@classytic/arc 2.19.0 → 2.21.0

package/dist/events/index.mjs

@@ -417,12 +417,13 @@ function repositoryAsOutboxStore(repository) {
 		},
 		async getPending(limit) {
 			const now = /* @__PURE__ */ new Date();
-			return unwrapDocs(await r.getAll({
+			const result = await r.getAll({
 				filters: claimableFilter(now),
 				sort: { createdAt: 1 },
 				page: 1,
 				limit
-			})).map((d) => d.event).filter(isWellFormed);
+			});
+			return unwrapDocs(result).map((d) => d.event).filter(isWellFormed);
 		},
 		async claimPending(options) {
 			const limit = options?.limit ?? DEFAULT_CLAIM_LIMIT;
@@ -493,12 +494,13 @@ function repositoryAsOutboxStore(repository) {
 			}
 		},
 		async getDeadLettered(limit) {
-			return unwrapDocs(await r.getAll({
+			const result = await r.getAll({
 				filters: eq("status", "dead_letter"),
 				sort: { [idField]: 1 },
 				page: 1,
 				limit
-			})).filter((d) => isWellFormed(d.event)).map((d) => ({
+			});
+			return unwrapDocs(result).filter((d) => isWellFormed(d.event)).map((d) => ({
 				event: d.event,
 				error: {
 					message: d.lastError?.message ?? "unknown",
@@ -513,13 +515,14 @@ function repositoryAsOutboxStore(repository) {
 			const cutoff = new Date(Date.now() - olderThanMs);
 			let totalDeleted = 0;
 			for (;;) {
-				const batch = unwrapDocs(await r.getAll({
+				const result = await r.getAll({
 					filters: and(eq("status", "delivered"), lte("deliveredAt", cutoff)),
 					sort: { deliveredAt: 1 },
 					page: 1,
 					limit: DEFAULT_PURGE_BATCH,
 					select: idField
-				}));
+				});
+				const batch = unwrapDocs(result);
 				if (batch.length === 0) break;
 				const ids = batch.map((d) => d[idField]);
 				const res = await r.deleteMany(anyOf(idField, ids));

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,2 +1,2 @@
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-DsP1vqZB.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-iVR2l7aS.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis.d.mts

@@ -1,5 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-IEn7Tn-Q.mjs";
-
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-QmY7A258.mjs";
 //#region src/events/transports/redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/factory/index.d.mts

@@ -1,13 +1,14 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, f as LoadResourcesOptions, h as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, m as ResourceModule, n as BetterAuthOption, o as JwtAuthOption, p as ResourceLike, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-9_wtNPsI.mjs";
+import { a as getModuleExports, c as LoadResourcesOptions, d as loadResources, i as defineModule, l as ResourceLike, n as ArcModuleInput, o as orderModules, r as ArcModuleRegistry, s as resolveModule, t as ArcModule, u as ResourceModule } from "../module-WeuU5jfd.mjs";
+import "../fastify-augmentation-DafigGQp.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-DpxoNX5v.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
-
 //#region src/factory/createApp.d.ts
 /**
  * Create a production-ready Fastify application with Arc framework.
