@web-ts-toolkit/access-router 0.43.0 → 0.44.0

package/README.md

@@ -104,6 +104,17 @@ snapshots. Mutating the original options object, a fetched options snapshot, or
 not change live runtime policy or served in-memory records. Replace configured data through `router.data(next)`
 or `setDataOption(name, 'data', next)`.
 
+ACL filter hooks may return `false` to deny a query. That denial is terminal through identifier, override, and
+base-filter composition. `overrideFilter` is a trusted hook that may replace an ordinary client or identifier
+filter before the base filter is applied, but it is not called for an existing `false` filter and cannot revive
+that denial. Returning `false` from `overrideFilter` also denies the query. Empty or absent filters retain their
+normal unrestricted meaning unless a base filter restricts them.
+
+Advanced mutation validators drive dispatch: nested `data` validators run first, then the whole-body (`default`)
+validator sees that transformed envelope, and the service persists only the final parsed `data`, `select`,
+`populate`, `tasks`, and allowed `options`. Missing body options fall back to `returning_all`/`include_permissions`
+query params; only `includePermissions`/`populateAccess` (plus `returningAll` for update/upsert) are forwarded.
+
 ## Main Exports
 
 Root entrypoint (`@web-ts-toolkit/access-router`):
@@ -152,6 +163,15 @@ to `runtime.createRouter(model, options)` or call `runtime.registerModelInstance
 string-name router. The default `acl` runtime retains string-name compatibility with `mongoose.model(name, schema)` and
 adopts that exact global model instance into its registry on first lookup.
 
+Cross-runtime composition on a shared request keeps independent runtime-owned state. When one request passes through
+middleware from runtime A and then runtime B, B initializes its own core, resolves its own `globalPermissions`, and
+uses its own base-filter cache; it never reuses A's permissions or cached filters, even when both runtimes use the
+same `requestPermissionField` name. Repeating the same runtime's middleware on one request reuses that runtime's state
+without rerunning its resolver. Values already present in `requestPermissionField` before any runtime middleware runs
+are treated as application-supplied and preserved. Migration: if you relied on B silently inheriting A's resolved
+permissions on a shared request, set those permissions explicitly before the chain or configure B's `globalPermissions`
+to resolve them.
+
 ## createRouter overloads
 
 `createRouter(modelName, options)` — on the default `acl` runtime, accept the Mongoose model name registered with `mongoose.model(name, schema)`. On isolated runtimes, the name must already be registered with that runtime.

package/advanced.d.mts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers-PMWujHUV.mjs';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CountBody, t as CreateArgs, u as CreateOptions, v as CreateQueryInput, w as CustomHeaders, D as DATA_MIDDLEWARE, x as DataBaseFilterHook, y as DataFilter, z as DataFindArgs, E as DataFindOneArgs, F as DataFindOneOptions, G as DataFindOptions, H as DataHook, I as DataHookContext, J as DataIdentifierHook, K as DataListHook, L as DataOverrideFilterHook, M as DataRequest, N as DataRequestSchemas, O as DataRouterOptions, P as DecorateAccess, Q as DecorateAllAccess, R as DeepFieldPath, S as DefaultModelRouterOptions, T as Defaults, U as DistinctArgs, V as DistinctBody, W as DocPermissionsAccess, X as ErrorResult, Y as ExistsOptions, Z as ExtendedDataRouterOptions, _ as ExtendedDefaultModelRouterOptions, $ as ExtendedModelRouterOptions, a0 as Filter, a1 as FilterOperator, a2 as FindAccess, a3 as FindArgs, a4 as FindByIdArgs, a5 as FindByIdOptions, a6 as FindOneArgs, a7 as FindOneOptions, a8 as FindOptions, a9 as GlobalOptions, aa as GlobalPermissionValue, ab as GuardHook, ac as IdentifierHook, ad as Include, ae as IoTsContextEntryLike, af as IoTsDecodeErrorLike, ag as IoTsDecoderLike, ah as JoiSchemaLike, ai as JoiValidationErrorDetailLike, aj as KeyValueProjection, ak as ListQueryInput, al as ListResult, am as MIDDLEWARE, an as MaybePromise, ao as ModelBaseFilterHook, ap as ModelChangeHook, aq as ModelDeleteHook, ar as ModelDocPermissionsHook, as as ModelDocument, at as ModelDocumentHook, au as ModelHook, av as ModelHookContext, aw as ModelIdentifierHook, ax as ModelListHook, ay as ModelOverrideFilterHook, az as ModelRequest, aA as ModelRouterOptions, aB as ModelValidateHook, aC as PERMISSIONS, aD as PERMISSION_KEYS, aE as PathValue, aF as PermissionSchema, aG as Populate, aH as PopulateAccess, aI as PrepareAccess, aJ as Projection, aK as PublicCreateArgs, aL as PublicCreateOptions, aM as PublicErrorResult, aN as PublicListArgs, aO as PublicListOptions, aP as PublicListResult, aQ as PublicOutput, aR as PublicReadArgs, aS as PublicReadOptions, aT as PublicServiceResult, aU as PublicSingleResult, aV as PublicUpdateArgs, aW as PublicUpdateOptions, aX as PublicUpsertArgs, aY as PublicUpsertOptions, aZ as ReadQueryInput, a_ as Request, a$ as RequestSchemaAdapter, b0 as RequestSchemaFailure, b1 as RequestSchemaIssue, b2 as RequestSchemaLike, b3 as RequestSchemaOptions, b4 as RequestSchemaResult, b5 as RequestSchemaSuccess, b6 as RequestSchemaValidator, b7 as RequestSchemas, b8 as RootDataListQueryEntry, b9 as RootDataOperation, ba as RootDataReadByFilterQueryEntry, bb as RootDataReadByIdQueryEntry, bc as RootModelCountQueryEntry, bd as RootModelCreateQueryEntry, be as RootModelDeleteQueryEntry, bf as RootModelDistinctQueryEntry, bg as RootModelListQueryEntry, bh as RootModelNewQueryEntry, bi as RootModelOperation, bj as RootModelReadByFilterQueryEntry, bk as RootModelReadByIdQueryEntry, bl as RootModelSubBulkUpdateQueryEntry, bm as RootModelSubCreateQueryEntry, bn as RootModelSubDeleteQueryEntry, bo as RootModelSubListQueryEntry, bp as RootModelSubReadQueryEntry, bq as RootModelSubUpdateQueryEntry, br as RootModelUpdateQueryEntry, bs as RootModelUpsertQueryEntry, bt as RootOperationResult, bu as RootQueryEntry, bv as RootRouterOptions, bw as RootSubOperation, bx as RootTarget, by as RouteGuardAccess, bz as SelectAccess, bA as SelectedPopulatedPublicOutput, bB as SelectedPublicOutput, bC as ServiceResult, bD as SingleResult, bE as Sort, bF as SortOrder, bG as StandardSchemaFailure, bH as StandardSchemaInferOutput, bI as StandardSchemaIssue, bJ as StandardSchemaPathSegment, bK as StandardSchemaResult, bL as StandardSchemaSuccess, bM as StandardSchemaV1, bN as StatusCodes, bO as SubListBody, bP as SubPopulate, bQ as SubQueryEntry, bR as SubReadBody, bS as SubdocumentBulkRecord, bT as SubdocumentBulkUpdateInput, bU as SubdocumentCreateInput, bV as SubdocumentCreateOptions, bW as SubdocumentId, bX as SubdocumentListOptions, bY as SubdocumentName, bZ as SubdocumentParentArgs, b_ as SubdocumentParentOptions, b$ as SubdocumentReadOptions, c0 as SubdocumentRecord, c1 as SuperstructFailureLike, c2 as SuperstructValidateLike, c3 as Task, c4 as TransformAccess, c5 as TypedFilter, c6 as UpdateByIdArgs, c7 as UpdateByIdOptions, c8 as UpdateOneArgs, c9 as UpdateOneOptions, ca as UpdateQueryInput, cb as UpsertArgs, cc as UpsertOptions, cd as UpsertQueryInput, ce as ValibotIssueLike, cf as ValibotPathItemLike, cg as ValibotSafeParseLike, ch as ValibotSafeParseResult, ci as ValidateAccess, cj as ValidateRule, ck as Validation, cl as ValidationError, cm as VineValidationErrorLike, cn as VineValidationMessageLike, co as VineValidatorLike, cp as YupSchemaLike, cq as YupValidationErrorLike, cr as defineRequestSchema, cs as fromAjv, ct as fromArkType, cu as fromIoTs, cv as fromJoi, cw as fromStandardSchema, cx as fromSuperstruct, cy as fromValibot, cz as fromVine, cA as fromYup, cB as fromZod, cC as parseBody, cD as parseBodyWithSchema, cE as