@web-ts-toolkit/access-router 0.43.0 → 0.44.0

package/advanced.mjs

@@ -486,6 +486,29 @@ var cloneConfigValue = (value) => {
     ])
   );
 };
+var cloneForRead = (value) => {
+  if (Array.isArray(value)) {
+    if (Object.isFrozen(value)) {
+      return value;
+    }
+    return value.map((item) => cloneForRead(item));
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Object.getPrototypeOf(value) !== Object.prototype) {
+    return value;
+  }
+  if (Object.isFrozen(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([entryKey, entryValue]) => [
+      entryKey,
+      cloneForRead(entryValue)
+    ])
+  );
+};
 var freezeConfigValue = (value) => {
   if (!value || typeof value !== "object") {
     return value;
@@ -501,6 +524,7 @@ var freezeConfigValue = (value) => {
   }
   return value;
 };
+var cloneAndFreezeForStore = (value) => freezeConfigValue(cloneForRead(value));
 var getNestedOption = (manager, key, defaultValue) => {
   const keys2 = String(key).split(".");
   if (keys2.length === 1) {
@@ -530,6 +554,14 @@ var OptionsManager = class {
         target[keystr] = value;
         _this.listeners[keystr] && _this.listeners[keystr].call(_this, value, keystr, target, oldvalue);
         return true;
+      },
+      defineProperty(target, key, descriptor) {
+        const keystr = String(key);
+        const oldvalue = target[keystr];
+        const result = Reflect.defineProperty(target, key, descriptor);
+        const newValue = target[keystr];
+        _this.listeners[keystr] && _this.listeners[keystr].call(_this, newValue, keystr, target, oldvalue);
+        return result;
       }
     });
   }
@@ -543,18 +575,18 @@ var OptionsManager = class {
   set(key, value) {
     const path = toPath(key);
     if (path.length <= 1) {
-      set(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneConfigValue(value));
+      set(this.currentOptions, path, this.preserveKeys.has(String(path[0])) ? value : cloneAndFreezeForStore(value));
       return;
     }
     const [rootKey, ...nestedPath] = path;
     const currentRoot = get(this.currentOptions, [rootKey], void 0);
     const baseRoot = isPlainObject7(currentRoot) ? currentRoot : {};
     const nextRoot = cloneConfigValue(baseRoot);
-    set(nextRoot, nestedPath, cloneConfigValue(value));
-    set(this.currentOptions, [rootKey], nextRoot);
+    set(nextRoot, nestedPath, cloneForRead(value));
+    set(this.currentOptions, [rootKey], freezeConfigValue(nextRoot));
   }
   fetch() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -563,20 +595,20 @@ var OptionsManager = class {
     return freezeConfigValue(cloned);
   }
   assign(options) {
-    const cloned = cloneConfigValue(options);
+    const cloned = cloneForRead(options);
     for (const key of this.preserveKeys) {
       if (key in options) {
         cloned[key] = options[key];
       }
     }
-    assign(this.currentOptions, cloned);
+    assign(this.currentOptions, freezeConfigValue(cloned));
   }
   onchange(key, func) {
     set(this.listeners, key, func);
     return this;
   }
   snapshot() {
-    const cloned = cloneConfigValue(this.currentOptions);
+    const cloned = cloneForRead(this.currentOptions);
     for (const key of this.preserveKeys) {
       if (key in this.currentOptions) {
         cloned[key] = this.currentOptions[key];
@@ -592,13 +624,13 @@ var OptionsManager = class {
         delete current[key];
       }
     }
-    const cloned = cloneConfigValue(snap);
+    const cloned = cloneForRead(snap);
     for (const key of this.preserveKeys) {
       if (key in snap) {
         cloned[key] = snap[key];
       }
     }
-    assign(current, cloned);
+    assign(current, freezeConfigValue(cloned));
   }
 };
 
@@ -1068,8 +1100,7 @@ var AccessRuntime = class {
   }
   setDataOptions(dataName, options) {
     const manager = this.getOrCreateDataOptions(dataName);
-    const currentDataOptions = manager.fetch();
-    manager.assign({ ...currentDataOptions, ...options });
+    manager.assign(options);
   }
   setDataOption(dataName, key, value) {
     const manager = this.getOrCreateDataOptions(dataName);
@@ -1079,6 +1110,11 @@ var AccessRuntime = class {
     const manager = this.getOrCreateDataOptions(dataName);
     return manager.fetch();
   }
+  getDataSnapshot(dataName) {
+    const manager = this.getOrCreateDataOptions(dataName);
+    const snapshot = manager.get("data");
+    return snapshot ?? [];
+  }
   getDataOption(dataName, key, defaultValue) {
     const manager = this.getOrCreateDataOptions(dataName);
     return getNestedOption(manager, key, defaultValue);
@@ -1324,8 +1360,9 @@ function defineRequestSchema(validator, options = {}) {
   };
 }
 function fromZod(schema) {
-  return (value) => {
-    const result = schema.safeParse(value);
+  return async (value) => {
+    const candidate = schema;
+    const result = typeof candidate.safeParseAsync === "function" ? await candidate.safeParseAsync.call(schema, value) : schema.safeParse(value);
     if (result.success) {
       return {
         success: true,
@@ -1362,6 +1399,9 @@ function fromYup(schema) {
         data
       };
     } catch (error) {
+      if (!isYupValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeYupIssues(error)
@@ -1386,8 +1426,32 @@ function fromJoi(schema) {
 }
 function fromAjv(validator) {
   return async (value) => {
-    const valid = await validator(value);
-    if (valid) {
+    const outcome = validator(value);
+    if (isThenable(outcome)) {
+      try {
+        const data = await outcome;
+        if (data === false) {
+          return {
+            success: false,
+            issues: normalizeAjvIssues(validator.errors ?? [])
+          };
+        }
+        return {
+          success: true,
+          data: data === true ? value : data
+        };
+      } catch (error) {
+        if (!isAjvValidationError(error)) {
+          throw error;
+        }
+        return {
+          success: false,
+          issues: normalizeAjvIssues(error.errors ?? [])
+        };
+      }
+    }
+    const errorsSnapshot = validator.errors ? [...validator.errors] : [];
+    if (outcome) {
       return {
         success: true,
         data: value
@@ -1395,7 +1459,7 @@ function fromAjv(validator) {
     }
     return {
       success: false,
-      issues: normalizeAjvIssues(validator.errors ?? [])
+      issues: normalizeAjvIssues(errorsSnapshot)
     };
   };
 }
@@ -1416,6 +1480,25 @@ function fromValibot(schema, safeParse) {
 }
 function fromArkType(type) {
   return async (value) => {
+    if (isStandardSchema(type)) {
+      const result2 = await type["~standard"].validate(value);
+      if (isArkTypeErrors(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeIssues(result2)
+        };
+      }
+      if (isStandardSchemaFailure(result2)) {
+        return {
+          success: false,
+          issues: normalizeArkTypeStandardIssues(result2.issues)
+        };
+      }
+      return {
+        success: true,
+        data: result2.value
+      };
+    }
     const result = await type(value);
     if (!isArkTypeErrors(result)) {
       return {
@@ -1468,6 +1551,9 @@ function fromVine(validator) {
         data: output
       };
     } catch (error) {
+      if (!isVineValidationError(error)) {
+        throw error;
+      }
       return {
         success: false,
         issues: normalizeVineError(error)
@@ -1528,6 +1614,13 @@ function normalizeArkTypeIssues(issues) {
   }));
   return normalized.length ? normalized : [{ message: issues.summary ?? "Validation failed" }];
 }
+function normalizeArkTypeStandardIssues(issues) {
+  const normalized = issues.map((issue) => ({
+    message: issue.message ?? issue.problem ?? "Validation failed",
+    path: issue.path?.flatMap((segment) => normalizePathSegment(segment))
+  }));
+  return normalized.length ? normalized : [{ message: "Validation failed" }];
+}
 function normalizeIoTsIssues(issues) {
   return issues.map((issue) => ({
     message: issue.message ?? "Validation failed",
@@ -1562,25 +1655,64 @@ function normalizeVineField(message) {
   }
   return path.length ? path : void 0;
 }
+function decodeAjvSegment(segment) {
+  return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function encodePointerSegment(segment) {
+  return encodeURIComponent(segment.replace(/~/g, "~0").replace(/\//g, "~1"));
+}
 function parseAjvPath(issue) {
-  const path = issue.instancePath?.split("/").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
-  if (issue.params?.missingProperty) {
-    return (path ?? []).concat(issue.params.missingProperty);
+  const raw = issue.instancePath;
+  const base = raw == null || raw === "" ? [] : (raw.startsWith("/") ? raw.slice(1) : raw).split("/").map(decodeAjvSegment);
+  const missing = issue.params?.missingProperty;
+  if (typeof missing === "string") {
+    return [...base, missing];
   }
-  return path;
+  return base;
 }
 function parsePathString(path) {
   if (!path) return void 0;
   return path.replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean).map((segment) => /^\d+$/.test(segment) ? Number(segment) : segment);
 }
 function isYupValidationError(error) {
-  return typeof error === "object" && error !== null && "message" in error;
+  if (typeof error !== "object" || error === null || !("message" in error)) {
+    return false;
+  }
+  const candidate = error;
+  return candidate.name === "ValidationError" && typeof candidate.message === "string" && Array.isArray(candidate.errors) && Array.isArray(candidate.inner);
 }
 function isArkTypeErrors(value) {
-  return Array.isArray(value);
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  return record.arkKind === "errors" || record[" arkKind"] === "errors";
+}
+function isThenable(value) {
+  return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function isAjvValidationError(error) {
+  if (typeof error !== "object" || error === null || !("errors" in error)) {
+    return false;
+  }
+  const errors = error.errors;
+  return errors == null || Array.isArray(errors);
 }
 function isVineValidationError(error) {
-  return typeof error === "object" && error !== null && "messages" in error && Array.isArray(error.messages);
+  if (typeof error !== "object" || error === null || !("messages" in error)) {
+    return false;
+  }
+  const candidate = error;
+  if (!Array.isArray(candidate.messages) || candidate.messages.length === 0) {
+    return false;
+  }
+  const hasDiscriminator = candidate.code === "E_VALIDATION_ERROR" || candidate.name === "ValidationError";
+  if (!hasDiscriminator) {
+    return false;
+  }
+  return candidate.messages.every(
+    (message) => typeof message === "object" && message !== null && typeof message.message === "string" && typeof message.field === "string"
+  );
 }
 function formatIssue(issue, key, location = "pointer") {
   const path = (issue.path ?? []).map(String);
@@ -1597,7 +1729,7 @@ function formatIssue(issue, key, location = "pointer") {
   };
 }
 function buildPointer(path) {
-  return path.length === 0 ? "#" : `#/${path.join("/")}`;
+  return path.length === 0 ? "#" : `#/${path.map(encodePointerSegment).join("/")}`;
 }
 
 // src/validation/model-router.ts

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { a8 as GlobalOptions, R as DefaultModelRouterOptions, az as ModelRouterOptions, N as DataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, Y as ExtendedDataRouterOptions, A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, L as DataRequest, cG as DataService, $ as Filter, aI as Projection, bD as Sort, aF as Populate, cH as Service, cI as PublicService, cj as Validation, bu as RootRouterOptions } from './parsers-PMWujHUV.mjs';
-export { cJ as AccessRouterPermissionMap, cK as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cL as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bx as RouteGuardAccess, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers-PMWujHUV.mjs';
+import { a9 as GlobalOptions, S as DefaultModelRouterOptions, aA as ModelRouterOptions, O as DataRouterOptions, _ as ExtendedDefaultModelRouterOptions, $ as ExtendedModelRouterOptions, Z as ExtendedDataRouterOptions, A as AccessRouterBaseRequest, ab as GuardHook, az as ModelRequest, M as DataRequest, cH as DataService, a0 as Filter, aJ as Projection, bE as Sort, aG as Populate, cI as Service, cJ as PublicService, ck as Validation, bv as RootRouterOptions } from './parsers-B5dbVmjm.mjs';
+export { cK as AccessRouterPermissionMap, cL as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, aa as GlobalPermissionValue, ae as IoTsContextEntryLike, af as IoTsDecodeErrorLike, ag as IoTsDecoderLike, ah as JoiSchemaLike, ai as JoiValidationErrorDetailLike, an as MaybePromise, ao as ModelBaseFilterHook, aq as ModelDeleteHook, ar as ModelDocPermissionsHook, at as ModelDocumentHook, au as ModelHook, aw as ModelIdentifierHook, ax as ModelListHook, ay as ModelOverrideFilterHook, aB as ModelValidateHook, cM as Permissions, a$ as RequestSchemaAdapter, b0 as RequestSchemaFailure, b1 as RequestSchemaIssue, b2 as RequestSchemaLike, b3 as RequestSchemaOptions, b4 as RequestSchemaResult, b5 as RequestSchemaSuccess, b6 as RequestSchemaValidator, by as RouteGuardAccess, bG as StandardSchemaFailure, bH as StandardSchemaInferOutput, bI as StandardSchemaIssue, bJ as StandardSchemaPathSegment, bK as StandardSchemaResult, bL as StandardSchemaSuccess, bM as StandardSchemaV1, c1 as SuperstructFailureLike, c2 as SuperstructValidateLike, ce as ValibotIssueLike, cf as ValibotPathItemLike, cg as ValibotSafeParseLike, ch as ValibotSafeParseResult, cm as VineValidationErrorLike, cn as VineValidationMessageLike, co as VineValidatorLike, cp as YupSchemaLike, cq as YupValidationErrorLike, cr as defineRequestSchema, cs as fromAjv, ct as fromArkType, cu as fromIoTs, cv as fromJoi, cw as fromStandardSchema, cx as fromSuperstruct, cy as fromValibot, cz as fromVine, cA as fromYup, cB as fromZod } from './parsers-B5dbVmjm.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -103,9 +103,9 @@ declare class AccessRuntime {
     private readonly modelAtts;
     private readonly modelInstances;
     private readonly openApiRegistry;
-    registerModelInstance(modelName: string, model: mongoose.Model<unknown>): void;
+    registerModelInstance<TModel>(modelName: string, model: mongoose.Model<TModel>): void;
     hasModelInstance(modelName: string): boolean;
-    getModelInstance(modelName: string): mongoose.Model<unknown> | null;
+    getModelInstance<TModel = unknown>(modelName: string): mongoose.Model<TModel> | null;
     registerOpenApiRoute(route: OpenApiRouteDescriptor): void;
     /**
      * Enable strict OpenAPI collision detection for the remainder of this
@@ -177,6 +177,7 @@ declare class AccessRuntime {
     setDataOptions<TData = unknown>(dataName: string, options: DataRouterOptions<TData>): void;
     setDataOption<K extends keyof DataRouterOptions<TData>, TData = unknown>(dataName: string, key: K, value: DataRouterOptions<TData>[K]): void;
     getDataOptions<TData = unknown>(dataName: string): DataRouterOptions<TData>;
+    getDataSnapshot<TData = unknown>(dataName: string): readonly TData[];
     getDataOption<K extends keyof DataRouterOptions<TData>, TData = unknown>(dataName: string, key: K | string, defaultValue?: DataRouterOptions<TData>[K]): DataRouterOptions<TData>[K];
     getExactDataOption<K extends keyof ExtendedDataRouterOptions<TData>, TData = unknown>(dataName: string, key: K | string): ExtendedDataRouterOptions<TData>[K];
     getDataNames(): string[];
@@ -228,6 +229,11 @@ declare class DataRouter<TData = unknown> {
     permissionSchema: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['permissionSchema']>;
     operationAccess: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['operationAccess']>;
     baseFilter: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['baseFilter']>;
+    /**
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
+     */
     overrideFilter: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['overrideFilter']>;
     decorate: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['decorate']>;
     decorateAll: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['decorateAll']>;
@@ -281,7 +287,7 @@ declare class ModelRouter<TModel = unknown> {
     readonly options: ModelRouterOptions<TModel>;
     readonly fullBasePath: string;
     constructor(modelName: string, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime);
-    static fromModel<TModel = unknown>(model: mongoose.Model<unknown>, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime): ModelRouter<TModel>;
+    static fromModel<TModel>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime): ModelRouter<TModel>;
     private getRequestSchema;
     getService(req: ModelRequest): Service<TModel>;
     getPublicService(req: ModelRequest): PublicService<TModel>;
@@ -326,7 +332,9 @@ declare class ModelRouter<TModel = unknown> {
      */
     baseFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['baseFilter']>;
     /**
-     * The override filter definitions applied in every query transaction.
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
      * @operation `list`, `read`, `update`, `delete`
      */
     overrideFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['overrideFilter']>;
@@ -517,9 +525,9 @@ declare const getModelOptions: <TModel = unknown>(modelName: string) => ModelRou
 declare const getModelOption: <K extends keyof ExtendedModelRouterOptions<TModel>, TModel = unknown>(modelName: string, key: K | string, defaultValue?: ExtendedModelRouterOptions<TModel>[K]) => ExtendedModelRouterOptions<TModel>[K];
 declare const getModelNames: () => string[];
 declare const getModelJsonSchema: (modelName: string) => Record<string, unknown>;
-declare const registerModelInstance: (modelName: string, model: mongoose.Model<unknown>) => void;
+declare const registerModelInstance: <TModel>(modelName: string, model: mongoose.Model<TModel>) => void;
 declare const hasModelInstance: (modelName: string) => boolean;
-declare const getModelInstance: (modelName: string) => mongoose.Model<unknown> | null;
+declare const getModelInstance: <TModel = unknown>(modelName: string) => mongoose.Model<TModel> | null;
 
 declare const setDefaultModelOptions: (options: DefaultModelRouterOptions) => void;
 declare const setDefaultModelOption: <K extends keyof ExtendedDefaultModelRouterOptions>(key: K, value: ExtendedDefaultModelRouterOptions[K]) => void;
@@ -590,9 +598,9 @@ interface Wtt {
     setDefaultModelOption: typeof setDefaultModelOption;
     getDefaultModelOptions: typeof getDefaultModelOptions;
     getDefaultModelOption: typeof getDefaultModelOption;
-    registerModelInstance: (modelName: string, model: mongoose.Model<unknown>) => void;
+    registerModelInstance: <TModel>(modelName: string, model: mongoose.Model<TModel>) => void;
     hasModelInstance: (modelName: string) => boolean;
-    getModelInstance: (modelName: string) => mongoose.Model<unknown> | null;
+    getModelInstance: <TModel = unknown>(modelName: string) => mongoose.Model<TModel> | null;
     RootRouter: typeof RootRouter;
     ModelRouter: typeof ModelRouter;
     DataRouter: typeof DataRouter;

package/index.d.ts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { a8 as GlobalOptions, R as DefaultModelRouterOptions, az as ModelRouterOptions, N as DataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, Y as ExtendedDataRouterOptions, A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, L as DataRequest, cG as DataService, $ as Filter, aI as Projection, bD as Sort, aF as Populate, cH as Service, cI as PublicService, cj as Validation, bu as RootRouterOptions } from './parsers-PMWujHUV.js';
-export { cJ as AccessRouterPermissionMap, cK as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cL as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bx as RouteGuardAccess, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers-PMWujHUV.js';
+import { a9 as GlobalOptions, S as DefaultModelRouterOptions, aA as ModelRouterOptions, O as DataRouterOptions, _ as ExtendedDefaultModelRouterOptions, $ as ExtendedModelRouterOptions, Z as ExtendedDataRouterOptions, A as AccessRouterBaseRequest, ab as GuardHook, az as ModelRequest, M as DataRequest, cH as DataService, a0 as Filter, aJ as Projection, bE as Sort, aG as Populate, cI as Service, cJ as PublicService, ck as Validation, bv as RootRouterOptions } from './parsers-B5dbVmjm.js';
+export { cK as AccessRouterPermissionMap, cL as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, n as AjvValidatorLike, o as ArkTypeErrorsLike, p as ArkTypeLike, aa as GlobalPermissionValue, ae as IoTsContextEntryLike, af as IoTsDecodeErrorLike, ag as IoTsDecoderLike, ah as JoiSchemaLike, ai as JoiValidationErrorDetailLike, an as MaybePromise, ao as ModelBaseFilterHook, aq as ModelDeleteHook, ar as ModelDocPermissionsHook, at as ModelDocumentHook, au as ModelHook, aw as ModelIdentifierHook, ax as ModelListHook, ay as ModelOverrideFilterHook, aB as ModelValidateHook, cM as Permissions, a$ as RequestSchemaAdapter, b0 as RequestSchemaFailure, b1 as RequestSchemaIssue, b2 as RequestSchemaLike, b3 as RequestSchemaOptions, b4 as RequestSchemaResult, b5 as RequestSchemaSuccess, b6 as RequestSchemaValidator, by as RouteGuardAccess, bG as StandardSchemaFailure, bH as StandardSchemaInferOutput, bI as StandardSchemaIssue, bJ as StandardSchemaPathSegment, bK as StandardSchemaResult, bL as StandardSchemaSuccess, bM as StandardSchemaV1, c1 as SuperstructFailureLike, c2 as SuperstructValidateLike, ce as ValibotIssueLike, cf as ValibotPathItemLike, cg as ValibotSafeParseLike, ch as ValibotSafeParseResult, cm as VineValidationErrorLike, cn as VineValidationMessageLike, co as VineValidatorLike, cp as YupSchemaLike, cq as YupValidationErrorLike, cr as defineRequestSchema, cs as fromAjv, ct as fromArkType, cu as fromIoTs, cv as fromJoi, cw as fromStandardSchema, cx as fromSuperstruct, cy as fromValibot, cz as fromVine, cA as fromYup, cB as fromZod } from './parsers-B5dbVmjm.js';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 
@@ -103,9 +103,9 @@ declare class AccessRuntime {
     private readonly modelAtts;
     private readonly modelInstances;
     private readonly openApiRegistry;
-    registerModelInstance(modelName: string, model: mongoose.Model<unknown>): void;
+    registerModelInstance<TModel>(modelName: string, model: mongoose.Model<TModel>): void;
     hasModelInstance(modelName: string): boolean;
-    getModelInstance(modelName: string): mongoose.Model<unknown> | null;
+    getModelInstance<TModel = unknown>(modelName: string): mongoose.Model<TModel> | null;
     registerOpenApiRoute(route: OpenApiRouteDescriptor): void;
     /**
      * Enable strict OpenAPI collision detection for the remainder of this
@@ -177,6 +177,7 @@ declare class AccessRuntime {
     setDataOptions<TData = unknown>(dataName: string, options: DataRouterOptions<TData>): void;
     setDataOption<K extends keyof DataRouterOptions<TData>, TData = unknown>(dataName: string, key: K, value: DataRouterOptions<TData>[K]): void;
     getDataOptions<TData = unknown>(dataName: string): DataRouterOptions<TData>;
+    getDataSnapshot<TData = unknown>(dataName: string): readonly TData[];
     getDataOption<K extends keyof DataRouterOptions<TData>, TData = unknown>(dataName: string, key: K | string, defaultValue?: DataRouterOptions<TData>[K]): DataRouterOptions<TData>[K];
     getExactDataOption<K extends keyof ExtendedDataRouterOptions<TData>, TData = unknown>(dataName: string, key: K | string): ExtendedDataRouterOptions<TData>[K];
     getDataNames(): string[];
@@ -228,6 +229,11 @@ declare class DataRouter<TData = unknown> {
     permissionSchema: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['permissionSchema']>;
     operationAccess: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['operationAccess']>;
     baseFilter: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['baseFilter']>;
+    /**
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
+     */
     overrideFilter: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['overrideFilter']>;
     decorate: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['decorate']>;
     decorateAll: SetTargetOption$1<DataRouter<TData>, DataRouterOptions<TData>['decorateAll']>;
@@ -281,7 +287,7 @@ declare class ModelRouter<TModel = unknown> {
     readonly options: ModelRouterOptions<TModel>;
     readonly fullBasePath: string;
     constructor(modelName: string, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime);
-    static fromModel<TModel = unknown>(model: mongoose.Model<unknown>, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime): ModelRouter<TModel>;
+    static fromModel<TModel>(model: mongoose.Model<TModel>, initialOptions: ModelRouterOptions<TModel>, runtime?: AccessRuntime): ModelRouter<TModel>;
     private getRequestSchema;
     getService(req: ModelRequest): Service<TModel>;
     getPublicService(req: ModelRequest): PublicService<TModel>;
@@ -326,7 +332,9 @@ declare class ModelRouter<TModel = unknown> {
      */
     baseFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['baseFilter']>;
     /**
-     * The override filter definitions applied in every query transaction.
+     * Trusted filter replacements applied before base-filter composition.
+     * They may replace ordinary filters, but cannot replace an existing `false` denial.
+     * Returning `false` denies the transaction.
      * @operation `list`, `read`, `update`, `delete`
      */
     overrideFilter: SetTargetOption<ModelRouter<TModel>, ModelRouterOptions<TModel>['overrideFilter']>;
@@ -517,9 +525,9 @@ declare const getModelOptions: <TModel = unknown>(modelName: string) => ModelRou
 declare const getModelOption: <K extends keyof ExtendedModelRouterOptions<TModel>, TModel = unknown>(modelName: string, key: K | string, defaultValue?: ExtendedModelRouterOptions<TModel>[K]) => ExtendedModelRouterOptions<TModel>[K];
 declare const getModelNames: () => string[];
 declare const getModelJsonSchema: (modelName: string) => Record<string, unknown>;
-declare const registerModelInstance: (modelName: string, model: mongoose.Model<unknown>) => void;
+declare const registerModelInstance: <TModel>(modelName: string, model: mongoose.Model<TModel>) => void;
 declare const hasModelInstance: (modelName: string) => boolean;
-declare const getModelInstance: (modelName: string) => mongoose.Model<unknown> | null;
+declare const getModelInstance: <TModel = unknown>(modelName: string) => mongoose.Model<TModel> | null;
 
 declare const setDefaultModelOptions: (options: DefaultModelRouterOptions) => void;
 declare const setDefaultModelOption: <K extends keyof ExtendedDefaultModelRouterOptions>(key: K, value: ExtendedDefaultModelRouterOptions[K]) => void;
@@ -590,9 +598,9 @@ interface Wtt {
     setDefaultModelOption: typeof setDefaultModelOption;
     getDefaultModelOptions: typeof getDefaultModelOptions;
     getDefaultModelOption: typeof getDefaultModelOption;
-    registerModelInstance: (modelName: string, model: mongoose.Model<unknown>) => void;
+    registerModelInstance: <TModel>(modelName: string, model: mongoose.Model<TModel>) => void;
     hasModelInstance: (modelName: string) => boolean;
-    getModelInstance: (modelName: string) => mongoose.Model<unknown> | null;
+    getModelInstance: <TModel = unknown>(modelName: string) => mongoose.Model<TModel> | null;
     RootRouter: typeof RootRouter;
     ModelRouter: typeof ModelRouter;
     DataRouter: typeof DataRouter;