  *
  * Boot order:
  * ```
- * 0. Logger, validation, preset merge
+ * 0. Logger, validation → beforeBoot() (DB connect etc.), preset merge
  * 1. Create Fastify instance
  * 2. Security plugins (Helmet, CORS, Rate Limit) — opt-out
  * 3. Utility plugins (Under Pressure, Sensible, Multipart, Raw Body)
@@ -95,4 +96,4 @@ declare const edgePreset: Partial<CreateAppOptions>;
  */
 declare function getPreset(name: "production" | "development" | "testing" | "edge"): Partial<CreateAppOptions>;
 //#endregion
-export { ArcFactory, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type MultipartOptions, type RawBodyOptions, type ResourceLike, type ResourceModule, type UnderPressureOptions, createApp, developmentPreset, edgePreset, getPreset, loadResources, preloadResources, preloadResourcesAsync, productionPreset, testingPreset, toFetchHandler };
+export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type MultipartOptions, type RawBodyOptions, type ResourceLike, type ResourceModule, type UnderPressureOptions, createApp, defineModule, developmentPreset, edgePreset, getModuleExports, getPreset, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveModule, testingPreset, toFetchHandler };

package/dist/factory/index.mjs

@@ -1,6 +1,6 @@
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CHw3_oA_.mjs";
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp--703hQE1.mjs";
-import { t as loadResources } from "../loadResources-B8UmpITt.mjs";
+import { a as edgePreset, c as testingPreset, d as orderModules, f as resolveModule, i as developmentPreset, l as defineModule, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory, u as getModuleExports } from "../createApp-Bi61XxqU.mjs";
+import { t as loadResources } from "../loadResources-DpU8pfjV.mjs";
 //#region src/factory/edge.ts
 /**
 * Convert a Fastify app into a Web Standards fetch handler.
@@ -47,4 +47,4 @@ function toFetchHandler(app, options = {}) {
 	};
 }
 //#endregion
-export { ArcFactory, createApp, developmentPreset, edgePreset, getPreset, loadResources, preloadResources, preloadResourcesAsync, productionPreset, testingPreset, toFetchHandler };
+export { ArcFactory, createApp, defineModule, developmentPreset, edgePreset, getModuleExports, getPreset, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveModule, testingPreset, toFetchHandler };

package/dist/{fastify-augmentation-D-5_yQJi.d.mts → fastify-augmentation-DafigGQp.d.mts}

@@ -1,7 +1,7 @@
-import { bn as HookSystem, z as ResourceRegistry } from "./index-CUTG2Cuo.mjs";
+import { bn as HookSystem, z as ResourceRegistry } from "./index-Dtrj6XZk.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
+import { r as ArcModuleRegistry } from "./module-WeuU5jfd.mjs";
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/core/arcCorePlugin.d.ts
 interface ArcCorePluginOptions {
   /** Enable event emission for CRUD operations (requires eventPlugin) */
@@ -28,6 +28,16 @@ interface ArcCore {
   externalOpenApiPaths: ExternalOpenApiPaths[];
   /** Registered plugins for introspection */
   plugins: Map<string, PluginMeta>;
+  /**
+   * Module public exports — `bootstrap()` return values keyed by module name
+   * (see `src/factory/module.ts`). Read via `getModuleExports(fastify, name)`:
+   * augment `ArcModuleRegistry` once and the name infers the export type;
+   * otherwise pass it inline. `Partial<ArcModuleRegistry>` gives augmented
+   * apps typed direct access (`fastify.arc.modules.order`), while the
+   * `Record<string, unknown>` intersection keeps un-augmented reads open.
+   * Populated lazily by `registerResources` — absent until a module exports.
