@classytic/arc 2.20.0 → 2.21.0

package/dist/factory/index.mjs

@@ -1,6 +1,6 @@
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CHw3_oA_.mjs";
-import { a as getModuleExports, c as developmentPreset, d as productionPreset, f as testingPreset, i as defineModule, l as edgePreset, n as createApp, o as orderModules, s as resolveModule, t as ArcFactory, u as getPreset } from "../createApp-D6uwzCKu.mjs";
-import { t as loadResources } from "../loadResources-B8UmpITt.mjs";
+import { a as edgePreset, c as testingPreset, d as orderModules, f as resolveModule, i as developmentPreset, l as defineModule, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory, u as getModuleExports } from "../createApp-Bi61XxqU.mjs";
+import { t as loadResources } from "../loadResources-DpU8pfjV.mjs";
 //#region src/factory/edge.ts
 /**
 * Convert a Fastify app into a Web Standards fetch handler.

package/dist/{fastify-augmentation-CCQJEDgh.d.mts → fastify-augmentation-DafigGQp.d.mts}

@@ -1,8 +1,7 @@
-import { bn as HookSystem, z as ResourceRegistry } from "./index-_--GyzcO.mjs";
+import { bn as HookSystem, z as ResourceRegistry } from "./index-Dtrj6XZk.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { r as ArcModuleRegistry } from "./module-JYH9V0I8.mjs";
+import { r as ArcModuleRegistry } from "./module-WeuU5jfd.mjs";
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/core/arcCorePlugin.d.ts
 interface ArcCorePluginOptions {
   /** Enable event emission for CRUD operations (requires eventPlugin) */

package/dist/{fields-C7ahdGYf.d.mts → fields-BGqrAa_u.d.mts}

@@ -1,6 +1,5 @@
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
 import { FastifyRequest } from "fastify";
-
 //#region src/permissions/types.d.ts
 /**
  * User base interface - minimal shape Arc expects

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { Cn as afterDelete, Dn as beforeUpdate, En as beforeDelete, On as createHookSystem, Sn as afterCreate, Tn as beforeCreate, _n as HookOperation, bn as HookSystem, gn as HookHandler, hn as HookContext, kn as defineHook, mn as DefineHookOptions, vn as HookPhase, wn as afterUpdate, xn as HookSystemOptions, yn as HookRegistration } from "../index-_--GyzcO.mjs";
+import { Cn as afterDelete, Dn as beforeUpdate, En as beforeDelete, On as createHookSystem, Sn as afterCreate, Tn as beforeCreate, _n as HookOperation, bn as HookSystem, gn as HookHandler, hn as HookContext, kn as defineHook, mn as DefineHookOptions, vn as HookPhase, wn as afterUpdate, xn as HookSystemOptions, yn as HookRegistration } from "../index-Dtrj6XZk.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -1,8 +1,7 @@
 import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-Uk8ONJv7.mjs";
-import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-C3W0qbz8.mjs";
+import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-UDtLaNj6.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
-
 //#region src/idempotency/idempotencyPlugin.d.ts
 interface IdempotencyPluginOptions {
   /** Enable idempotency (default: false) */
@@ -60,7 +59,9 @@ declare module "fastify" {
   interface FastifyInstance {
     /** Idempotency utilities */
     idempotency: {
-      /** Manually invalidate an idempotency key */invalidate: (key: string) => Promise<void>; /** Check if a key has a cached response */
+      /** Manually invalidate an idempotency key */
+      invalidate: (key: string) => Promise<void>;
+      /** Check if a key has a cached response */
       has: (key: string) => Promise<boolean>;
       /**
        * Route-level preHandler for idempotency check + lock.

package/dist/idempotency/redis.d.mts

@@ -1,2 +1,2 @@
-import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-C3W0qbz8.mjs";
+import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-UDtLaNj6.mjs";
 export { type IoredisLike, type RedisClient, RedisIdempotencyStore, type RedisIdempotencyStoreOptions, type UpstashRedisLike, ioredisAsIdempotencyClient, upstashAsIdempotencyClient };

