@classytic/arc 2.18.5 → 2.19.0

package/dist/encryption/index.mjs

@@ -0,0 +1,270 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import fp from "fastify-plugin";
+//#region src/encryption/fieldCipher.ts
+/**
+* Field-level cipher — `node:crypto` AES-256-GCM, zero external deps.
+*
+* Used by `mode: 'fields'` to encrypt individual field values in place while
+* leaving the JSON structure intact. The envelope is an authenticated,
+* versioned, `kid`-tagged token:
+*
+*   arc.v1.<b64url(kid)>.<b64url(iv)>.<b64url(ciphertext)>.<b64url(tag)>
+*
+* This is NOT a hand-rolled cipher — it's the correct use of a vetted AEAD
+* primitive (AES-256-GCM): a fresh random 96-bit IV per operation (never
+* caller-supplied — IV reuse under GCM is catastrophic), authentication via
+* the GCM tag, and a version prefix so the format can evolve. Same shape, in
+* spirit, as MongoDB CSFLE's BSON-binary subtype-6 envelope. For
+* cross-vendor interop or asymmetric keys use `mode: 'jwe'` (RFC 7516)
+* instead.
+*/
+const ENVELOPE_PREFIX = "arc.v1";
+const IV_BYTES = 12;
+const KEY_BYTES = 32;
+function b64url(buf) {
+	return buf.toString("base64url");
+}
+function toKeyBuffer(key) {
+	if (Buffer.isBuffer(key)) {
+		if (key.length !== KEY_BYTES) throw new Error(`[arc/encryption] field-mode key must be ${KEY_BYTES} bytes (AES-256); got ${key.length}`);
+		return key;
+	}
+	if (key instanceof Uint8Array) return toKeyBuffer(Buffer.from(key));
+	throw new Error("[arc/encryption] field-mode key must be a 32-byte Buffer/Uint8Array. For asymmetric or cross-vendor encryption use mode: 'jwe'.");
+}
+/** Encrypt a UTF-8 string into the `arc.v1` field envelope. */
+function encryptField(plaintext, kid, key) {
+	const secret = toKeyBuffer(key);
+	const iv = randomBytes(IV_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", secret, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return [
+		ENVELOPE_PREFIX,
+		b64url(Buffer.from(kid, "utf8")),
+		b64url(iv),
+		b64url(ciphertext),
+		b64url(tag)
+	].join(".");
+}
+/** Returns the parsed envelope, or `null` when the token isn't `arc.v1`. */
+function parseFieldEnvelope(token) {
+	if (typeof token !== "string") return null;
+	const parts = token.split(".");
+	if (parts.length !== 6) return null;
+	const [v0, v1, kidPart, ivPart, ctPart, tagPart] = parts;
+	if (`${v0}.${v1}` !== ENVELOPE_PREFIX) return null;
+	if (kidPart === void 0 || ivPart === void 0 || ctPart === void 0 || tagPart === void 0) return null;
+	try {
+		return {
+			kid: Buffer.from(kidPart, "base64url").toString("utf8"),
+			iv: Buffer.from(ivPart, "base64url"),
+			ciphertext: Buffer.from(ctPart, "base64url"),
+			tag: Buffer.from(tagPart, "base64url")
+		};
+	} catch {
+		return null;
+	}
+}
+/** Decrypt a parsed `arc.v1` envelope with the resolved key. Throws on tamper. */
+function decryptField(envelope, key) {
+	const decipher = createDecipheriv("aes-256-gcm", toKeyBuffer(key), envelope.iv);
+	decipher.setAuthTag(envelope.tag);
+	return Buffer.concat([decipher.update(envelope.ciphertext), decipher.final()]).toString("utf8");
+}
+//#endregion
+//#region src/encryption/jose.ts
+let josePromise;
+/** Load `jose` once, caching the module. Throws an actionable error if absent. */
+async function loadJose() {
+	if (!josePromise) josePromise = import("jose").then((m) => m, (cause) => {
+		josePromise = void 0;
+		throw new Error("[arc/encryption] mode 'jwe' requires the optional peer dependency `jose`. Install it with `npm i jose`, or use mode: 'fields' (node:crypto, no dependency).", { cause });
+	});
+	return josePromise;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** Encrypt a UTF-8 string into a JWE compact serialization. */
+async function jweEncrypt(plaintext, active, alg, enc) {
+	return new (await (loadJose())).CompactEncrypt(encoder.encode(plaintext)).setProtectedHeader({
+		alg: active.alg ?? alg,
+		enc,
+		kid: active.kid
+	}).encrypt(active.key);
+}
+/**
+* Decrypt a JWE compact string. `resolve` maps the header `kid` to a key;
+* the allowlists are enforced by `jose` so a malicious header can't downgrade
+* the algorithm.
+*/
+async function jweDecrypt(jwe, resolve, allowedAlgs, allowedEncs) {
+	const { plaintext } = await (await loadJose()).compactDecrypt(jwe, async (header) => {
+		if (!header.kid) throw new Error("[arc/encryption] inbound JWE is missing the `kid` header");
+		const key = await resolve(header.kid);
+		if (key === void 0) throw new Error(`[arc/encryption] no decryption key for kid '${header.kid}'`);
+		return key;
+	}, {
+		keyManagementAlgorithms: [...allowedAlgs],
+		contentEncryptionAlgorithms: [...allowedEncs]
+	});
+	return decoder.decode(plaintext);
+}
+//#endregion
+//#region src/encryption/resolver.ts
+function routeDirective(request) {
+	return (request.routeOptions?.config)?.arcExtensions?.encryption;
+}
+function finalize(directive, defaultMode) {
+	if (directive.enabled === false) return null;
+	return {
+		mode: directive.mode ?? defaultMode,
+		fields: directive.fields ?? []
+	};
+}
+/**
+* Resolve the active directive for a request, or `null` to skip encryption.
+*
+* @param request     incoming request (carries route config)
+* @param defaultMode plugin-level default mode
+* @param fallback    plugin-level `routes` matcher (optional)
+*/
+function resolveDirective(request, defaultMode, fallback) {
+	const declared = routeDirective(request);
+	if (declared) return finalize(declared, defaultMode);
+	if (fallback) {
+		const result = fallback(request);
+		if (result === true) return {
+			mode: defaultMode,
+			fields: []
+		};
+		if (result && typeof result === "object") return finalize(result, defaultMode);
+	}
+	return null;
+}
+//#endregion
+//#region src/encryption/encryptionPlugin.ts
+function getPath(obj, path) {
+	let cur = obj;
+	for (const seg of path.split(".")) {
+		if (cur === null || typeof cur !== "object") return void 0;
+		cur = cur[seg];
+	}
+	return cur;
+}
+function setPath(obj, path, value) {
+	const segs = path.split(".");
+	const last = segs[segs.length - 1];
+	if (last === void 0) return;
+	let cur = obj;
+	for (let i = 0; i < segs.length - 1; i++) {
+		const seg = segs[i];
+		if (seg === void 0) return;
+		const next = cur[seg];
+		if (next === null || typeof next !== "object") return;
+		cur = next;
+	}
+	cur[last] = value;
+}
+const encryptionPlugin = async (fastify, opts) => {
+	const { enabled = true, keyProvider, mode: defaultMode = "jwe", alg = "RSA-OAEP-256", enc = "A256GCM", routes: fallback, decryptRequests = true, contentType = "application/jose", responseContentType = "application/jose", flagHeader = "x-encrypted" } = opts;
+	fastify.decorateRequest("requestDecrypted", false);
+	fastify.decorateRequest("responseEncrypted", false);
+	if (enabled === false) {
+		fastify.log?.debug?.("[arc/encryption] disabled");
+		return;
+	}
+	if (!keyProvider) throw new Error("[arc/encryption] `keyProvider` is required when the plugin is enabled.");
+	const allowedAlgs = opts.allowedAlgs ?? [alg];
+	const allowedEncs = opts.allowedEncs ?? [enc];
+	function setFlag(reply) {
+		if (flagHeader) reply.header(flagHeader, "true");
+	}
+	if (decryptRequests) fastify.addContentTypeParser(contentType, { parseAs: "string" }, async (request, body) => {
+		const provider = keyProvider;
+		const plaintext = await jweDecrypt(body, (kid) => provider.decryptionKey(kid, { request }), allowedAlgs, allowedEncs);
+		request.requestDecrypted = true;
+		if (plaintext.length === 0) return void 0;
+		try {
+			return JSON.parse(plaintext);
+		} catch (cause) {
+			throw Object.assign(/* @__PURE__ */ new Error("[arc/encryption] decrypted request body is not valid JSON"), {
+				statusCode: 400,
+				cause
+			});
+		}
+	});
+	fastify.addHook("preSerialization", async (request, reply, payload) => {
+		const directive = resolveDirective(request, defaultMode, fallback);
+		if (!directive) return payload;
+		if (payload === null || typeof payload !== "object") return payload;
+		if (directive.mode === "fields") {
+			if (directive.fields.length === 0) return payload;
+			const { kid, key } = await keyProvider.encryptionKey({ request });
+			const obj = payload;
+			let touched = false;
+			for (const path of directive.fields) {
+				const value = getPath(obj, path);
+				if (value === void 0 || value === null) continue;
+				setPath(obj, path, encryptField(JSON.stringify(value), kid, key));
+				touched = true;
+			}
+			if (touched) {
+				setFlag(reply);
+				request.responseEncrypted = true;
+			}
+			return payload;
+		}
+		const active = await keyProvider.encryptionKey({ request });
+		const jwe = await jweEncrypt(JSON.stringify(payload), active, alg, enc);
+		reply.header("content-type", responseContentType);
+		setFlag(reply);
+		reply.serializer((p) => p);
+		request.responseEncrypted = true;
+		return jwe;
+	});
+	fastify.log?.debug?.({
+		mode: defaultMode,
+		alg,
+		enc
+	}, "[arc/encryption] enabled");
+};
+var encryptionPlugin_default = fp(encryptionPlugin, {
+	name: "arc-encryption",
+	fastify: "5.x"
+});
+//#endregion
+//#region src/encryption/keyProvider.ts
+/**
+* A static, in-memory key provider with `kid`-based rotation. Keys are held
+* for the process lifetime — resolve them from env / a secrets file at boot
+* and pass the imported key material in (don't re-parse PEM per request).
+*
+* @example symmetric field mode
+* ```ts
+* const provider = createStaticKeyProvider({
+*   encryptionKey: { kid: "2026-06", key: Buffer.from(process.env.FIELD_KEY!, "base64") },
+* });
+* ```
+*
+* @example asymmetric JWE (jose key material)
+* ```ts
+* const provider = createStaticKeyProvider({
+*   encryptionKey: { kid: "client-1", key: await importSPKI(clientPubPem, "RSA-OAEP-256") },
+*   decryptionKeys: { "server-1": await importPKCS8(serverPrivPem, "RSA-OAEP-256") },
+* });
+* ```
+*/
+function createStaticKeyProvider(options) {
+	const { encryptionKey } = options;
+	const decryptionKeys = {
+		[encryptionKey.kid]: encryptionKey.key,
+		...options.decryptionKeys
+	};
+	return {
+		encryptionKey: () => encryptionKey,
+		decryptionKey: (kid) => decryptionKeys[kid]
+	};
+}
+//#endregion
+export { createStaticKeyProvider, decryptField, encryptionPlugin_default as default, encryptField, encryptionPlugin, parseFieldEnvelope };

