@classytic/arc 2.20.0 → 2.22.0

package/dist/{BaseController-D-MHZ27_.mjs → BaseController-C6FlRWxF.mjs}

@@ -2,8 +2,8 @@ import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { N as simpleEqualityMatcher, _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-ChjYQpjn.mjs";
-import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-CgbOLJZG.mjs";
+import { F as simpleEqualityMatcher, _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-FhJ88TJE.mjs";
+import { I as applyFieldWritePermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
 //#region src/core/AccessControl.ts

package/dist/{EventTransport-IEn7Tn-Q.d.mts → EventTransport-QmY7A258.d.mts}

@@ -1,5 +1,4 @@
 import { DeadLetteredEvent, DomainEvent, DomainEvent as DomainEvent$1, EventHandler, EventHandler as EventHandler$1, EventLogger, EventLogger as EventLogger$1, EventTransport, EventTransport as EventTransport$1, PublishManyResult } from "@classytic/primitives/events";
-
 //#region src/events/EventTransport.d.ts
 interface MemoryEventTransportOptions {
   /** Logger for error/warning messages (default: console) */

package/dist/{QueryCache-TRfXau3W.d.mts → QueryCache-Z1B38koh.d.mts}

@@ -1,5 +1,4 @@
 import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
-
 //#region src/cache/QueryCache.d.ts
 /** Metadata wrapper stored in CacheStore */
 interface CacheEnvelope<T = unknown> {

package/dist/{actionPermissions-C9RMiIpc.mjs → actionPermissions-ze70xXJi.mjs}

@@ -1,5 +1,5 @@
 import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { L as resolveEffectiveRoles, P as applyFieldReadPermissions } from "./permissions-CgbOLJZG.mjs";
+import { F as applyFieldReadPermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";

package/dist/audit/index.d.mts

@@ -1,7 +1,7 @@
-import { d as UserBase } from "../fields-C7ahdGYf.mjs";
+import "../index-DbtgCOCj.mjs";
+import { i as UserBase } from "../types-Csxga7d3.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
-
 //#region src/audit/stores/interface.d.ts
 type AuditAction = "create" | "update" | "delete" | "restore" | "custom";
 interface AuditEntry {
@@ -126,7 +126,9 @@ interface AuditPluginOptions {
    * Set `purgeIntervalMs: 0` to skip the timer (manual purge only).
    */
   retention?: {
-    /** Max entry age in ms. Entries with `timestamp < now - maxAgeMs` are purged. */maxAgeMs: number; /** Interval between purges in ms. Default 86_400_000 (24h). 0 disables the timer. */
+    /** Max entry age in ms. Entries with `timestamp < now - maxAgeMs` are purged. */
+    maxAgeMs: number;
+    /** Interval between purges in ms. Default 86_400_000 (24h). 0 disables the timer. */
     purgeIntervalMs?: number;
   };
   /**
@@ -159,8 +161,10 @@ interface AuditPluginOptions {
    * - `false`: Disable auto-audit (manual `fastify.audit.*()` calls only)
    */
   autoAudit?: boolean | {
-    operations?: ("create" | "update" | "delete")[]; /** Allowlist — only listed resources are audited (mutually exclusive with exclude) */
-    include?: string[]; /** Denylist — audit everything except listed resources */
+    operations?: ("create" | "update" | "delete")[];
+    /** Allowlist — only listed resources are audited (mutually exclusive with exclude) */
+    include?: string[];
+    /** Denylist — audit everything except listed resources */
     exclude?: string[];
     /**
      * Per-resource opt-in mode: only audit resources with `audit: true` in their

package/dist/auth/audit.d.mts

@@ -1,5 +1,4 @@
 import { FastifyInstance } from "fastify";
-
 //#region src/auth/audit.d.ts
 /**
  * Canonical auth event names emitted by the bridge. Hosts pattern-match
@@ -143,9 +142,13 @@ interface BetterAuthAuditBridge {
    * is called again. Useful for Prometheus exporters that scrape periodically.
    */
   getStats(): {
-    /** Events buffered during pre-`attach` phase that were dropped due to `bufferSize` overflow. */droppedFromBuffer: number; /** Events that reached `app.audit.custom(...)` but threw (audit store failure). */
-    dispatchFailures: number; /** Total `dispatch` calls — useful to verify BA is actually invoking the bridge's hooks. */
-    dispatchAttempts: number; /** Events currently buffered awaiting `attach`. */
+    /** Events buffered during pre-`attach` phase that were dropped due to `bufferSize` overflow. */
+    droppedFromBuffer: number;
+    /** Events that reached `app.audit.custom(...)` but threw (audit store failure). */
+    dispatchFailures: number;
+    /** Total `dispatch` calls — useful to verify BA is actually invoking the bridge's hooks. */
+    dispatchAttempts: number;
+    /** Events currently buffered awaiting `attach`. */
     pendingBuffered: number;
   };
 }

package/dist/auth/audit.mjs

@@ -100,6 +100,11 @@ const ENDPOINT_TO_EVENT = [
 		test: /\/api-key\/delete\b/,
 		phase: "after",
 		name: "apikey.delete"
+	},
+	{
+		test: /\/sign-out\b/,
+		phase: "after",
+		name: "session.delete"
 	}
 ];
 function classifyEndpoint(phase, ctx) {

package/dist/auth/index.d.mts

@@ -1,9 +1,8 @@
-import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-_--GyzcO.mjs";
-import { c as PermissionCheck } from "../fields-C7ahdGYf.mjs";
+import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-DbtgCOCj.mjs";
+import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BXG-HGwG.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
-
 //#region src/auth/authPlugin.d.ts
 declare module "fastify" {
   interface FastifyInstance {
@@ -17,14 +16,6 @@ declare module "fastify" {
     auth: AuthHelpers;
   }
 }
-/**
- * Extract Bearer token from Authorization header.
- *
- * Exported for property-based test coverage — the contract is:
- *  - header must start with exactly `"Bearer "` (case-sensitive, one space)
- *  - everything after that prefix is returned verbatim (no trim, no parse)
- *  - missing header → `null`; any other shape → `null`
- */
 declare const authPlugin: FastifyPluginAsync<AuthPluginOptions>;
 declare const _default: FastifyPluginAsync<AuthPluginOptions>;
 //#endregion
@@ -93,6 +84,34 @@ interface BetterAuthAdapterOptions {
    * When true, includes the actual error message for debugging.
    */
   exposeAuthErrors?: boolean;
+  /**
+   * Per-route rate limit for the Better Auth catch-all (`/api/auth/*`),
+   * applied via `@fastify/rate-limit`'s route config (requires the
+   * limiter to be registered, which createApp does by default).
+   *
+   * Credential endpoints deserve a tighter bucket than the global limit
+   * (brute-force / credential-stuffing surface), BUT the same catch-all
+   * also serves Better Auth's chatty `get-session` heartbeat — so arc
+   * ships NO default here; a forced strict limit (the classic "5/min on
+   * /login") would 429 every SPA that polls sessions. Pick a ceiling that
+   * covers your session-poll cadence, or key the bucket smarter:
+   *
+   * @example
+   * ```ts
+   * createBetterAuthAdapter({
+   *   auth,
+   *   // simple ceiling over the whole auth surface
+   *   rateLimit: { max: 60, timeWindow: '1 minute' },
+   * });
+   *
+   * // OR keep the global limiter but exempt the heartbeat:
+   * createApp({ rateLimit: { max: 100, skipPaths: ['/api/auth/get-session'] } });
+   * ```
+   */
+  rateLimit?: {
+    max: number;
+    timeWindow: string | number;
+  } | false;
 }
 interface BetterAuthAdapterResult {
   /** Fastify plugin that registers catch-all auth routes */
@@ -177,8 +196,10 @@ interface BetterAuthOpenApiOptions {
    */
   userFields?: Record<string, {
     type: string;
-    description?: string; /** Whether this field is required in sign-up (default: false) */
-    required?: boolean; /** Whether this field is accepted in request body (default: true). Set false for output-only fields. */
+    description?: string;
+    /** Whether this field is required in sign-up (default: false) */
+    required?: boolean;
+    /** Whether this field is accepted in request body (default: true). Set false for output-only fields. */
     input?: boolean;
   }>;
 }

package/dist/auth/index.mjs

@@ -1,7 +1,7 @@
 import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { _ as requireTeamMembership, m as requireOrgRole, p as requireOrgMembership } from "../permissions-CgbOLJZG.mjs";
+import { h as requireOrgRole, m as requireOrgMembership, v as requireTeamMembership } from "../permissions-BJMuKMl7.mjs";
 import { n as normalizeRoles, t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { a as toJsonSchema } from "../schemaConverter-U0MnO9vd.mjs";
+import { o as toJsonSchema } from "../schemaConverter-Ds5reSGs.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -605,7 +605,8 @@ function createBetterAuthAdapter(options) {
 	if (openapiOpt === false) extractedOpenApi = void 0;
 	else if (typeof openapiOpt === "object") extractedOpenApi = openapiOpt;
 	const betterAuthPlugin = async (fastify) => {
-		fastify.all(`${normalizedBase}/*`, async (request, reply) => {
+		const routeOpts = options.rateLimit && typeof options.rateLimit === "object" ? { config: { rateLimit: options.rateLimit } } : {};
+		fastify.all(`${normalizedBase}/*`, routeOpts, async (request, reply) => {
 			try {
 				const fetchRequest = toFetchRequest(request);
 				await sendFetchResponse(await auth.handler(fetchRequest), reply);
@@ -619,6 +620,8 @@ function createBetterAuthAdapter(options) {
 		});
 		if (!fastify.hasDecorator("authenticate")) fastify.decorate("authenticate", authenticate);
 		if (!fastify.hasDecorator("optionalAuthenticate")) fastify.decorate("optionalAuthenticate", optionalAuthenticate);
+		if (!fastify.hasRequestDecorator("user")) fastify.decorateRequest("user", void 0);
+		if (!fastify.hasRequestDecorator("session")) fastify.decorateRequest("session", void 0);
 		if (!extractedOpenApi && openapiOpt !== false && auth.api && typeof auth.api === "object") {
 			const { extractBetterAuthOpenApi } = await import("../betterAuthOpenApi-CV1lxpRX.mjs");
 			extractedOpenApi = extractBetterAuthOpenApi(auth.api, {

package/dist/auth/redis-session.d.mts

@@ -1,5 +1,4 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-BXG-HGwG.mjs";
-
+import { i as SessionData, s as SessionStore } from "../sessionManager-BHOM3N_0.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
 interface RedisLike {

package/dist/cache/index.d.mts

@@ -1,7 +1,6 @@
 import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-C1_WLTMK.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-TRfXau3W.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-xzFyKAjT.mjs";
-
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-Z1B38koh.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-CfYWq-Ak.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,4 @@
-import { V as ResourceDefinition, ht as RouteSchemaOptions, it as RateLimitConfig } from "../../index-_--GyzcO.mjs";
-
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DbtgCOCj.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-Dq6RbEGK.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-BRpMZD7C.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-OMCvIEE7.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-YH_nslQR.mjs";
+import { t as init } from "../../init-DleK3p9f.mjs";
 export { init };

package/dist/cli/index.mjs

@@ -2,6 +2,6 @@ import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
 import { t as generate } from "../generate-usRSdQmP.mjs";
-import { t as init } from "../init-YH_nslQR.mjs";
+import { t as init } from "../init-DleK3p9f.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/context/index.d.mts

@@ -1,5 +1,4 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-
 //#region src/context/requestContext.d.ts
 /**
  * Shape of the request-scoped context store.
@@ -104,7 +103,8 @@ declare const transactionContext: {
    * Get the current DB session, or `undefined` if not inside a
    * `transactionContext.run(...)` scope.
    */
-  get(): DbSession | undefined; /** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
+  get(): DbSession | undefined;
+  /** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
   storage: AsyncLocalStorage<unknown>;
 };
 //#endregion

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { At as AggregationMaterializedResult, B as defineResource, Bn as BodySanitizerConfig, Ct as AggMeasureInput, Dt as AggregationDateRangeRequirement, Et as AggregationConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Mt as AggregationsMap, Ot as AggregationIndexHint, Rn as ListResult, Tt as AggregationCacheConfig, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, dn as QueryResolverConfig, en as BaseController, fn as AccessControl, in as TreeMixin, jt as AggregationRateLimit, kt as AggregationMaterializedContext, ln as BaseCrudController, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, rn as TreeExt, sn as BulkExt, tn as SoftDeleteExt, un as QueryResolver, wt as AggMeasureShorthand, zn as BodySanitizer } from "../index-_--GyzcO.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-DUa8WHz3.mjs";
-export { AccessControl, type AccessControlConfig, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };
+import { B as defineResource, Bn as BodySanitizerConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Rn as ListResult, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, ct as AggMeasureShorthand, dn as QueryResolverConfig, dt as AggregationDateRangeRequirement, en as BaseController, fn as AccessControl, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as TreeMixin, ln as BaseCrudController, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, pt as AggregationMaterializedContext, rn as TreeExt, sn as BulkExt, st as AggMeasureInput, tn as SoftDeleteExt, un as QueryResolver, ut as AggregationConfig, zn as BodySanitizer } from "../index-DbtgCOCj.mjs";
+import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-D8MKYGDa.mjs";
+export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-D-MHZ27_.mjs";
-import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-CWhyGkiM.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-C9RMiIpc.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-C6FlRWxF.mjs";
+import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as mergeResourceConfig, t as getEntityId, u as createPermissionMiddleware } from "../core-b6fgFgnd.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-ze70xXJi.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/{core-CWhyGkiM.mjs → core-b6fgFgnd.mjs}

@@ -2,16 +2,16 @@ import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DN
 import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { A as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-ChjYQpjn.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-D-MHZ27_.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-DGSREwPw.mjs";
-import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-CgbOLJZG.mjs";
+import { M as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-FhJ88TJE.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-C6FlRWxF.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
+import { I as applyFieldWritePermissions, R as resolveEffectiveRoles, w as requireAuth } from "./permissions-BJMuKMl7.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
-import { t as applyPresets } from "./presets-DWsYQdbV.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
+import { t as applyPresets } from "./presets-gw0ciIUD.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-Ds5reSGs.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-C9RMiIpc.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 //#region src/core/middlewares/fieldWrite.ts
 /**
@@ -151,7 +151,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			const fieldWriteMw = buildFieldWritePreHandler(fieldPermissions, onFieldWriteDenied);
 			if (fieldWriteMw) customPreHandlers.push(fieldWriteMw);
 		}
-		const preHandler = buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			preAuth: route.preAuth ?? [],
 			arcDecorator,
 			authMw: buildAuthMiddleware(fastify, route.permissions),
@@ -165,7 +165,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			method: route.method,
 			url: route.path,
 			schema,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions(hooks),
 			handler: isStream ? async (request, reply) => {
 				reply.raw.setHeader("Content-Type", "text/event-stream");
 				reply.raw.setHeader("Cache-Control", "no-cache");
@@ -274,7 +274,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 		for (const spec of crudTable) {
 			if (disabledRoutes.includes(spec.op)) continue;
 			const permission = permissions[spec.op];
-			const preHandler = buildPreHandlerChain({
+			const hooks = buildRouteHooks({
 				arcDecorator,
 				authMw: buildAuthMiddleware(fastify, permission),
 				permissionMw: buildCrudPermissionMw(permission, resourceName, spec.op),
@@ -293,7 +293,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 						summary,
 						...spec.hasIdParams ? { params: idParamsSchema } : {}
 					}, defaultSchemas[spec.op], schemas[spec.op]),
-					preHandler: preHandler.length > 0 ? preHandler : void 0,
+					...routeHookOptions(hooks),
 					handler: handlers[spec.op],
 					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
@@ -359,6 +359,58 @@ function defineAction(config) {
 	};
 }
 //#endregion
+//#region src/core/defineResource/seams.ts
+/** Plain object test — literals only; class instances must replace, not merge. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
+function mergePlain(base, next) {
+	const out = { ...base };
+	for (const [key, value] of Object.entries(next)) {
+		if (value === void 0) continue;
+		const existing = out[key];
+		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
+	}
+	return out;
+}
+/**
+* Canonical slot-aware merge of a base resource config with host seams.
+* Later seams win over earlier ones; `undefined` values never clobber.
+*
+* Merge semantics (value-driven — no per-slot registry to drift):
+*
+*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+*     `routeGuards`, `disabledRoutes`: additive collections, base first.
+*   - **Plain objects merge recursively** — `permissions`, `actions`,
+*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+*     them replace (they're value lists — enums, sort specs), not concat.
+*   - **Everything else last-wins** — class instances (`adapter`,
+*     `controller`, `queryParser`), functions, scalars.
+*
+* The single `as` at the return is the one documented erasure for the
+* {@link AdapterLike}-widened seam slots — inside the helper so no module
+* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+*/
+function mergeResourceConfig(base, ...seams) {
+	const out = { ...base };
+	for (const seam of seams) {
+		if (!seam) continue;
+		for (const [key, value] of Object.entries(seam)) {
+			if (value === void 0) continue;
+			const existing = out[key];
+			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
+			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
+			else if (Array.isArray(value)) out[key] = [...value];
+			else out[key] = value;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/core/defineResource/controller.ts
 /**
 * Phase 4 — pick (or auto-create) the resource's controller.
@@ -652,7 +704,7 @@ function resolveIdField(config, repository) {
 * enabled but no adapter" (a confusing false-positive error).
 */
 function normalizeResourceConfig(config) {
-	return resolveCrudAllowList(expandCustomRoutesOnly(expandReferenceData(config)));
+	return resolveCrudAllowList(expandHistory(expandCustomRoutesOnly(expandReferenceData(config))));
 }
 /**
 * Expand the `referenceData: true` shorthand. Reference data is the
@@ -706,6 +758,61 @@ function expandCustomRoutesOnly(config) {
 	};
 }
 /**
+* Expand the 2.22 `history: true` shorthand — the per-record change
+* timeline. Injects `GET /:id/history` (audit-entry page for one
+* document, newest-first per the audit store's contract) and implies
+* `audit: true` so the rows the route reads actually get written.
+*
+* The gate defaults STRICTER than reads (history exposes before/after
+* snapshots): resource `update` permission → `get` → route auth.
+* `history: { permissions }` overrides. The flag is CONSUMED here
+* (set to undefined) — later phases and the registry see only its
+* expansion, same contract as `customRoutesOnly`.
+*/
+function expandHistory(config) {
+	if (!config.history) return config;
+	const opts = config.history === true ? {} : config.history;
+	const permissions = opts.permissions ?? config.permissions?.update ?? config.permissions?.get ?? requireAuth();
+	const defaultLimit = opts.limit ?? 50;
+	const resourceName = config.name;
+	const historyRoute = {
+		method: "GET",
+		path: "/:id/history",
+		summary: `Change history for a ${resourceName} record (audit-backed timeline)`,
+		raw: true,
+		handler: async (request, reply) => {
+			const audit = request.server.audit;
+			if (!audit?.query || audit._noop === true) return reply.code(503).send({
+				code: "history.audit_unavailable",
+				message: `history for '${resourceName}' requires auditPlugin to be registered (and enabled)`,
+				status: 503
+			});
+			const { id } = request.params;
+			const q = request.query;
+			const limit = Math.min(Number(q.limit) > 0 ? Number(q.limit) : defaultLimit, 200);
+			const offset = Number(q.offset) > 0 ? Number(q.offset) : 0;
+			const entries = await audit.query({
+				resource: resourceName,
+				documentId: id,
+				limit,
+				offset
+			});
+			return reply.send({
+				data: entries,
+				limit,
+				offset
+			});
+		},
+		permissions
+	};
+	return {
+		...config,
+		history: void 0,
+		audit: config.audit ?? true,
+		routes: [...config.routes ?? [], historyRoute]
+	};
+}
+/**
 * Normalise the 2.16 `crud:` positive-form allow-list into the canonical
 * `{ disabledRoutes, disableDefaultRoutes }` pair the rest of arc reads.
 *
@@ -1068,7 +1175,10 @@ function buildGeneratedCrudSchemas(openApi, customSchemas) {
 		for (const [op, customSchema] of Object.entries(customSchemas)) {
 			const key = op;
 			const converted = convertRouteSchema(customSchema);
-			schemas[key] = schemas[key] ? deepMergeSchemas(schemas[key], converted) : converted;
+			schemas[key] = schemas[key] ? {
+				...schemas[key],
+				...converted
+			} : converted;
 		}
 	}
 	return schemas;
@@ -1218,7 +1328,8 @@ function normalizeActionsToRouterConfig(actions, resourceActionPermissions, tag,
 * Fastify instance via `resource._sharedStateRegisteredOn`.
 */
 function buildResourcePlugin(resource) {
-	return async function resourcePlugin(fastify, _opts) {
+	return async function resourcePlugin(fastify, opts) {
+		await ensureSchemaConverter();
 		const sharedRoot = fastify.server;
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
@@ -1254,6 +1365,7 @@ function buildResourcePlugin(resource) {
 				fastify.log?.warn?.(`[Arc] Resource '${resource.name}' declares events (${eventNames}) but \`eventPlugin\` is not registered. The events will silently NOT be emitted on CRUD mutations. Either register the plugin (\`await fastify.register(eventPlugin, { transport: ... })\`) or remove the \`events\` declaration from the resource.`);
 			}
 		}
+		if (opts?.arcMountRoutes === false) return;
 		await fastify.register(async (instance) => {
 			const typedInstance = instance;
 			let schemas = buildGeneratedCrudSchemas(resource._registryMeta?.openApiSchemas, resource.customSchemas);
@@ -1283,7 +1395,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-HlQso0jO.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-h1cEEaEX.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1298,7 +1410,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-5LzPzgw1.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B1C0kvTL.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -2008,4 +2120,4 @@ function getEntityQuery(req) {
 	return { [getEntityIdField(req)]: id };
 }
 //#endregion
-export { defineResource as a, createCrudRouter as c, defineResourceVariants as i, createPermissionMiddleware as l, getEntityIdField as n, ResourceDefinition as o, getEntityQuery as r, defineAction as s, getEntityId as t, defineAggregation as u };
+export { defineResource as a, defineAction as c, defineAggregation as d, defineResourceVariants as i, createCrudRouter as l, getEntityIdField as n, ResourceDefinition as o, getEntityQuery as r, mergeResourceConfig as s, getEntityId as t, createPermissionMiddleware as u };

package/dist/{createActionRouter-HlQso0jO.mjs → createActionRouter-h1cEEaEX.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-DGSREwPw.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-C9RMiIpc.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-ajetw3Fv.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-ze70xXJi.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-B-6SPe7g.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -108,19 +108,23 @@ function createActionRouter(fastify, config) {
 			scopedError.meta = { action: submitted };
 			throw scopedError;
 		};
-		const preHandler = [actionValidationFormatter, ...buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			arcDecorator,
 			authMw,
 			permissionMw,
 			pluginMw: selectPluginMw("POST", pluginMw),
 			routeGuards
-		})];
+		});
+		const preHandler = [actionValidationFormatter, ...hooks.preHandler];
 		tryRegisterRoute(fastify, {
 			method: "POST",
 			url: urlPath,
 			schema: routeSchema,
 			attachValidation: true,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions({
+				onRequest: hooks.onRequest,
+				preHandler
+			}),
 			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;

package/dist/{createAggregationRouter-5LzPzgw1.mjs → createAggregationRouter-B1C0kvTL.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-DGSREwPw.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
@@ -48,7 +48,7 @@ function registerOne(fastify, normalized, ctx) {
 			throw new ForbiddenError(reason ?? "You do not have permission to access this aggregation.");
 		}
 	};
-	const preHandler = buildPreHandlerChain({
+	const hooks = buildRouteHooks({
 		arcDecorator,
 		authMw,
 		permissionMw,
@@ -73,7 +73,7 @@ function registerOne(fastify, normalized, ctx) {
 		method: "GET",
 		url: `/aggregations/${name}`,
 		schema: routeSchema,
-		preHandler: preHandler.length > 0 ? preHandler : void 0,
+		...routeHookOptions(hooks),
 		...rateLimitConfig ? { config: rateLimitConfig } : {},
 		handler: async (req, reply) => {
 			try {