+   */
+  modules?: Partial<ArcModuleRegistry> & Record<string, unknown>;
 }
 declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
 declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;

package/dist/{fields-C7ahdGYf.d.mts → fields-BGqrAa_u.d.mts}

@@ -1,6 +1,5 @@
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
 import { FastifyRequest } from "fastify";
-
 //#region src/permissions/types.d.ts
 /**
  * User base interface - minimal shape Arc expects

package/dist/{generate-Brans3fW.mjs → generate-usRSdQmP.mjs}

@@ -1,4 +1,4 @@
-import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
+import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts
@@ -601,9 +601,10 @@ async function generate(type, args) {
 	if (!type) throw new Error("Missing type argument\nUsage: arc generate <resource|controller|model|repository|schemas> <name>");
 	const [name, ...restArgs] = args;
 	if (!name) throw new Error("Missing name argument\nUsage: arc generate <type> <name>\nExample: arc generate resource product");
+	if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(name)) throw new Error(`Invalid name "${name}". Use kebab-case: a letter followed by letters, digits, or hyphens (e.g. 'product', 'order-line'). No slashes, dots, spaces, or path segments.`);
 	const capitalizedName = toPascalCase(name);
 	const lowerName = name.toLowerCase();
-	if ((type === "resource" || type === "r" || type === "model" || type === "m") && new Set([
+	if ((type === "resource" || type === "r" || type === "model" || type === "m") && (/* @__PURE__ */ new Set([
 		"user",
 		"session",
 		"account",
@@ -614,7 +615,7 @@ async function generate(type, args) {
 		"team",
 		"team-member",
 		"apikey"
-	]).has(lowerName)) {
+	])).has(lowerName)) {
 		console.warn(`\n[arc generate] "${lowerName}" is a Better Auth-owned collection.\nBetter Auth's organization/admin/bearer plugins write this collection directly,\nso generating a parallel arc model would create a duplicate registration.\n\nRecommended pattern:\n  import { createBetterAuthOverlay } from '@classytic/mongokit/better-auth';\n  const adapter = await createBetterAuthOverlay({\n    auth, mongoose, collection: '${lowerName}',\n  });\n  // ...then \`defineResource({ name: '${lowerName}', adapter, ... })\` reads\n  //    BA's collection through arc with full pagination/filters/permissions.\n\nAborting. Re-run with a different name if you need a separate domain model.\n`);
 		return;
 	}

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { Cn as afterDelete, Dn as beforeUpdate, En as beforeDelete, On as createHookSystem, Sn as afterCreate, Tn as beforeCreate, _n as HookOperation, bn as HookSystem, gn as HookHandler, hn as HookContext, kn as defineHook, mn as DefineHookOptions, vn as HookPhase, wn as afterUpdate, xn as HookSystemOptions, yn as HookRegistration } from "../index-CUTG2Cuo.mjs";
+import { Cn as afterDelete, Dn as beforeUpdate, En as beforeDelete, On as createHookSystem, Sn as afterCreate, Tn as beforeCreate, _n as HookOperation, bn as HookSystem, gn as HookHandler, hn as HookContext, kn as defineHook, mn as DefineHookOptions, vn as HookPhase, wn as afterUpdate, xn as HookSystemOptions, yn as HookRegistration } from "../index-Dtrj6XZk.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -1,8 +1,7 @@
 import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-Uk8ONJv7.mjs";
-import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-C3W0qbz8.mjs";
+import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-UDtLaNj6.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
-
 //#region src/idempotency/idempotencyPlugin.d.ts
 interface IdempotencyPluginOptions {
   /** Enable idempotency (default: false) */
@@ -60,7 +59,9 @@ declare module "fastify" {
   interface FastifyInstance {
     /** Idempotency utilities */
     idempotency: {
-      /** Manually invalidate an idempotency key */invalidate: (key: string) => Promise<void>; /** Check if a key has a cached response */
+      /** Manually invalidate an idempotency key */
+      invalidate: (key: string) => Promise<void>;
+      /** Check if a key has a cached response */
       has: (key: string) => Promise<boolean>;
       /**
        * Route-level preHandler for idempotency check + lock.

