,
+          unattemptedIds: scope?.ids.filter(id => !progress.attempted.includes(id)),
+        }),
+      },
+    });
+  }
+  function copyResult(scope: Scope, data: Result<S>): Result<S> {
+    return { data: data.data.map(record => parseContractRecord(scope.contract, record)) };
+  }
+  function notify(scope: Scope, current: () => boolean, type: 'success' | 'error', message: string): void {
+    observe(() => {
+      if (!current()) return;
+      if (scope.notification) return scope.notification.open({ type, message });
+      if (type === 'success') toast.success(message);
+      else toast.error(message);
+    });
+  }
+  async function refresh(scope: Scope, attempted: readonly (string | number)[]) {
+    if (!attempted.length) return;
+    const owner = {
+      client, matcher: { ...scope.matcher, resource: scope.contract.name },
+      owner: { source: scope.source, authSession: scope.authScope.cacheKey },
+      current: () => sessionCurrent(scope),
+    };
+    // Every started refresh settles even if a sibling fails or changes authentication.
+    await Promise.allSettled([
+      invalidateOwnedQueries({ ...owner, scopes: ['list', 'many'] }),
+      ...attempted.map(id => invalidateOwnedQueries({ ...owner, scopes: ['detail'], id })),
+    ]);
+  }
+  const mutation = createMutation<Result<S>, Failure, Invocation>(() => ({
+    retry: false, onMutate: () => undefined, onSuccess: () => {}, onError: () => {}, onSettled: () => {},
+    mutationFn: async invocation => {
+      let scope: Scope;
+      try { scope = invocation.readScope(); }
+      catch (cause) {
+        const error = failure(cause);
+        const current = () => latestToken === invocation.token && originCurrent(invocation.origin);
+        if (!current()) throw cancelled(undefined, invocation.readProgress());
+        observe(() => { if (current()) return invocation.callbacks.onError?.(copyFailure(error)); });
+        observe(() => { if (current()) return invocation.callbacks.onSettled?.(undefined, copyFailure(error)); });
+        throw error;
+      }
+      const progress = invocation.readProgress();
+      const { attempted, succeeded, failed } = progress;
+      const causes: HttpError[] = [];
+      const data: ContractRecord<S>[] = [];
+      let rejected: Failure | undefined;
+      const current = () => isCurrent(scope) && latestToken === invocation.token;
+      const ensureCurrent = () => {
+        if (!current() || active?.token !== invocation.token) throw cancelled(scope, progress);
+      };
+      const request = () => ({
+        resource: scope.contract.name, variables: snapshotPlainData(scope.variables),
+        ...definedOptions({ meta: scope.meta === undefined ? undefined : decodeBaseRecord(snapshotPlainData(scope.meta)) }),
+      });
+      try {
+        ensureCurrent();
+        if (scope.updateMany) {
+          const params = { ...request(), ids: [...scope.ids] };
+          attempted.push(...scope.ids);
+          const response = await scope.updateMany(params);
+          if (!sessionCurrent(scope)) throw cancelled(scope, progress);
+          data.push(...decodeUpdateManyReceipt(scope.contract, scope.ids, response, true));
+          succeeded.push(...scope.ids);
+        } else {
+          for (const id of scope.ids) {
+            ensureCurrent();
+            const params = { ...request(), id };
+            attempted.push(id);
+            try {
+              const response = await scope.update(params);
+              if (!sessionCurrent(scope)) throw cancelled(scope, progress);
+              data.push(...decodeUpdateManyReceipt(scope.contract, [id], response, false));
+              succeeded.push(id);
+            } catch (cause) {
+              if (!sessionCurrent(scope)) throw cancelled(scope, progress);
+              failed.push(id);
+              causes.push(failure(cause, true));
+            }
+          }
