@classytic/arc 2.21.0 → 2.22.0

package/dist/{BaseController-BnLYgE9A.mjs → BaseController-C6FlRWxF.mjs}

@@ -2,7 +2,7 @@ import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { F as simpleEqualityMatcher, _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-CO8a3B_1.mjs";
+import { F as simpleEqualityMatcher, _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-FhJ88TJE.mjs";
 import { I as applyFieldWritePermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";

package/dist/audit/index.d.mts

@@ -1,5 +1,5 @@
-import "../index-Dtrj6XZk.mjs";
-import { d as UserBase } from "../fields-BGqrAa_u.mjs";
+import "../index-DbtgCOCj.mjs";
+import { i as UserBase } from "../types-Csxga7d3.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/auth/index.d.mts

@@ -1,5 +1,5 @@
-import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-Dtrj6XZk.mjs";
-import { c as PermissionCheck } from "../fields-BGqrAa_u.mjs";
+import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-DbtgCOCj.mjs";
+import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
@@ -84,6 +84,34 @@ interface BetterAuthAdapterOptions {
    * When true, includes the actual error message for debugging.
    */
   exposeAuthErrors?: boolean;
+  /**
+   * Per-route rate limit for the Better Auth catch-all (`/api/auth/*`),
+   * applied via `@fastify/rate-limit`'s route config (requires the
+   * limiter to be registered, which createApp does by default).
+   *
+   * Credential endpoints deserve a tighter bucket than the global limit
+   * (brute-force / credential-stuffing surface), BUT the same catch-all
+   * also serves Better Auth's chatty `get-session` heartbeat — so arc
+   * ships NO default here; a forced strict limit (the classic "5/min on
+   * /login") would 429 every SPA that polls sessions. Pick a ceiling that
+   * covers your session-poll cadence, or key the bucket smarter:
+   *
+   * @example
+   * ```ts
+   * createBetterAuthAdapter({
+   *   auth,
+   *   // simple ceiling over the whole auth surface
+   *   rateLimit: { max: 60, timeWindow: '1 minute' },
+   * });
+   *
+   * // OR keep the global limiter but exempt the heartbeat:
+   * createApp({ rateLimit: { max: 100, skipPaths: ['/api/auth/get-session'] } });
+   * ```
+   */
+  rateLimit?: {
+    max: number;
+    timeWindow: string | number;
+  } | false;
 }
 interface BetterAuthAdapterResult {
   /** Fastify plugin that registers catch-all auth routes */

package/dist/auth/index.mjs

@@ -1,7 +1,7 @@
 import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
 import { h as requireOrgRole, m as requireOrgMembership, v as requireTeamMembership } from "../permissions-BJMuKMl7.mjs";
 import { n as normalizeRoles, t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { a as toJsonSchema } from "../schemaConverter-U0MnO9vd.mjs";
+import { o as toJsonSchema } from "../schemaConverter-Ds5reSGs.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -605,7 +605,8 @@ function createBetterAuthAdapter(options) {
 	if (openapiOpt === false) extractedOpenApi = void 0;
 	else if (typeof openapiOpt === "object") extractedOpenApi = openapiOpt;
 	const betterAuthPlugin = async (fastify) => {
-		fastify.all(`${normalizedBase}/*`, async (request, reply) => {
+		const routeOpts = options.rateLimit && typeof options.rateLimit === "object" ? { config: { rateLimit: options.rateLimit } } : {};
+		fastify.all(`${normalizedBase}/*`, routeOpts, async (request, reply) => {
 			try {
 				const fetchRequest = toFetchRequest(request);
 				await sendFetchResponse(await auth.handler(fetchRequest), reply);
@@ -619,6 +620,8 @@ function createBetterAuthAdapter(options) {
 		});
 		if (!fastify.hasDecorator("authenticate")) fastify.decorate("authenticate", authenticate);
 		if (!fastify.hasDecorator("optionalAuthenticate")) fastify.decorate("optionalAuthenticate", optionalAuthenticate);
+		if (!fastify.hasRequestDecorator("user")) fastify.decorateRequest("user", void 0);
+		if (!fastify.hasRequestDecorator("session")) fastify.decorateRequest("session", void 0);
 		if (!extractedOpenApi && openapiOpt !== false && auth.api && typeof auth.api === "object") {
 			const { extractBetterAuthOpenApi } = await import("../betterAuthOpenApi-CV1lxpRX.mjs");
 			extractedOpenApi = extractBetterAuthOpenApi(auth.api, {

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition, ht as RouteSchemaOptions, it as RateLimitConfig } from "../../index-Dtrj6XZk.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DbtgCOCj.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-Kyod_di6.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-BRpMZD7C.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-OMCvIEE7.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-0YhHkXGk.mjs";
+import { t as init } from "../../init-DleK3p9f.mjs";
 export { init };

package/dist/cli/index.mjs

@@ -2,6 +2,6 @@ import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
 import { t as generate } from "../generate-usRSdQmP.mjs";
-import { t as init } from "../init-0YhHkXGk.mjs";
+import { t as init } from "../init-DleK3p9f.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { At as AggregationMaterializedResult, B as defineResource, Bn as BodySanitizerConfig, Ct as AggMeasureInput, Dt as AggregationDateRangeRequirement, Et as AggregationConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Mt as AggregationsMap, Ot as AggregationIndexHint, Rn as ListResult, Tt as AggregationCacheConfig, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, dn as QueryResolverConfig, en as BaseController, fn as AccessControl, in as TreeMixin, jt as AggregationRateLimit, kt as AggregationMaterializedContext, ln as BaseCrudController, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, rn as TreeExt, sn as BulkExt, tn as SoftDeleteExt, un as QueryResolver, wt as AggMeasureShorthand, zn as BodySanitizer } from "../index-Dtrj6XZk.mjs";
-import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-B5N-NaHs.mjs";
+import { B as defineResource, Bn as BodySanitizerConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Rn as ListResult, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, ct as AggMeasureShorthand, dn as QueryResolverConfig, dt as AggregationDateRangeRequirement, en as BaseController, fn as AccessControl, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as TreeMixin, ln as BaseCrudController, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, pt as AggregationMaterializedContext, rn as TreeExt, sn as BulkExt, st as AggMeasureInput, tn as SoftDeleteExt, un as QueryResolver, ut as AggregationConfig, zn as BodySanitizer } from "../index-DbtgCOCj.mjs";
+import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-D8MKYGDa.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-BnLYgE9A.mjs";
-import { a as mergeResourceConfig, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as defineResource, r as getEntityQuery, s as ResourceDefinition, t as getEntityId, u as createPermissionMiddleware } from "../core-DZ6Xe1jR.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-C6FlRWxF.mjs";
+import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as mergeResourceConfig, t as getEntityId, u as createPermissionMiddleware } from "../core-b6fgFgnd.mjs";
 import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-ze70xXJi.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/{core-DZ6Xe1jR.mjs → core-b6fgFgnd.mjs}

@@ -2,13 +2,13 @@ import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DN
 import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { M as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-CO8a3B_1.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-BnLYgE9A.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-oGAl0oA8.mjs";
-import { I as applyFieldWritePermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
+import { M as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-FhJ88TJE.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-C6FlRWxF.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
+import { I as applyFieldWritePermissions, R as resolveEffectiveRoles, w as requireAuth } from "./permissions-BJMuKMl7.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as applyPresets } from "./presets-gw0ciIUD.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-Ds5reSGs.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
 import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
@@ -151,7 +151,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			const fieldWriteMw = buildFieldWritePreHandler(fieldPermissions, onFieldWriteDenied);
 			if (fieldWriteMw) customPreHandlers.push(fieldWriteMw);
 		}
-		const preHandler = buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			preAuth: route.preAuth ?? [],
 			arcDecorator,
 			authMw: buildAuthMiddleware(fastify, route.permissions),
@@ -165,7 +165,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			method: route.method,
 			url: route.path,
 			schema,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions(hooks),
 			handler: isStream ? async (request, reply) => {
 				reply.raw.setHeader("Content-Type", "text/event-stream");
 				reply.raw.setHeader("Cache-Control", "no-cache");
@@ -274,7 +274,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 		for (const spec of crudTable) {
 			if (disabledRoutes.includes(spec.op)) continue;
 			const permission = permissions[spec.op];
-			const preHandler = buildPreHandlerChain({
+			const hooks = buildRouteHooks({
 				arcDecorator,
 				authMw: buildAuthMiddleware(fastify, permission),
 				permissionMw: buildCrudPermissionMw(permission, resourceName, spec.op),
@@ -293,7 +293,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 						summary,
 						...spec.hasIdParams ? { params: idParamsSchema } : {}
 					}, defaultSchemas[spec.op], schemas[spec.op]),
-					preHandler: preHandler.length > 0 ? preHandler : void 0,
+					...routeHookOptions(hooks),
 					handler: handlers[spec.op],
 					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
@@ -359,6 +359,58 @@ function defineAction(config) {
 	};
 }
 //#endregion
+//#region src/core/defineResource/seams.ts
+/** Plain object test — literals only; class instances must replace, not merge. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
+function mergePlain(base, next) {
+	const out = { ...base };
+	for (const [key, value] of Object.entries(next)) {
+		if (value === void 0) continue;
+		const existing = out[key];
+		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
+	}
+	return out;
+}
+/**
+* Canonical slot-aware merge of a base resource config with host seams.
+* Later seams win over earlier ones; `undefined` values never clobber.
+*
+* Merge semantics (value-driven — no per-slot registry to drift):
+*
+*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+*     `routeGuards`, `disabledRoutes`: additive collections, base first.
+*   - **Plain objects merge recursively** — `permissions`, `actions`,
+*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+*     them replace (they're value lists — enums, sort specs), not concat.
+*   - **Everything else last-wins** — class instances (`adapter`,
+*     `controller`, `queryParser`), functions, scalars.
+*
+* The single `as` at the return is the one documented erasure for the
+* {@link AdapterLike}-widened seam slots — inside the helper so no module
+* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+*/
+function mergeResourceConfig(base, ...seams) {
+	const out = { ...base };
+	for (const seam of seams) {
+		if (!seam) continue;
+		for (const [key, value] of Object.entries(seam)) {
+			if (value === void 0) continue;
+			const existing = out[key];
+			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
+			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
+			else if (Array.isArray(value)) out[key] = [...value];
+			else out[key] = value;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/core/defineResource/controller.ts
 /**
 * Phase 4 — pick (or auto-create) the resource's controller.
@@ -652,7 +704,7 @@ function resolveIdField(config, repository) {
 * enabled but no adapter" (a confusing false-positive error).
 */
 function normalizeResourceConfig(config) {
-	return resolveCrudAllowList(expandCustomRoutesOnly(expandReferenceData(config)));
+	return resolveCrudAllowList(expandHistory(expandCustomRoutesOnly(expandReferenceData(config))));
 }
 /**
 * Expand the `referenceData: true` shorthand. Reference data is the
@@ -706,6 +758,61 @@ function expandCustomRoutesOnly(config) {
 	};
 }
 /**
+* Expand the 2.22 `history: true` shorthand — the per-record change
+* timeline. Injects `GET /:id/history` (audit-entry page for one
+* document, newest-first per the audit store's contract) and implies
+* `audit: true` so the rows the route reads actually get written.
+*
+* The gate defaults STRICTER than reads (history exposes before/after
+* snapshots): resource `update` permission → `get` → route auth.
+* `history: { permissions }` overrides. The flag is CONSUMED here
+* (set to undefined) — later phases and the registry see only its
+* expansion, same contract as `customRoutesOnly`.
+*/
+function expandHistory(config) {
+	if (!config.history) return config;
+	const opts = config.history === true ? {} : config.history;
+	const permissions = opts.permissions ?? config.permissions?.update ?? config.permissions?.get ?? requireAuth();
+	const defaultLimit = opts.limit ?? 50;
+	const resourceName = config.name;
+	const historyRoute = {
+		method: "GET",
+		path: "/:id/history",
+		summary: `Change history for a ${resourceName} record (audit-backed timeline)`,
+		raw: true,
+		handler: async (request, reply) => {
+			const audit = request.server.audit;
+			if (!audit?.query || audit._noop === true) return reply.code(503).send({
+				code: "history.audit_unavailable",
+				message: `history for '${resourceName}' requires auditPlugin to be registered (and enabled)`,
+				status: 503
+			});
+			const { id } = request.params;
+			const q = request.query;
+			const limit = Math.min(Number(q.limit) > 0 ? Number(q.limit) : defaultLimit, 200);
+			const offset = Number(q.offset) > 0 ? Number(q.offset) : 0;
+			const entries = await audit.query({
+				resource: resourceName,
+				documentId: id,
+				limit,
+				offset
+			});
+			return reply.send({
+				data: entries,
+				limit,
+				offset
+			});
+		},
+		permissions
+	};
+	return {
+		...config,
+		history: void 0,
+		audit: config.audit ?? true,
+		routes: [...config.routes ?? [], historyRoute]
+	};
+}
+/**
 * Normalise the 2.16 `crud:` positive-form allow-list into the canonical
 * `{ disabledRoutes, disableDefaultRoutes }` pair the rest of arc reads.
 *
@@ -1221,7 +1328,8 @@ function normalizeActionsToRouterConfig(actions, resourceActionPermissions, tag,
 * Fastify instance via `resource._sharedStateRegisteredOn`.
 */
 function buildResourcePlugin(resource) {
-	return async function resourcePlugin(fastify, _opts) {
+	return async function resourcePlugin(fastify, opts) {
+		await ensureSchemaConverter();
 		const sharedRoot = fastify.server;
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
@@ -1257,6 +1365,7 @@ function buildResourcePlugin(resource) {
 				fastify.log?.warn?.(`[Arc] Resource '${resource.name}' declares events (${eventNames}) but \`eventPlugin\` is not registered. The events will silently NOT be emitted on CRUD mutations. Either register the plugin (\`await fastify.register(eventPlugin, { transport: ... })\`) or remove the \`events\` declaration from the resource.`);
 			}
 		}
+		if (opts?.arcMountRoutes === false) return;
 		await fastify.register(async (instance) => {
 			const typedInstance = instance;
 			let schemas = buildGeneratedCrudSchemas(resource._registryMeta?.openApiSchemas, resource.customSchemas);
@@ -1286,7 +1395,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-BWMDW-dL.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-h1cEEaEX.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1301,7 +1410,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-l5mNdYrZ.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B1C0kvTL.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1913,58 +2022,6 @@ function defineResource(config) {
 	return resource;
 }
 //#endregion
-//#region src/core/defineResource/seams.ts
-/** Plain object test — literals only; class instances must replace, not merge. */
-function isPlainObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
-function mergePlain(base, next) {
-	const out = { ...base };
-	for (const [key, value] of Object.entries(next)) {
-		if (value === void 0) continue;
-		const existing = out[key];
-		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
-	}
-	return out;
-}
-/**
-* Canonical slot-aware merge of a base resource config with host seams.
-* Later seams win over earlier ones; `undefined` values never clobber.
-*
-* Merge semantics (value-driven — no per-slot registry to drift):
-*
-*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
-*     `routeGuards`, `disabledRoutes`: additive collections, base first.
-*   - **Plain objects merge recursively** — `permissions`, `actions`,
-*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
-*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
-*     them replace (they're value lists — enums, sort specs), not concat.
-*   - **Everything else last-wins** — class instances (`adapter`,
-*     `controller`, `queryParser`), functions, scalars.
-*
-* The single `as` at the return is the one documented erasure for the
-* {@link AdapterLike}-widened seam slots — inside the helper so no module
-* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
-*/
-function mergeResourceConfig(base, ...seams) {
-	const out = { ...base };
-	for (const seam of seams) {
-		if (!seam) continue;
-		for (const [key, value] of Object.entries(seam)) {
-			if (value === void 0) continue;
-			const existing = out[key];
-			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
-			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
-			else if (Array.isArray(value)) out[key] = [...value];
-			else out[key] = value;
-		}
-	}
-	return out;
-}
-//#endregion
 //#region src/core/defineResourceVariants.ts
 /**
 * Define multiple resources from a shared base config and per-variant overrides.
@@ -2063,4 +2120,4 @@ function getEntityQuery(req) {
 	return { [getEntityIdField(req)]: id };
 }
 //#endregion
-export { mergeResourceConfig as a, defineAction as c, defineAggregation as d, defineResourceVariants as i, createCrudRouter as l, getEntityIdField as n, defineResource as o, getEntityQuery as r, ResourceDefinition as s, getEntityId as t, createPermissionMiddleware as u };
+export { defineResource as a, defineAction as c, defineAggregation as d, defineResourceVariants as i, createCrudRouter as l, getEntityIdField as n, ResourceDefinition as o, getEntityQuery as r, mergeResourceConfig as s, getEntityId as t, createPermissionMiddleware as u };

package/dist/{createActionRouter-BWMDW-dL.mjs → createActionRouter-h1cEEaEX.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-oGAl0oA8.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
 import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-ze70xXJi.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-ajetw3Fv.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-B-6SPe7g.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -108,19 +108,23 @@ function createActionRouter(fastify, config) {
 			scopedError.meta = { action: submitted };
 			throw scopedError;
 		};
-		const preHandler = [actionValidationFormatter, ...buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			arcDecorator,
 			authMw,
 			permissionMw,
 			pluginMw: selectPluginMw("POST", pluginMw),
 			routeGuards
-		})];
+		});
+		const preHandler = [actionValidationFormatter, ...hooks.preHandler];
 		tryRegisterRoute(fastify, {
 			method: "POST",
 			url: urlPath,
 			schema: routeSchema,
 			attachValidation: true,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions({
+				onRequest: hooks.onRequest,
+				preHandler
+			}),
 			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;

package/dist/{createAggregationRouter-l5mNdYrZ.mjs → createAggregationRouter-B1C0kvTL.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-oGAl0oA8.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
@@ -48,7 +48,7 @@ function registerOne(fastify, normalized, ctx) {
 			throw new ForbiddenError(reason ?? "You do not have permission to access this aggregation.");
 		}
 	};
-	const preHandler = buildPreHandlerChain({
+	const hooks = buildRouteHooks({
 		arcDecorator,
 		authMw,
 		permissionMw,
@@ -73,7 +73,7 @@ function registerOne(fastify, normalized, ctx) {
 		method: "GET",
 		url: `/aggregations/${name}`,
 		schema: routeSchema,
-		preHandler: preHandler.length > 0 ? preHandler : void 0,
+		...routeHookOptions(hooks),
 		...rateLimitConfig ? { config: rateLimitConfig } : {},
 		handler: async (req, reply) => {
 			try {