package/dist/{index-DUa8WHz3.d.mts → index-B5N-NaHs.d.mts}

@@ -1,11 +1,12 @@
-import { C as RequestContext, Et as AggregationConfig, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, L as RequestWithExtras, T as CrudRouterOptions, V as ResourceDefinition, bt as IControllerResponse, ht as RouteSchemaOptions, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, st as ResourceConfig, xt as IRequestContext, yt as IController } from "./index-_--GyzcO.mjs";
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
-import { c as PermissionCheck } from "./fields-C7ahdGYf.mjs";
+import { C as RequestContext, Et as AggregationConfig, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, L as RequestWithExtras, T as CrudRouterOptions, V as ResourceDefinition, bt as IControllerResponse, ht as RouteSchemaOptions, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, st as ResourceConfig, xt as IRequestContext, yt as IController } from "./index-Dtrj6XZk.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
+import { c as PermissionCheck } from "./fields-BGqrAa_u.mjs";
+import "./fastify-augmentation-DafigGQp.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
+import { DataAdapter } from "@classytic/repo-core/adapter";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { LookupSpec } from "@classytic/repo-core/lookup";
-
 //#region src/constants.d.ts
 /**
  * Arc Framework Constants — Single Source of Truth
@@ -130,7 +131,7 @@ declare function createPermissionMiddleware(permission: PermissionCheck, resourc
  * Plain JSON-Schema entries skip the inference path entirely (they go
  * through the untyped `ActionDefinition` form).
  */
-interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefined, TData = (TSchema extends z.ZodTypeAny ? z.infer<TSchema> : Record<string, unknown>)> {
+interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefined, TData = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : Record<string, unknown>> {
   /** Per-action body schema (Zod v4). Drives both AJV validation and the typed `data` param. */
   schema?: TSchema;
   /** Per-action permission gate. Falls back to resource-level if omitted. */
@@ -167,6 +168,86 @@ interface DefineActionConfig<TSchema extends z.ZodTypeAny | undefined = undefine
  */
 declare function defineAction<TSchema extends z.ZodTypeAny | undefined = undefined>(config: DefineActionConfig<TSchema>): ActionDefinition;
 //#endregion
+//#region src/core/defineResource/seams.d.ts
+/**
+ * Structural adapter boundary — the `ControllerLike` pattern (v2.10.6)
+ * applied to adapters. `DataAdapter<T>` is invariant in `T`, so a
+ * `DataAdapter<HydratedDocument<IProduct>>` built by the HOST does not
+ * assign to a module's `DataAdapter<AnyRecord>` slot; before this type,
+ * module authors erased the slot to `unknown` and cast at every use.
+ *
+ * Arc only reaches for these members at runtime — the rest of the adapter's
+ * shape is the caller's concern. All slots optional + `unknown` so every
+ * kit adapter (mongokit, sqlitekit, prismakit, custom) assigns structurally.
+ *
+ * Used by {@link ResourceSeams}; `ResourceConfig.adapter` itself stays
+ * `DataAdapter<TDoc>` so `defineResource`'s doc-type inference is untouched.
+ */
+interface AdapterLike {
+  repository?: unknown;
+  generateSchemas?: unknown;
+  getSchemaMetadata?: unknown;
+}
+/**
+ * Seam-slot type transform, two widenings per property:
+ *
+ *   - admits explicit `undefined` — {@link mergeResourceConfig} skips
+ *     `undefined` values at runtime, so the type says so. Makes
+ *     field-mapping seams (`{ permissions: cfg.permissionsMap, ... }`)
+ *     ergonomic under `exactOptionalPropertyTypes: true` (stricter than
+ *     arc's own tsconfig — found by a live spine-module smoke).
+ *   - array slots also accept `readonly` arrays — hosts naturally write
+ *     route/preset tables `as const` or behind `readonly` exports; the
+ *     merge copies arrays into fresh mutable ones, so a frozen host table
+ *     never leaks into arc's internals.
+ */
+type SeamSlot<V> = V | undefined | (V extends (infer E)[] ? readonly E[] : never);
+type SkippableUndefined<T> = { [K in keyof T]: SeamSlot<T[K]>; };
+/**
+ * The host-injectable subset of a resource config — everything a module can
+ * let its host override, i.e. every `ResourceConfig` slot except the
+ * module-owned `name` (and the internal preset-tracking field).
+ *
+ * Type your module's per-resource override bundles as `ResourceSeams` (or a
+ * `Pick<ResourceSeams, ...>` allow-list when you want to constrain what
+ * hosts may touch) and pass them through {@link mergeResourceConfig}.
+ */