+          if (failed.length) rejected = succeeded.length
+            ? new UpdateManyPartialError(succeeded, failed, causes) : causes[0] ?? failure(undefined, true);
+        }
+      } catch (cause) {
+        rejected = failure(cause, attempted.length > 0);
+      } finally {
+        for (const id of succeeded) {
+          if (!sessionCurrent(scope)) break;
+          auditWithProvider({ action: 'update', resource: scope.contract.name, recordId: id,
+            ...definedOptions({ meta: scope.meta }) }, scope.audit, () => sessionCurrent(scope));
+        }
+        if (succeeded.length) observe(() => {
+          if (sessionCurrent(scope)) return scope.live?.publish?.({
+            type: 'UPDATE', resource: scope.contract.name, payload: { ids: [...succeeded] },
+          });
+        });
+        if (sessionCurrent(scope)) await refresh(scope, attempted);
+      }
+      ensureCurrent();
+      if (rejected) {
+        const error = rejected;
+        const authError = causes.find(cause => cause.statusCode === 401 || cause.statusCode === 403) ?? error;
+        observe(async () => {
+          await handleAuthError(failure(authError, true), context,
+            () => targetCurrent(scope) && latestToken === invocation.token,
+            () => clearAuthQueries(client, scope.auth), scope.authScope,
+            () => mounted && latestToken !== invocation.token);
+        });
+        notify(scope, current, 'error', i18n.t('common.operationFailed'));
+        observe(() => { if (current()) return invocation.callbacks.onError?.(copyFailure(error)); });
+        observe(() => { if (current()) return invocation.callbacks.onSettled?.(undefined, copyFailure(error)); });
+        throw error;
+      }
+      const result = { data };
+      notify(scope, current, 'success', i18n.t('common.updateSuccess'));
+      observe(() => { if (current()) return invocation.callbacks.onSuccess?.(copyResult(scope, result)); });
+      observe(() => { if (current()) return invocation.callbacks.onSettled?.(copyResult(scope, result), null); });
+      ensureCurrent();
+      return copyResult(scope, result);
+    },
+  }));
+  $effect.pre(() => {
+    if (latest && !isCurrent(latest)) {
+      latest = undefined;
+      active = undefined;
+      mutation.reset();
+    }
+  });
+  $effect(() => () => { mounted = false; active = undefined; latestToken = undefined; });
+
+  function detachedPromise(promise: Promise<Result<S>>, scope: Scope, token: object, progress: Progress): Promise<Result<S>> {
+    return promise.then(data => {
+      if (!isCurrent(scope) || latestToken !== token) throw cancelled(scope, progress);
+      return copyResult(scope, data);
+    }, (cause: unknown) => {
+      if (!isCurrent(scope) || latestToken !== token) throw cancelled(scope, progress);
+      throw cause instanceof HttpError ? copyFailure(cause) : failure(cause, progress.attempted.length > 0);
+    });
+  }
+  function mutateAsync(params: ContractUpdateManyParams<S>, callbacks: Callbacks<S> = {}): Promise<Result<S>> {
+    const origin = captureOrigin();
+    const observer = { onSuccess: callbacks.onSuccess, onError: callbacks.onError, onSettled: callbacks.onSettled };
+    let scope: Scope;
+    try { scope = capture(params); }
+    catch (cause) {
+      const error = failure(cause);
+      if (active && isCurrent(active.scope)) return Promise.reject(error);
+      latest = undefined;
+      active = undefined;
+      const token = {};
+      const progress = newProgress();
+      latestToken = token;
+      return mutation.mutateAsync(Object.freeze({
+        scope: undefined, origin, token, callbacks: definedOptions(observer), readScope: () => { throw error; },
+        readProgress: () => progress,
+      })).catch((cause: unknown) => {
+        if (!originCurrent(origin) || latestToken !== token) throw cancelled(undefined, progress);
+        throw cause instanceof HttpError ? copyFailure(cause) : failure(cause);
+      });
+    }
+    if (active && isCurrent(active.scope)) {
+      if (active.scope.signature === scope.signature) {
+        const owner = active.scope;
+        const { token, progress } = active;
+        const current = () => isCurrent(owner) && latestToken === token;
+        return detachedPromise(active.promise, owner, token, progress).then(data => {
+          if (current()) {
+            observe(() => observer.onSuccess?.(copyResult(owner, data)));
+            observe(() => { if (current()) return observer.onSettled?.(copyResult(owner, data), null); });
+          }
+          if (!current()) throw cancelled(owner, progress);
+          return data;
+        }, (cause: unknown) => {
+          const error = cause instanceof HttpError ? cause : failure(cause, progress.attempted.length > 0);
+          if (current()) {
+            observe(() => observer.onError?.(copyFailure(error)));
+            observe(() => { if (current()) return observer.onSettled?.(undefined, copyFailure(error)); });
+          }
+          if (!current()) throw cancelled(owner, progress);
+          throw error;
+        });
+      }
+      return Promise.reject(new HttpError('Batch update is already running', 409, undefined, { code: 'UPDATE_MANY_BUSY' }));
+    }
+    const token = {};
+    latestToken = token;
+    latest = scope;
+    const target = scope;
+    const progress = newProgress();
+    // Preserve scope and token identity through Svelte's mutation-state projection.
+    const promise = mutation.mutateAsync(Object.freeze({
+      scope, origin, token, callbacks: definedOptions(observer), readScope: () => target,
+      readProgress: () => progress,
+    })).finally(() => { if (active?.token === token) active = undefined; });
+    active = { scope, token, promise, progress };
+    return detachedPromise(promise, target, token, progress);
+  }
+  // Copy reads while retaining TanStack's success/error discriminated union.
+  function detachedState(state: typeof mutation): typeof mutation;
+  function detachedState(state: typeof mutation): object {
+    return replaceReactiveUnionMembers(state, {
+      get data() {
+        const scope = state.variables?.scope;
+        return state.data && scope ? copyResult(scope, state.data) : undefined;
+      },
+      get error() { return state.error ? copyFailure(state.error) : null; },
+      get failureReason() { return state.failureReason ? copyFailure(state.failureReason) : null; },
+    });
+  }
+  const result = replaceReactiveUnionMembers(detachedState(mutation), {
+    get variables() {
+      const scope = mutation.variables?.scope;
+      return scope ? parseUpdateManyParams(scope.contract, scope.input) : undefined;
+    },
+    mutateAsync,
+    mutate(params: ContractUpdateManyParams<S>, callbacks?: Callbacks<S>): void {
+      void mutateAsync(params, callbacks).catch(() => {});
+    },
+    reset() { active = undefined; latest = undefined; latestToken = undefined; mutation.reset(); },
+  });
+  const idle: typeof result = {
+    context: undefined, data: undefined, error: null, failureCount: 0, failureReason: null,
+    isError: false, isIdle: true, isPending: false, isPaused: false, isSuccess: false,
+    status: 'idle', submittedAt: 0, variables: undefined,
+    mutate: result.mutate, mutateAsync: result.mutateAsync, reset: result.reset,
+  };
+  const view = createQueryResultView(() => {
+    const invocation = mutation.variables;
+    if (!mounted || (invocation && (!originCurrent(invocation.origin) || latestToken !== invocation.token ||
+      (invocation.scope && !isCurrent(invocation.scope))))) return idle;
+    return result;
+  });
+  const overtime = createOvertimeTracker(() => view.isPending, options.overtimeOptions ?? adminOptions.overtime);
+  return { mutation: view, get overtime() { return overtime; } };
+}

package/src/url-sync.ts

@@ -16,16 +16,16 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 function isFilter(value: unknown, depth: number, budget: { remaining: number }): value is Filter {
   if (depth > 20 || budget.remaining-- <= 0 || !isRecord(value)) return false;
 
-  if (typeof value.field === 'string') {
-    return value.field.trim().length > 0
-      && typeof value.operator === 'string'
-      && CRUD_OPERATORS.has(value.operator)
+  if (typeof value['field'] === 'string') {
+    return value['field'].trim().length > 0
+      && typeof value['operator'] === 'string'
+      && CRUD_OPERATORS.has(value['operator'])
       && 'value' in value;
   }
 
-  return (value.operator === 'and' || value.operator === 'or')
-    && Array.isArray(value.value)
-    && value.value.every((entry) => isFilter(entry, depth + 1, budget));
+  return (value['operator'] === 'and' || value['operator'] === 'or')
+    && Array.isArray(value['value'])
+    && value['value'].every((entry) => isFilter(entry, depth + 1, budget));
 }
 
 function parseFilters(value: string): Filter[] | undefined {
@@ -46,8 +46,8 @@ function positiveIntegerParam(value: string | undefined, max: number): string |
 }
 
 /**
- * 保留从列表进入 CRUD 页面时可安全恢复的查询状态。
- * 未知参数不会跨页面传播，避免把 detail、tenantId 或敏感参数带入记录路由。
+ * Preserves query state that can be safely restored when navigating from a list to CRUD pages.
+ * Unknown parameters do not propagate across pages, preventing detail, tenantId, or sensitive values from entering record routes.
  */
 export function sanitizeListQueryParams(params: Record<string, string>): Record<string, string> {
   const result: Record<string, string> = {};
@@ -128,7 +128,8 @@ export function readURLState(adminContext: AdminContextAccessor = captureAdminCo
 }
 
 export function writeURLState(
-  state: URLState,
+  // An own undefined field clears that URL parameter; an absent field leaves it unchanged.
+  state: { [K in keyof URLState]?: URLState[K] | undefined },
   adminContext: AdminContextAccessor = captureAdminContext(),
   type: 'push' | 'replace' = 'replace',
 ): void {

package/src/useCan.ts

@@ -1,14 +1,30 @@
 // useCan — reactive permission check hook with TanStack Query integration
 
-import { createQuery } from '@tanstack/svelte-query';
+import { hashKey, useQueryClient, type QueryClient } from '@tanstack/svelte-query';
+import { onDestroy } from 'svelte';
+import { definedOptions } from './defined-options';
 import { captureAdminContext } from './context.svelte';
-import type { Action, CanResult } from './permissions.svelte';
+import type { Action, CanParams, CanResult } from './permissions.svelte';
+import { accessControlSource, snapshotCanParams, decodeCanResult, prepareCanCheck } from './access-control-contract';
+import { createSessionQuery } from './session-query.svelte';
+import { supersededQuerySession } from './query-session.svelte';
+import { HttpError } from './types';
+import { captureAuthLiveScope } from './auth-hooks.svelte';
+
+interface AccessQueryOwner {
+  readonly key: string;
+  readonly current: () => boolean;
+  readonly execute: () => Promise<CanResult>;
+}
+const accessQueryOwners = new WeakMap<QueryClient, Set<AccessQueryOwner>>();
 
 export interface UseCanOptions {
   resource: string;
   action: Action;
-  params?: Record<string, unknown>;
-  meta?: Record<string, unknown>;
+  /** Fixed record target; overrides an ID in additional permission params after validation. */
+  id?: string | number;
+  params?: NonNullable<CanParams['params']>;
+  meta?: Record<string,unknown>;
   queryOptions?: {
     enabled?: boolean;
     staleTime?: number;
@@ -17,7 +33,7 @@ export interface UseCanOptions {
 
 export interface UseCanResult {
   readonly allowed: boolean;
-  readonly reason: string | undefined;
+  readonly reason: string|undefined;
   readonly isLoading: boolean;
 }
 
@@ -32,38 +48,87 @@ export interface UseCanResult {
  * ```
  */
 export function useCan(options: () => UseCanOptions): UseCanResult {
-  const adminContext = captureAdminContext();
-  const query = createQuery<CanResult>(() => {
-    const opts = options();
-    const provider = adminContext.accessControlProvider;
+  const adminContext=captureAdminContext();
+  const client = useQueryClient();
+  const peers = accessQueryOwners.get(client) ?? new Set<AccessQueryOwner>();
+  accessQueryOwners.set(client, peers);
+  let disposed = false;
+  let release = () => {};
+  onDestroy(() => { disposed = true; release(); });
+
+  function captureTarget() {
+    const opts=options();
+    const provider=adminContext.accessControlProvider;
+    const { enabled = true, staleTime = 5 * 60 * 1000 } = opts.queryOptions ?? {};
+    if (typeof enabled !== 'boolean' || typeof staleTime !== 'number' || Number.isNaN(staleTime) || staleTime < 0) {
+      throw new HttpError('Invalid access control query settings', 422, undefined, { code: 'INVALID_ACCESS_CONTROL_INPUT' });
+    }
+    const explicit=snapshotCanParams(definedOptions({
+      resource: opts.resource, action: opts.action, params: opts.params, meta: opts.meta,
+    }));
+    const params=snapshotCanParams({
+      ...explicit,
+      ...definedOptions({
+        params: opts.id === undefined ? explicit.params : { ...explicit.params, id: opts.id },
+        meta: adminContext.getProviderMeta(opts.resource, explicit.meta),
+      }),
+    });
     return {
-      queryKey: adminContext.queryKeys(opts.resource).access.can(opts.resource, {
-        action: opts.action,
-        params: opts.params,
-        meta: opts.meta,
+      resource: params.resource, params, provider, enabled, staleTime,
+      queryKey: adminContext.queryKeys(opts.resource).access.can(opts.resource,{
+        ...params,
+        source: accessControlSource(provider),
       }),
+    };
+  }
+
+  const query=createSessionQuery<CanResult>(adminContext, () => {
+    const target = captureTarget();
+    const signature = hashKey(target.queryKey);
+    const authProvider = adminContext.authProvider;
+    const auth = captureAuthLiveScope(authProvider);
+    const key = hashKey([target.queryKey, auth.cacheKey]);
+    const execute = prepareCanCheck(target.provider, target.params);
+    const owner: AccessQueryOwner = {
+      key, execute,
+      current() {
+        if (disposed || adminContext.authProvider !== authProvider || !auth.isCurrent()) return false;
+        try {
+          const current = captureTarget();
+          return current.enabled && current.provider === target.provider && hashKey(current.queryKey) === signature;
+        } catch {
+          return false;
+        }
+      },
+    };
+    release();
+    if (!disposed) peers.add(owner);
+    release = () => { peers.delete(owner); };
+    return {
+      resource: target.resource, queryKey: target.queryKey,
+      successNotification: false, errorNotification: false,
+      allowRetiredQueryFn: true,
+      isTargetCurrent: () => !disposed && options().queryOptions?.enabled !== false,
       queryFn: async () => {
-        if (!provider) return { can: true };
-        const result = await provider.can({
-          resource: opts.resource,
-          action: opts.action,
-          params: opts.params,
-          meta: adminContext.getProviderMeta(opts.resource, opts.meta),
-        });
-        return Array.isArray(result) ? (result[0] ?? { can: false }) : result;
+        // Native cache refreshes may retain an unmounted peer's query function.
+        for (const peer of peers) {
+          if (peer.key === key && peer.current()) return peer.execute();
+        }
+        throw supersededQuerySession();
       },
-      enabled: opts.queryOptions?.enabled ?? true,
-      staleTime: opts.queryOptions?.staleTime ?? 5 * 60 * 1000,
+      decode: decodeCanResult,
+      enabled: target.enabled, staleTime: target.staleTime,
     };
   });
 
-  return {
-    get allowed() { 
-      const p = adminContext.accessControlProvider;
-      if (!p) return true;
-      return (query.data as CanResult | undefined)?.can ?? false; 
+  return Object.freeze({
+    get allowed() {
+      const auth = captureAuthLiveScope(adminContext.authProvider);
+      if (adminContext.accessControlProvider === null) return query.isEnabled && auth.isCurrent();
+      if (!auth.isCurrent()) return false;
+      return query.isEnabled && query.isSuccess && query.data?.can === true;
     },
-    get reason() { return (query.data as CanResult | undefined)?.reason; },
-    get isLoading() { return query.isLoading; },
-  };
+    get reason() { return query.isEnabled && query.isSuccess ? query.data?.reason : undefined; },
+    get isLoading() { return adminContext.accessControlProvider !== null && query.isLoading; },
+  });
 }

package/src/useParsed.svelte.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 // useParsed — parse current URL hash into structured route info
 
 import { registerRouterSync } from './router';
@@ -6,10 +5,10 @@ import { captureAdminContext } from './context.svelte';
 import { parseResourceActionSegments } from './route-parsing';
 
 interface ParsedRoute {
-  resource?: string;
-  resourcePath?: string;
-  action?: 'list' | 'create' | 'edit' | 'show' | 'clone';
-  id?: string;
+  resource: string | undefined;
+  resourcePath: string | undefined;
+  action: 'list' | 'create' | 'edit' | 'show' | 'clone' | undefined;
+  id: string | undefined;
   /** Query params parsed from the URL search string (e.g. ?page=2). */
   params: Record<string, string>;
   /** Parent path params derived from nested routes (e.g. /teams/123/users -> teamId). */
@@ -25,7 +24,7 @@ export function syncGlobalPath(): void {
   routeVersion++;
 }
 
-/** 简单的英文名词单数化，处理常见复数模式（-ies, -ses, -es, -s） */
+/** Basic English noun singularization for common plural suffixes: -ies, -ses, -es, and -s. */
 function singularize(word: string): string {
   if (word.endsWith('ies') && word.length > 3) return word.slice(0, -3) + 'y';
   if (word.endsWith('ses') && word.length > 3) return word.slice(0, -2);
@@ -37,8 +36,8 @@ function singularize(word: string): string {
 registerRouterSync(syncGlobalPath);
 
 if (typeof window !== 'undefined') {
-  if (!(window as any).__svadminParsedInit) {
-    (window as any).__svadminParsedInit = true;
+  if (!('__svadminParsedInit' in window) || window.__svadminParsedInit !== true) {
+    Object.defineProperty(window, '__svadminParsedInit', { value: true, configurable: true });
     window.addEventListener('hashchange', syncGlobalPath);
     window.addEventListener('popstate', syncGlobalPath);
   }
@@ -68,10 +67,13 @@ export function useParsed(): ParsedRoute {
 
   const parsed = $derived.by(() => {
     const p = activePath;
-    const result: ParsedRoute = { params: {}, parentParams: {} };
+    const result: ParsedRoute = {
+      resource: undefined, resourcePath: undefined, action: undefined, id: undefined,
+      params: {}, parentParams: {},
+    };
 
     // Parse query params from hash
-    const [pathname, queryString] = p.split('?');
+    const [pathname = '/', queryString] = p.split('?');
     if (queryString) {
       const sp = new URLSearchParams(queryString);
       for (const [k, v] of sp.entries()) {
@@ -86,7 +88,8 @@ export function useParsed(): ParsedRoute {
     const resourceNames = resources.map(r => r.name);
     let resourceIndex = -1;
     for (let i = segments.length - 1; i >= 0; i--) {
-      if (resourceNames.includes(segments[i])) {
+      const segment = segments[i];
+      if (segment !== undefined && resourceNames.includes(segment)) {
         resourceIndex = i;
         break;
       }
@@ -101,10 +104,11 @@ export function useParsed(): ParsedRoute {
       // injection only applies to path-derived parent params, never to
       // arbitrary query params like ?tenantId=1.
       for (let i = 0; i < resourceIndex; i += 2) {
-        if (segments[i] && segments[i + 1]) {
-          const parentName = segments[i];
+        const parentName = segments[i];
+        const parentId = segments[i + 1];
+        if (parentName && parentId) {
           const singular = singularize(parentName);
-          result.parentParams[`${singular}Id`] = segments[i + 1];
+          result.parentParams[`${singular}Id`] = parentId;
         }
       }