package/dist/idempotency/index.mjs

@@ -387,7 +387,7 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		const statusCode = reply.statusCode;
 		if (statusCode < 200 || statusCode >= 300) return payload;
 		const headersToCache = {};
-		const excludeHeaders = new Set([
+		const excludeHeaders = /* @__PURE__ */ new Set([
 			"content-length",
 			"transfer-encoding",
 			"connection",

package/dist/idempotency/redis.d.mts

@@ -1,2 +1,2 @@
-import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-C3W0qbz8.mjs";
+import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-UDtLaNj6.mjs";
 export { type IoredisLike, type RedisClient, RedisIdempotencyStore, type RedisIdempotencyStoreOptions, type UpstashRedisLike, ioredisAsIdempotencyClient, upstashAsIdempotencyClient };

package/dist/{index-CP6A1Ffj.d.mts → index-B5N-NaHs.d.mts}

@@ -1,11 +1,12 @@
-import { C as RequestContext, Et as AggregationConfig, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, L as RequestWithExtras, T as CrudRouterOptions, V as ResourceDefinition, bt as IControllerResponse, ht as RouteSchemaOptions, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, st as ResourceConfig, xt as IRequestContext, yt as IController } from "./index-CUTG2Cuo.mjs";
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
-import { c as PermissionCheck } from "./fields-C7ahdGYf.mjs";
+import { C as RequestContext, Et as AggregationConfig, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, L as RequestWithExtras, T as CrudRouterOptions, V as ResourceDefinition, bt as IControllerResponse, ht as RouteSchemaOptions, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, st as ResourceConfig, xt as IRequestContext, yt as IController } from "./index-Dtrj6XZk.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
+import { c as PermissionCheck } from "./fields-BGqrAa_u.mjs";
+import "./fastify-augmentation-DafigGQp.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
+import { DataAdapter } from "@classytic/repo-core/adapter";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { LookupSpec } from "@classytic/repo-core/lookup";
-
 //#region src/constants.d.ts
 /**
  * Arc Framework Constants — Single Source of Truth
@@ -130,7 +131,7 @@ declare function createPermissionMiddleware(permission: PermissionCheck, resourc
  * Plain JSON-Schema entries skip the inference path entirely (they go
  * through the untyped `ActionDefinition` form).
  */
-interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefined, TData = (TSchema extends z.ZodTypeAny ? z.infer<TSchema> : Record<string, unknown>)> {
+interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefined, TData = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : Record<string, unknown>> {
   /** Per-action body schema (Zod v4). Drives both AJV validation and the typed `data` param. */
   schema?: TSchema;
   /** Per-action permission gate. Falls back to resource-level if omitted. */
@@ -167,6 +168,86 @@ interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefine
  */
 declare function defineAction<TSchema extends z.ZodTypeAny | undefined = undefined>(config: DefineActionConfig<TSchema>): ActionDefinition;
 //#endregion
+//#region src/core/defineResource/seams.d.ts
+/**
+ * Structural adapter boundary — the `ControllerLike` pattern (v2.10.6)
+ * applied to adapters. `DataAdapter<T>` is invariant in `T`, so a
+ * `DataAdapter<HydratedDocument<IProduct>>` built by the HOST does not
+ * assign to a module's `DataAdapter<AnyRecord>` slot; before this type,
+ * module authors erased the slot to `unknown` and cast at every use.
+ *
+ * Arc only reaches for these members at runtime — the rest of the adapter's
+ * shape is the caller's concern. All slots optional + `unknown` so every
+ * kit adapter (mongokit, sqlitekit, prismakit, custom) assigns structurally.
+ *
+ * Used by {@link ResourceSeams}; `ResourceConfig.adapter` itself stays
+ * `DataAdapter<TDoc>` so `defineResource`'s doc-type inference is untouched.
+ */
+interface AdapterLike {
+  repository?: unknown;
+  generateSchemas?: unknown;
+  getSchemaMetadata?: unknown;
+}
+/**
+ * Seam-slot type transform, two widenings per property:
+ *
+ *   - admits explicit `undefined` — {@link mergeResourceConfig} skips
+ *     `undefined` values at runtime, so the type says so. Makes
+ *     field-mapping seams (`{ permissions: cfg.permissionsMap, ... }`)
+ *     ergonomic under `exactOptionalPropertyTypes: true` (stricter than
+ *     arc's own tsconfig — found by a live spine-module smoke).
+ *   - array slots also accept `readonly` arrays — hosts naturally write
+ *     route/preset tables `as const` or behind `readonly` exports; the
+ *     merge copies arrays into fresh mutable ones, so a frozen host table
+ *     never leaks into arc's internals.