+type ResourceSeams<TDoc = AnyRecord> = SkippableUndefined<Omit<ResourceConfig<TDoc>, "name" | "_appliedPresets" | "adapter">> & {
+  /** Any kit adapter — widened via {@link AdapterLike} at this boundary. */
+  adapter?: DataAdapter<TDoc> | AdapterLike | undefined;
+};
+/**
+ * Base-config input for {@link mergeResourceConfig} — a required `name`
+ * plus every seam slot (which is exactly `ResourceConfig` with the
+ * {@link AdapterLike} widening, `undefined`-skipping, and readonly-array
+ * acceptance the seams get). Module builders constructing DEFAULT adapters
+ * from untyped kernel engine bags hit the identical `DataAdapter<T>`
+ * invariance at the base as hosts do at the seam.
+ */
+type SeamedResourceConfig<TDoc = AnyRecord> = {
+  name: string;
+} & ResourceSeams<TDoc>;
+/**
+ * Canonical slot-aware merge of a base resource config with host seams.
+ * Later seams win over earlier ones; `undefined` values never clobber.
+ *
+ * Merge semantics (value-driven — no per-slot registry to drift):
+ *
+ *   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+ *     `routeGuards`, `disabledRoutes`: additive collections, base first.
+ *   - **Plain objects merge recursively** — `permissions`, `actions`,
+ *     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+ *     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+ *     them replace (they're value lists — enums, sort specs), not concat.
+ *   - **Everything else last-wins** — class instances (`adapter`,
+ *     `controller`, `queryParser`), functions, scalars.
+ *
+ * The single `as` at the return is the one documented erasure for the
+ * {@link AdapterLike}-widened seam slots — inside the helper so no module
+ * author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+ */
+declare function mergeResourceConfig<TDoc = AnyRecord>(base: SeamedResourceConfig<TDoc>, ...seams: ReadonlyArray<ResourceSeams<TDoc> | undefined>): ResourceConfig<TDoc>;
+//#endregion
 //#region src/core/defineResourceVariants.d.ts
 /**
  * Required identity fields for each variant. The user MUST provide a unique
@@ -188,7 +269,7 @@ type VariantsMap<TDoc = AnyRecord> = Record<string, VariantOverride<TDoc>>;
  * Result type — preserves the variant keys so destructuring is type-safe:
  * `const { articlePublic, articleAdmin } = defineResourceVariants(...)`.
  */
-type VariantsResult<TDoc, V extends VariantsMap<TDoc>> = { [K in keyof V]: ResourceDefinition<TDoc> };
+type VariantsResult<TDoc, V extends VariantsMap<TDoc>> = { [K in keyof V]: ResourceDefinition<TDoc>; };
 /**
  * Define multiple resources from a shared base config and per-variant overrides.
  *
@@ -344,4 +425,4 @@ declare function isFieldReadable(rule: ArcFieldRule | undefined): boolean;
  */
 declare function collectReadBlockedFields(schemaOptions: RouteSchemaOptions | undefined): Set<string> | null;
 //#endregion
-export { MAX_FILTER_DEPTH as A, DEFAULT_SORT as C, HOOK_PHASES as D, HOOK_OPERATIONS as E, RESERVED_QUERY_PARAMS as F, SYSTEM_FIELDS as I, MAX_SEARCH_LENGTH as M, MUTATION_OPERATIONS as N, HookOperation as O, MutationOperation as P, DEFAULT_MAX_LIMIT as S, DEFAULT_UPDATE_METHOD as T, defineAggregation as _, createRequestContext as a, DEFAULT_ID_FIELD as b, sendControllerResponse as c, getEntityQuery as d, defineResourceVariants as f, createPermissionMiddleware as g, createCrudRouter as h, createFastifyHandler as i, MAX_REGEX_LENGTH as j, HookPhase as k, getEntityId as l, defineAction as m, isFieldReadable as n, getControllerContext as o, DefineActionConfig as p, createCrudHandlers as r, getControllerScope as s, collectReadBlockedFields as t, getEntityIdField as u, CRUD_OPERATIONS as v, DEFAULT_TENANT_FIELD as w, DEFAULT_LIMIT as x, CrudOperation as y };
+export { HOOK_OPERATIONS as A, SYSTEM_FIELDS as B, CrudOperation as C, DEFAULT_SORT as D, DEFAULT_MAX_LIMIT as E, MAX_REGEX_LENGTH as F, MAX_SEARCH_LENGTH as I, MUTATION_OPERATIONS as L, HookOperation as M, HookPhase as N, DEFAULT_TENANT_FIELD as O, MAX_FILTER_DEPTH as P, MutationOperation as R, CRUD_OPERATIONS as S, DEFAULT_LIMIT as T, DefineActionConfig as _, createRequestContext as a, createPermissionMiddleware as b, sendControllerResponse as c, getEntityQuery as d, defineResourceVariants as f, mergeResourceConfig as g, SeamedResourceConfig as h, createFastifyHandler as i, HOOK_PHASES as j, DEFAULT_UPDATE_METHOD as k, getEntityId as l, ResourceSeams as m, isFieldReadable as n, getControllerContext as o, AdapterLike as p, createCrudHandlers as r, getControllerScope as s, collectReadBlockedFields as t, getEntityIdField as u, defineAction as v, DEFAULT_ID_FIELD as w, defineAggregation as x, createCrudRouter as y, RESERVED_QUERY_PARAMS as z };