parseNestedBodyWithSchema, cF as parsePathParam, cG as parseQuery } from './parsers-B5dbVmjm.mjs';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers-PMWujHUV.js';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidationErrorLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, q as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, r as Codes, s as CountBody, t as CreateArgs, u as CreateOptions, v as CreateQueryInput, w as CustomHeaders, D as DATA_MIDDLEWARE, x as DataBaseFilterHook, y as DataFilter, z as DataFindArgs, E as DataFindOneArgs, F as DataFindOneOptions, G as DataFindOptions, H as DataHook, I as DataHookContext, J as DataIdentifierHook, K as DataListHook, L as DataOverrideFilterHook, M as DataRequest, N as DataRequestSchemas, O as DataRouterOptions, P as DecorateAccess, Q as DecorateAllAccess, R as DeepFieldPath, S as DefaultModelRouterOptions, T as Defaults, U as DistinctArgs, V as DistinctBody, W as DocPermissionsAccess, X as ErrorResult, Y as ExistsOptions, Z as ExtendedDataRouterOptions, _ as ExtendedDefaultModelRouterOptions, $ as ExtendedModelRouterOptions, a0 as Filter, a1 as FilterOperator, a2 as FindAccess, a3 as FindArgs, a4 as FindByIdArgs, a5 as FindByIdOptions, a6 as FindOneArgs, a7 as FindOneOptions, a8 as FindOptions, a9 as GlobalOptions, aa as GlobalPermissionValue, ab as GuardHook, ac as IdentifierHook, ad as Include, ae as IoTsContextEntryLike, af as IoTsDecodeErrorLike, ag as IoTsDecoderLike, ah as JoiSchemaLike, ai as JoiValidationErrorDetailLike, aj as KeyValueProjection, ak as ListQueryInput, al as ListResult, am as MIDDLEWARE, an as MaybePromise, ao as ModelBaseFilterHook, ap as ModelChangeHook, aq as ModelDeleteHook, ar as ModelDocPermissionsHook, as as ModelDocument, at as ModelDocumentHook, au as ModelHook, av as ModelHookContext, aw as ModelIdentifierHook, ax as ModelListHook, ay as ModelOverrideFilterHook, az as ModelRequest, aA as ModelRouterOptions, aB as ModelValidateHook, aC as PERMISSIONS, aD as PERMISSION_KEYS, aE as PathValue, aF as PermissionSchema, aG as Populate, aH as PopulateAccess, aI as PrepareAccess, aJ as Projection, aK as PublicCreateArgs, aL as PublicCreateOptions, aM as PublicErrorResult, aN as PublicListArgs, aO as PublicListOptions, aP as PublicListResult, aQ as PublicOutput, aR as PublicReadArgs, aS as PublicReadOptions, aT as PublicServiceResult, aU as PublicSingleResult, aV as PublicUpdateArgs, aW as PublicUpdateOptions, aX as PublicUpsertArgs, aY as PublicUpsertOptions, aZ as ReadQueryInput, a_ as Request, a$ as RequestSchemaAdapter, b0 as RequestSchemaFailure, b1 as RequestSchemaIssue, b2 as RequestSchemaLike, b3 as RequestSchemaOptions, b4 as RequestSchemaResult, b5 as RequestSchemaSuccess, b6 as RequestSchemaValidator, b7 as RequestSchemas, b8 as RootDataListQueryEntry, b9 as RootDataOperation, ba as RootDataReadByFilterQueryEntry, bb as RootDataReadByIdQueryEntry, bc as RootModelCountQueryEntry, bd as RootModelCreateQueryEntry, be as RootModelDeleteQueryEntry, bf as RootModelDistinctQueryEntry, bg as RootModelListQueryEntry, bh as RootModelNewQueryEntry, bi as RootModelOperation, bj as RootModelReadByFilterQueryEntry, bk as RootModelReadByIdQueryEntry, bl as RootModelSubBulkUpdateQueryEntry, bm as RootModelSubCreateQueryEntry, bn as RootModelSubDeleteQueryEntry, bo as RootModelSubListQueryEntry, bp as RootModelSubReadQueryEntry, bq as RootModelSubUpdateQueryEntry, br as RootModelUpdateQueryEntry, bs as RootModelUpsertQueryEntry, bt as RootOperationResult, bu as RootQueryEntry, bv as RootRouterOptions, bw as RootSubOperation, bx as RootTarget, by as RouteGuardAccess, bz as SelectAccess, bA as SelectedPopulatedPublicOutput, bB as SelectedPublicOutput, bC as ServiceResult, bD as SingleResult, bE as Sort, bF as SortOrder, bG as StandardSchemaFailure, bH as StandardSchemaInferOutput, bI as StandardSchemaIssue, bJ as StandardSchemaPathSegment, bK as StandardSchemaResult, bL as StandardSchemaSuccess, bM as StandardSchemaV1, bN as StatusCodes, bO as SubListBody, bP as SubPopulate, bQ as SubQueryEntry, bR as SubReadBody, bS as SubdocumentBulkRecord, bT as SubdocumentBulkUpdateInput, bU as SubdocumentCreateInput, bV as SubdocumentCreateOptions, bW as SubdocumentId, bX as SubdocumentListOptions, bY as SubdocumentName, bZ as SubdocumentParentArgs, b_ as SubdocumentParentOptions, b$ as SubdocumentReadOptions, c0 as SubdocumentRecord, c1 as SuperstructFailureLike, c2 as SuperstructValidateLike, c3 as Task, c4 as TransformAccess, c5 as TypedFilter, c6 as UpdateByIdArgs, c7 as UpdateByIdOptions, c8 as UpdateOneArgs, c9 as UpdateOneOptions, ca as UpdateQueryInput, cb as UpsertArgs, cc as UpsertOptions, cd as UpsertQueryInput, ce as ValibotIssueLike, cf as ValibotPathItemLike, cg as ValibotSafeParseLike, ch as ValibotSafeParseResult, ci as ValidateAccess, cj as ValidateRule, ck as Validation, cl as ValidationError, cm as VineValidationErrorLike, cn as VineValidationMessageLike, co as VineValidatorLike, cp as YupSchemaLike, cq as YupValidationErrorLike, cr as defineRequestSchema, cs as fromAjv, ct as fromArkType, cu as fromIoTs, cv as fromJoi, cw as fromStandardSchema, cx as fromSuperstruct, cy as fromValibot, cz as fromVine, cA as fromYup, cB as fromZod, cC as parseBody, cD as parseBodyWithSchema, cE as parseNestedBodyWithSchema, cF as parsePathParam, cG as parseQuery } from './parsers-B5dbVmjm.js';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.js

@@ -557,6 +557,29 @@ var cloneConfigValue = (value) => {
     ])
   );
 };
+var cloneForRead = (value) => {
+  if (Array.isArray(value)) {
+    if (Object.isFrozen(value)) {
+      return value;
+    }
+    return value.map((item) => cloneForRead(item));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) {
+    return value;
+  }
+  if (Object.isFrozen(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([entryKey, entryValue]) => [
+      entryKey,
+      cloneForRead(entryValue)
+    ])
+  );
+};
 var freezeConfigValue = (value) => {
   if (!value || typeof value !== "object") {
     return value;
@@ -572,6 +595,7 @@ var freezeConfigValue = (value) => {
   }
   return value;
 };
+var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -601,6 +625,14 @@ var OptionsManager = class {
         target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
+      },
+      defineProperty(target, key, descriptor) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        const result = Reflect.defineProperty(target, key, descriptor);
+        const newValue = target[keystr];
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, newValue, keystr, target, oldvalue);
+        return result;
       }
     });
   }
@@ -614,18 +646,18 @@ var OptionsManager = class {
   set(key, value) {
     const path = toPath(key);
     if (path.length <= 1) {
-      (0, import_utils6.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneConfigValue(value));
+      (0, import_utils6.set)(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
       return;
     }
     const [rootKey, ...nestedPath] = path;
     const currentRoot = (0, import_utils6.get)(this.currentOptions, [rootKey], void 0);
     const baseRoot = (0, import_utils6.isPlainObject)(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
-    (0, import_utils6.set)(nextRoot, nestedPath, cloneConfigValue(value));
-    (0, import_utils6.set)(this.currentOptions, [rootKey], nextRoot);
+    (0, import_utils6.set)(nextRoot, nestedPath, cloneForRead(value));
+    (0, import_utils6.set)(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
   }
   fetch() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -634,20 +666,20 @@ var OptionsManager = class {
     return freezeConfigValue(cloned);
   }
   assign(options) {
-    const cloned = cloneConfigValue(options);
+    const cloned = cloneForRead(options);
     for (const key of this.preserveKeys) {
       if (key in options) {
         cloned[key] = options[key];
       }
     }
-    (0, import_utils6.assign)(this.currentOptions, cloned);
+    (0, import_utils6.assign)(this.currentOptions, freezeConfigValue(cloned));
   }
   onchange(key, func) {
     (0, import_utils6.set)(this.listeners, key, func);
     return this;
   }
   snapshot() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -663,13 +695,13 @@ var OptionsManager = class {
         delete current[key];
       }
     }
-    const cloned = cloneConfigValue(snap);
+    const cloned = cloneForRead(snap);
     for (const key of this.preserveKeys) {
       if (key in snap) {
         cloned[key] = snap[key];
       }
     }
-    (0, import_utils6.assign)(current, cloned);
+    (0, import_utils6.assign)(current, freezeConfigValue(cloned));
   }
 };
 
@@ -1139,8 +1171,7 @@ var AccessRuntime = class {
   }
   setDataOptions(dataName, options) {
     const manager = this.getOrCreateDataOptions(dataName);
-    const currentDataOptions = manager.fetch();
-    manager.assign({ ...currentDataOptions, ...options });
+    manager.assign(options);
   }
   setDataOption(dataName, key, value) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1150,6 +1181,11 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  getDataSnapshot(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const snapshot = manager.get("data");
+    return snapshot ?? [];
+  }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
     return getNestedOption(manager, key, defaultValue);
@@ -1395,8 +1431,9 @@ function defineRequestSchema(validator, options = {}) {
   };
 }
 function fromZod(schema) {
-  return (value) => {
-    const result = schema.safeParse(value);
+  return async (value) => {
+    const candidate = schema;
+    const result = typeof candidate.safeParseAsync === "function" ? await candidate.safeParseAsync.call(schema, value) : schema.safeParse(value);
     if (result.success) {
       return {
         success: true,
@@ -1433,6 +1470,9 @@ function fromYup(schema) {
         data
       };
     } catch (error) {
+      if (!isYupValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeYupIssues(error)
@@ -1457,8 +1497,32 @@ function fromJoi(schema) {
 }
 function fromAjv(validator) {
   return async (value) => {
-    const valid = await validator(value);
-    if (valid) {
+    const outcome = validator(value);
+    if (isThenable(outcome)) {
+      try {
+        const data = await outcome;
+        if (data === false) {
+          return {
+            success: false,
+            issues: normalizeAjvIssues(validator.errors ?? [])
+          };
+        }
+        return {
+          success: true,
+          data: data === true ? value : data
+        };
+      } catch (error) {
+        if (!isAjvValidationError(error)) {
+          throw error;
+        }
+        return {
+          success: false,
+          issues: normalizeAjvIssues(error.errors ?? [])
+        };
+      }
+    }
+    const errorsSnapshot = validator.errors ? [...validator.errors] : [];
+    if (outcome) {
       return {
         success: true,
         data: value
@@ -1466,7 +1530,7 @@ function fromAjv(validator) {
     }
     return {
       success: false,
-      issues: normalizeAjvIssues(validator.errors ?? [])
+      issues: normalizeAjvIssues(errorsSnapshot)
     };
   };
 }
@@ -1487,6 +1551,25 @@ function fromValibot(schema, safeParse) {
 }
 function fromArkType(type) {
   return async (value) => {
+    if (isStandardSchema(type)) {
+      const result2 = await type["~standard"].validate(value);
+      if (isArkTypeErrors(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeIssues(result2)
+        };
+      }
+      if (isStandardSchemaFailure(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeStandardIssues(result2.issues)
+        };
+      }
+      return {
+        success: true,
+        data: result2.value
+      };
+    }
     const result = await type(value);
     if (!isArkTypeErrors(result)) {
       return {
@@ -1539,6 +1622,9 @@ function fromVine(validator) {
         data: output
       };
     } catch (error) {
+      if (!isVineValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeVineError(error)
@@ -1599,6 +1685,13 @@ function normalizeArkTypeIssues(issues) {
   }));
   return normalized.length ? normalized : [{ message: issues.summary ?? "Validation failed" }];
 }
+function normalizeArkTypeStandardIssues(issues) {
+  const normalized = issues.map((issue) => ({
+    message: issue.message ?? issue.problem ?? "Validation failed",
+    path: issue.path?.flatMap((segment) => normalizePathSegment(segment))
+  }));
+  return normalized.length ? normalized : [{ message: "Validation failed" }];
+}
 function normalizeIoTsIssues(issues) {
   return issues.map((issue) => ({
     message: issue.message ?? "Validation failed",
@@ -1633,25 +1726,64 @@ function normalizeVineField(message) {
   }
   return path.length ? path : void 0;
 }
+function decodeAjvSegment(segment) {
+  return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function encodePointerSegment(segment) {
+  return encodeURIComponent(segment.replace(/~/g, "~0").replace(/\//g, "~1"));
+}
 function parseAjvPath(issue) {
-  const path = issue.instancePath?.split("/").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
-  if (issue.params?.missingProperty) {
-    return (path ?? []).concat(issue.params.missingProperty);
+  const raw = issue.instancePath;
+  const base = raw == null || raw === "" ? [] : (raw.startsWith("/") ? raw.slice(1) : raw).split("/").map(decodeAjvSegment);
+  const missing = issue.params?.missingProperty;
+  if (typeof missing === "string") {
+    return [...base, missing];
   }
-  return path;
+  return base;
 }
 function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
 function isYupValidationError(error) {
-  return typeof error === "object" && error !== null && "message" in error;
+  if (typeof error !== "object" || error === null || !("message" in error)) {
+    return false;
+  }
+  const candidate = error;
+  return candidate.name === "ValidationError" && typeof candidate.message === "string" && Array.isArray(candidate.errors) && Array.isArray(candidate.inner);
 }
 function isArkTypeErrors(value) {
-  return Array.isArray(value);
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return record.arkKind === "errors" || record[" arkKind"] === "errors";
+}
+function isThenable(value) {
+  return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function isAjvValidationError(error) {
+  if (typeof error !== "object" || error === null || !("errors" in error)) {
+    return false;
+  }
+  const errors = error.errors;
+  return errors == null || Array.isArray(errors);
 }
 function isVineValidationError(error) {
-  return typeof error === "object" && error !== null && "messages" in error && Array.isArray(error.messages);
+  if (typeof error !== "object" || error === null || !("messages" in error)) {
+    return false;
+  }
+  const candidate = error;
+  if (!Array.isArray(candidate.messages) || candidate.messages.length === 0) {
+    return false;
+  }
+  const hasDiscriminator = candidate.code === "E_VALIDATION_ERROR" || candidate.name === "ValidationError";
+  if (!hasDiscriminator) {
+    return false;
+  }
+  return candidate.messages.every(
+    (message) => typeof message === "object" && message !== null && typeof message.message === "string" && typeof message.field === "string"
+  );
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -1668,7 +1800,7 @@ function formatIssue(issue, key, location = "pointer") {
   };
 }
 function buildPointer(path) {
-  return path.length === 0 ? "#" : `#/${path.join("/")}`;
+  return path.length === 0 ? "#" : `#/${path.map(encodePointerSegment).join("/")}`;
 }
 
 // src/validation/model-router.ts