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-CmkknLzI.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-9_wtNPsI.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 
 //#region src/factory/createApp.d.ts

package/dist/{fastify-augmentation-Cxb0ROIw.d.mts → fastify-augmentation-D-5_yQJi.d.mts}

@@ -1,4 +1,4 @@
-import { yn as HookSystem, z as ResourceRegistry } from "./index-CHNQIhcb.mjs";
+import { bn as HookSystem, z as ResourceRegistry } from "./index-CUTG2Cuo.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { Cn as afterUpdate, Dn as createHookSystem, En as beforeUpdate, On as defineHook, Sn as afterDelete, Tn as beforeDelete, _n as HookPhase, bn as HookSystemOptions, gn as HookOperation, hn as HookHandler, mn as HookContext, pn as DefineHookOptions, vn as HookRegistration, wn as beforeCreate, xn as afterCreate, yn as HookSystem } from "../index-CHNQIhcb.mjs";
+import { Cn as afterDelete, Dn as beforeUpdate, En as beforeDelete, On as createHookSystem, Sn as afterCreate, Tn as beforeCreate, _n as HookOperation, bn as HookSystem, gn as HookHandler, hn as HookContext, kn as defineHook, mn as DefineHookOptions, vn as HookPhase, wn as afterUpdate, xn as HookSystemOptions, yn as HookRegistration } from "../index-CUTG2Cuo.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/{index-Dh0_RSTd.d.mts → index-CP6A1Ffj.d.mts}

@@ -1,4 +1,4 @@
-import { C as RequestContext, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, bt as IRequestContext, ft as RouteMcpConfig, mt as RouteSchemaOptions, q as CrudController, st as ResourceConfig, vt as IController, yt as IControllerResponse } from "./index-CHNQIhcb.mjs";
+import { C as RequestContext, Et as AggregationConfig, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, L as RequestWithExtras, T as CrudRouterOptions, V as ResourceDefinition, bt as IControllerResponse, ht as RouteSchemaOptions, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, st as ResourceConfig, xt as IRequestContext, yt as IController } from "./index-CUTG2Cuo.mjs";
 import { i as RequestScope } from "./types-LNebCoJx.mjs";
 import { c as PermissionCheck } from "./fields-C7ahdGYf.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
@@ -300,7 +300,7 @@ declare function sendControllerResponse<T>(reply: FastifyReply, response: IContr
  * fastify.get('/products', listHandler);
  * ```
  */
-declare function createFastifyHandler<T>(controllerMethod: (req: IRequestContext) => Promise<IControllerResponse<T>>): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+declare function createFastifyHandler<T>(controllerMethod: (req: IRequestContext) => Promise<IControllerResponse<T>>): (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
 /**
  * Create Fastify adapters for all CRUD methods of an IController
  *
@@ -319,11 +319,11 @@ declare function createFastifyHandler<T>(controllerMethod: (req: IRequestContext
  * ```
  */
 declare function createCrudHandlers<TDoc>(controller: IController<TDoc>): {
-  list: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  get: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  create: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  update: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  delete: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+  list: (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
+  get: (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
+  create: (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
+  update: (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
+  delete: (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply>;
 };
 //#endregion
 //#region src/core/fieldRulePredicates.d.ts

package/dist/{index-CHNQIhcb.d.mts → index-CUTG2Cuo.d.mts}

@@ -2667,6 +2667,48 @@ interface ResourcePermissions {
   update?: PermissionCheck;
   delete?: PermissionCheck;
 }
+/**
+ * Plugin extension namespace — arc's typed escape hatch for attaching
+ * declarative, per-resource config that **plugins** read at request time.
+ *
+ * This interface is intentionally **empty in core**. Each optional plugin
+ * augments it via TypeScript declaration merging to register its own typed
+ * slice — exactly the model Fastify uses for `FastifyInstance` decorators.
+ * A host that never installs a plugin never sees its key; a host that does
+ * gets full autocomplete + compile-time checking on the matching
+ * `extensions` block, and a typo (`extensions: { encyrption: … }`) is a
+ * type error rather than a silent no-op.
+ *
+ * **The "React for backend" composition model.** `defineResource()` is the
+ * declarative component, `extensions` is its typed props bag, and plugins
+ * are the providers that consume those props at the framework boundary.
+ * Adding a cross-cutting capability becomes *additive* — a plugin ships a
+ * subpath + a one-line `declare module` augmentation, with no new
+ * first-class `ResourceConfig` field and no core release per feature.
+ *
+ * Arc threads the declared `extensions` onto every generated route's
+ * Fastify `config` (see `createCrudRouter`), so a plugin reads its slice
+ * at request time via `request.routeOptions.config.arcExtensions` without
+ * re-deriving which resource a route belongs to.
+ *
+ * @example A plugin registers its slice (in `@classytic/arc/encryption`)
+ * ```ts
+ * declare module "@classytic/arc/types" {
+ *   interface ResourceExtensions {
+ *     encryption?: import("@classytic/arc/encryption").EncryptionDirective;
+ *   }
+ * }
+ * ```
+ *
+ * @example A host declares it on a resource
+ * ```ts
+ * defineResource({
+ *   name: "payment",
+ *   extensions: { encryption: { mode: "fields", fields: ["cardNumber", "cvv"] } },
+ * });
+ * ```
+ */
+interface ResourceExtensions {}
 interface ResourceConfig<TDoc = AnyRecord> {
   name: string;
   displayName?: string;
@@ -3097,6 +3139,26 @@ interface ResourceConfig<TDoc = AnyRecord> {
   audit?: boolean | {
     operations?: ("create" | "update" | "delete")[];
   };
+  /**
+   * Typed plugin-extension namespace — declarative per-resource config that
+   * arc plugins read at request time. Empty by default; each installed
+   * plugin augments {@link ResourceExtensions} with its own typed slice via
+   * `declare module`. See {@link ResourceExtensions} for the full rationale
+   * and the "React for backend" composition model.
+   *
+   * Threaded onto every generated route's Fastify `config` as
+   * `config.arcExtensions`, so a plugin reads its slice via
+   * `request.routeOptions.config.arcExtensions` without a resource lookup.
+   *
+   * @example
+   * ```ts
+   * defineResource({
+   *   name: "payment",
+   *   extensions: { encryption: { mode: "fields", fields: ["cardNumber"] } },
+   * });
+   * ```
+   */
+  extensions?: ResourceExtensions;
 }
 //#endregion
 //#region src/core/defineResource/diagnostics.d.ts
@@ -3189,6 +3251,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
    */
   readonly onFieldWriteDenied?: "reject" | "strip";
   readonly cache?: ResourceCacheConfig;
+  readonly extensions?: ResourceExtensions;
   readonly referenceData: boolean;
   /**
    * Per-resource MCP opt-out. `false` keeps the resource out of every
@@ -3544,6 +3607,18 @@ type FastifyWithDecorators = FastifyInstance & {
 };
 /** Handler signature for middleware functions. */
 type MiddlewareHandler = (request: RequestWithExtras, reply: FastifyReply) => Promise<unknown>;
+/**
+ * Route-config augmentation — arc stamps `defineResource({ extensions })`
+ * onto every generated route's Fastify `config` under `arcExtensions`, so
+ * plugins read their typed slice at request time via
+ * `request.routeOptions.config.arcExtensions` without re-resolving which
+ * resource a route belongs to. Type-only; see `ResourceExtensions`.
+ */
+declare module "fastify" {
+  interface FastifyContextConfig {
+    arcExtensions?: ResourceExtensions;
+  }
+}
 //#endregion
 //#region src/types/plugins.d.ts
 interface GracefulShutdownOptions {
@@ -3619,6 +3694,13 @@ interface CrudRouterOptions {
    * re-reading resource config. Defaults to `_id`.
    */
   idField?: string;
+  /**
+   * Resource-level plugin extensions (`defineResource({ extensions })`).
+   * Stamped onto every registered route's Fastify `config.arcExtensions`
+   * so request-time plugins (encryption, …) read their typed slice without
+   * re-resolving which resource a route belongs to. See `ResourceExtensions`.
+   */
+  extensions?: ResourceExtensions;
 }
 //#endregion
 //#region src/types/query.d.ts
@@ -4032,4 +4114,4 @@ interface ValidateOptions {
   strict?: boolean;
 }
 //#endregion
-export { OnTenantDeleteConfig as $, BaseController as $t, RequestIdOptions as A, ArcDeleteResult as An, AggregationRateLimit as At, defineResource as B, AuthHelpers as Bt, RequestContext as C, afterUpdate as Cn, AggMeasureShorthand as Ct, HealthCheck as D, createHookSystem as Dn, AggregationIndexHint as Dt, GracefulShutdownOptions as E, beforeUpdate as En, AggregationDateRangeRequirement as Et, FastifyWithDecorators as F, ControllerConfigurableOptions as Fn, OperationFilter as Ft, ActionsMap as G, TokenPair as Gt, ActionDefinition as H, Authenticator as Ht, MiddlewareHandler as I, ControllerConstructionOptions as In, PipelineConfig as It, CrudRouteKey as J, ArcRequest as Jt, ArcFieldRule as K, AnyRecord as Kt, RequestWithExtras as L, ListResult as Ln, PipelineContext as Lt, EventsDecorator as M, ArcListResult as Mn, Guard as Mt, FastifyRequestExtras as N, ArcUpdateResult as Nn, Interceptor as Nt, HealthOptions as O, defineHook as On, AggregationMaterializedContext as Ot, FastifyWithAuth as P, BaseControllerOptions as Pn, NextFunction as Pt, MiddlewareConfig as Q, UserOrganization as Qt, RegisterOptions as R, BodySanitizer as Rn, PipelineStep as Rt, QueryParserInterface as S, afterDelete as Sn, AggMeasureInput as St, CrudRouterOptions as T, beforeDelete as Tn, AggregationConfig as Tt, ActionEntry as U, AuthenticatorContext as Ut, ResourceDefinition as V, AuthPluginOptions as Vt, ActionHandlerFn as W, JwtContext as Wt, EventDefinition as X, ObjectId as Xt, CrudSchemas as Y, JWTPayload as Yt, FieldRule$1 as Z, UserLike as Zt, ControllerQueryOptions as _, HookPhase as _n, FastifyHandler as _t, InferAdapterDoc as a, SlugMixin as an, ResolvedTenantPurge as at, ParsedQuery as b, HookSystemOptions as bn, IRequestContext as bt, TypedController as c, BaseCrudController as cn, ResourceHookContext as ct, PaginationResult as d, AccessControl as dn, RouteDefinition as dt, SoftDeleteExt as en, OpenApiSchemas as et, IntrospectionData as f, AccessControlConfig as fn, RouteMcpConfig as ft, ArcInternalMetadata as g, HookOperation as gn, ControllerLike as gt, ResourceMetadata as h, HookHandler as hn, ControllerHandler as ht, ValidationResult as i, SlugExt as in, RateLimitConfig as it, ArcDecorator as j, ArcGetResult as jn, AggregationsMap as jt, IntrospectionPluginOptions as k, ArcCreateResult as kn, AggregationMaterializedResult as kt, TypedRepository as l, QueryResolver as ln, ResourceHooks as lt, RegistryStats as m, HookContext as mn, RouteSchemaOptions as mt, ConfigError as n, TreeExt as nn, PresetHook as nt, InferDocType as o, BulkExt as on, ResourceCacheConfig as ot, RegistryEntry as p, DefineHookOptions as pn, RouteMethod as pt, CrudController as q, ApiResponse as qt, ValidateOptions as r, TreeMixin as rn, PresetResult as rt, InferResourceDoc as s, BulkMixin as sn, ResourceConfig as st, RouteHandlerMethod$1 as t, SoftDeleteMixin as tn, PresetFunction as tt, TypedResourceConfig as u, QueryResolverConfig as un, ResourcePermissions as ut, LookupOption as v, HookRegistration as vn, IController as vt, ServiceContext as w, beforeCreate as wn, AggregationCacheConfig as wt, PopulateOption as x, afterCreate as xn, RouteHandler as xt, OwnershipCheck as y, HookSystem as yn, IControllerResponse as yt, ResourceRegistry as z, BodySanitizerConfig as zn, Transform as zt };
+export { OnTenantDeleteConfig as $, UserOrganization as $t, RequestIdOptions as A, ArcCreateResult as An, AggregationMaterializedResult as At, defineResource as B, BodySanitizerConfig as Bn, Transform as Bt, RequestContext as C, afterDelete as Cn, AggMeasureInput as Ct, HealthCheck as D, beforeUpdate as Dn, AggregationDateRangeRequirement as Dt, GracefulShutdownOptions as E, beforeDelete as En, AggregationConfig as Et, FastifyWithDecorators as F, BaseControllerOptions as Fn, NextFunction as Ft, ActionsMap as G, JwtContext as Gt, ActionDefinition as H, AuthPluginOptions as Ht, MiddlewareHandler as I, ControllerConfigurableOptions as In, OperationFilter as It, CrudRouteKey as J, ApiResponse as Jt, ArcFieldRule as K, TokenPair as Kt, RequestWithExtras as L, ControllerConstructionOptions as Ln, PipelineConfig as Lt, EventsDecorator as M, ArcGetResult as Mn, AggregationsMap as Mt, FastifyRequestExtras as N, ArcListResult as Nn, Guard as Nt, HealthOptions as O, createHookSystem as On, AggregationIndexHint as Ot, FastifyWithAuth as P, ArcUpdateResult as Pn, Interceptor as Pt, MiddlewareConfig as Q, UserLike as Qt, RegisterOptions as R, ListResult as Rn, PipelineContext as Rt, QueryParserInterface as S, afterCreate as Sn, RouteHandler as St, CrudRouterOptions as T, beforeCreate as Tn, AggregationCacheConfig as Tt, ActionEntry as U, Authenticator as Ut, ResourceDefinition as V, AuthHelpers as Vt, ActionHandlerFn as W, AuthenticatorContext as Wt, EventDefinition as X, JWTPayload as Xt, CrudSchemas as Y, ArcRequest as Yt, FieldRule$1 as Z, ObjectId as Zt, ControllerQueryOptions as _, HookOperation as _n, ControllerLike as _t, InferAdapterDoc as a, SlugExt as an, ResolvedTenantPurge as at, ParsedQuery as b, HookSystem as bn, IControllerResponse as bt, TypedController as c, BulkMixin as cn, ResourceExtensions as ct, PaginationResult as d, QueryResolverConfig as dn, ResourcePermissions as dt, BaseController as en, OpenApiSchemas as et, IntrospectionData as f, AccessControl as fn, RouteDefinition as ft, ArcInternalMetadata as g, HookHandler as gn, ControllerHandler as gt, ResourceMetadata as h, HookContext as hn, RouteSchemaOptions as ht, ValidationResult as i, TreeMixin as in, RateLimitConfig as it, ArcDecorator as j, ArcDeleteResult as jn, AggregationRateLimit as jt, IntrospectionPluginOptions as k, defineHook as kn, AggregationMaterializedContext as kt, TypedRepository as l, BaseCrudController as ln, ResourceHookContext as lt, RegistryStats as m, DefineHookOptions as mn, RouteMethod as mt, ConfigError as n, SoftDeleteMixin as nn, PresetHook as nt, InferDocType as o, SlugMixin as on, ResourceCacheConfig as ot, RegistryEntry as p, AccessControlConfig as pn, RouteMcpConfig as pt, CrudController as q, AnyRecord as qt, ValidateOptions as r, TreeExt as rn, PresetResult as rt, InferResourceDoc as s, BulkExt as sn, ResourceConfig as st, RouteHandlerMethod$1 as t, SoftDeleteExt as tn, PresetFunction as tt, TypedResourceConfig as u, QueryResolver as un, ResourceHooks as ut, LookupOption as v, HookPhase as vn, FastifyHandler as vt, ServiceContext as w, afterUpdate as wn, AggMeasureShorthand as wt, PopulateOption as x, HookSystemOptions as xn, IRequestContext as xt, OwnershipCheck as y, HookRegistration as yn, IController as yt, ResourceRegistry as z, BodySanitizer as zn, PipelineStep as zt };

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { $t as BaseController, A as RequestIdOptions, An as ArcDeleteResult, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, Fn as ControllerConfigurableOptions, In as ControllerConstructionOptions, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, Ln as ListResult, Mn as ArcListResult, N as FastifyRequestExtras, Nn as ArcUpdateResult, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Pn as BaseControllerOptions, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseCrudController, d as PaginationResult, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gt as ControllerLike, h as ResourceMetadata, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jn as ArcGetResult, jt as AggregationsMap, k as IntrospectionPluginOptions, kn as ArcCreateResult, kt as AggregationMaterializedResult, l as TypedRepository, m as RegistryStats, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yt as IControllerResponse } from "./index-CHNQIhcb.mjs";
+import { $t as UserOrganization, A as RequestIdOptions, An as ArcCreateResult, At as AggregationMaterializedResult, B as defineResource, C as RequestContext, Ct as AggMeasureInput, D as HealthCheck, Dt as AggregationDateRangeRequirement, E as GracefulShutdownOptions, Et as AggregationConfig, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ht as AuthPluginOptions, In as ControllerConfigurableOptions, J as CrudRouteKey, Jt as ApiResponse, L as RequestWithExtras, Ln as ControllerConstructionOptions, Mn as ArcGetResult, Mt as AggregationsMap, N as FastifyRequestExtras, Nn as ArcListResult, O as HealthOptions, Ot as AggregationIndexHint, P as FastifyWithAuth, Pn as ArcUpdateResult, Q as MiddlewareConfig, Rn as ListResult, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, Tt as AggregationCacheConfig, V as ResourceDefinition, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, _t as ControllerLike, a as InferAdapterDoc, an as SlugExt, bt as IControllerResponse, c as TypedController, cn as BulkMixin, d as PaginationResult, en as BaseController, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, in as TreeMixin, it as RateLimitConfig, jn as ArcDeleteResult, jt as AggregationRateLimit, k as IntrospectionPluginOptions, kt as AggregationMaterializedContext, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, n as ConfigError, nn as SoftDeleteMixin, o as InferDocType, on as SlugMixin, p as RegistryEntry, q as CrudController, qt as AnyRecord, r as ValidateOptions, rn as TreeExt, rt as PresetResult, s as InferResourceDoc, sn as BulkExt, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteExt, tt as PresetFunction, u as TypedResourceConfig, w as ServiceContext, wt as AggMeasureShorthand, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "./index-CUTG2Cuo.mjs";
 import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-C7ahdGYf.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-Dh0_RSTd.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-CP6A1Ffj.mjs";
 import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-CRKiiP5o.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DOHkjQlD.mjs";
 

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-gaEeMlz-.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
 import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-ZnQBa5rh.mjs";
+import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-Ba-6Sue6.mjs";
 import { C as requireAuth, D as when, F as applyFieldWritePermissions, I as fields, P as applyFieldReadPermissions, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-BPB1xqGf.mjs";
-import { l as getControllerScope } from "./actionPermissions-h7DYDNMg.mjs";
+import { l as getControllerScope } from "./actionPermissions-D7NGwcAR.mjs";
 //#region src/index.ts
-const version = "2.18.5";
+const version = "2.19.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-D60PFwfG.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-DpvSF5Hh.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,7 +1,7 @@
-import { V as ResourceDefinition, bt as IRequestContext, yt as IControllerResponse } from "../../index-CHNQIhcb.mjs";
+import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-CUTG2Cuo.mjs";
 import { i as RequestScope } from "../../types-LNebCoJx.mjs";
 import { c as PermissionCheck } from "../../fields-C7ahdGYf.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-D60PFwfG.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-DpvSF5Hh.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-D1wuRD2c.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-C088Nd-G.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { c as McpAuthResult, l as McpPluginOptions } from "../../types-D60PFwfG.mjs";
+import { c as McpAuthResult, l as McpPluginOptions } from "../../types-DpvSF5Hh.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-D1wuRD2c.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-C088Nd-G.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/{mcpPlugin-D1wuRD2c.mjs → mcpPlugin-C088Nd-G.mjs}

@@ -1,7 +1,7 @@
 import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
 import { t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
 import { N as normalizePermissionResult } from "./permissions-BPB1xqGf.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-D7NGwcAR.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
 import { i as shouldRejectAdditionalProperties, r as schemaIRToZodShape, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CHNQIhcb.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CUTG2Cuo.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/{openapi-xVJibapr.mjs → openapi-DZ-5a5Op.mjs}

@@ -1,8 +1,8 @@
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-U0MnO9vd.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-D7NGwcAR.mjs";
 import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-CagItpxI.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-B_WzBFyf.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-CHNQIhcb.mjs";
+import { Bt as Transform, Ft as NextFunction, It as OperationFilter, Lt as PipelineConfig, Nt as Guard, Pt as Interceptor, Rt as PipelineContext, bt as IControllerResponse, zt as PipelineStep } from "../index-CUTG2Cuo.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/plugins/index.d.mts

@@ -1,5 +1,5 @@
-import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-CHNQIhcb.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-Cxb0ROIw.mjs";
+import { Q as MiddlewareConfig, ft as RouteDefinition, ht as RouteSchemaOptions, nt as PresetHook, qt as AnyRecord } from "../index-CUTG2Cuo.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-D-5_yQJi.mjs";
 import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-D_eBCfNr.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-BtUUDPEa.mjs";
 import { t as TracingOptions } from "../tracing-D8jlGXP7.mjs";

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.18.5";
+	const resolvedVersion = serviceVersion ?? "2.19.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/presets/filesUpload.d.mts

@@ -1,4 +1,4 @@
-import { rt as PresetResult } from "../index-CHNQIhcb.mjs";
+import { rt as PresetResult } from "../index-CUTG2Cuo.mjs";
 import { i as RequestScope } from "../types-LNebCoJx.mjs";
 import { c as PermissionCheck } from "../fields-C7ahdGYf.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Co_PQpeQ.mjs";

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-CHNQIhcb.mjs";
+import { bt as IControllerResponse, d as PaginationResult, qt as AnyRecord, rt as PresetResult, st as ResourceConfig, xt as IRequestContext } from "../index-CUTG2Cuo.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, rt as PresetResult } from "../index-CHNQIhcb.mjs";
+import { J as CrudRouteKey, rt as PresetResult } from "../index-CUTG2Cuo.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**