package/dist/{index-CdFkIMEd.d.mts → index-B5PoNbfu.d.mts}

@@ -1,8 +1,7 @@
 import { r as CacheStore, t as CacheLogger } from "./interface-C1_WLTMK.mjs";
-import { i as RequestScope, n as Mandate } from "./types-LNebCoJx.mjs";
-import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-C7ahdGYf.mjs";
+import { i as RequestScope, n as Mandate } from "./types-DH0GupI7.mjs";
+import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-BGqrAa_u.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
-
 //#region src/permissions/agent.d.ts
 /**
  * Require a sender-constrained credential — the inbound token MUST carry a
@@ -356,8 +355,11 @@ interface DynamicPermissionMatrixConfig {
    * and `ttlSeconds > 0`, Arc creates an internal MemoryCacheStore.
    */
   cache?: {
-    /** Cache TTL in seconds */ttlSeconds: number; /** Optional custom cache key builder */
-    key?: (ctx: PermissionContext) => string | null | undefined; /** Hard entry cap for internal memory store (default: 1000) */
+    /** Cache TTL in seconds */
+    ttlSeconds: number;
+    /** Optional custom cache key builder */
+    key?: (ctx: PermissionContext) => string | null | undefined;
+    /** Hard entry cap for internal memory store (default: 1000) */
     maxEntries?: number;
   };
 }
@@ -620,7 +622,7 @@ declare function requireOrgInScope<TDoc = Record<string, unknown>>(target: strin
  */
 declare function requireTeamMembership<TDoc = Record<string, unknown>>(): PermissionCheck<TDoc>;
 declare namespace presets_d_exports {
-  export { adminOnly, authenticated, fullPublic, ownerWithAdminBypass, publicRead, publicReadAdminWrite, readOnly };
+  export { adminOnly, authenticated, fullPublic, ownerWithAdminBypass, permissionMatrix, publicRead, publicReadAdminWrite, readOnly };
 }
 /**
  * ResourcePermissions shape — matches the type in types/index.ts
@@ -652,6 +654,33 @@ declare function authenticated<TDoc = Record<string, unknown>>(overrides?: Permi
  * @param roles - Required roles (user needs at least one). Default: ['admin']
  */
 declare function adminOnly<TDoc = Record<string, unknown>>(roles?: readonly string[], overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
+/**
+ * Arbitrary-gate CRUD matrix — the generalization every host and arc-*
+ * module hand-rolls as `{ list: view, get: view, create: manage, ... }`.
+ *
+ * Unlike the fixed presets above, the gates are caller-supplied
+ * `PermissionCheck`s, so ANY combinator plugs in — org roles, ownership,
+ * `anyOf(...)`, service scopes, custom async checks. `delete` defaults to
+ * the `write` gate.
+ *
+ * @example
+ * ```typescript
+ * // Two-gate (view/manage) — the arc-* module convention:
+ * permissionMatrix({ read: requireAuth(), write: requireOrgRole('manager') })
+ *
+ * // Three-gate with a stricter delete:
+ * permissionMatrix({
+ *   read: allowPublic(),
+ *   write: requireOrgRole('manager'),
+ *   delete: requireOrgRole('owner'),
+ * })
+ * ```
+ */
+declare function permissionMatrix<TDoc = Record<string, unknown>>(gates: {
+  read: PermissionCheck<TDoc>;
+  write: PermissionCheck<TDoc>;
+  delete?: PermissionCheck<TDoc>;
+}, overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 /**
  * Owner-scoped with admin bypass.
  * list = auth (scoped to owner), get = auth, create = auth,
@@ -677,4 +706,4 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
  */
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
-export { requireRoles as A, allOf as C, not as D, denyAll as E, RequireAgentScopeOptions as F, RequireMandateOptions as I, requireAgentScope as L, when as M, applyPermissionResult as N, requireAuth as O, normalizePermissionResult as P, requireDPoP as R, createOrgPermissions as S, anyOf as T, ConnectEventsOptions as _, presets_d_exports as a, PermissionEventBus as b, readOnly as c, requireOrgRole as d, requireScopeContext as f, createRoleHierarchy as g, RoleHierarchy as h, ownerWithAdminBypass as i, roles as j, requireOwnership as k, requireOrgInScope as l, requireTeamMembership as m, authenticated as n, publicRead as o, requireServiceScope as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, requireOrgMembership as u, DynamicPermissionMatrix as v, allowPublic as w, createDynamicPermissionMatrix as x, DynamicPermissionMatrixConfig as y, requireMandate as z };
+export { requireOwnership as A, requireMandate as B, createOrgPermissions as C, denyAll as D, anyOf as E, normalizePermissionResult as F, RequireAgentScopeOptions as I, RequireMandateOptions as L, roles as M, when as N, not as O, applyPermissionResult as P, requireAgentScope as R, createDynamicPermissionMatrix as S, allowPublic as T, createRoleHierarchy as _, permissionMatrix as a, DynamicPermissionMatrixConfig as b, publicReadAdminWrite as c, requireOrgMembership as d, requireOrgRole as f, RoleHierarchy as g, requireTeamMembership as h, ownerWithAdminBypass as i, requireRoles as j, requireAuth as k, readOnly as l, requireServiceScope as m, authenticated as n, presets_d_exports as o, requireScopeContext as p, fullPublic as r, publicRead as s, adminOnly as t, requireOrgInScope as u, ConnectEventsOptions as v, allOf as w, PermissionEventBus as x, DynamicPermissionMatrix as y, requireDPoP as z };

package/dist/{index-_--GyzcO.d.mts → index-Dtrj6XZk.d.mts}

@@ -1,14 +1,15 @@
-import { a as QueryCacheConfig } from "./QueryCache-TRfXau3W.mjs";
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
-import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-C7ahdGYf.mjs";
-import { n as DomainEvent } from "./EventTransport-IEn7Tn-Q.mjs";
+import { a as QueryCacheConfig } from "./QueryCache-Z1B38koh.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
+import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-BGqrAa_u.mjs";
+import "./elevation-C9s5hFP_.mjs";
+import { n as EncryptionDirective } from "./types-Cc91nXuA.mjs";
+import { n as DomainEvent } from "./EventTransport-QmY7A258.mjs";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 import { DataAdapter, RepositoryLike } from "@classytic/repo-core/adapter";
 import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 import { LookupSpec } from "@classytic/repo-core/lookup";
 import { FieldRule, SchemaBuilderOptions } from "@classytic/repo-core/schema";
-
 //#region src/core/BodySanitizer.d.ts
 /**
  * Policy for handling fields the caller lacks write permission for.
@@ -1082,7 +1083,8 @@ type ObjectId = string | {
  * The actual user structure is defined by your app's auth system.
  */
 type UserLike = UserBase & {
-  /** User email (optional) */email?: string;
+  /** User email (optional) */
+  email?: string;
 };
 interface UserOrganization {
   userId: string;
@@ -1229,11 +1231,17 @@ interface AuthPluginOptions {
    * utilities are available in the authenticator context.
    */
   jwt?: {
-    /** JWT secret (required for JWT features) */secret: string; /** Access token expiry (default: '15m') */
-    expiresIn?: string; /** Refresh token secret (defaults to main secret) */
-    refreshSecret?: string; /** Refresh token expiry (default: '7d') */
-    refreshExpiresIn?: string; /** Additional `@fastify/jwt` sign options */
-    sign?: Record<string, unknown>; /** Additional `@fastify/jwt` verify options */
+    /** JWT secret (required for JWT features) */
+    secret: string;
+    /** Access token expiry (default: '15m') */
+    expiresIn?: string;
+    /** Refresh token secret (defaults to main secret) */
+    refreshSecret?: string;
+    /** Refresh token expiry (default: '7d') */
+    refreshExpiresIn?: string;
+    /** Additional `@fastify/jwt` sign options */
+    sign?: Record<string, unknown>;
+    /** Additional `@fastify/jwt` verify options */
     verify?: Record<string, unknown>;
   };
   /**
@@ -2698,14 +2706,22 @@ interface ResourcePermissions {
  * Plugin extension namespace — arc's typed escape hatch for attaching
  * declarative, per-resource config that **plugins** read at request time.
  *
- * This interface is intentionally **empty in core**. Each optional plugin
- * augments it via TypeScript declaration merging to register its own typed
+ * **External** plugins augment it via TypeScript declaration merging
+ * (`declare module "@classytic/arc/types"`) to register their own typed
  * slice — exactly the model Fastify uses for `FastifyInstance` decorators.
- * A host that never installs a plugin never sees its key; a host that does
- * gets full autocomplete + compile-time checking on the matching
+ * The host gets full autocomplete + compile-time checking on the matching
  * `extensions` block, and a typo (`extensions: { encyrption: … }`) is a
  * type error rather than a silent no-op.
  *
+ * **First-party** slices (arc's own subpath plugins) are declared inline
+ * below with type-only imports instead of `declare module`. Not a style
+ * choice: arc bundles its declarations, and a relative module augmentation
+ * (`declare module "../types/resource.js"`) survives bundling as an
+ * unresolvable specifier — the merge silently never happens for consumers,
+ * so the key would be a compile ERROR downstream while working inside this
+ * repo. Inline declaration is bundler-proof; the type-only import is erased
+ * at runtime, so the plugin stays fully opt-in.
+ *
  * **The "React for backend" composition model.** `defineResource()` is the
  * declarative component, `extensions` is its typed props bag, and plugins
  * are the providers that consume those props at the framework boundary.
@@ -2718,11 +2734,11 @@ interface ResourcePermissions {
  * at request time via `request.routeOptions.config.arcExtensions` without
  * re-deriving which resource a route belongs to.
  *
- * @example A plugin registers its slice (in `@classytic/arc/encryption`)
+ * @example An external plugin package registers its slice
  * ```ts
  * declare module "@classytic/arc/types" {
  *   interface ResourceExtensions {
- *     encryption?: import("@classytic/arc/encryption").EncryptionDirective;
+ *     myPlugin?: import("my-arc-plugin").MyPluginDirective;
  *   }
  * }
  * ```
@@ -2735,7 +2751,16 @@ interface ResourcePermissions {
  * });
  * ```
  */
-interface ResourceExtensions {}
+interface ResourceExtensions {
+  /**
+   * Encrypt this resource's responses — full-body JWE or specific fields.
+   * Read at request time by `@classytic/arc/encryption`'s `encryptionPlugin`
+   * from `request.routeOptions.config.arcExtensions.encryption`; inert (and
+   * dependency-free — the import is type-only) unless that plugin is
+   * registered.
+   */
+  encryption?: EncryptionDirective;
+}
 interface ResourceConfig<TDoc = AnyRecord> {
   name: string;
   displayName?: string;
@@ -2935,7 +2960,7 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * });
    * ```
    */
-  crud?: false | { [K in CrudRouteKey]?: boolean };
+  crud?: false | { [K in CrudRouteKey]?: boolean; };
   /**
    * Field name used for multi-tenant scoping (default: 'organizationId').
    * Override to match your schema: 'workspaceId', 'tenantId', etc.
@@ -3626,7 +3651,8 @@ type FastifyWithDecorators = FastifyInstance & {
   arc?: ArcDecorator;
   events?: EventsDecorator;
   authenticate?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
-  optionalAuthenticate?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>; /** Organization-scoped filtering — from `multiTenant` preset */
+  optionalAuthenticate?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+  /** Organization-scoped filtering — from `multiTenant` preset */
   organizationScoped?: (options?: {
     required?: boolean;
   }) => RouteHandlerMethod;
@@ -3991,8 +4017,10 @@ interface RegistryEntry extends ResourceMetadata {
    */
   actions?: Array<{
     readonly name: string;
-    readonly description?: string; /** Raw per-action schema (JSON Schema, Zod v4, or legacy field map) */
-    readonly schema?: unknown; /** Per-action permission check (if different from resource-level `actionPermissions`) */
+    readonly description?: string;
+    /** Raw per-action schema (JSON Schema, Zod v4, or legacy field map) */
+    readonly schema?: unknown;
+    /** Per-action permission check (if different from resource-level `actionPermissions`) */
     readonly permissions?: PermissionCheck;
     /**
      * 2.15.5: mount point — `true` (default) for `POST /:id/action`,
@@ -4001,7 +4029,8 @@ interface RegistryEntry extends ResourceMetadata {
      * resource manifests so callers can pick the right URL without
      * reading the action definition itself.
      */
-    readonly id?: boolean; /** MCP tool generation flag — `false` to skip, object for overrides */
+    readonly id?: boolean;
+    /** MCP tool generation flag — `false` to skip, object for overrides */
     readonly mcp?: boolean | {
       readonly description?: string;
       readonly annotations?: Record<string, unknown>;
@@ -4028,13 +4057,17 @@ interface RegistryEntry extends ResourceMetadata {
     readonly summary?: string;
     readonly description?: string;
     readonly permissions: PermissionCheck;
-    readonly groupBy?: string | readonly string[]; /** Measure aliases keyed to their op-tag (e.g. `'count'`, `'sum:price'`). */
-    readonly measures: Readonly<Record<string, string>>; /** Lookup alias names (`as` or `from`) — used by OpenAPI to know which dotted-path output keys nest. */
-    readonly lookupAliases: readonly string[]; /** Whether the aggregation requires a date range — surfaced in docs. */
+    readonly groupBy?: string | readonly string[];
+    /** Measure aliases keyed to their op-tag (e.g. `'count'`, `'sum:price'`). */
+    readonly measures: Readonly<Record<string, string>>;
+    /** Lookup alias names (`as` or `from`) — used by OpenAPI to know which dotted-path output keys nest. */
+    readonly lookupAliases: readonly string[];
+    /** Whether the aggregation requires a date range — surfaced in docs. */
     readonly requireDateRange?: {
       field: string;
       maxRangeDays?: number;
-    }; /** Whether the aggregation requires named filters — surfaced in docs. */
+    };
+    /** Whether the aggregation requires named filters — surfaced in docs. */
     readonly requireFilters?: readonly string[];
     /**
      * Static result-row cap (no URL override). Mutually exclusive with
@@ -4052,7 +4085,8 @@ interface RegistryEntry extends ResourceMetadata {
      * URL-driven limit ceiling (only meaningful with `defaultLimit`).
      * OpenAPI docs render this as the `maximum` constraint on `?limit`.
      */
-    readonly maxLimit?: number; /** MCP tool generation flag — `false` to skip, object for overrides. */
+    readonly maxLimit?: number;
+    /** MCP tool generation flag — `false` to skip, object for overrides. */
     readonly mcp?: boolean | {
       readonly description?: string;
       readonly annotations?: Record<string, unknown>;

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { $t as UserOrganization, A as RequestIdOptions, An as ArcCreateResult, At as AggregationMaterializedResult, B as defineResource, C as RequestContext, Ct as AggMeasureInput, D as HealthCheck, Dt as AggregationDateRangeRequirement, E as GracefulShutdownOptions, Et as AggregationConfig, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ht as AuthPluginOptions, In as ControllerConfigurableOptions, J as CrudRouteKey, Jt as ApiResponse, L as RequestWithExtras, Ln as ControllerConstructionOptions, Mn as ArcGetResult, Mt as AggregationsMap, N as FastifyRequestExtras, Nn as ArcListResult, O as HealthOptions, Ot as AggregationIndexHint, P as FastifyWithAuth, Pn as ArcUpdateResult, Q as MiddlewareConfig, Rn as ListResult, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, Tt as AggregationCacheConfig, V as ResourceDefinition, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, _t as ControllerLike, a as InferAdapterDoc, an as SlugExt, bt as IControllerResponse, c as TypedController, cn as BulkMixin, d as PaginationResult, en as BaseController, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, in as TreeMixin, it as RateLimitConfig, jn as ArcDeleteResult, jt as AggregationRateLimit, k as IntrospectionPluginOptions, kt as AggregationMaterializedContext, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, n as ConfigError, nn as SoftDeleteMixin, o as InferDocType, on as SlugMixin, p as RegistryEntry, q as CrudController, qt as AnyRecord, r as ValidateOptions, rn as TreeExt, rt as PresetResult, s as InferResourceDoc, sn as BulkExt, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteExt, tt as PresetFunction, u as TypedResourceConfig, w as ServiceContext, wt as AggMeasureShorthand, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "./index-_--GyzcO.mjs";
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-C7ahdGYf.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-DUa8WHz3.mjs";
-import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-CdFkIMEd.mjs";
-import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DOHkjQlD.mjs";
-
+import { $t as UserOrganization, A as RequestIdOptions, An as ArcCreateResult, At as AggregationMaterializedResult, B as defineResource, C as RequestContext, Ct as AggMeasureInput, D as HealthCheck, Dt as AggregationDateRangeRequirement, E as GracefulShutdownOptions, Et as AggregationConfig, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ht as AuthPluginOptions, In as ControllerConfigurableOptions, J as CrudRouteKey, Jt as ApiResponse, L as RequestWithExtras, Ln as ControllerConstructionOptions, Mn as ArcGetResult, Mt as AggregationsMap, N as FastifyRequestExtras, Nn as ArcListResult, O as HealthOptions, Ot as AggregationIndexHint, P as FastifyWithAuth, Pn as ArcUpdateResult, Q as MiddlewareConfig, Rn as ListResult, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, Tt as AggregationCacheConfig, V as ResourceDefinition, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, _t as ControllerLike, a as InferAdapterDoc, an as SlugExt, bt as IControllerResponse, c as TypedController, cn as BulkMixin, d as PaginationResult, en as BaseController, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, in as TreeMixin, it as RateLimitConfig, jn as ArcDeleteResult, jt as AggregationRateLimit, k as IntrospectionPluginOptions, kt as AggregationMaterializedContext, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, n as ConfigError, nn as SoftDeleteMixin, o as InferDocType, on as SlugMixin, p as RegistryEntry, q as CrudController, qt as AnyRecord, r as ValidateOptions, rn as TreeExt, rt as PresetResult, s as InferResourceDoc, sn as BulkExt, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteExt, tt as PresetFunction, u as TypedResourceConfig, w as ServiceContext, wt as AggMeasureShorthand, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "./index-Dtrj6XZk.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-BGqrAa_u.mjs";
+import "./fastify-augmentation-DafigGQp.mjs";
+import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, m as ResourceSeams, p as AdapterLike, s as getControllerScope, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, z as RESERVED_QUERY_PARAMS } from "./index-B5N-NaHs.mjs";
+import { A as requireOwnership, C as createOrgPermissions, D as denyAll, E as anyOf, N as when, S as createDynamicPermissionMatrix, T as allowPublic, b as DynamicPermissionMatrixConfig, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as requireRoles, k as requireAuth, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, w as allOf, y as DynamicPermissionMatrix } from "./index-B5PoNbfu.mjs";
+import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DHcHVAgk.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ApiResponse, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PermissionResult, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ApiResponse, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PermissionResult, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DNre0wRg.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-D-MHZ27_.mjs";
-import { C as requireAuth, D as when, F as applyFieldWritePermissions, I as fields, P as applyFieldReadPermissions, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-CgbOLJZG.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-CWhyGkiM.mjs";
-import { l as getControllerScope } from "./actionPermissions-C9RMiIpc.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-BnLYgE9A.mjs";
+import { E as requireRoles, F as applyFieldReadPermissions, I as applyFieldWritePermissions, L as fields, O as when, S as denyAll, T as requireOwnership, _ as requireServiceScope, b as allowPublic, c as publicReadAdminWrite, d as createDynamicPermissionMatrix, f as createOrgPermissions, g as requireScopeContext, h as requireOrgRole, i as ownerWithAdminBypass, l as readOnly, m as requireOrgMembership, n as authenticated, o as presets_exports, p as requireOrgInScope, r as fullPublic, s as publicRead, t as adminOnly, v as requireTeamMembership, w as requireAuth, x as anyOf, y as allOf } from "./permissions-BJMuKMl7.mjs";
+import { a as mergeResourceConfig, c as defineAction, d as defineAggregation, i as defineResourceVariants, o as defineResource, s as ResourceDefinition } from "./core-DZ6Xe1jR.mjs";
+import { l as getControllerScope } from "./actionPermissions-ze70xXJi.mjs";
 //#region src/index.ts
-const version = "2.20.0";
+const version = "2.21.0";
 //#endregion
-export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };