@classytic/arc 2.10.8 → 2.11.1

package/dist/{permissions-wkqRwicB.mjs → permissions-B4vU9L0Q.mjs}

@@ -1,8 +1,226 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import { _ as isElevated, b as isService, c as getRequestScope, d as getServiceScopes, f as getTeamId, h as hasOrgAccess, l as getScopeContext, p as getUserId, u as getScopeContextMap, v as isMember, y as isOrgInScope } from "./types-AOD8fxIw.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { t as MemoryCacheStore } from "./memory-DqI-449b.mjs";
+import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
+import { t as MemoryCacheStore } from "./memory-DikHSvWa.mjs";
 import { randomUUID } from "node:crypto";
+//#region src/permissions/fields.ts
+/**
+* Field-Level Permissions
+*
+* Control field visibility and writability per role.
+* Integrated into the response path (read) and sanitization path (write).
+*
+* @example
+* ```typescript
+* import { fields, defineResource } from '@classytic/arc';
+*
+* const userResource = defineResource({
+*   name: 'user',
+*   adapter: userAdapter,
+*   fields: {
+*     salary: fields.visibleTo(['admin', 'hr']),
+*     internalNotes: fields.writableBy(['admin']),
+*     email: fields.redactFor(['viewer']),
+*     password: fields.hidden(),
+*   },
+* });
+* ```
+*/
+/** Type guard for Mongoose-like documents with toObject() */
+function isMongooseDoc(obj) {
+	return !!obj && typeof obj === "object" && "toObject" in obj && typeof obj.toObject === "function";
+}
+const fields = {
+	hidden() {
+		return { _type: "hidden" };
+	},
+	visibleTo(roles) {
+		return {
+			_type: "visibleTo",
+			roles
+		};
+	},
+	writableBy(roles) {
+		return {
+			_type: "writableBy",
+			roles
+		};
+	},
+	redactFor(roles, redactValue = "***") {
+		return {
+			_type: "redactFor",
+			roles,
+			redactValue
+		};
+	}
+};
+/**
+* Apply field-level READ permissions to a response object.
+* Strips hidden fields, enforces visibility, and applies redaction.
+*
+* @param data - The response object (mutated in place for performance)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles (empty array for unauthenticated)
+* @returns The filtered object
+*/
+function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
+	if (!data || typeof data !== "object") return data;
+	const result = { ...isMongooseDoc(data) ? data.toObject() : data };
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			delete result[field];
+			break;
+		case "visibleTo":
+			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
+			break;
+		case "redactFor":
+			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
+			break;
+		case "writableBy": break;
+	}
+	return result;
+}
+/**
+* Apply field-level WRITE permissions to request body.
+*
+* Returns both the filtered body and the list of denied fields. Callers are
+* expected to reject the request when `deniedFields.length > 0` — silently
+* stripping fields hides misconfigurations and real attacks. See
+* `BodySanitizer` for the default policy.
+*
+* @param body - The request body (returns a new filtered copy)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles
+*/
+function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
+	const result = { ...body };
+	const deniedFields = [];
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			if (field in result) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+		case "writableBy":
+			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+	}
+	return {
+		body: result,
+		deniedFields
+	};
+}
+/**
+* Resolve effective roles by merging global user roles with org-level roles.
+*
+* Global roles come from `req.user.role` (normalized via getUserRoles()).
+* Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
+*
+* When no org context exists, returns global roles only — backward compatible.
+*/
+function resolveEffectiveRoles(userRoles, orgRoles) {
+	if (orgRoles.length === 0) return [...userRoles];
+	if (userRoles.length === 0) return [...orgRoles];
+	return [...new Set([...userRoles, ...orgRoles])];
+}
+//#endregion
+//#region src/permissions/applyPermissionResult.ts
+/**
+* Normalize a permission check return value (`boolean | PermissionResult`)
+* into a concrete `PermissionResult`. This is the only place in Arc that
+* promotes booleans to results — keeps the type narrowing honest everywhere.
+*/
+function normalizePermissionResult(result) {
+	if (typeof result === "boolean") return { granted: result };
+	return result;
+}
+/**
+* Apply a granted `PermissionResult` to a Fastify request — merges row-level
+* filters into `_policyFilters` and conditionally installs the scope.
+*
+* **Scope install rule:** only writes `scope` when the current request scope
+* is absent or `public`. This prevents downgrading an already-authenticated
+* request (e.g. Better Auth set `member`, then a permission check returns a
+* narrower `service` scope — the original `member` wins because it came from
+* a more authoritative source).
+*
+* Safe to call with a non-granted result — it simply no-ops. Callers should
+* still check `result.granted` and send an error response before reaching here,
+* but this function tolerates the misuse defensively.
+*/
+function applyPermissionResult(result, request) {
+	if (!result.granted) return;
+	if (result.filters) request._policyFilters = {
+		...request._policyFilters ?? {},
+		...result.filters
+	};
+	if (result.scope) {
+		const current = request.scope;
+		if (!current || current.kind === "public") request.scope = result.scope;
+	}
+}
+/**
+* Max length of a `PermissionResult.reason` string before we fall back to the
+* generic default message. Upstream checks can return arbitrary strings; we
+* clamp to prevent accidental leakage of internal diagnostics or oversized
+* payloads via the 4xx response body.
+*/
+const MAX_DENIAL_REASON_LENGTH = 100;
+/**
+* End-to-end evaluator: runs the permission check, catches throws, normalizes
+* the result, sends a 401/403 response on denial, and applies side-effects on
+* grant. Returns `true` if the caller should continue, `false` if a response
+* has been sent and the caller should return.
+*
+* This is the single source of truth for the 5-step sequence shared by the
+* CRUD router, action router, and MCP tool handlers:
+*
+*   1. `try { await check(ctx) } catch { reply 403 }`
+*   2. `normalizePermissionResult(result)`
+*   3. If denied → 401 (no user) or 403 (user) with clamped reason
+*   4. If granted → `applyPermissionResult` (filters + scope)
+*   5. Return true/false so the caller knows whether to keep going
+*
+* Context construction, pre-check auth gating, and success-path handler
+* invocation stay at the callsite — those are genuinely different per router
+* and don't belong here.
+*
+* @returns `true` if authorized (caller continues), `false` if a response was sent
+*/
+async function evaluateAndApplyPermission(check, context, request, reply, opts) {
+	let result;
+	try {
+		result = await check(context);
+	} catch (err) {
+		request.log?.warn?.({
+			err,
+			resource: context.resource,
+			action: context.action
+		}, "Permission check threw");
+		reply.code(403).send({
+			success: false,
+			error: "Permission denied"
+		});
+		return false;
+	}
+	const permResult = normalizePermissionResult(result);
+	if (!permResult.granted) {
+		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
+		const reason = permResult.reason && permResult.reason.length <= MAX_DENIAL_REASON_LENGTH ? permResult.reason : defaultMsg;
+		reply.code(context.user ? 403 : 401).send({
+			success: false,
+			error: reason
+		});
+		return false;
+	}
+	applyPermissionResult(permResult, request);
+	return true;
+}
+//#endregion
 //#region src/permissions/core.ts
 /**
 * Normalize a `string | [readonly string[]]` rest-args tuple into a single
@@ -1002,4 +1220,4 @@ function readOnly(overrides) {
 	}, overrides);
 }
 //#endregion
-export { requireAuth as C, when as D, roles as E, not as S, requireRoles as T, requireTeamMembership as _, presets_exports as a, anyOf as b, readOnly as c, createOrgPermissions as d, requireOrgInScope as f, requireServiceScope as g, requireScopeContext as h, ownerWithAdminBypass as i, createRoleHierarchy as l, requireOrgRole as m, authenticated as n, publicRead as o, requireOrgMembership as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, createDynamicPermissionMatrix as u, allOf as v, requireOwnership as w, denyAll as x, allowPublic as y };
+export { normalizePermissionResult as A, requireAuth as C, when as D, roles as E, applyFieldWritePermissions as M, fields as N, applyPermissionResult as O, resolveEffectiveRoles as P, not as S, requireRoles as T, requireTeamMembership as _, presets_exports as a, anyOf as b, readOnly as c, createOrgPermissions as d, requireOrgInScope as f, requireServiceScope as g, requireScopeContext as h, ownerWithAdminBypass as i, applyFieldReadPermissions as j, evaluateAndApplyPermission as k, createRoleHierarchy as l, requireOrgRole as m, authenticated as n, publicRead as o, requireOrgMembership as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, createDynamicPermissionMatrix as u, allOf as v, requireOwnership as w, denyAll as x, allowPublic as y };

package/dist/{pipe-CGJxqDGx.mjs → pipe-DVoIheVC.mjs}

@@ -1,4 +1,4 @@
-import { r as ForbiddenError } from "./errors-BqdUDja_.mjs";
+import { r as ForbiddenError } from "./errors-D5c-5BJL.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Bt as PipelineContext, Ft as Guard, Ht as Transform, It as Interceptor, Lt as NextFunction, Mt as IControllerResponse, Rt as OperationFilter, Vt as PipelineStep, zt as PipelineConfig } from "../index-BGbpGVyM.mjs";
+import { Ct as OperationFilter, Dt as Transform, Et as PipelineStep, St as NextFunction, Tt as PipelineContext, _t as IControllerResponse, bt as Guard, wt as PipelineConfig, xt as Interceptor } from "../index-C_bgx9o4.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/pipeline/index.mjs

@@ -1,4 +1,4 @@
-import { n as pipe, t as executePipeline } from "../pipe-CGJxqDGx.mjs";
+import { n as pipe, t as executePipeline } from "../pipe-DVoIheVC.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,8 +1,8 @@
-import { Dt as RouteSchemaOptions, J as HookSystem, Yt as AnyRecord, gt as PresetHook, pt as MiddlewareConfig, wt as RouteDefinition, z as ResourceRegistry } from "../index-BGbpGVyM.mjs";
+import { Pt as AnyRecord, Q as MiddlewareConfig, ft as RouteSchemaOptions, gn as HookSystem, lt as RouteDefinition, tt as PresetHook, z as ResourceRegistry } from "../index-C_bgx9o4.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-Bapitwvd.mjs";
-import { a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6 } from "../versioning-CeUXHfjw.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-2ii4RIYr.mjs";
-import { t as TracingOptions } from "../tracing-xqXzWeaf.mjs";
+import { a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6 } from "../versioning-M9lNLhO8.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-Co3lnVmJ.mjs";
+import { t as TracingOptions } from "../tracing-DokiEsuz.mjs";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 

package/dist/plugins/index.mjs

@@ -1,15 +1,15 @@
 import { p as MUTATION_OPERATIONS } from "../constants-BhY1OHoH.mjs";
 import { o as getOrgId } from "../types-AOD8fxIw.mjs";
-import { t as requestContext } from "../requestContext-C38GskNt.mjs";
-import { t as hasEvents } from "../typeGuards-Cj5Rgvlg.mjs";
-import { t as HookSystem } from "../HookSystem-BjFu7zf1.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CcN2LVrc.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-3h93rkJM.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-CSxe7KIM.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-TuOmguhi.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-BLojtuvR.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-D8UeDwis.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-B6mimogM.mjs";
+import { t as requestContext } from "../requestContext-CfRkaxwf.mjs";
+import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
+import { t as HookSystem } from "../HookSystem-CGsMd6oK.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-DkAeAuTX.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-CheW3m-S.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BQm8ZxTK.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-Csh4nsvv.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-ByllIXXV.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-V7aXc3bW.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CGPjkqAg.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.mjs

@@ -1,4 +1,4 @@
-import { t as hasEvents } from "../typeGuards-Cj5Rgvlg.mjs";
+import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-xqXzWeaf.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-DokiEsuz.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -14,6 +14,20 @@ import fp from "fastify-plugin";
 *   serviceName: 'my-api',
 *   exporterUrl: 'http://localhost:4318/v1/traces', // OTLP endpoint
 * });
+*
+* ## Type strategy
+*
+* `@opentelemetry/api` is the stable surface — its types are type-only
+* imported here so hook handlers, `createSpan`, and `traced` don't hand
+* out `any` for Tracer / Span. Only the runtime-loaded module BODIES
+* (`trace.getTracer`, `context.with`, etc.) go through the optional-require
+* path; everything downstream keeps its shape through the plugin.
+*
+* The SDK-side factories (`NodeTracerProvider`, `BatchSpanProcessor`,
+* `OTLPTraceExporter`) aren't in @classytic/arc's devDeps and aren't
+* type-importable without adding install weight, so those retain
+* minimal constructor-style `unknown`-valued boxes. If a future refactor
+* moves SDK types into devDependencies we can tighten further.
 */
 const require = createRequire(import.meta.url);
 let trace;
@@ -33,8 +47,8 @@ try {
 	NodeTracerProvider = sdkNode.NodeTracerProvider;
 	BatchSpanProcessor = sdkNode.BatchSpanProcessor;
 	OTLPTraceExporter = require("@opentelemetry/exporter-trace-otlp-http").OTLPTraceExporter;
-	require("@opentelemetry/instrumentation-http").HttpInstrumentation;
-	require("@opentelemetry/instrumentation-mongodb").MongoDBInstrumentation;
+	require("@opentelemetry/instrumentation-http");
+	require("@opentelemetry/instrumentation-mongodb");
 	getNodeAutoInstrumentations = require("@opentelemetry/auto-instrumentations-node").getNodeAutoInstrumentations;
 	isAvailable = true;
 } catch (_e) {}
@@ -42,9 +56,9 @@ try {
 * Create a tracer provider
 */
 function createTracerProvider(options) {
-	if (!isAvailable) return null;
+	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.10.8";
+	const resolvedVersion = serviceVersion ?? "2.11.1";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,
@@ -59,11 +73,14 @@ function createTracerProvider(options) {
 */
 async function tracingPlugin(fastify, options = {}) {
 	const { serviceName = "@classytic/arc", autoInstrumentation = true, sampleRate = 1 } = options;
-	if (!isAvailable) {
+	if (!isAvailable || !trace || !context || !SpanStatusCode) {
 		fastify.log.warn("OpenTelemetry not installed. Tracing disabled.");
 		fastify.log.warn("Install: npm install @opentelemetry/api @opentelemetry/sdk-node");
 		return;
 	}
+	const otelTrace = trace;
+	const otelContext = context;
+	const otelStatus = SpanStatusCode;
 	if (!createTracerProvider(options)) return;
 	if (autoInstrumentation && getNodeAutoInstrumentations) {
 		const instrumentations = getNodeAutoInstrumentations({
@@ -73,7 +90,7 @@ async function tracingPlugin(fastify, options = {}) {
 		for (const instrumentation of instrumentations) instrumentation.enable();
 		fastify.log.debug("OpenTelemetry auto-instrumentation enabled");
 	}
-	const tracer = trace.getTracer(serviceName);
+	const tracer = otelTrace.getTracer(serviceName);
 	fastify.decorateRequest("tracer", void 0);
 	fastify.addHook("onRequest", async (request, _reply) => {
 		if (Math.random() > sampleRate) return;
@@ -92,7 +109,7 @@ async function tracingPlugin(fastify, options = {}) {
 			tracer,
 			currentSpan: span
 		};
-		context.with(trace.setSpan(context.active(), span), () => {});
+		otelContext.with(otelTrace.setSpan(otelContext.active(), span), () => {});
 	});
 	fastify.addHook("onResponse", async (request, reply) => {
 		if (!request.tracer?.currentSpan) return;
@@ -101,11 +118,11 @@ async function tracingPlugin(fastify, options = {}) {
 			"http.status_code": reply.statusCode,
 			"http.response_content_length": reply.getHeader("content-length")
 		});
-		if (reply.statusCode >= 500) span.setStatus({
-			code: SpanStatusCode.ERROR,
+		const status = reply.statusCode >= 500 ? {
+			code: otelStatus.ERROR,
 			message: `HTTP ${reply.statusCode}`
-		});
-		else span.setStatus({ code: SpanStatusCode.OK });
+		} : { code: otelStatus.OK };
+		span.setStatus(status);
 		span.end();
 	});
 	fastify.addHook("onError", async (request, _reply, error) => {
@@ -113,7 +130,7 @@ async function tracingPlugin(fastify, options = {}) {
 		const span = request.tracer.currentSpan;
 		span.recordException(error);
 		span.setStatus({
-			code: SpanStatusCode.ERROR,
+			code: otelStatus.ERROR,
 			message: error.message
 		});
 	});
@@ -133,22 +150,23 @@ async function tracingPlugin(fastify, options = {}) {
 * }
 */
 function createSpan(request, name, fn, attributes) {
-	if (!request.tracer) return fn(null);
+	if (!request.tracer || !trace || !context || !SpanStatusCode) return fn(null);
+	const otelTrace = trace;
+	const otelContext = context;
+	const otelStatus = SpanStatusCode;
 	const { tracer, currentSpan } = request.tracer;
-	const span = tracer.startSpan(name, {
-		parent: currentSpan,
-		attributes: attributes || {}
-	}, trace.setSpan(context.active(), currentSpan));
-	return context.with(trace.setSpan(context.active(), span), async () => {
+	const span = tracer.startSpan(name, { attributes: attributes ?? {} }, otelTrace.setSpan(otelContext.active(), currentSpan));
+	return otelContext.with(otelTrace.setSpan(otelContext.active(), span), async () => {
 		try {
 			const result = await fn(span);
-			span.setStatus({ code: SpanStatusCode.OK });
+			span.setStatus({ code: otelStatus.OK });
 			return result;
 		} catch (error) {
-			span.recordException(error);
+			const err = error;
+			span.recordException(err);
 			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: error.message
+				code: otelStatus.ERROR,
+				message: err.message
 			});
 			throw error;
 		} finally {
@@ -171,9 +189,9 @@ function traced(spanName) {
 	return (target, propertyKey, descriptor) => {
 		const originalMethod = descriptor.value;
 		descriptor.value = async function(...args) {
-			const request = args.find((arg) => arg?.tracer);
+			const request = args.find((arg) => !!(arg && typeof arg === "object" && "tracer" in arg && arg.tracer));
 			if (!request?.tracer) return originalMethod.apply(this, args);
-			return createSpan(request, spanName || `${target.constructor.name}.${propertyKey}`, async (span) => {
+			return createSpan(request, spanName ?? `${target.constructor.name}.${propertyKey}`, async (span) => {
 				if (span) {
 					span.setAttribute("db.operation", propertyKey);
 					span.setAttribute("db.system", "mongodb");

package/dist/presets/filesUpload.d.mts

@@ -1,4 +1,4 @@
-import { _t as PresetResult } from "../index-BGbpGVyM.mjs";
+import { nt as PresetResult } from "../index-C_bgx9o4.mjs";
 import { r as RequestScope } from "../types-tgR4Pt8F.mjs";
 import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-BwGQXUpd.mjs";

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,7 @@
 import { o as getOrgId, p as getUserId } from "../types-AOD8fxIw.mjs";
-import { i as NotFoundError, u as ValidationError } from "../errors-BqdUDja_.mjs";
-import { C as requireAuth, y as allowPublic } from "../permissions-wkqRwicB.mjs";
-import { t as multipartBody } from "../multipartBody-CUQGVlM_.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-B4vU9L0Q.mjs";
+import { i as NotFoundError, u as ValidationError } from "../errors-D5c-5BJL.mjs";
+import { t as multipartBody } from "../multipartBody-CvTR1Un6.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Mt as IControllerResponse, Nt as IRequestContext, Yt as AnyRecord, _t as PresetResult, bt as ResourceConfig, d as PaginationResult } from "../index-BGbpGVyM.mjs";
+import { Pt as AnyRecord, _t as IControllerResponse, at as ResourceConfig, d as PaginationResult, nt as PresetResult, vt as IRequestContext } from "../index-C_bgx9o4.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CrwOvuXI.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-k604Lj99.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { _t as PresetResult, lt as CrudRouteKey } from "../index-BGbpGVyM.mjs";
+import { J as CrudRouteKey, nt as PresetResult } from "../index-C_bgx9o4.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/multiTenant.mjs

@@ -172,8 +172,14 @@ function multiTenantPreset(options = {}) {
 	const flexibleTenantFilter = createFlexibleTenantFilter(specs);
 	const tenantInjection = createTenantInjection(specs);
 	const getFilter = (route) => allowPublic.includes(route) ? flexibleTenantFilter : strictTenantFilter;
+	const fieldRules = {};
+	for (const spec of specs) fieldRules[spec.field] = {
+		systemManaged: true,
+		preserveForElevated: true
+	};
 	return {
 		name: "multiTenant",
+		schemaOptions: { fieldRules },
 		middlewares: {
 			list: [getFilter("list")],
 			get: [getFilter("get")],

package/dist/presets/search.d.mts

@@ -1,4 +1,4 @@
-import { Ot as ControllerHandler, Tt as RouteMcpConfig, _t as PresetResult, wt as RouteDefinition } from "../index-BGbpGVyM.mjs";
+import { lt as RouteDefinition, nt as PresetResult, pt as ControllerHandler, ut as RouteMcpConfig } from "../index-C_bgx9o4.mjs";
 import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 
 //#region src/presets/search.d.ts

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as requireAuth, y as allowPublic } from "../permissions-wkqRwicB.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-B4vU9L0Q.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-CrwOvuXI.mjs → presets-k604Lj99.mjs}

@@ -1,6 +1,6 @@
 import { _ as isElevated, n as PUBLIC_SCOPE } from "./types-AOD8fxIw.mjs";
+import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-B4vU9L0Q.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
-import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-wkqRwicB.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.

package/dist/queryCachePlugin-BUXBSm4F.d.mts

@@ -0,0 +1,34 @@
+import { r as CacheStore } from "./interface-Da0r7Lna.mjs";
+import { i as QueryCache } from "./QueryCache-DOBNHBE0.mjs";
+import { FastifyPluginAsync } from "fastify";
+
+//#region src/cache/queryCachePlugin.d.ts
+interface QueryCachePluginOptions {
+  /** CacheStore instance. Default: MemoryCacheStore with default options. */
+  store?: CacheStore;
+  /** Global defaults for staleTime/gcTime (seconds) */
+  defaults?: {
+    staleTime?: number;
+    gcTime?: number;
+  };
+}
+interface QueryCacheDefaults {
+  staleTime: number;
+  gcTime: number;
+}
+/** Cross-resource invalidation rules collected from resource configs */
+interface CrossResourceRule {
+  pattern: string;
+  tags: string[];
+}
+declare module "fastify" {
+  interface FastifyInstance {
+    queryCache: QueryCache;
+    queryCacheConfig: QueryCacheDefaults;
+    /** Register cross-resource invalidation rules (called by defineResource) */
+    registerCacheInvalidationRule?(rule: CrossResourceRule): void;
+  }
+}
+declare const queryCachePlugin: FastifyPluginAsync<QueryCachePluginOptions>;
+//#endregion
+export { queryCachePlugin as i, QueryCacheDefaults as n, QueryCachePluginOptions as r, CrossResourceRule as t };

package/dist/{queryCachePlugin-ChLNZvFT.mjs → queryCachePlugin-Bq6bO6vc.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-nWQGUTu1.mjs";
-import { t as hasEvents } from "./typeGuards-Cj5Rgvlg.mjs";
-import { t as MemoryCacheStore } from "./memory-DqI-449b.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-CARyUjiR.mjs";
+import { t as MemoryCacheStore } from "./memory-DikHSvWa.mjs";
+import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{redis-MXLp1oOf.d.mts → redis-Cm1gnRDf.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-B-pe8fhj.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-CkkWm5uR.mjs";
 
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {

package/dist/registry/index.d.mts

@@ -1,4 +1,4 @@
-import { R as RegisterOptions, k as IntrospectionPluginOptions, z as ResourceRegistry } from "../index-BGbpGVyM.mjs";
+import { R as RegisterOptions, k as IntrospectionPluginOptions, z as ResourceRegistry } from "../index-C_bgx9o4.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/registry/introspectionPlugin.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
-import { n as introspectionPlugin_default, t as introspectionPlugin } from "../registry-B0Wl7uVV.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CcN2LVrc.mjs";
+import { n as introspectionPlugin_default, t as introspectionPlugin } from "../registry-D63ee7fl.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-DkAeAuTX.mjs";
 export { ResourceRegistry, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };