@classytic/arc 2.23.0 → 2.28.0

package/dist/{index-CC5ruDGh.d.mts → index-CjVg-Epg.d.mts}

@@ -1,7 +1,7 @@
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, H as CrudController, Jt as AnyRecord, L as RequestWithExtras, Lt as IController, Rt as IControllerResponse, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig, zt as IRequestContext } from "./index-BBsvQt7U.mjs";
-import { i as RequestScope } from "./types-DH0GupI7.mjs";
-import { t as PermissionCheck } from "./types-Csxga7d3.mjs";
-import "./fastify-augmentation-g_f9omSc.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, H as CrudController, L as RequestWithExtras, Lt as IController, Rt as IControllerResponse, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig, zt as IRequestContext } from "./index-DPRH0Cme.mjs";
+import { i as RequestScope } from "./types-DjC-KUCz.mjs";
+import { c as AnyRecord, t as PermissionCheck } from "./types-Dmw-6Qeo.mjs";
+import "./fastify-augmentation-OzYGIiU1.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
 import { DataAdapter } from "@classytic/repo-core/adapter";
@@ -425,4 +425,36 @@ declare function isFieldReadable(rule: ArcFieldRule | undefined): boolean;
  */
 declare function collectReadBlockedFields(schemaOptions: RouteSchemaOptions | undefined): Set<string> | null;
 //#endregion
-export { HOOK_OPERATIONS as A, SYSTEM_FIELDS as B, CrudOperation as C, DEFAULT_SORT as D, DEFAULT_MAX_LIMIT as E, MAX_REGEX_LENGTH as F, MAX_SEARCH_LENGTH as I, MUTATION_OPERATIONS as L, HookOperation as M, HookPhase as N, DEFAULT_TENANT_FIELD as O, MAX_FILTER_DEPTH as P, MutationOperation as R, CRUD_OPERATIONS as S, DEFAULT_LIMIT as T, DefineActionConfig as _, createRequestContext as a, createPermissionMiddleware as b, sendControllerResponse as c, getEntityQuery as d, defineResourceVariants as f, mergeResourceConfig as g, SeamedResourceConfig as h, createFastifyHandler as i, HOOK_PHASES as j, DEFAULT_UPDATE_METHOD as k, getEntityId as l, ResourceSeams as m, isFieldReadable as n, getControllerContext as o, AdapterLike as p, createCrudHandlers as r, getControllerScope as s, collectReadBlockedFields as t, getEntityIdField as u, defineAction as v, DEFAULT_ID_FIELD as w, defineAggregation as x, createCrudRouter as y, RESERVED_QUERY_PARAMS as z };
+//#region src/core/validateResourceConfig.d.ts
+interface ConfigError {
+  field: string;
+  message: string;
+  suggestion?: string;
+}
+interface ValidationResult {
+  valid: boolean;
+  errors: ConfigError[];
+  warnings: ConfigError[];
+}
+interface ValidateOptions {
+  /** Skip controller method validation (for testing) */
+  skipControllerCheck?: boolean;
+  /** Allow unknown preset names */
+  allowUnknownPresets?: boolean;
+  /** Custom valid permission keys beyond CRUD */
+  additionalPermissionKeys?: string[];
+}
+/**
+ * Validate a resource configuration
+ */
+declare function validateResourceConfig(config: ResourceConfig, options?: ValidateOptions): ValidationResult;
+/**
+ * Format validation errors for display
+ */
+declare function formatValidationErrors(resourceName: string, result: ValidationResult): string;
+/**
+ * Validate and throw if invalid
+ */
+declare function assertValidConfig(config: ResourceConfig, options?: ValidateOptions): void;
+//#endregion
+export { DEFAULT_ID_FIELD as A, MAX_FILTER_DEPTH as B, DefineActionConfig as C, defineAggregation as D, createPermissionMiddleware as E, DEFAULT_UPDATE_METHOD as F, RESERVED_QUERY_PARAMS as G, MAX_SEARCH_LENGTH as H, HOOK_OPERATIONS as I, SYSTEM_FIELDS as K, HOOK_PHASES as L, DEFAULT_MAX_LIMIT as M, DEFAULT_SORT as N, CRUD_OPERATIONS as O, DEFAULT_TENANT_FIELD as P, HookOperation as R, mergeResourceConfig as S, createCrudRouter as T, MUTATION_OPERATIONS as U, MAX_REGEX_LENGTH as V, MutationOperation as W, getEntityQuery as _, formatValidationErrors as a, ResourceSeams as b, isFieldReadable as c, createRequestContext as d, getControllerContext as f, getEntityIdField as g, getEntityId as h, assertValidConfig as i, DEFAULT_LIMIT as j, CrudOperation as k, createCrudHandlers as l, sendControllerResponse as m, ValidateOptions as n, validateResourceConfig as o, getControllerScope as p, ValidationResult as r, collectReadBlockedFields as s, ConfigError as t, createFastifyHandler as u, defineResourceVariants as v, defineAction as w, SeamedResourceConfig as x, AdapterLike as y, HookPhase as z };

package/dist/{index-BBsvQt7U.d.mts → index-DPRH0Cme.d.mts}

@@ -1,6 +1,6 @@
-import { a as QueryCacheConfig } from "./QueryCache-Z1B38koh.mjs";
-import { i as RequestScope } from "./types-DH0GupI7.mjs";
-import { i as UserBase, t as PermissionCheck } from "./types-Csxga7d3.mjs";
+import { a as QueryCacheConfig } from "./QueryCache-DOMT_iq7.mjs";
+import { P as ArcHeaders, i as RequestScope } from "./types-DjC-KUCz.mjs";
+import { c as AnyRecord, i as UserBase, t as PermissionCheck } from "./types-Dmw-6Qeo.mjs";
 import "./elevation-C9s5hFP_.mjs";
 import { n as FieldPermissionMap } from "./fields-D3lhgzhD.mjs";
 import { n as EncryptionDirective } from "./types-Cc91nXuA.mjs";
@@ -620,9 +620,9 @@ declare class QueryResolver {
   /** Sanitize advanced populate options against allowedPopulate */
   private sanitizePopulateOptions;
   /**
-   * Sanitize lookup/join options.
-   * If schemaOptions.query.allowedLookups is set, only those collections are allowed.
-   * Validates lookup structure to prevent injection.
+   * Sanitize lookup/join options. Deny-by-default: `allowedLookups` must be
+   * configured for any client-driven lookup to pass; listed collections are
+   * then structurally validated to prevent injection.
    */
   private sanitizeLookups;
   /**
@@ -833,6 +833,26 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    * create/update, the original input (`existing`) for delete.
    */
   protected runAfterHook(req: IRequestContext, op: "create" | "update" | "delete", data: AnyRecord, meta?: Record<string, unknown>): Promise<void>;
+  /**
+   * Per-instance single-flight for cache fills — concurrent requests for
+   * the SAME cache key coalesce onto one repository query instead of each
+   * issuing its own (a popular entry expiring under 1,000 concurrent
+   * readers must produce 1 DB query, not 1,000). Keys already encode the
+   * resolved query + user/org scope + resource version, so coalescing can
+   * never cross tenants, scopes, or invalidation generations. Per-process
+   * by design; distributed refresh leases are a store-level concern
+   * (planned with the repo-core CacheEngine façade, which ships
+   * single-flight natively).
+   */
+  private readonly inFlightCacheFills;
+  private cacheSingleFlight;
+  /**
+   * Register a background SWR refresh for `key` unless one is already in
+   * flight. Registration is SYNCHRONOUS (before the deferred tick) so a
+   * burst of stale readers arriving in the same tick schedules exactly one
+   * revalidation.
+   */
+  private scheduleCacheRefresh;
   /** Cached `list()` flow with SWR semantics. Returns null when cache is disabled. */
   protected withListCache(req: IRequestContext, options: ParsedQuery): Promise<IControllerResponse<ListResult<TDoc>> | null>;
   /** Cached `get()` flow with SWR semantics. Returns null when cache is disabled. */
@@ -1044,96 +1064,6 @@ declare class BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository ex
   readonly _phantom?: [TDoc, _TRepository];
 }
 //#endregion
-//#region src/types/base.d.ts
-declare module "fastify" {
-  interface FastifyRequest {
-    /** Request scope — set by auth adapter, read by permissions/presets/guards */
-    scope: RequestScope;
-    /**
-     * Current user — set by auth adapter (Better Auth, JWT, custom).
-     * `undefined` on public routes (`auth: false`) or unauthenticated requests.
-     * Guard with `if (request.user)` on routes that allow anonymous access.
-     *
-     * Kept as required (not `user?`) because `@fastify/jwt` declares it
-     * as required — declaration merges must have identical modifiers.
-     * The `| undefined` in the type achieves the same DX.
-     */
-    user: Record<string, unknown> | undefined;
-    /** Policy-injected query filters (e.g. ownership, org-scoping) */
-    _policyFilters?: Record<string, unknown>;
-    /** Field mask — fields to include/exclude in responses */
-    fieldMask?: {
-      include?: string[];
-      exclude?: string[];
-    };
-    /** Arbitrary policy metadata for downstream consumers */
-    policyMetadata?: Record<string, unknown>;
-    /** Document loaded by policy middleware for ownership checks */
-    document?: unknown;
-    /** Ownership check context (field name + user field) */
-    _ownershipCheck?: Record<string, unknown>;
-  }
-}
-type AnyRecord = Record<string, unknown>;
-/** MongoDB ObjectId — accepts string or any object with a `toString()` (e.g. mongoose ObjectId). */
-type ObjectId = string | {
-  toString(): string;
-};
-/**
- * Flexible user type that accepts any object with id/_id properties.
- * The actual user structure is defined by your app's auth system.
- */
-type UserLike = UserBase & {
-  /** User email (optional) */
-  email?: string;
-};
-interface UserOrganization {
-  userId: string;
-  organizationId: string;
-  [key: string]: unknown;
-}
-interface JWTPayload {
-  sub: string;
-  [key: string]: unknown;
-}
-/**
- * @deprecated LEGACY envelope — arc's actual wire contract has not used
- * `{ success, data, error, message }` for a long time. Successes return
- * DIRECT data (see `IControllerResponse` — `{ data, meta?, status?, headers? }`
- * flattened onto the wire), and errors return the canonical `ErrorContract`
- * (`{ code, message, status, details? }` from `@classytic/repo-core/errors`)
- * emitted by the global error handler. Keeping this type visible teaches new
- * applications and AI agents to generate an obsolete shape. Scheduled for
- * removal in v3. Do NOT build new response handling against it.
- */
-interface ApiResponse<T = unknown> {
-  success: boolean;
-  data?: T;
-  error?: string;
-  message?: string;
-  meta?: Record<string, unknown>;
-}
-/**
- * Typed Fastify request with Arc decorations. Use in `raw: true` handlers
- * instead of `(req as any).user`.
- *
- * @example
- * ```typescript
- * import type { ArcRequest } from '@classytic/arc';
- *
- * handler: async (req: ArcRequest, reply) => {
- *   req.user?.id;                    // typed
- *   req.scope.organizationId;        // typed (when member)
- *   req.signal;                      // AbortSignal (Fastify 5)
- * }
- * ```
- */
-type ArcRequest = FastifyRequest & {
-  scope: RequestScope;
-  user: Record<string, unknown> | undefined;
-  signal: AbortSignal;
-};
-//#endregion
 //#region src/types/auth.d.ts
 /**
  * JWT utilities provided to authenticator. Arc provides the helpers;
@@ -1430,15 +1360,15 @@ interface IRequestContext<TBody = unknown, TParams extends Record<string, string
   /** Authenticated user or null */
   user: TUser | null;
   /**
-   * Request headers.
-   *
-   * ⚠ Declared narrow for ergonomics, but on the HTTP path this is
-   * Fastify's headers object passed through — repeated headers arrive as
-   * `string[]` at RUNTIME behind this type. Read via `getHeader(ctx.headers,
-   * name)` from `@classytic/arc/utils` for array-safe, duplicate-deterministic
-   * access. The declared type widens to `ArcHeaders` in v3.
+   * Request headers — `ArcHeaders` (`string | string[] | undefined` per
+   * name), the HONEST type: on the HTTP path this is Fastify's headers
+   * object passed through, and repeated headers arrive as `string[]` at
+   * runtime (2.24 widening — the previous `Record<string, string |
+   * undefined>` lied about that). Read via `getHeader(ctx.headers, name)`
+   * from `@classytic/arc/utils` for array-safe, duplicate-deterministic
+   * access, or `requireSingleHeaderValue` for security-sensitive headers.
    */
-  headers: Record<string, string | undefined>;
+  headers: ArcHeaders;
   /** Organization ID (for multi-tenant apps) */
   organizationId?: string;
   /** Team ID (for team-scoped resources) */
@@ -1666,7 +1596,7 @@ interface RouteDefinition {
    * compiler to catch typos. `handler` stays optional when `controllerMethod`
    * is set — exactly one of the two must be declared.
    */
-  readonly handler?: string | ControllerHandler | RouteHandlerMethod | ((request: FastifyRequest<Record<string, unknown>>, reply: FastifyReply) => unknown);
+  readonly handler?: string | ControllerHandler | RouteHandlerMethod | ((request: never, reply: never) => unknown);
   /**
    * Typed function-reference handler (2.16). Receives the live controller
    * instance and returns the method to invoke — TypeScript catches typos
@@ -4259,4 +4189,4 @@ interface ValidateOptions {
   strict?: boolean;
 }
 //#endregion
-export { OpenApiSchemas as $, UserLike as $t, RequestIdOptions as A, defineHook as An, RouteDefinition as At, defineResource as B, BodySanitizer as Bn, RouteHandler as Bt, RequestContext as C, afterCreate as Cn, PipelineStep as Ct, HealthCheck as D, beforeDelete as Dn, ActionEntry as Dt, GracefulShutdownOptions as E, beforeCreate as En, ActionDefinition as Et, FastifyWithDecorators as F, ArcUpdateResult as Fn, ControllerLike as Ft, OnTenantDeleteConfig as G, AuthenticatorContext as Gt, CrudController as H, AuthHelpers as Ht, MiddlewareHandler as I, BaseControllerOptions as In, FastifyHandler as It, PresetHook as J, AnyRecord as Jt, ResolvedTenantPurge as K, JwtContext as Kt, RequestWithExtras as L, ControllerConfigurableOptions as Ln, IController as Lt, EventsDecorator as M, ArcDeleteResult as Mn, RouteMethod as Mt, FastifyRequestExtras as N, ArcGetResult as Nn, RateLimitConfig as Nt, HealthOptions as O, beforeUpdate as On, ActionHandlerFn as Ot, FastifyWithAuth as P, ArcListResult as Pn, ControllerHandler as Pt, MiddlewareConfig as Q, ObjectId as Qt, RegisterOptions as R, ControllerConstructionOptions as Rn, IControllerResponse as Rt, QueryParserInterface as S, HookSystemOptions as Sn, PipelineContext as St, CrudRouterOptions as T, afterUpdate as Tn, ResourceCacheConfig as Tt, ResourceConfig as U, AuthPluginOptions as Ut, ResourceDefinition as V, BodySanitizerConfig as Vn, ServerAccessor as Vt, ResourcePermissions as W, Authenticator as Wt, CrudRouteKey as X, ArcRequest as Xt, PresetResult as Y, ApiResponse as Yt, CrudSchemas as Z, JWTPayload as Zt, ControllerQueryOptions as _, HookHandler as _n, Guard as _t, InferAdapterDoc as a, TreeMixin as an, ResourceExtensions as at, ParsedQuery as b, HookRegistration as bn, OperationFilter as bt, TypedController as c, BulkExt as cn, AggMeasureShorthand as ct, PaginationResult as d, QueryResolver as dn, AggregationDateRangeRequirement as dt, UserOrganization as en, RouteSchemaOptions as et, IntrospectionData as f, QueryResolverConfig as fn, AggregationIndexHint as ft, ArcInternalMetadata as g, HookContext as gn, AggregationsMap as gt, ResourceMetadata as h, DefineHookOptions as hn, AggregationRateLimit as ht, ValidationResult as i, TreeExt as in, ResourceHooks as it, ArcDecorator as j, ArcCreateResult as jn, RouteMcpConfig as jt, IntrospectionPluginOptions as k, createHookSystem as kn, ActionsMap as kt, TypedRepository as l, BulkMixin as ln, AggregationCacheConfig as lt, RegistryStats as m, AccessControlConfig as mn, AggregationMaterializedResult as mt, ConfigError as n, SoftDeleteExt as nn, FieldRule$1 as nt, InferDocType as o, SlugExt as on, EventDefinition as ot, RegistryEntry as p, AccessControl as pn, AggregationMaterializedContext as pt, PresetFunction as q, TokenPair as qt, ValidateOptions as r, SoftDeleteMixin as rn, ResourceHookContext as rt, InferResourceDoc as s, SlugMixin as sn, AggMeasureInput as st, RouteHandlerMethod$1 as t, BaseController as tn, ArcFieldRule as tt, TypedResourceConfig as u, BaseCrudController as un, AggregationConfig as ut, LookupOption as v, HookOperation as vn, Interceptor as vt, ServiceContext as w, afterDelete as wn, Transform as wt, PopulateOption as x, HookSystem as xn, PipelineConfig as xt, OwnershipCheck as y, HookPhase as yn, NextFunction as yt, ResourceRegistry as z, ListResult as zn, IRequestContext as zt };
+export { OpenApiSchemas as $, SlugExt as $t, RequestIdOptions as A, ControllerConfigurableOptions as An, RouteDefinition as At, defineResource as B, RouteHandler as Bt, RequestContext as C, defineHook as Cn, PipelineStep as Ct, HealthCheck as D, ArcListResult as Dn, ActionEntry as Dt, GracefulShutdownOptions as E, ArcGetResult as En, ActionDefinition as Et, FastifyWithDecorators as F, ControllerLike as Ft, OnTenantDeleteConfig as G, AuthenticatorContext as Gt, CrudController as H, AuthHelpers as Ht, MiddlewareHandler as I, FastifyHandler as It, PresetHook as J, BaseController as Jt, ResolvedTenantPurge as K, JwtContext as Kt, RequestWithExtras as L, IController as Lt, EventsDecorator as M, ListResult as Mn, RouteMethod as Mt, FastifyRequestExtras as N, BodySanitizer as Nn, RateLimitConfig as Nt, HealthOptions as O, ArcUpdateResult as On, ActionHandlerFn as Ot, FastifyWithAuth as P, BodySanitizerConfig as Pn, ControllerHandler as Pt, MiddlewareConfig as Q, TreeMixin as Qt, RegisterOptions as R, IControllerResponse as Rt, QueryParserInterface as S, createHookSystem as Sn, PipelineContext as St, CrudRouterOptions as T, ArcDeleteResult as Tn, ResourceCacheConfig as Tt, ResourceConfig as U, AuthPluginOptions as Ut, ResourceDefinition as V, ServerAccessor as Vt, ResourcePermissions as W, Authenticator as Wt, CrudRouteKey as X, SoftDeleteMixin as Xt, PresetResult as Y, SoftDeleteExt as Yt, CrudSchemas as Z, TreeExt as Zt, ControllerQueryOptions as _, afterDelete as _n, Guard as _t, InferAdapterDoc as a, QueryResolverConfig as an, ResourceExtensions as at, ParsedQuery as b, beforeDelete as bn, OperationFilter as bt, TypedController as c, DefineHookOptions as cn, AggMeasureShorthand as ct, PaginationResult as d, HookOperation as dn, AggregationDateRangeRequirement as dt, SlugMixin as en, RouteSchemaOptions as et, IntrospectionData as f, HookPhase as fn, AggregationIndexHint as ft, ArcInternalMetadata as g, afterCreate as gn, AggregationsMap as gt, ResourceMetadata as h, HookSystemOptions as hn, AggregationRateLimit as ht, ValidationResult as i, QueryResolver as in, ResourceHooks as it, ArcDecorator as j, ControllerConstructionOptions as jn, RouteMcpConfig as jt, IntrospectionPluginOptions as k, BaseControllerOptions as kn, ActionsMap as kt, TypedRepository as l, HookContext as ln, AggregationCacheConfig as lt, RegistryStats as m, HookSystem as mn, AggregationMaterializedResult as mt, ConfigError as n, BulkMixin as nn, FieldRule$1 as nt, InferDocType as o, AccessControl as on, EventDefinition as ot, RegistryEntry as p, HookRegistration as pn, AggregationMaterializedContext as pt, PresetFunction as q, TokenPair as qt, ValidateOptions as r, BaseCrudController as rn, ResourceHookContext as rt, InferResourceDoc as s, AccessControlConfig as sn, AggMeasureInput as st, RouteHandlerMethod$1 as t, BulkExt as tn, ArcFieldRule as tt, TypedResourceConfig as u, HookHandler as un, AggregationConfig as ut, LookupOption as v, afterUpdate as vn, Interceptor as vt, ServiceContext as w, ArcCreateResult as wn, Transform as wt, PopulateOption as x, beforeUpdate as xn, PipelineConfig as xt, OwnershipCheck as y, beforeCreate as yn, NextFunction as yt, ResourceRegistry as z, IRequestContext as zt };

package/dist/index.d.mts

@@ -1,11 +1,11 @@
-import { A as RequestIdOptions, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as ArcUpdateResult, Ft as ControllerLike, H as CrudController, In as BaseControllerOptions, Jt as AnyRecord, L as RequestWithExtras, Ln as ControllerConfigurableOptions, Lt as IController, Mn as ArcDeleteResult, N as FastifyRequestExtras, Nn as ArcGetResult, Nt as RateLimitConfig, O as HealthOptions, P as FastifyWithAuth, Pn as ArcListResult, Q as MiddlewareConfig, Rn as ControllerConstructionOptions, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, U as ResourceConfig, Ut as AuthPluginOptions, V as ResourceDefinition, X as CrudRouteKey, Xt as ArcRequest, Y as PresetResult, Yt as ApiResponse, Z as CrudSchemas, Zt as JWTPayload, a as InferAdapterDoc, an as TreeMixin, c as TypedController, cn as BulkExt, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as UserOrganization, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, in as TreeExt, jn as ArcCreateResult, k as IntrospectionPluginOptions, l as TypedRepository, ln as BulkMixin, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as SoftDeleteExt, nt as FieldRule, o as InferDocType, on as SlugExt, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as SoftDeleteMixin, s as InferResourceDoc, sn as SlugMixin, st as AggMeasureInput, t as RouteHandlerMethod, tn as BaseController, u as TypedResourceConfig, un as BaseCrudController, ut as AggregationConfig, w as ServiceContext, y as OwnershipCheck, zn as ListResult, zt as IRequestContext } from "./index-BBsvQt7U.mjs";
-import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-Csxga7d3.mjs";
+import { $t as SlugExt, A as RequestIdOptions, An as ControllerConfigurableOptions, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcListResult, E as GracefulShutdownOptions, En as ArcGetResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, Jt as BaseController, L as RequestWithExtras, Lt as IController, Mn as ListResult, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ArcUpdateResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeMixin, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcDeleteResult, U as ResourceConfig, Ut as AuthPluginOptions, V as ResourceDefinition, X as CrudRouteKey, Xt as SoftDeleteMixin, Y as PresetResult, Yt as SoftDeleteExt, Z as CrudSchemas, Zt as TreeExt, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugMixin, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, jn as ControllerConstructionOptions, k as IntrospectionPluginOptions, kn as BaseControllerOptions, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkMixin, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BaseCrudController, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as BulkExt, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, wn as ArcCreateResult, y as OwnershipCheck, zt as IRequestContext } from "./index-DPRH0Cme.mjs";
+import { c as AnyRecord, i as UserBase, l as ArcRequest, n as PermissionContext, p as UserOrganization, r as PermissionResult, t as PermissionCheck, u as JWTPayload } from "./types-Dmw-6Qeo.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-D3lhgzhD.mjs";
-import "./fastify-augmentation-g_f9omSc.mjs";
-import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, m as ResourceSeams, p as AdapterLike, s as getControllerScope, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, z as RESERVED_QUERY_PARAMS } from "./index-CC5ruDGh.mjs";
-import { A as allOf, E as DynamicPermissionMatrixConfig, F as requireAuth, I as requireOwnership, L as requireRoles, M as anyOf, N as denyAll, O as createDynamicPermissionMatrix, T as DynamicPermissionMatrix, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as allowPublic, k as createOrgPermissions, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as when } from "./index-wMoWBLkn.mjs";
+import "./fastify-augmentation-OzYGIiU1.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-CjVg-Epg.mjs";
+import { A as allOf, E as DynamicPermissionMatrixConfig, F as requireAuth, I as requireOwnership, L as requireRoles, M as anyOf, N as denyAll, O as createDynamicPermissionMatrix, T as DynamicPermissionMatrix, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as allowPublic, k as createOrgPermissions, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as when } from "./index-BMnbzvtO.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DHcHVAgk.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ApiResponse, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PermissionResult, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PermissionResult, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,11 +1,12 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DNre0wRg.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-BQ8KNvWC.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, o as fields } from "./applyPermissionResult-Tw4iXtlf.mjs";
-import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, o as ResourceDefinition, s as mergeResourceConfig } from "./core-DQ6rDTyH.mjs";
-import { C as allowPublic, D as requireAuth, O as requireOwnership, S as allOf, T as denyAll, _ as requireOrgMembership, b as requireServiceScope, c as publicReadAdminWrite, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as readOnly, m as createDynamicPermissionMatrix, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "./permissions-tbxFHxjZ.mjs";
-import { l as getControllerScope } from "./actionPermissions-lszoJle1.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B65zbz9m.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, o as fields } from "./applyPermissionResult-BnyVE9eD.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-2zvVVpxg.mjs";
+import { c as getControllerScope } from "./pipeline-BGRnV-To.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction, s as defineAggregation } from "./core-BGa8TXJR.mjs";
+import { A as requireAuth, D as anyOf, E as allowPublic, M as requireRoles, O as denyAll, P as when, T as allOf, _ as requireOrgMembership, b as requireServiceScope, c as publicReadAdminWrite, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as requireOwnership, l as readOnly, m as createDynamicPermissionMatrix, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as requireOrgRole, x as requireTeamMembership, y as requireScopeContext } from "./permissions-BrtiBKGs.mjs";
 //#region src/index.ts
-const version = "2.23.0";
+const version = "2.28.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };