@classytic/arc 2.18.1 → 2.18.3

package/dist/{QueryCache-8YmAQ-zW.d.mts → QueryCache-Dsyv2mLS.d.mts}

@@ -1,4 +1,4 @@
-import { r as CacheStore } from "./interface-BVkZsvEe.mjs";
+import { r as CacheStore } from "./interface-DL7LlWS5.mjs";
 
 //#region src/cache/QueryCache.d.ts
 /** Metadata wrapper stored in CacheStore */

package/dist/audit/index.d.mts

@@ -1,4 +1,4 @@
-import { d as UserBase } from "../fields-DqZLp5d6.mjs";
+import { d as UserBase } from "../fields-CKLrhyOb.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 

package/dist/auth/index.d.mts

@@ -1,7 +1,7 @@
-import { Bt as AuthHelpers, Vt as AuthPluginOptions } from "../index-C000faom.mjs";
-import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-ClykOQqa.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-DlmaHUAl.mjs";
+import { Bt as AuthHelpers, Vt as AuthPluginOptions } from "../index-QYma8mdC.mjs";
+import { c as PermissionCheck } from "../fields-CKLrhyOb.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-DLle0R07.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-CyHpYXoB.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
 
 //#region src/auth/authPlugin.d.ts

package/dist/auth/index.mjs

@@ -1,7 +1,7 @@
 import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-j4aJm1Wg.mjs";
-import { _ as requireTeamMembership, m as requireOrgRole, p as requireOrgMembership } from "../permissions-B1Qy55fg.mjs";
-import { n as normalizeRoles, t as getUserRoles } from "../types-DV9WDfeg.mjs";
-import { n as extractBetterAuthOpenApi } from "../betterAuthOpenApi-ClWxaceA.mjs";
+import { _ as requireTeamMembership, m as requireOrgRole, p as requireOrgMembership } from "../permissions-3uzwkbQt.mjs";
+import { n as normalizeRoles, t as getUserRoles } from "../types-D57iXYb8.mjs";
+import { n as extractBetterAuthOpenApi } from "../betterAuthOpenApi-DAAhMZff.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -611,7 +611,7 @@ function createBetterAuthAdapter(options) {
 		if (!fastify.hasDecorator("authenticate")) fastify.decorate("authenticate", authenticate);
 		if (!fastify.hasDecorator("optionalAuthenticate")) fastify.decorate("optionalAuthenticate", optionalAuthenticate);
 		if (!extractedOpenApi && openapiOpt !== false && auth.api && typeof auth.api === "object") {
-			const { extractBetterAuthOpenApi } = await import("../betterAuthOpenApi-ClWxaceA.mjs").then((n) => n.t);
+			const { extractBetterAuthOpenApi } = await import("../betterAuthOpenApi-DAAhMZff.mjs").then((n) => n.t);
 			extractedOpenApi = extractBetterAuthOpenApi(auth.api, {
 				basePath,
 				userFields

package/dist/auth/redis-session.d.mts

@@ -1,4 +1,4 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-DlmaHUAl.mjs";
+import { i as SessionData, s as SessionStore } from "../sessionManager-CyHpYXoB.mjs";
 
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */

package/dist/{betterAuthOpenApi-ClWxaceA.mjs → betterAuthOpenApi-DAAhMZff.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { a as toJsonSchema } from "./schemaConverter-De34B1ZG.mjs";
+import { a as toJsonSchema } from "./schemaConverter-DatAaVNj.mjs";
 //#region src/auth/betterAuthOpenApi.ts
 var betterAuthOpenApi_exports = /* @__PURE__ */ __exportAll({ extractBetterAuthOpenApi: () => extractBetterAuthOpenApi });
 /**

package/dist/{buildHandler-C_SkBNF3.mjs → buildHandler-Cvrc2p7r.mjs}

@@ -1,4 +1,4 @@
-import { n as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DFIP2VrM.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-0__MuUsK.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -1,6 +1,6 @@
-import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BVkZsvEe.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-8YmAQ-zW.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-Do4P_WBC.mjs";
+import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-DL7LlWS5.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-Dsyv2mLS.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-Bd2tYgh5.mjs";
 
 //#region src/cache/keys.d.ts
 /**

package/dist/cache/index.mjs

@@ -1,6 +1,6 @@
-import { t as MemoryCacheStore } from "../memory-QOLe11D5.mjs";
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-DopsCuyQ.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-B4XMSSe7.mjs";
+import { t as MemoryCacheStore } from "../memory-TdTHCS9-.mjs";
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B3yyBEyH.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-CnAeFqju.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition, it as RateLimitConfig, mt as RouteSchemaOptions } from "../../index-C000faom.mjs";
+import { V as ResourceDefinition, it as RateLimitConfig, mt as RouteSchemaOptions } from "../../index-QYma8mdC.mjs";
 
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {

package/dist/cli/commands/describe.mjs

@@ -1,5 +1,5 @@
 import { t as CRUD_OPERATIONS } from "../../constants-TrJVIJl0.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-CzSzVK1m.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-CWmOggxS.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,5 @@
-import { t as buildOpenApiSpec } from "../../openapi-CLZx9bwS.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DCjYMgfC.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-ButnRyOM.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-XHNeUWpu.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/generate.d.mts

@@ -1,2 +1,2 @@
-import { n as generate, t as ArcProjectConfig } from "../../generate-cRnsafMS.mjs";
+import { n as generate, t as ArcProjectConfig } from "../../generate-Dmk8cfvX.mjs";
 export { ArcProjectConfig, generate };

package/dist/cli/commands/generate.mjs

@@ -1,2 +1,2 @@
-import { t as generate } from "../../generate-CcM24hoq.mjs";
+import { t as generate } from "../../generate-BaxDdmJ8.mjs";
 export { generate };

package/dist/cli/commands/init.d.mts

@@ -1,2 +1,2 @@
-import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-D-vrTZ1G.mjs";
+import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-BS4Daqnv.mjs";
 export { DependencyManifest, InitOptions, PackageManager, ProjectConfig, init };

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-DQ_rY1J7.mjs";
+import { t as init } from "../../init-DSsdRfk9.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,4 +1,4 @@
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DCjYMgfC.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-XHNeUWpu.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.d.mts

@@ -1,7 +1,7 @@
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { n as generate } from "../generate-cRnsafMS.mjs";
-import { t as init } from "../init-D-vrTZ1G.mjs";
+import { n as generate } from "../generate-Dmk8cfvX.mjs";
+import { t as init } from "../init-BS4Daqnv.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/cli/index.mjs

@@ -1,7 +1,7 @@
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-CcM24hoq.mjs";
-import { t as init } from "../init-DQ_rY1J7.mjs";
+import { t as generate } from "../generate-BaxDdmJ8.mjs";
+import { t as init } from "../init-DSsdRfk9.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { $t as BaseController, At as AggregationRateLimit, B as defineResource, Cn as AccessControlConfig, Ct as AggMeasureShorthand, Dt as AggregationIndexHint, Et as AggregationDateRangeRequirement, Ot as AggregationMaterializedContext, Sn as AccessControl, St as AggMeasureInput, Tt as AggregationConfig, V as ResourceDefinition, an as SlugMixin, bn as BodySanitizer, cn as BaseControllerOptions, dn as ControllerConstructionOptions, en as SoftDeleteExt, fn as QueryResolver, in as SlugExt, jt as AggregationsMap, kt as AggregationMaterializedResult, ln as BaseCrudController, nn as TreeExt, on as BulkExt, pn as QueryResolverConfig, rn as TreeMixin, sn as BulkMixin, tn as SoftDeleteMixin, un as ControllerConfigurableOptions, wt as AggregationCacheConfig, xn as BodySanitizerConfig, yn as ListResult } from "../index-C000faom.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-CNiryUMN.mjs";
+import { $t as BaseController, At as AggregationRateLimit, B as defineResource, Ct as AggMeasureShorthand, Dt as AggregationIndexHint, Et as AggregationDateRangeRequirement, Fn as ControllerConfigurableOptions, In as ControllerConstructionOptions, Ln as ListResult, Ot as AggregationMaterializedContext, Pn as BaseControllerOptions, Rn as BodySanitizer, St as AggMeasureInput, Tt as AggregationConfig, V as ResourceDefinition, an as SlugMixin, cn as BaseCrudController, dn as AccessControl, en as SoftDeleteExt, fn as AccessControlConfig, in as SlugExt, jt as AggregationsMap, kt as AggregationMaterializedResult, ln as QueryResolver, nn as TreeExt, on as BulkExt, rn as TreeMixin, sn as BulkMixin, tn as SoftDeleteMixin, un as QueryResolverConfig, wt as AggregationCacheConfig, zn as BodySanitizerConfig } from "../index-QYma8mdC.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-Cvo1u9n6.mjs";
 export { AccessControl, AccessControlConfig, AggMeasureInput, AggMeasureShorthand, AggregationCacheConfig, AggregationConfig, AggregationDateRangeRequirement, AggregationIndexHint, AggregationMaterializedContext, AggregationMaterializedResult, AggregationRateLimit, AggregationsMap, BaseController, BaseControllerOptions, BaseCrudController, BodySanitizer, BodySanitizerConfig, BulkExt, BulkMixin, CRUD_OPERATIONS, ControllerConfigurableOptions, ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugExt, SlugMixin, SoftDeleteExt, SoftDeleteMixin, TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-TrJVIJl0.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as AccessControl } from "../BaseController-DPwe89qs.mjs";
-import { S as sendControllerResponse, _ as createCrudHandlers, b as getControllerContext, v as createFastifyHandler, w as BodySanitizer, x as getControllerScope, y as createRequestContext } from "../routerShared-Dl0A77Ba.mjs";
-import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-B41eZxyM.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-B-uXzf6I.mjs";
+import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-C88uIwd3.mjs";
+import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-D4sqiokR.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/{core-B41eZxyM.mjs → core-C88uIwd3.mjs}

@@ -1,13 +1,58 @@
 import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-BMQK8mRl.mjs";
-import { t as BaseController } from "./BaseController-DPwe89qs.mjs";
-import { t as applyPresets } from "./presets-BYbPobbF.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-De34B1ZG.mjs";
-import { t as hasEvents } from "./typeGuards-BzkXkvVv.mjs";
-import { C as buildRequestScopeProjection, _ as createCrudHandlers, c as buildPipelineHandler, d as methodCarriesBody, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, o as buildCrudPermissionMw, p as resolveRoutePreHandlers, r as buildArcDecorator, s as buildFieldWritePreHandler, u as buildRateLimitConfig, v as createFastifyHandler, y as createRequestContext } from "./routerShared-Dl0A77Ba.mjs";
-import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
+import { r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Bi0r0vjG.mjs";
+import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-xAQeDyU_.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B-uXzf6I.mjs";
+import { a as resolveRoutePreHandlers, c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
+import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-3uzwkbQt.mjs";
+import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
+import { t as applyPresets } from "./presets-CF79RHEo.mjs";
+import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-DatAaVNj.mjs";
+import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
+import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-D4sqiokR.mjs";
+import { t as pluralize } from "./pluralize-BxdUl2P4.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CX9QIMTd.mjs";
+//#region src/core/middlewares/fieldWrite.ts
+/**
+* Build a preHandler that enforces field-write permissions on the request body.
+*
+* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
+* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
+* never went through that path — so a host that declared
+* `fields: { role: fields.writableBy(['admin']) }` and a custom
+* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
+*
+* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
+* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
+* bodies don't necessarily mirror the resource's adapter shape, and we'd
+* generate surprising 403s by enforcing rules tied to that shape.
+*
+* Returns `null` when the resource has no field permissions configured — the
+* caller should then skip wiring it into the preHandler chain.
+*/
+function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
+	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
+	return async (request, _reply) => {
+		const body = request.body;
+		if (!body || typeof body !== "object" || Array.isArray(body)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
+		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+		request.body = filtered;
+	};
+}
+/**
+* True for HTTP methods that carry a request body and should run the
+* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
+*/
+function methodCarriesBody(method) {
+	const m = method.toUpperCase();
+	return m === "POST" || m === "PUT" || m === "PATCH";
+}
+//#endregion
 //#region src/core/aggregation/defineAggregation.ts
 /**
 * Declare a single resource aggregation. Exported configs flow into
@@ -597,6 +642,111 @@ function resolveIdField(config, repository) {
 	return config;
 }
 //#endregion
+//#region src/core/defineResource/normalizeConfig.ts
+/**
+* Run all Phase-0 expansions in order and return the canonical config.
+*
+* The `crud:` allow-list resolves LAST and is lifted BEFORE validation
+* so the validator sees the resolved shape: `crud: false` looks like
+* `disableDefaultRoutes: true` (no adapter required) instead of "CRUD
+* enabled but no adapter" (a confusing false-positive error).
+*/
+function normalizeResourceConfig(config) {
+	return resolveCrudAllowList(expandCustomRoutesOnly(expandReferenceData(config)));
+}
+/**
+* Expand the `referenceData: true` shorthand. Reference data is the
+* recurring "small static catalogue" shape (currencies, plans,
+* pipeline stages, credential types) where callers want "fetch all"
+* semantics and aggressive caching — pre-2.17.0 hosts hand-wired
+* `crud` + `defaultLimit` + `maxLimit` + `cache` on every such
+* resource. The shorthand pins canonical defaults; explicit narrow
+* settings always win so a host can opt INTO mutations
+* (`referenceData: true, crud: { list: true, get: true, create: true }`)
+* or override the cache window without giving up the read-only +
+* fetch-all defaults.
+*/
+function expandReferenceData(config) {
+	if (config.referenceData !== true) return config;
+	return {
+		...config,
+		crud: config.crud ?? {
+			list: true,
+			get: true
+		},
+		defaultLimit: config.defaultLimit ?? 1e3,
+		maxLimit: config.maxLimit ?? 1e3,
+		cache: config.cache ?? {
+			staleTime: 300,
+			gcTime: 600
+		}
+	};
+}
+/**
+* Expand the `customRoutesOnly: true` shorthand into its three primitive
+* flags. The shorthand exists because hosts wiring a "service resource"
+* (custom routes only, no adapter, no auto-CRUD) had to remember to set
+* `disableDefaultRoutes` + `skipValidation` + `skipRegistry` in lockstep —
+* forgetting any one of them produced confusing errors ("controller
+* required when CRUD routes are enabled" for a resource that ships none).
+*
+* Explicit narrow settings always win — the shorthand only fills in
+* flags that were not set so power users can opt back into a specific
+* primitive (`customRoutesOnly: true, skipRegistry: false` keeps OpenAPI
+* docs while still skipping CRUD + validation).
+*/
+function expandCustomRoutesOnly(config) {
+	if (config.customRoutesOnly !== true) return config;
+	return {
+		...config,
+		customRoutesOnly: void 0,
+		disableDefaultRoutes: config.disableDefaultRoutes ?? true,
+		skipValidation: config.skipValidation ?? true,
+		skipRegistry: config.skipRegistry ?? true
+	};
+}
+/**
+* Normalise the 2.16 `crud:` positive-form allow-list into the canonical
+* `{ disabledRoutes, disableDefaultRoutes }` pair the rest of arc reads.
+*
+* Three input forms collapse to one output:
+*   - `crud: false`           → `disableDefaultRoutes: true`
+*   - `crud: { list: true }`  → `disabledRoutes: [get,create,update,delete]`
+*   - legacy `disabledRoutes` → passed through unchanged
+*
+* Mutually exclusive: `crud` + `disabledRoutes` together is a config bug
+* (the host meant ONE of two intents) — throw rather than pick.
+*
+* Lifted out of the `ResourceDefinition` constructor in 2.16 so the
+* validator (Phase 1) observes the post-resolve shape — `crud: false`
+* now looks like `disableDefaultRoutes: true` to the validator, so it
+* doesn't false-positive "Data adapter required when CRUD routes are
+* enabled" on a host that explicitly opted CRUD out.
+*/
+function resolveCrudAllowList(config) {
+	const { crud, disabledRoutes: legacyDisabled, disableDefaultRoutes: legacyDisableAll } = config;
+	if (crud === void 0) return config;
+	if (legacyDisabled !== void 0) throw new Error(`[Arc] Resource '${config.name}': pass either \`crud\` (positive allow-list) or \`disabledRoutes\` (negative opt-out), not both. The positive form is the documented default going forward; drop \`disabledRoutes\` when both are set.`);
+	if (crud === false) return {
+		...config,
+		crud: void 0,
+		disableDefaultRoutes: true
+	};
+	const disabled = [
+		"list",
+		"get",
+		"create",
+		"update",
+		"delete"
+	].filter((op) => crud[op] !== true);
+	return {
+		...config,
+		crud: void 0,
+		disabledRoutes: disabled,
+		disableDefaultRoutes: legacyDisableAll ?? false
+	};
+}
+//#endregion
 //#region src/core/schemaOptions.ts
 /**
 * Inject the tenant-scoping field rule into `schemaOptions.fieldRules`:
@@ -1096,7 +1246,7 @@ function buildResourcePlugin(resource) {
 				idField: resource.idField
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-CRaIwB5S.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-DGCCp-kP.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1110,7 +1260,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-n3O6WdLO.mjs"), import("./validate-DFIP2VrM.mjs").then((n) => n.i)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-Ca77b8iK.mjs"), import("./validate-0__MuUsK.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1659,7 +1809,7 @@ function validateActionsShape(config) {
 //#endregion
 //#region src/core/defineResource.ts
 function defineResource(config) {
-	const normalisedConfig = resolveCrudAllowList(expandCustomRoutesOnly(expandReferenceData(config)));
+	const normalisedConfig = normalizeResourceConfig(config);
 	let diagnostics = [];
 	if (!normalisedConfig.skipValidation) diagnostics = validateDefineResourceConfig(normalisedConfig);
 	const repository = normalisedConfig.adapter?.repository;
@@ -1683,98 +1833,6 @@ function defineResource(config) {
 	if (diagnostics.length > 0) resource._diagnostics = diagnostics;
 	return resource;
 }
-/**
-* Normalise the 2.16 `crud:` positive-form allow-list into the canonical
-* `{ disabledRoutes, disableDefaultRoutes }` pair the rest of arc reads.
-*
-* Three input forms collapse to one output:
-*   - `crud: false`           → `disableDefaultRoutes: true`
-*   - `crud: { list: true }`  → `disabledRoutes: [get,create,update,delete]`
-*   - legacy `disabledRoutes` → passed through unchanged
-*
-* Mutually exclusive: `crud` + `disabledRoutes` together is a config bug
-* (the host meant ONE of two intents) — throw rather than pick.
-*
-* Lifted out of the `ResourceDefinition` constructor in 2.16 so the
-* validator (Phase 1) observes the post-resolve shape — `crud: false`
-* now looks like `disableDefaultRoutes: true` to the validator, so it
-* doesn't false-positive "Data adapter required when CRUD routes are
-* enabled" on a host that explicitly opted CRUD out.
-*/
-/**
-* Expand the `referenceData: true` shorthand. Reference data is the
-* recurring "small static catalogue" shape (currencies, plans,
-* pipeline stages, credential types) where callers want "fetch all"
-* semantics and aggressive caching — pre-2.17.0 hosts hand-wired
-* `crud` + `defaultLimit` + `maxLimit` + `cache` on every such
-* resource. The shorthand pins canonical defaults; explicit narrow
-* settings always win so a host can opt INTO mutations
-* (`referenceData: true, crud: { list: true, get: true, create: true }`)
-* or override the cache window without giving up the read-only +
-* fetch-all defaults.
-*/
-function expandReferenceData(config) {
-	if (config.referenceData !== true) return config;
-	return {
-		...config,
-		crud: config.crud ?? {
-			list: true,
-			get: true
-		},
-		defaultLimit: config.defaultLimit ?? 1e3,
-		maxLimit: config.maxLimit ?? 1e3,
-		cache: config.cache ?? {
-			staleTime: 300,
-			gcTime: 600
-		}
-	};
-}
-/**
-* Expand the `customRoutesOnly: true` shorthand into its three primitive
-* flags. The shorthand exists because hosts wiring a "service resource"
-* (custom routes only, no adapter, no auto-CRUD) had to remember to set
-* `disableDefaultRoutes` + `skipValidation` + `skipRegistry` in lockstep —
-* forgetting any one of them produced confusing errors ("controller
-* required when CRUD routes are enabled" for a resource that ships none).
-*
-* Explicit narrow settings always win — the shorthand only fills in
-* flags that were not set so power users can opt back into a specific
-* primitive (`customRoutesOnly: true, skipRegistry: false` keeps OpenAPI
-* docs while still skipping CRUD + validation).
-*/
-function expandCustomRoutesOnly(config) {
-	if (config.customRoutesOnly !== true) return config;
-	return {
-		...config,
-		customRoutesOnly: void 0,
-		disableDefaultRoutes: config.disableDefaultRoutes ?? true,
-		skipValidation: config.skipValidation ?? true,
-		skipRegistry: config.skipRegistry ?? true
-	};
-}
-function resolveCrudAllowList(config) {
-	const { crud, disabledRoutes: legacyDisabled, disableDefaultRoutes: legacyDisableAll } = config;
-	if (crud === void 0) return config;
-	if (legacyDisabled !== void 0) throw new Error(`[Arc] Resource '${config.name}': pass either \`crud\` (positive allow-list) or \`disabledRoutes\` (negative opt-out), not both. The positive form is the documented default going forward; drop \`disabledRoutes\` when both are set.`);
-	if (crud === false) return {
-		...config,
-		crud: void 0,
-		disableDefaultRoutes: true
-	};
-	const disabled = [
-		"list",
-		"get",
-		"create",
-		"update",
-		"delete"
-	].filter((op) => crud[op] !== true);
-	return {
-		...config,
-		crud: void 0,
-		disabledRoutes: disabled,
-		disableDefaultRoutes: legacyDisableAll ?? false
-	};
-}
 //#endregion
 //#region src/core/defineResourceVariants.ts
 /**

package/dist/{createActionRouter-CRaIwB5S.mjs → createActionRouter-DGCCp-kP.mjs}

@@ -1,8 +1,10 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import "./constants-TrJVIJl0.mjs";
 import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { S as sendControllerResponse, a as buildAuthMiddlewareForPermissions, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, l as buildPreHandlerChain, m as resolveRouterPluginMw, n as buildActionPipelineHandler, r as buildArcDecorator, t as buildActionPermissionMw, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Bk6Tns82.mjs";
+import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, r as selectPluginMw, s as buildAuthMiddlewareForPermissions, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
+import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
+import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-D4sqiokR.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CE6USIRi.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,

package/dist/{createAggregationRouter-n3O6WdLO.mjs → createAggregationRouter-Ca77b8iK.mjs}

@@ -1,7 +1,7 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, r as buildArcDecorator, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
-import { r as validateAggregations } from "./validate-DFIP2VrM.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-C_SkBNF3.mjs";
+import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
+import { n as validateAggregations } from "./validate-0__MuUsK.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-Cvrc2p7r.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is

package/dist/{createApp-DZvrb587.mjs → createApp-DLuUGVZQ.mjs}

@@ -202,7 +202,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Dxp9JlKK.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-Bw4bUDEO.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -239,15 +239,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-8MfrrUYU.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-C0DdKiYB.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-B4XMSSe7.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-CnAeFqju.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-QOLe11D5.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-TdTHCS9-.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -256,19 +256,19 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-jh5OqFjR.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-Xq8UtuQx.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-B-PU4-Yu.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-Da2EUPi9.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-CuIwUQZ2.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-C0K8KQLx.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -337,7 +337,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-6mfTLBC-.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-BzhyVWfn.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -347,7 +347,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-wQejMBT3.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-Bua97SEt.mjs").then((n) => n.r);
 	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
@@ -448,7 +448,7 @@ async function registerResources(fastify, config) {
 	let discoveryPath;
 	let discoveryYieldedZero = false;
 	if (resolvedResources === void 0 && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-fol6JuvW.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-CwXt9MCh.mjs").then((n) => n.n);
 		const { resolve, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const rawDir = config.resourceDir;
@@ -896,7 +896,7 @@ async function createApp(options) {
 	await registerErrorHandler(fastify, config, trackPlugin);
 	await registerResources(fastify, config);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-boS5Rx26.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-DXHVxrrj.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {

package/dist/{defineEvent-NPKUJRt8.mjs → defineEvent-DC981g-o.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { n as createEvent } from "./EventTransport-ClEDfiMS.mjs";
+import { n as createEvent } from "./EventTransport-7LPXLEUX.mjs";
 //#region src/events/defineEvent.ts
 /**
 * defineEvent — Typed Event Definitions with Optional Schema Validation