@classytic/arc 2.17.1 → 2.18.1

package/dist/{BaseController-CgHomZ4d.mjs → BaseController-DPwe89qs.mjs}

@@ -3,7 +3,7 @@ import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
 import { b as isElevated, c as getOrgId } from "./types-Bi0r0vjG.mjs";
 import { I as simpleEqualityMatcher, b as ArcQueryParser, o as scheduleBackground, t as getUserId } from "./utils-BMQK8mRl.mjs";
-import { w as BodySanitizer } from "./routerShared-nCyJGOKX.mjs";
+import { w as BodySanitizer } from "./routerShared-Dl0A77Ba.mjs";
 import { t as buildQueryKey } from "./keys-DopsCuyQ.mjs";
 //#region src/core/AccessControl.ts
 const log = arcLog("access-control");

package/dist/auth/index.d.mts

@@ -1,4 +1,4 @@
-import { Bt as AuthHelpers, Vt as AuthPluginOptions } from "../index-C1JSBan-.mjs";
+import { Bt as AuthHelpers, Vt as AuthPluginOptions } from "../index-C000faom.mjs";
 import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-ClykOQqa.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-DlmaHUAl.mjs";

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition, it as RateLimitConfig, mt as RouteSchemaOptions } from "../../index-C1JSBan-.mjs";
+import { V as ResourceDefinition, it as RateLimitConfig, mt as RouteSchemaOptions } from "../../index-C000faom.mjs";
 
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-DKDs9NfD.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-CLZx9bwS.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DCjYMgfC.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-DYzfniuX.mjs";
+import { t as init } from "../../init-DQ_rY1J7.mjs";
 export { init };

package/dist/cli/index.mjs

@@ -2,6 +2,6 @@ import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
 import { t as generate } from "../generate-CcM24hoq.mjs";
-import { t as init } from "../init-DYzfniuX.mjs";
+import { t as init } from "../init-DQ_rY1J7.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/context/index.d.mts

@@ -23,6 +23,18 @@ interface RequestStore {
   resourceName?: string;
   /** Request start time (for timing) */
   startTime: number;
+  /**
+   * W3C Trace Context traceparent header (RFC 9457 / W3C Recommendation).
+   * Format: `00-<trace-id>-<parent-id>-<flags>` (e.g. `00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01`).
+   * Populated by `requestIdPlugin` when the header is present and valid.
+   */
+  traceparent?: string;
+  /**
+   * W3C Trace Context tracestate header.
+   * Vendor-specific, comma-separated `key=value` pairs.
+   * Populated by `requestIdPlugin` when the header is present.
+   */
+  tracestate?: string;
   /** Additional context — extensible by app */
   [key: string]: unknown;
 }
@@ -54,5 +66,46 @@ declare const requestContext: {
    */
   storage: AsyncLocalStorage<RequestStore>;
 };
+/**
+ * Returns the W3C Trace Context headers (`traceparent`, `tracestate`) from
+ * the current request context as a plain `Record<string, string>`, suitable
+ * for passing to `OutboxWriteOptions.headers` or forwarding to downstream
+ * HTTP clients.
+ *
+ * Returns `undefined` when called outside a request scope or when no trace
+ * context was propagated by the upstream caller.
+ *
+ * @example
+ * ```typescript
+ * // Propagate trace context through the outbox so downstream consumers
+ * // can stitch together distributed traces.
+ * const traceHeaders = getTraceHeaders();
+ * await outbox.store(event, { headers: traceHeaders });
+ * ```
+ */
+declare function getTraceHeaders(): Record<string, string> | undefined;
+//#endregion
+//#region src/context/transactionContext.d.ts
+/** DB session/transaction handle. Typed as unknown — arc is DB-agnostic. */
+type DbSession = unknown;
+/**
+ * Transaction context API.
+ *
+ * - `run(session, fn)` — install an active DB session for the duration of `fn`
+ * - `get()` — read the current session (undefined if outside a transaction scope)
+ */
+declare const transactionContext: {
+  /**
+   * Run `fn` with `session` as the active DB transaction context.
+   * Any call to `get()` within `fn`'s async call stack returns `session`.
+   */
+  run<T>(session: DbSession, fn: () => T): T;
+  /**
+   * Get the current DB session, or `undefined` if not inside a
+   * `transactionContext.run(...)` scope.
+   */
+  get(): DbSession | undefined; /** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
+  storage: AsyncLocalStorage<unknown>;
+};
 //#endregion
-export { type RequestStore, requestContext };
+export { type DbSession, type RequestStore, getTraceHeaders, requestContext, transactionContext };

