@web-ts-toolkit/access-router 0.42.2 → 0.44.0

package/index.js

@@ -841,6 +841,29 @@ var cloneConfigValue = (value) => {
     ])
   );
 };
+var cloneForRead = (value) => {
+  if (Array.isArray(value)) {
+    if (Object.isFrozen(value)) {
+      return value;
+    }
+    return value.map((item) => cloneForRead(item));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) {
+    return value;
+  }
+  if (Object.isFrozen(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([entryKey, entryValue]) => [
+      entryKey,
+      cloneForRead(entryValue)
+    ])
+  );
+};
 var freezeConfigValue = (value) => {
   if (!value || typeof value !== "object") {
     return value;
@@ -856,6 +879,7 @@ var freezeConfigValue = (value) => {
   }
   return value;
 };
+var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -885,6 +909,14 @@ var OptionsManager = class {
         target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
+      },
+      defineProperty(target, key, descriptor) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        const result = Reflect.defineProperty(target, key, descriptor);
+        const newValue = target[keystr];
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, newValue, keystr, target, oldvalue);
+        return result;
       }
     });
   }
@@ -898,18 +930,18 @@ var OptionsManager = class {
   set(key, value) {
     const path = toPath(key);
     if (path.length <= 1) {
-      (0, import_utils9.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneConfigValue(value));
+      (0, import_utils9.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
       return;
     }
     const [rootKey, ...nestedPath] = path;
     const currentRoot = (0, import_utils9.get)(this.currentOptions, [rootKey], void 0);
     const baseRoot = (0, import_utils9.isPlainObject)(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
-    (0, import_utils9.set)(nextRoot, nestedPath, cloneConfigValue(value));
-    (0, import_utils9.set)(this.currentOptions, [rootKey], nextRoot);
+    (0, import_utils9.set)(nextRoot, nestedPath, cloneForRead(value));
+    (0, import_utils9.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
   }
   fetch() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -918,20 +950,20 @@ var OptionsManager = class {
     return freezeConfigValue(cloned);
   }
   assign(options) {
-    const cloned = cloneConfigValue(options);
+    const cloned = cloneForRead(options);
     for (const key of this.preserveKeys) {
       if (key in options) {
         cloned[key] = options[key];
       }
     }
-    (0, import_utils9.assign)(this.currentOptions, cloned);
+    (0, import_utils9.assign)(this.currentOptions, freezeConfigValue(cloned));
   }
   onchange(key, func) {
     (0, import_utils9.set)(this.listeners, key, func);
     return this;
   }
   snapshot() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -947,13 +979,13 @@ var OptionsManager = class {
         delete current[key];
       }
     }
-    const cloned = cloneConfigValue(snap);
+    const cloned = cloneForRead(snap);
     for (const key of this.preserveKeys) {
       if (key in snap) {
         cloned[key] = snap[key];
       }
     }
-    (0, import_utils9.assign)(current, cloned);
+    (0, import_utils9.assign)(current, freezeConfigValue(cloned));
   }
 };
 
@@ -1423,8 +1455,7 @@ var AccessRuntime = class {
   }
   setDataOptions(dataName, options) {
     const manager = this.getOrCreateDataOptions(dataName);
-    const currentDataOptions = manager.fetch();
-    manager.assign({ ...currentDataOptions, ...options });
+    manager.assign(options);
   }
   setDataOption(dataName, key, value) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1434,6 +1465,11 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  getDataSnapshot(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const snapshot = manager.get("data");
+    return snapshot ?? [];
+  }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
     return getNestedOption(manager, key, defaultValue);
@@ -1555,6 +1591,9 @@ var getRuntime4 = () => getActiveRuntime() ?? defaultRuntime;
 var getDataOptions = (dataName) => {
   return getRuntime4().getDataOptions(dataName);
 };
+var getDataSnapshot = (dataName) => {
+  return getRuntime4().getDataSnapshot(dataName);
+};
 var getDataOption = (dataName, key, defaultValue) => {
   return getRuntime4().getDataOption(dataName, key, defaultValue);
 };
@@ -1564,9 +1603,6 @@ var getRuntime5 = () => getActiveRuntime() ?? defaultRuntime;
 var getModelRef = (modelName, refPath) => {
   return getRuntime5().getModelRef(modelName, refPath);
 };
-var getModelSub = (modelName) => {
-  return getRuntime5().getModelSub(modelName);
-};
 
 // src/services/base.ts
 var import_utils12 = require("@web-ts-toolkit/utils");
@@ -3474,7 +3510,7 @@ var DataService = class {
     this.req = req;
     this.dataName = dataName;
     this.options = getDataOptions(dataName);
-    this.data = this.options.data ?? [];
+    this.data = getDataSnapshot(dataName);
   }
   async findOne(filter2, args, options) {
     const filterErrors = validateClientFilter(filter2);
@@ -3655,8 +3691,11 @@ var copyAndDepopulate = (docObject, operations, options = { mutable: true, idFie
           if (!(0, import_utils17.isPlainObject)(target)) return ret;
           const targetObject = target;
           const next = targetObject[seg];
-          if ((0, import_utils17.isArray)(next)) ret.push(...next);
-          else if (next !== null && next !== void 0) ret.push(next);
+          if ((0, import_utils17.isArray)(next)) {
+            for (const item of next) {
+              ret.push(item);
+            }
+          } else if (next !== null && next !== void 0) ret.push(next);
           return ret;
         }, []);
       }
@@ -3831,11 +3870,12 @@ async function resolveAccessFilter({
 }) {
   let nextFilter = normalizeFilter(filter2);
   const overrideFilterFn = getOption(`overrideFilter.${access}`, null);
-  if ((0, import_utils19.isFunction)(overrideFilterFn)) {
+  if (nextFilter !== false && (0, import_utils19.isFunction)(overrideFilterFn)) {
     nextFilter = normalizeFilter(await overrideFilterFn.call(req, nextFilter, permissions));
   }
+  if (nextFilter === false) return false;
   const baseFilterFn = getOption(`baseFilter.${access}`, null);
-  if (!(0, import_utils19.isFunction)(baseFilterFn)) return nextFilter || {};
+  if (!(0, import_utils19.isFunction)(baseFilterFn)) return nextFilter ?? {};
   const baseFilter = normalizeFilter(
     cache.has(cacheKey) ? cache.get(cacheKey) : await baseFilterFn.call(req, permissions)
   );
@@ -3843,7 +3883,7 @@ async function resolveAccessFilter({
     cache.set(cacheKey, baseFilter);
   }
   if (baseFilter === false) return false;
-  if (!baseFilter) return nextFilter || {};
+  if (!baseFilter) return nextFilter ?? {};
   if (!nextFilter) return baseFilter;
   return optimizeAndFilter([baseFilter, nextFilter]);
 }
@@ -3851,15 +3891,30 @@ function getRequestPermissions(req) {
   const requestPermissionField = getGlobalOption("requestPermissionField");
   return new permission_default(req[requestPermissionField] || {});
 }
+var permissionFieldOwners = /* @__PURE__ */ new WeakMap();
+function getPermissionFieldOwnerMap(req) {
+  let owners = permissionFieldOwners.get(req);
+  if (!owners) {
+    owners = /* @__PURE__ */ new Map();
+    permissionFieldOwners.set(req, owners);
+  }
+  return owners;
+}
 async function setRequestPermissions(req) {
   const requestPermissionField = getGlobalOption("requestPermissionField");
-  if (req[requestPermissionField]) return;
+  const activeRuntime = getActiveRuntime();
+  const owners = getPermissionFieldOwnerMap(req);
+  const owner = owners.get(requestPermissionField);
+  const hasFieldValue = Boolean(req[requestPermissionField]);
+  if (owner === activeRuntime) return;
+  if (hasFieldValue && owner === void 0) return;
   const globalPermissions = getGlobalOption("globalPermissions");
   if (!(0, import_utils19.isFunction)(globalPermissions)) return;
   const permissions = await globalPermissions.call(req, req);
   if ((0, import_utils19.isPlainObject)(permissions)) req[requestPermissionField] = permissions;
   else if ((0, import_utils19.isArray)(permissions)) req[requestPermissionField] = (0, import_utils19.arrayToRecord)(permissions);
   else if ((0, import_utils19.isString)(permissions)) req[requestPermissionField] = { [permissions]: true };
+  owners.set(requestPermissionField, activeRuntime);
 }
 async function evaluateRouteGuard(req, permissions, routeGuard) {
   const phas = (key) => permissions.has(key);
@@ -3927,17 +3982,14 @@ function getResolvedRequestPermissions(req) {
 async function setResolvedRequestPermissions(req) {
   await setRequestPermissions(req);
 }
-async function canActivateRequest(req, routeGuard) {
-  const permissions = getGlobalPermissions(req);
-  return evaluateRouteGuard(req, permissions, routeGuard);
-}
 async function initializeAclRequest({
   req,
   flag,
+  runtime,
   createCore,
   assignCore
 }) {
-  if (req[flag]) {
+  if (req[flag] === runtime) {
     return null;
   }
   const core = createCore(req);
@@ -3945,7 +3997,7 @@ async function initializeAclRequest({
   assignCore(core);
   req[PERMISSIONS] = core.getPermissions();
   req[PERMISSION_KEYS] = [...req[PERMISSIONS].keys];
-  req[flag] = true;
+  req[flag] = runtime;
   return core;
 }
 
@@ -4081,6 +4133,7 @@ async function resolveSelectForRequest({
 // src/core.ts
 var Core = class {
   constructor(req) {
+    this.cachedPermissions = null;
     this.req = req;
     this.caches = {
       baseFilter: new Cache()
@@ -4364,13 +4417,15 @@ var Core = class {
     return docObject;
   }
   getPermissions() {
+    if (this.cachedPermissions) return this.cachedPermissions;
     return getResolvedRequestPermissions(this.req);
   }
   async setPermissions() {
     await setResolvedRequestPermissions(this.req);
+    this.cachedPermissions = getResolvedRequestPermissions(this.req);
   }
   async canActivate(routeGuard) {
-    return canActivateRequest(this.req, routeGuard);
+    return evaluateRouteGuard(this.req, this.getGlobalPermissions(), routeGuard);
   }
   async isAllowed(modelName, access) {
     if (access.startsWith("subs")) {
@@ -4406,6 +4461,7 @@ var Core = class {
     return this.getPublicService(modelName);
   }
   getGlobalPermissions() {
+    if (this.cachedPermissions) return this.cachedPermissions;
     return getGlobalPermissions(this.req);
   }
 };
@@ -4415,6 +4471,7 @@ var createSetCore = (runtime = defaultRuntime) => {
       await initializeAclRequest({
         req,
         flag: MIDDLEWARE,
+        runtime,
         createCore: (request) => new Core(request),
         assignCore: (core) => {
           req.macl = core;
@@ -4795,8 +4852,9 @@ function defineRequestSchema(validator, options = {}) {
   };
 }
 function fromZod(schema) {
-  return (value) => {
-    const result = schema.safeParse(value);
+  return async (value) => {
+    const candidate = schema;
+    const result = typeof candidate.safeParseAsync === "function" ? await candidate.safeParseAsync.call(schema, value) : schema.safeParse(value);
     if (result.success) {
       return {
         success: true,
@@ -4833,6 +4891,9 @@ function fromYup(schema) {
         data
       };
     } catch (error2) {
+      if (!isYupValidationError(error2)) {
+        throw error2;
+      }
       return {
         success: false,
         issues: normalizeYupIssues(error2)
@@ -4857,8 +4918,32 @@ function fromJoi(schema) {
 }
 function fromAjv(validator) {
   return async (value) => {
-    const valid = await validator(value);
-    if (valid) {
+    const outcome = validator(value);
+    if (isThenable(outcome)) {
+      try {
+        const data = await outcome;
+        if (data === false) {
+          return {
+            success: false,
+            issues: normalizeAjvIssues(validator.errors ?? [])
+          };
+        }
+        return {
+          success: true,
+          data: data === true ? value : data
+        };
+      } catch (error2) {
+        if (!isAjvValidationError(error2)) {
+          throw error2;
+        }
+        return {
+          success: false,
+          issues: normalizeAjvIssues(error2.errors ?? [])
+        };
+      }
+    }
+    const errorsSnapshot = validator.errors ? [...validator.errors] : [];
+    if (outcome) {
       return {
         success: true,
         data: value
@@ -4866,7 +4951,7 @@ function fromAjv(validator) {
     }
     return {
       success: false,
-      issues: normalizeAjvIssues(validator.errors ?? [])
+      issues: normalizeAjvIssues(errorsSnapshot)
     };
   };
 }
@@ -4887,6 +4972,25 @@ function fromValibot(schema, safeParse) {
 }
 function fromArkType(type) {
   return async (value) => {
+    if (isStandardSchema(type)) {
+      const result2 = await type["~standard"].validate(value);
+      if (isArkTypeErrors(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeIssues(result2)
+        };
+      }
+      if (isStandardSchemaFailure(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeStandardIssues(result2.issues)
+        };
+      }
+      return {
+        success: true,
+        data: result2.value
+      };
+    }
     const result = await type(value);
     if (!isArkTypeErrors(result)) {
       return {
@@ -4939,6 +5043,9 @@ function fromVine(validator) {
         data: output
       };
     } catch (error2) {
+      if (!isVineValidationError(error2)) {
+        throw error2;
+      }
       return {
         success: false,
         issues: normalizeVineError(error2)
@@ -4999,6 +5106,13 @@ function normalizeArkTypeIssues(issues) {
   }));
   return normalized.length ? normalized : [{ message: issues.summary ?? "Validation failed" }];
 }
+function normalizeArkTypeStandardIssues(issues) {
+  const normalized = issues.map((issue) => ({
+    message: issue.message ?? issue.problem ?? "Validation failed",
+    path: issue.path?.flatMap((segment) => normalizePathSegment(segment))
+  }));
+  return normalized.length ? normalized : [{ message: "Validation failed" }];
+}
 function normalizeIoTsIssues(issues) {
   return issues.map((issue) => ({
     message: issue.message ?? "Validation failed",
@@ -5033,25 +5147,64 @@ function normalizeVineField(message) {
   }
   return path.length ? path : void 0;
 }
+function decodeAjvSegment(segment) {
+  return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function encodePointerSegment(segment) {
+  return encodeURIComponent(segment.replace(/~/g, "~0").replace(/\//g, "~1"));
+}
 function parseAjvPath(issue) {
-  const path = issue.instancePath?.split("/").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
-  if (issue.params?.missingProperty) {
-    return (path ?? []).concat(issue.params.missingProperty);
+  const raw = issue.instancePath;
+  const base = raw == null || raw === "" ? [] : (raw.startsWith("/") ? raw.slice(1) : raw).split("/").map(decodeAjvSegment);
+  const missing = issue.params?.missingProperty;
+  if (typeof missing === "string") {
+    return [...base, missing];
   }
-  return path;
+  return base;
 }
 function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
 function isYupValidationError(error2) {
-  return typeof error2 === "object" && error2 !== null && "message" in error2;
+  if (typeof error2 !== "object" || error2 === null || !("message" in error2)) {
+    return false;
+  }
+  const candidate = error2;
+  return candidate.name === "ValidationError" && typeof candidate.message === "string" && Array.isArray(candidate.errors) && Array.isArray(candidate.inner);
 }
 function isArkTypeErrors(value) {
-  return Array.isArray(value);
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return record.arkKind === "errors" || record[" arkKind"] === "errors";
+}
+function isThenable(value) {
+  return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function isAjvValidationError(error2) {
+  if (typeof error2 !== "object" || error2 === null || !("errors" in error2)) {
+    return false;
+  }
+  const errors = error2.errors;
+  return errors == null || Array.isArray(errors);
 }
 function isVineValidationError(error2) {
-  return typeof error2 === "object" && error2 !== null && "messages" in error2 && Array.isArray(error2.messages);
+  if (typeof error2 !== "object" || error2 === null || !("messages" in error2)) {
+    return false;
+  }
+  const candidate = error2;
+  if (!Array.isArray(candidate.messages) || candidate.messages.length === 0) {
+    return false;
+  }
+  const hasDiscriminator = candidate.code === "E_VALIDATION_ERROR" || candidate.name === "ValidationError";
+  if (!hasDiscriminator) {
+    return false;
+  }
+  return candidate.messages.every(
+    (message) => typeof message === "object" && message !== null && typeof message.message === "string" && typeof message.field === "string"
+  );
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -5068,7 +5221,7 @@ function formatIssue(issue, key, location = "pointer") {
   };
 }
 function buildPointer(path) {
-  return path.length === 0 ? "#" : `#/${path.join("/")}`;
+  return path.length === 0 ? "#" : `#/${path.map(encodePointerSegment).join("/")}`;
 }
 
 // src/validation/model-router.ts
@@ -5569,24 +5722,26 @@ function setModelCollectionRoutes(context) {
   router.post(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "create");
     const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
-    const body = await parseNestedBodyWithSchema(
+    const intermediateBody = await parseNestedBodyWithSchema(
       advancedCreateBodySchema,
       req.body,
       "data",
       context.getRequestSchema("requestSchemas.advancedCreate.data")
     );
-    const { data, select, populate, tasks } = body;
-    const advancedOptions = body.options ?? {};
-    await parseBodyWithSchema(
+    const { data: nestedData, select: nestedSelect, populate: nestedPopulate, tasks: nestedTasks } = intermediateBody;
+    const nestedOptions = intermediateBody.options ?? {};
+    const finalBody = await parseBodyWithSchema(
       advancedCreateBodySchema,
-      { data, select, populate, tasks, options: advancedOptions },
+      { data: nestedData, select: nestedSelect, populate: nestedPopulate, tasks: nestedTasks, options: nestedOptions },
       context.getRequestSchema("requestSchemas.advancedCreate.default") ?? context.getRequestSchema("requestSchemas.advancedCreate")
     );
-    const { includePermissions, populateAccess } = advancedOptions;
+    const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
+    const finalOptions = finalBody.options ?? {};
+    const { includePermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._create(
-      data,
-      { select, populate, tasks },
+      finalData,
+      { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
         populateAccess
@@ -5785,25 +5940,33 @@ function setModelDocumentRoutes(context) {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
     const { returning_all, include_permissions } = parseQuery(requestSchemas.updateQuery, req.query);
-    const body = await parseNestedBodyWithSchema(
+    const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpdateBodySchema,
       req.body,
       "data",
       context.getRequestSchema("requestSchemas.advancedUpdate.data")
     );
-    const { data, select, populate, tasks } = body;
-    const advancedOptions = body.options ?? {};
-    await parseBodyWithSchema(
+    const { data: nestedData, select: nestedSelect, populate: nestedPopulate, tasks: nestedTasks } = intermediateBody;
+    const nestedOptions = intermediateBody.options ?? {};
+    const finalBody = await parseBodyWithSchema(
       advancedUpdateBodySchema,
-      { data, select, populate, tasks, options: advancedOptions },
+      {
+        data: nestedData,
+        select: nestedSelect,
+        populate: nestedPopulate,
+        tasks: nestedTasks,
+        options: nestedOptions
+      },
       context.getRequestSchema("requestSchemas.advancedUpdate.default") ?? context.getRequestSchema("requestSchemas.advancedUpdate")
     );
-    const { returningAll, includePermissions, populateAccess } = advancedOptions;
+    const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
+    const finalOptions = finalBody.options ?? {};
+    const { returningAll, includePermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._update(
       id,
-      data,
-      { select, populate, tasks },
+      finalData,
+      { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         returningAll: returningAll ?? (0, import_utils23.parseBooleanString)(returning_all),
         includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
@@ -5853,23 +6016,31 @@ function setModelDocumentRoutes(context) {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
     const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
-    const body = await parseNestedBodyWithSchema(
+    const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpsertBodySchema,
       req.body,
       "data",
       context.getRequestSchema("requestSchemas.advancedUpsert.data")
     );
-    const { data, select, populate, tasks } = body;
-    const advancedOptions = body.options ?? {};
-    await parseBodyWithSchema(
+    const { data: nestedData, select: nestedSelect, populate: nestedPopulate, tasks: nestedTasks } = intermediateBody;
+    const nestedOptions = intermediateBody.options ?? {};
+    const finalBody = await parseBodyWithSchema(
       advancedUpsertBodySchema,
-      { data, select, populate, tasks, options: advancedOptions },
+      {
+        data: nestedData,
+        select: nestedSelect,
+        populate: nestedPopulate,
+        tasks: nestedTasks,
+        options: nestedOptions
+      },
       context.getRequestSchema("requestSchemas.advancedUpsert.default") ?? context.getRequestSchema("requestSchemas.advancedUpsert")
     );
-    const { returningAll, includePermissions, populateAccess } = advancedOptions;
+    const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
+    const finalOptions = finalBody.options ?? {};
+    const { returningAll, includePermissions, populateAccess } = finalOptions;
     const result = await svc._upsert(
-      data,
-      { select, populate, tasks },
+      finalData,
+      { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         returningAll: returningAll ?? (0, import_utils23.parseBooleanString)(returning_all),
         includePermissions: includePermissions ?? (0, import_utils23.parseBooleanString)(include_permissions),
@@ -5939,7 +6110,7 @@ function setModelDocumentRoutes(context) {
 
 // src/routers/model-router-subdocument-routes.ts
 function setModelSubDocumentRoutes(context) {
-  const subs = getModelSub(context.modelName);
+  const subs = context.runtime.getModelSub(context.modelName);
   for (let x = 0; x < subs.length; x++) {
     const sub = subs[x];
     context.router.get(`/:${context.options.idParam}/${sub}`, async (req) => {
@@ -6164,7 +6335,9 @@ var ModelRouter = class _ModelRouter {
       "baseFilter"
     );
     /**
-     * The override filter definitions applied in every query transaction.
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
      * @operation `list`, `read`, `update`, `delete`
      */
     this.overrideFilter = setOption.bind(this, "overrideFilter");
@@ -6324,6 +6497,7 @@ var ModelRouter = class _ModelRouter {
       modelName: this.modelName,
       router: this.router,
       options: this.options,
+      runtime: this.runtime,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
       assertAllowed: this.assertAllowed.bind(this),
@@ -6338,6 +6512,7 @@ var ModelRouter = class _ModelRouter {
       modelName: this.modelName,
       router: this.router,
       options: this.options,
+      runtime: this.runtime,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
       assertAllowed: this.assertAllowed.bind(this),
@@ -6352,6 +6527,7 @@ var ModelRouter = class _ModelRouter {
       modelName: this.modelName,
       router: this.router,
       options: this.options,
+      runtime: this.runtime,
       getRequestSchema: this.getRequestSchema.bind(this),
       getPublicService: this.getPublicService.bind(this),
       assertAllowed: this.assertAllowed.bind(this),
@@ -6402,6 +6578,7 @@ var import_utils26 = require("@web-ts-toolkit/utils");
 // src/core-data.ts
 var DataCore = class {
   constructor(req) {
+    this.cachedPermissions = null;
     this.req = req;
     this.caches = {
       baseFilter: new Cache()
@@ -6495,13 +6672,15 @@ var DataCore = class {
     });
   }
   getPermissions() {
+    if (this.cachedPermissions) return this.cachedPermissions;
     return getResolvedRequestPermissions(this.req);
   }
   async setPermissions() {
     await setResolvedRequestPermissions(this.req);
+    this.cachedPermissions = getResolvedRequestPermissions(this.req);
   }
   async canActivate(routeGuard) {
-    return canActivateRequest(this.req, routeGuard);
+    return evaluateRouteGuard(this.req, this.getGlobalPermissions(), routeGuard);
   }
   async isAllowed(dataName, access) {
     const operationAccess = getDataOption(dataName, `operationAccess.${access}`);
@@ -6517,6 +6696,7 @@ var DataCore = class {
     return this.getService(dataName);
   }
   getGlobalPermissions() {
+    if (this.cachedPermissions) return this.cachedPermissions;
     return getGlobalPermissions(this.req);
   }
 };
@@ -6526,6 +6706,7 @@ var createSetDataCore = (runtime = defaultRuntime) => {
       await initializeAclRequest({
         req,
         flag: DATA_MIDDLEWARE,
+        runtime,
         createCore: (request) => new DataCore(request),
         assignCore: (core) => {
           req.dacl = core;
@@ -6830,6 +7011,11 @@ var DataRouter = class {
       this,
       "baseFilter"
     );
+    /**
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
+     */
     this.overrideFilter = setOption2.bind(this, "overrideFilter");
     this.decorate = setOption2.bind(
       this,