+ */
+type SeamSlot<V> = V | undefined | (V extends (infer E)[] ? readonly E[] : never);
+type SkippableUndefined<T> = { [K in keyof T]: SeamSlot<T[K]>; };
+/**
+ * The host-injectable subset of a resource config — everything a module can
+ * let its host override, i.e. every `ResourceConfig` slot except the
+ * module-owned `name` (and the internal preset-tracking field).
+ *
+ * Type your module's per-resource override bundles as `ResourceSeams` (or a
+ * `Pick<ResourceSeams, ...>` allow-list when you want to constrain what
+ * hosts may touch) and pass them through {@link mergeResourceConfig}.
+ */
+type ResourceSeams<TDoc = AnyRecord> = SkippableUndefined<Omit<ResourceConfig<TDoc>, "name" | "_appliedPresets" | "adapter">> & {
+  /** Any kit adapter — widened via {@link AdapterLike} at this boundary. */
+  adapter?: DataAdapter<TDoc> | AdapterLike | undefined;
+};
+/**
+ * Base-config input for {@link mergeResourceConfig} — a required `name`
+ * plus every seam slot (which is exactly `ResourceConfig` with the
+ * {@link AdapterLike} widening, `undefined`-skipping, and readonly-array
+ * acceptance the seams get). Module builders constructing DEFAULT adapters
+ * from untyped kernel engine bags hit the identical `DataAdapter<T>`
+ * invariance at the base as hosts do at the seam.
+ */
+type SeamedResourceConfig<TDoc = AnyRecord> = {
+  name: string;
+} & ResourceSeams<TDoc>;
+/**
+ * Canonical slot-aware merge of a base resource config with host seams.
+ * Later seams win over earlier ones; `undefined` values never clobber.
+ *
+ * Merge semantics (value-driven — no per-slot registry to drift):
+ *
+ *   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+ *     `routeGuards`, `disabledRoutes`: additive collections, base first.
+ *   - **Plain objects merge recursively** — `permissions`, `actions`,
+ *     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+ *     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+ *     them replace (they're value lists — enums, sort specs), not concat.
+ *   - **Everything else last-wins** — class instances (`adapter`,
+ *     `controller`, `queryParser`), functions, scalars.
+ *
+ * The single `as` at the return is the one documented erasure for the
+ * {@link AdapterLike}-widened seam slots — inside the helper so no module
+ * author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+ */
+declare function mergeResourceConfig<TDoc = AnyRecord>(base: SeamedResourceConfig<TDoc>, ...seams: ReadonlyArray<ResourceSeams<TDoc> | undefined>): ResourceConfig<TDoc>;
+//#endregion
 //#region src/core/defineResourceVariants.d.ts
 /**
  * Required identity fields for each variant. The user MUST provide a unique
@@ -188,7 +269,7 @@ type VariantsMap<TDoc = AnyRecord> = Record<string, VariantOverride<TDoc>>;
  * Result type — preserves the variant keys so destructuring is type-safe:
  * `const { articlePublic, articleAdmin } = defineResourceVariants(...)`.
  */
-type VariantsResult<TDoc, V extends VariantsMap<TDoc>> = { [K in keyof V]: ResourceDefinition<TDoc> };
+type VariantsResult<TDoc, V extends VariantsMap<TDoc>> = { [K in keyof V]: ResourceDefinition<TDoc>; };
 /**
  * Define multiple resources from a shared base config and per-variant overrides.
  *
@@ -344,4 +425,4 @@ declare function isFieldReadable(rule: ArcFieldRule | undefined): boolean;
  */
 declare function collectReadBlockedFields(schemaOptions: RouteSchemaOptions | undefined): Set<string> | null;
 //#endregion
-export { MAX_FILTER_DEPTH as A, DEFAULT_SORT as C, HOOK_PHASES as D, HOOK_OPERATIONS as E, RESERVED_QUERY_PARAMS as F, SYSTEM_FIELDS as I, MAX_SEARCH_LENGTH as M, MUTATION_OPERATIONS as N, HookOperation as O, MutationOperation as P, DEFAULT_MAX_LIMIT as S, DEFAULT_UPDATE_METHOD as T, defineAggregation as _, createRequestContext as a, DEFAULT_ID_FIELD as b, sendControllerResponse as c, getEntityQuery as d, defineResourceVariants as f, createPermissionMiddleware as g, createCrudRouter as h, createFastifyHandler as i, MAX_REGEX_LENGTH as j, HookPhase as k, getEntityId as l, defineAction as m, isFieldReadable as n, getControllerContext as o, DefineActionConfig as p, createCrudHandlers as r, getControllerScope as s, collectReadBlockedFields as t, getEntityIdField as u, CRUD_OPERATIONS as v, DEFAULT_TENANT_FIELD as w, DEFAULT_LIMIT as x, CrudOperation as y };
+export { HOOK_OPERATIONS as A, SYSTEM_FIELDS as B, CrudOperation as C, DEFAULT_SORT as D, DEFAULT_MAX_LIMIT as E, MAX_REGEX_LENGTH as F, MAX_SEARCH_LENGTH as I, MUTATION_OPERATIONS as L, HookOperation as M, HookPhase as N, DEFAULT_TENANT_FIELD as O, MAX_FILTER_DEPTH as P, MutationOperation as R, CRUD_OPERATIONS as S, DEFAULT_LIMIT as T, DefineActionConfig as _, createRequestContext as a, createPermissionMiddleware as b, sendControllerResponse as c, getEntityQuery as d, defineResourceVariants as f, mergeResourceConfig as g, SeamedResourceConfig as h, createFastifyHandler as i, HOOK_PHASES as j, DEFAULT_UPDATE_METHOD as k, getEntityId as l, ResourceSeams as m, isFieldReadable as n, getControllerContext as o, AdapterLike as p, createCrudHandlers as r, getControllerScope as s, collectReadBlockedFields as t, getEntityIdField as u, defineAction as v, DEFAULT_ID_FIELD as w, defineAggregation as x, createCrudRouter as y, RESERVED_QUERY_PARAMS as z };

package/dist/{index-CRKiiP5o.d.mts → index-B5PoNbfu.d.mts}

@@ -1,8 +1,7 @@
 import { r as CacheStore, t as CacheLogger } from "./interface-C1_WLTMK.mjs";
-import { i as RequestScope, n as Mandate } from "./types-LNebCoJx.mjs";
-import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-C7ahdGYf.mjs";
+import { i as RequestScope, n as Mandate } from "./types-DH0GupI7.mjs";
+import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-BGqrAa_u.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
-
 //#region src/permissions/agent.d.ts
 /**
  * Require a sender-constrained credential — the inbound token MUST carry a
@@ -356,8 +355,11 @@ interface DynamicPermissionMatrixConfig {
    * and `ttlSeconds > 0`, Arc creates an internal MemoryCacheStore.
    */
   cache?: {
-    /** Cache TTL in seconds */ttlSeconds: number; /** Optional custom cache key builder */
-    key?: (ctx: PermissionContext) => string | null | undefined; /** Hard entry cap for internal memory store (default: 1000) */
+    /** Cache TTL in seconds */
+    ttlSeconds: number;
+    /** Optional custom cache key builder */
+    key?: (ctx: PermissionContext) => string | null | undefined;
+    /** Hard entry cap for internal memory store (default: 1000) */
     maxEntries?: number;
   };
 }
@@ -620,7 +622,7 @@ declare function requireOrgInScope<TDoc = Record<string, unknown>>(target: strin
  */
 declare function requireTeamMembership<TDoc = Record<string, unknown>>(): PermissionCheck<TDoc>;
 declare namespace presets_d_exports {
-  export { adminOnly, authenticated, fullPublic, ownerWithAdminBypass, publicRead, publicReadAdminWrite, readOnly };
+  export { adminOnly, authenticated, fullPublic, ownerWithAdminBypass, permissionMatrix, publicRead, publicReadAdminWrite, readOnly };
 }
 /**
  * ResourcePermissions shape — matches the type in types/index.ts
@@ -652,6 +654,33 @@ declare function authenticated<TDoc = Record<string, unknown>>(overrides?: Permi
  * @param roles - Required roles (user needs at least one). Default: ['admin']
  */
 declare function adminOnly<TDoc = Record<string, unknown>>(roles?: readonly string[], overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
+/**
+ * Arbitrary-gate CRUD matrix — the generalization every host and arc-*
+ * module hand-rolls as `{ list: view, get: view, create: manage, ... }`.
+ *
+ * Unlike the fixed presets above, the gates are caller-supplied
+ * `PermissionCheck`s, so ANY combinator plugs in — org roles, ownership,
+ * `anyOf(...)`, service scopes, custom async checks. `delete` defaults to
+ * the `write` gate.
+ *
+ * @example
+ * ```typescript
+ * // Two-gate (view/manage) — the arc-* module convention:
+ * permissionMatrix({ read: requireAuth(), write: requireOrgRole('manager') })
+ *
+ * // Three-gate with a stricter delete:
+ * permissionMatrix({
+ *   read: allowPublic(),
+ *   write: requireOrgRole('manager'),
+ *   delete: requireOrgRole('owner'),
+ * })
+ * ```
+ */
+declare function permissionMatrix<TDoc = Record<string, unknown>>(gates: {
+  read: PermissionCheck<TDoc>;
+  write: PermissionCheck<TDoc>;
+  delete?: PermissionCheck<TDoc>;
+}, overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 /**
  * Owner-scoped with admin bypass.
  * list = auth (scoped to owner), get = auth, create = auth,
@@ -669,7 +698,12 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
 /**
  * Read-only: list + get authenticated, write operations denied.
  * Useful for computed/derived resources.
+ *
+ * Writes carry an explicit `denyAll` check — an omitted CRUD permission
+ * mounts the route with NO gate (public-by-omission), so leaving
+ * create/update/delete undefined here would expose unauthenticated writes.
+ * Hosts that disable write routes entirely (`disabledRoutes`) are unaffected.
  */
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
-export { requireRoles as A, allOf as C, not as D, denyAll as E, RequireAgentScopeOptions as F, RequireMandateOptions as I, requireAgentScope as L, when as M, applyPermissionResult as N, requireAuth as O, normalizePermissionResult as P, requireDPoP as R, createOrgPermissions as S, anyOf as T, ConnectEventsOptions as _, presets_d_exports as a, PermissionEventBus as b, readOnly as c, requireOrgRole as d, requireScopeContext as f, createRoleHierarchy as g, RoleHierarchy as h, ownerWithAdminBypass as i, roles as j, requireOwnership as k, requireOrgInScope as l, requireTeamMembership as m, authenticated as n, publicRead as o, requireServiceScope as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, requireOrgMembership as u, DynamicPermissionMatrix as v, allowPublic as w, createDynamicPermissionMatrix as x, DynamicPermissionMatrixConfig as y, requireMandate as z };
+export { requireOwnership as A, requireMandate as B, createOrgPermissions as C, denyAll as D, anyOf as E, normalizePermissionResult as F, RequireAgentScopeOptions as I, RequireMandateOptions as L, roles as M, when as N, not as O, applyPermissionResult as P, requireAgentScope as R, createDynamicPermissionMatrix as S, allowPublic as T, createRoleHierarchy as _, permissionMatrix as a, DynamicPermissionMatrixConfig as b, publicReadAdminWrite as c, requireOrgMembership as d, requireOrgRole as f, RoleHierarchy as g, requireTeamMembership as h, ownerWithAdminBypass as i, requireRoles as j, requireAuth as k, readOnly as l, requireServiceScope as m, authenticated as n, presets_d_exports as o, requireScopeContext as p, fullPublic as r, publicRead as s, adminOnly as t, requireOrgInScope as u, ConnectEventsOptions as v, allOf as w, PermissionEventBus as x, DynamicPermissionMatrix as y, requireDPoP as z };