package/dist/context/index.mjs

@@ -1,2 +1,65 @@
-import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
-export { requestContext };
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-DDLS3NVU.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/context/transactionContext.ts
+/**
+* Transaction Context via AsyncLocalStorage
+*
+* Provides a Unit-of-Work (UoW) hook so any code in the call stack can
+* retrieve the active database session/transaction without it being threaded
+* through every function parameter.
+*
+* Arc is DB-agnostic — the session type is `unknown` so any backend
+* (Mongoose session, Prisma transaction, pg client, Drizzle client) can
+* participate. Kit adapters call `runInTransaction(session, fn)` to install
+* the active context; the outbox's `store()` reads it automatically when no
+* explicit `options.session` is passed.
+*
+* @example
+* ```typescript
+* // In a Mongoose-backed service (mongokit adapter)
+* import { transactionContext } from '@classytic/arc/context';
+*
+* await mongoose.connection.withSession(async (session) => {
+*   await session.withTransaction(async () => {
+*     await transactionContext.run(session, async () => {
+*       await orders.insertOne(order, { session });
+*       // outbox.store() auto-picks up `session` — no manual threading
+*       await outbox.store(orderCreatedEvent);
+*     });
+*   });
+* });
+* ```
+*
+* @example
+* ```typescript
+* // Opt-out: explicit session always wins over the ALS context
+* await outbox.store(event, { session: explicitSession });
+* ```
+*/
+const storage = new AsyncLocalStorage();
+/**
+* Transaction context API.
+*
+* - `run(session, fn)` — install an active DB session for the duration of `fn`
+* - `get()` — read the current session (undefined if outside a transaction scope)
+*/
+const transactionContext = {
+	/**
+	* Run `fn` with `session` as the active DB transaction context.
+	* Any call to `get()` within `fn`'s async call stack returns `session`.
+	*/
+	run(session, fn) {
+		return storage.run(session, fn);
+	},
+	/**
+	* Get the current DB session, or `undefined` if not inside a
+	* `transactionContext.run(...)` scope.
+	*/
+	get() {
+		return storage.getStore();
+	},
+	/** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
+	storage
+};
+//#endregion
+export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { $t as BaseController, At as AggregationRateLimit, B as defineResource, Cn as AccessControlConfig, Ct as AggMeasureShorthand, Dt as AggregationIndexHint, Et as AggregationDateRangeRequirement, Ot as AggregationMaterializedContext, Sn as AccessControl, St as AggMeasureInput, Tt as AggregationConfig, V as ResourceDefinition, an as SlugMixin, bn as BodySanitizer, cn as BaseControllerOptions, dn as ControllerConstructionOptions, en as SoftDeleteExt, fn as QueryResolver, in as SlugExt, jt as AggregationsMap, kt as AggregationMaterializedResult, ln as BaseCrudController, nn as TreeExt, on as BulkExt, pn as QueryResolverConfig, rn as TreeMixin, sn as BulkMixin, tn as SoftDeleteMixin, un as ControllerConfigurableOptions, wt as AggregationCacheConfig, xn as BodySanitizerConfig, yn as ListResult } from "../index-C1JSBan-.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-CruZir1o.mjs";
+import { $t as BaseController, At as AggregationRateLimit, B as defineResource, Cn as AccessControlConfig, Ct as AggMeasureShorthand, Dt as AggregationIndexHint, Et as AggregationDateRangeRequirement, Ot as AggregationMaterializedContext, Sn as AccessControl, St as AggMeasureInput, Tt as AggregationConfig, V as ResourceDefinition, an as SlugMixin, bn as BodySanitizer, cn as BaseControllerOptions, dn as ControllerConstructionOptions, en as SoftDeleteExt, fn as QueryResolver, in as SlugExt, jt as AggregationsMap, kt as AggregationMaterializedResult, ln as BaseCrudController, nn as TreeExt, on as BulkExt, pn as QueryResolverConfig, rn as TreeMixin, sn as BulkMixin, tn as SoftDeleteMixin, un as ControllerConfigurableOptions, wt as AggregationCacheConfig, xn as BodySanitizerConfig, yn as ListResult } from "../index-C000faom.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-CNiryUMN.mjs";
 export { AccessControl, AccessControlConfig, AggMeasureInput, AggMeasureShorthand, AggregationCacheConfig, AggregationConfig, AggregationDateRangeRequirement, AggregationIndexHint, AggregationMaterializedContext, AggregationMaterializedResult, AggregationRateLimit, AggregationsMap, BaseController, BaseControllerOptions, BaseCrudController, BodySanitizer, BodySanitizerConfig, BulkExt, BulkMixin, CRUD_OPERATIONS, ControllerConfigurableOptions, ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugExt, SlugMixin, SoftDeleteExt, SoftDeleteMixin, TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-TrJVIJl0.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as AccessControl } from "../BaseController-CgHomZ4d.mjs";
-import { S as sendControllerResponse, _ as createCrudHandlers, b as getControllerContext, v as createFastifyHandler, w as BodySanitizer, x as getControllerScope, y as createRequestContext } from "../routerShared-nCyJGOKX.mjs";
-import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-D8tpQ4ZL.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as AccessControl } from "../BaseController-DPwe89qs.mjs";
+import { S as sendControllerResponse, _ as createCrudHandlers, b as getControllerContext, v as createFastifyHandler, w as BodySanitizer, x as getControllerScope, y as createRequestContext } from "../routerShared-Dl0A77Ba.mjs";
+import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-B41eZxyM.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/{core-D8tpQ4ZL.mjs → core-B41eZxyM.mjs}

@@ -1,11 +1,11 @@
 import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-BMQK8mRl.mjs";
-import { t as BaseController } from "./BaseController-CgHomZ4d.mjs";
+import { t as BaseController } from "./BaseController-DPwe89qs.mjs";
 import { t as applyPresets } from "./presets-BYbPobbF.mjs";
 import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-De34B1ZG.mjs";
 import { t as hasEvents } from "./typeGuards-BzkXkvVv.mjs";
-import { C as buildRequestScopeProjection, _ as createCrudHandlers, c as buildPipelineHandler, d as methodCarriesBody, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, o as buildCrudPermissionMw, p as resolveRoutePreHandlers, r as buildArcDecorator, s as buildFieldWritePreHandler, u as buildRateLimitConfig, v as createFastifyHandler, y as createRequestContext } from "./routerShared-nCyJGOKX.mjs";
+import { C as buildRequestScopeProjection, _ as createCrudHandlers, c as buildPipelineHandler, d as methodCarriesBody, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, o as buildCrudPermissionMw, p as resolveRoutePreHandlers, r as buildArcDecorator, s as buildFieldWritePreHandler, u as buildRateLimitConfig, v as createFastifyHandler, y as createRequestContext } from "./routerShared-Dl0A77Ba.mjs";
 import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
 //#region src/core/aggregation/defineAggregation.ts
@@ -127,7 +127,10 @@ function createCustomRoutes(fastify, routes, controller, options) {
 				reply.raw.setHeader("Cache-Control", "no-cache");
 				reply.raw.setHeader("Connection", "keep-alive");
 				const result = await handler(request, reply);
-				if (isReadableStream(result)) await pipeUIMessageStreamToReply(reply, result);
+				if (isReadableStream(result)) {
+					await pipeUIMessageStreamToReply(reply, result);
+					return reply;
+				}
 				return result;
 			} : handler,
 			...rateLimitConfig ? { config: rateLimitConfig } : {}
@@ -1093,7 +1096,7 @@ function buildResourcePlugin(resource) {
 				idField: resource.idField
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-BHUMb1-y.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-CRaIwB5S.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1107,7 +1110,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-BYVvhfc5.mjs"), import("./validate-DFIP2VrM.mjs").then((n) => n.i)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-n3O6WdLO.mjs"), import("./validate-DFIP2VrM.mjs").then((n) => n.i)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/{createActionRouter-BHUMb1-y.mjs → createActionRouter-CRaIwB5S.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import "./constants-TrJVIJl0.mjs";
 import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { S as sendControllerResponse, a as buildAuthMiddlewareForPermissions, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, l as buildPreHandlerChain, m as resolveRouterPluginMw, n as buildActionPipelineHandler, r as buildArcDecorator, t as buildActionPermissionMw, u as buildRateLimitConfig } from "./routerShared-nCyJGOKX.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-DAOvBWgT.mjs";
+import { S as sendControllerResponse, a as buildAuthMiddlewareForPermissions, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, l as buildPreHandlerChain, m as resolveRouterPluginMw, n as buildActionPipelineHandler, r as buildArcDecorator, t as buildActionPermissionMw, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Bk6Tns82.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,

package/dist/{createAggregationRouter-BYVvhfc5.mjs → createAggregationRouter-n3O6WdLO.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, r as buildArcDecorator, u as buildRateLimitConfig } from "./routerShared-nCyJGOKX.mjs";
+import { h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, r as buildArcDecorator, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
 import { r as validateAggregations } from "./validate-DFIP2VrM.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-C_SkBNF3.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts

package/dist/{createApp-CzCEEsEm.mjs → createApp-DZvrb587.mjs}

@@ -202,7 +202,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-CnJCUyM0.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-Dxp9JlKK.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -776,19 +776,36 @@ function validateDistributedRuntime(options) {
 	if (options.runtime !== "distributed") return deferredWarnings;
 	const missing = [];
 	const events = options.stores?.events;
-	if (!events || MEMORY_STORE_NAMES.has(events.name)) missing.push("events transport");
+	if (!events || MEMORY_STORE_NAMES.has(events.name)) missing.push({
+		key: "stores.events",
+		hint: "a Redis Streams or pub/sub transport"
+	});
 	if (options.arcPlugins?.caching) {
 		const cache = options.stores?.cache;
-		if (!cache || cache.name !== void 0 && MEMORY_STORE_NAMES.has(cache.name)) missing.push("cache store");
+		if (!cache || cache.name !== void 0 && MEMORY_STORE_NAMES.has(cache.name)) missing.push({
+			key: "stores.cache",
+			hint: "a Redis-backed cache adapter"
+		});
 	}
 	const idempotency = options.stores?.idempotency;
-	if (idempotency && MEMORY_STORE_NAMES.has(idempotency.name)) missing.push("idempotency store (memory-backed in distributed mode)");
+	if (idempotency && MEMORY_STORE_NAMES.has(idempotency.name)) missing.push({
+		key: "stores.idempotency",
+		hint: "a Redis/MongoDB store (currently memory-backed → instance-local)"
+	});
 	else if (!idempotency) deferredWarnings.push("runtime: 'distributed' — no idempotency store configured. Write-path deduplication will be instance-local. If resources use the idempotency plugin, provide stores.idempotency with a Redis/MongoDB store.");
 	if (options.arcPlugins?.queryCache) {
 		const qc = options.stores?.queryCache;
-		if (!qc || qc.name !== void 0 && MEMORY_STORE_NAMES.has(qc.name)) missing.push("queryCache store");
+		if (!qc || qc.name !== void 0 && MEMORY_STORE_NAMES.has(qc.name)) missing.push({
+			key: "stores.queryCache",
+			hint: "a Redis-backed query-cache adapter"
+		});
+	}
+	if (missing.length > 0) {
+		const lines = missing.map((m) => `  • ${m.key.padEnd(20)} → ${m.hint}`).join("\n");
+		throw new Error(`[Arc] runtime: 'distributed' requires durable (Redis/MongoDB) adapters, not memory.
+
+Missing:\n${lines}\n\nFix: pass durable adapters under \`stores\`, or use runtime: 'memory' for single-instance dev.`);
 	}
-	if (missing.length > 0) throw new Error(`[Arc] runtime: 'distributed' requires Redis/durable adapters.\nMissing: ${missing.join(", ")}.\nProvide Redis-backed stores or use runtime: 'memory' for development.`);
 	return deferredWarnings;
 }
 /**
@@ -828,7 +845,12 @@ async function createApp(options) {
 		...config.bodyLimit !== void 0 ? { bodyLimit: config.bodyLimit } : {},
 		allowErrorHandlerOverride: true,
 		routerOptions: {
-			querystringParser: (str) => qs.parse(str),
+			querystringParser: (str) => qs.parse(str, {
+				depth: 5,
+				parameterLimit: 100,
+				arrayLimit: 20,
+				allowPrototypes: false
+			}),
 			maxParamLength: config.maxParamLength ?? 400
 		},
 		ajv: { customOptions: {

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-C1JSBan-.mjs";
+import { p as RegistryEntry } from "../index-C000faom.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-ClykOQqa.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-DV9WDfeg.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-DKDs9NfD.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-CLZx9bwS.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{eventPlugin-CnJCUyM0.mjs → eventPlugin-Dxp9JlKK.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError } from "./errors-j4aJm1Wg.mjs";
-import { t as requestContext } from "./requestContext-SSaaTgW8.mjs";
+import { n as requestContext } from "./requestContext-DDLS3NVU.mjs";
 import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-ClEDfiMS.mjs";
 import fp from "fastify-plugin";
 //#region src/events/retry.ts

package/dist/events/index.d.mts

@@ -450,6 +450,52 @@ interface EventOutboxOptions {
    * on next poll) — legacy behaviour, unchanged.
    */
   readonly failurePolicy?: OutboxFailurePolicy;
+  /**
+   * Unit-of-Work session provider (AsyncLocalStorage integration).
+   *
+   * When set, `store()` calls this to get the active DB session and uses
+   * it as `OutboxWriteOptions.session` — **only when the caller has not
+   * already passed an explicit `options.session`**. This eliminates the
+   * boilerplate of threading the transaction handle from the controller
+   * through every service layer down to the outbox call site.
+   *
+   * Wire up with arc's `transactionContext`:
+   * ```typescript
+   * import { transactionContext } from '@classytic/arc/context';
+   *
+   * const outbox = new EventOutbox({
+   *   store: myOutboxStore,
+   *   sessionProvider: () => transactionContext.get(),
+   * });
+   *
+   * // In your service layer — session is auto-picked up:
+   * await transactionContext.run(mongooseSession, async () => {
+   *   await orders.insertOne(order, { session: mongooseSession });
+   *   await outbox.store(orderCreatedEvent); // no session arg needed
+   * });
+   * ```
+   */
+  readonly sessionProvider?: () => unknown;
+  /**
+   * W3C Trace Context provider.
+   *
+   * When set, `store()` calls this and merges the returned headers into
+   * `OutboxWriteOptions.headers` — only when `traceparent` is not already
+   * present in the caller-supplied headers. Downstream relay workers can
+   * then forward the headers to the transport, preserving the distributed
+   * trace tree across service boundaries.
+   *
+   * Wire up with arc's `getTraceHeaders`:
+   * ```typescript
+   * import { getTraceHeaders } from '@classytic/arc/context';
+   *
+   * const outbox = new EventOutbox({
+   *   store: myOutboxStore,
+   *   traceContextProvider: getTraceHeaders,
+   * });
+   * ```
+   */
+  readonly traceContextProvider?: () => Record<string, string> | undefined;
 }
 declare class EventOutbox {
   private readonly _store;
@@ -459,6 +505,8 @@ declare class EventOutbox {
   private readonly _leaseMs;
   private readonly _onError?;
   private readonly _usePublishMany;
+  private readonly _sessionProvider?;
+  private readonly _traceContextProvider?;
   private readonly _failurePolicy?;
   /**
    * In-process attempt counter per event id. Accurate within this relay

package/dist/events/index.mjs

@@ -1,6 +1,6 @@
 import { t as MemoryEventTransport } from "../EventTransport-ClEDfiMS.mjs";
 import { n as defineEvent, t as createEventRegistry } from "../defineEvent-NPKUJRt8.mjs";
-import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-CnJCUyM0.mjs";
+import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-Dxp9JlKK.mjs";
 import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-5JgaxieH.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { update } from "@classytic/repo-core/update";
@@ -387,6 +387,8 @@ var EventOutbox = class {
 	_leaseMs;
 	_onError;
 	_usePublishMany;
+	_sessionProvider;
+	_traceContextProvider;
 	_failurePolicy;
 	/**
 	* In-process attempt counter per event id. Accurate within this relay
@@ -406,6 +408,8 @@ var EventOutbox = class {
 		this._onError = opts.onError;
 		this._usePublishMany = opts.usePublishMany ?? true;
 		this._failurePolicy = opts.failurePolicy;
+		this._sessionProvider = opts.sessionProvider;
+		this._traceContextProvider = opts.traceContextProvider;
 	}
 	/** Unique consumer ID used for lease ownership when the store supports claims */
 	get consumerId() {
@@ -427,11 +431,29 @@ var EventOutbox = class {
 		if (!event || typeof event !== "object") throw new InvalidOutboxEventError("event is not an object");
 		if (!event.type || typeof event.type !== "string") throw new InvalidOutboxEventError("event.type is required");
 		if (!event.meta?.id || typeof event.meta.id !== "string") throw new InvalidOutboxEventError("event.meta.id is required");
-		const effectiveOptions = options?.dedupeKey === void 0 && event.meta.idempotencyKey ? {
-			...options ?? {},
+		let effective = options;
+		if (effective?.session === void 0 && this._sessionProvider) {
+			const autoSession = this._sessionProvider();
+			if (autoSession !== void 0) effective = {
+				...effective ?? {},
+				session: autoSession
+			};
+		}
+		if (!effective?.headers?.["traceparent"] && this._traceContextProvider) {
+			const traceHeaders = this._traceContextProvider();
+			if (traceHeaders && Object.keys(traceHeaders).length > 0) effective = {
+				...effective ?? {},
+				headers: {
+					...traceHeaders,
+					...effective?.headers ?? {}
+				}
+			};
+		}
+		if (effective?.dedupeKey === void 0 && event.meta.idempotencyKey) effective = {
+			...effective ?? {},
 			dedupeKey: event.meta.idempotencyKey
-		} : options;
-		await this._store.save(event, effectiveOptions);
+		};
+		await this._store.save(event, effective);
 	}
 	_reportError(kind, error, event) {
 		if (!this._onError) return;

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-BRmS8TNa.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-DEEWwQFR.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 
 //#region src/factory/createApp.d.ts

package/dist/factory/index.mjs

@@ -1,5 +1,5 @@
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BOXzPhKU.mjs";
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-CzCEEsEm.mjs";
+import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-DZvrb587.mjs";
 import { t as loadResources } from "../loadResources-fol6JuvW.mjs";
 //#region src/factory/edge.ts
 /**

package/dist/{fastify-augmentation-7LIR0nDv.d.mts → fastify-augmentation-CL48B6gW.d.mts}

@@ -1,4 +1,4 @@
-import { An as HookSystem, z as ResourceRegistry } from "./index-C1JSBan-.mjs";
+import { An as HookSystem, z as ResourceRegistry } from "./index-C000faom.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-ClykOQqa.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { An as HookSystem, Dn as HookOperation, En as HookHandler, Fn as beforeCreate, In as beforeDelete, Ln as beforeUpdate, Mn as afterCreate, Nn as afterDelete, On as HookPhase, Pn as afterUpdate, Rn as createHookSystem, Tn as HookContext, jn as HookSystemOptions, kn as HookRegistration, wn as DefineHookOptions, zn as defineHook } from "../index-C1JSBan-.mjs";
+import { An as HookSystem, Dn as HookOperation, En as HookHandler, Fn as beforeCreate, In as beforeDelete, Ln as beforeUpdate, Mn as afterCreate, Nn as afterDelete, On as HookPhase, Pn as afterUpdate, Rn as createHookSystem, Tn as HookContext, jn as HookSystemOptions, kn as HookRegistration, wn as DefineHookOptions, zn as defineHook } from "../index-C000faom.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/{index-C1JSBan-.d.mts → index-C000faom.d.mts}

@@ -2854,7 +2854,16 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * ```
    */
   aggregations?: AggregationsMap;
-  disableCrud?: boolean;
+  /**
+   * Turn off ALL auto-CRUD routes for this resource (custom `routes` /
+   * `actions` / `aggregations` still mount). The canonical kill-switch —
+   * `crud: false` is its declarative equivalent.
+   *
+   * Note: there is no `disableCrud` alias. A short-lived `disableCrud`
+   * field shipped in the type but was never read by the router, so it
+   * silently no-opped — removed in 2.18.0 so the only kill-switch is the
+   * one that actually works.
+   */
   disableDefaultRoutes?: boolean;
   /** Specific routes to disable (negative-form opt-out). */
   disabledRoutes?: CrudRouteKey[];

package/dist/{index-CruZir1o.d.mts → index-CNiryUMN.d.mts}

@@ -1,4 +1,4 @@
-import { C as RequestContext, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, bt as IRequestContext, ft as RouteMcpConfig, mt as RouteSchemaOptions, q as CrudController, st as ResourceConfig, vt as IController, yt as IControllerResponse } from "./index-C1JSBan-.mjs";
+import { C as RequestContext, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, bt as IRequestContext, ft as RouteMcpConfig, mt as RouteSchemaOptions, q as CrudController, st as ResourceConfig, vt as IController, yt as IControllerResponse } from "./index-C000faom.mjs";
 import { i as RequestScope } from "./types-CfapW2t8.mjs";
 import { c as PermissionCheck } from "./fields-DqZLp5d6.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { $t as BaseController, A as RequestIdOptions, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, N as FastifyRequestExtras, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, _n as ArcListResult, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, d as PaginationResult, dn as ControllerConstructionOptions, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gn as ArcGetResult, gt as ControllerLike, h as ResourceMetadata, hn as ArcDeleteResult, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jt as AggregationsMap, k as IntrospectionPluginOptions, kt as AggregationMaterializedResult, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, mn as ArcCreateResult, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, un as ControllerConfigurableOptions, vn as ArcUpdateResult, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yn as ListResult, yt as IControllerResponse } from "./index-C1JSBan-.mjs";
+import { $t as BaseController, A as RequestIdOptions, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, N as FastifyRequestExtras, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, _n as ArcListResult, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, d as PaginationResult, dn as ControllerConstructionOptions, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gn as ArcGetResult, gt as ControllerLike, h as ResourceMetadata, hn as ArcDeleteResult, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jt as AggregationsMap, k as IntrospectionPluginOptions, kt as AggregationMaterializedResult, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, mn as ArcCreateResult, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, un as ControllerConfigurableOptions, vn as ArcUpdateResult, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yn as ListResult, yt as IControllerResponse } from "./index-C000faom.mjs";
 import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-DqZLp5d6.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-CruZir1o.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-CNiryUMN.mjs";
 import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-3L-adFJO.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-4ZloYFvm.mjs";
 

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-TrJVIJl0.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-j4aJm1Wg.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CgHomZ4d.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DPwe89qs.mjs";
 import { C as requireAuth, D as when, M as applyFieldWritePermissions, N as fields, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyFieldReadPermissions, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-B1Qy55fg.mjs";
-import { x as getControllerScope } from "./routerShared-nCyJGOKX.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-D8tpQ4ZL.mjs";
+import { x as getControllerScope } from "./routerShared-Dl0A77Ba.mjs";
+import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-B41eZxyM.mjs";
 //#region src/index.ts
-const version = "2.17.1";
+const version = "2.18.1";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };