@classytic/arc 2.25.0 → 2.30.0

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DPRH0Cme.mjs";
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-Q5gzEIWY.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/{pipeline-BN5G05rd.mjs → pipeline-BJnpkY9i.mjs}

@@ -1,23 +1,9 @@
 import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { i as applyFieldReadPermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
+import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
-//#region src/scope/projection.ts
-/**
-* Compute the request-scope projection. Returns `undefined` when no
-* scope is attached (public / unscoped routes) so hosts can idiomatically
-* write `ctx.scope?.organizationId` without a double-null check.
-*/
-function buildRequestScopeProjection(scope) {
-	if (!scope) return void 0;
-	return {
-		organizationId: getOrgId(scope),
-		userId: getUserId(scope),
-		orgRoles: isMember(scope) ? scope.orgRoles : void 0
-	};
-}
-//#endregion
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
 function isMongooseDoc(obj) {
@@ -334,4 +320,4 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t, buildRequestScopeProjection as u };
+export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t };

package/dist/plugins/index.d.mts

@@ -1,8 +1,8 @@
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DPRH0Cme.mjs";
-import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-Q5gzEIWY.mjs";
+import { l as AnyRecord } from "../types-ChvvVNP8.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-C6yv4ZTW.mjs";
-import { C as schedulesPlugin, D as healthPlugin, E as _default$3, S as _default$7, T as HealthOptions, b as ScheduleStats, w as HealthCheck, x as SchedulesPluginOptions, y as ScheduleDefinition } from "../index-KUoxjIq1.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-dPNBVeIj.mjs";
+import { _ as _default$3, d as ScheduleStats, f as SchedulesPluginOptions, g as HealthOptions, h as HealthCheck, m as schedulesPlugin, p as _default$7, u as ScheduleDefinition, v as healthPlugin } from "../types-D_n8L6VY.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-0WhPnUH7.mjs";
 import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DXgY5BUm.mjs";
 import { t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";

package/dist/plugins/index.mjs

@@ -2,13 +2,13 @@ import { p as MUTATION_OPERATIONS } from "../constants-DNre0wRg.mjs";
 import { c as getOrgId } from "../types-CSyCxl2V.mjs";
 import { n as requestContext } from "../requestContext-MrlJwECf.mjs";
 import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
-import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
+import { t as HookSystem } from "../HookSystem-WkIougo6.mjs";
 import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-CB_m4S32.mjs";
 import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
 import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bq2OeEQL.mjs";
 import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-Cuw_deA-.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-B9nmIY5V.mjs";
 import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
 import { n as schedules_default, t as schedulesPlugin } from "../schedules-CjOd2MG9.mjs";
 import { n as sse_default, t as ssePlugin } from "../sse-BQ1w0dfl.mjs";

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.25.0";
+	const resolvedVersion = serviceVersion ?? "2.30.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{preloadResources-0oe-JSSS.d.mts → preloadResources-DCfa2egz.d.mts}

@@ -1,11 +1,12 @@
-import { Wt as Authenticator } from "./index-DPRH0Cme.mjs";
+import { Wt as Authenticator } from "./index-Q5gzEIWY.mjs";
 import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
 import { n as ElevationOptions } from "./elevation-C9s5hFP_.mjs";
 import { a as EventTransport } from "./EventTransport-QmY7A258.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
 import { r as QueryCachePluginOptions } from "./queryCachePlugin-br4otiqF.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler-C6yv4ZTW.mjs";
-import { T as HealthOptions, d as ArcModuleInput, g as ResourceLike, x as SchedulesPluginOptions } from "./index-KUoxjIq1.mjs";
+import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-D_n8L6VY.mjs";
+import "./index-CCzVR-N3.mjs";
 import { t as EventPluginOptions } from "./eventPlugin-Bg3cP2_u.mjs";
 import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-DXgY5BUm.mjs";
 import { r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";

package/dist/preloadResources-DSY5HGpS.mjs

@@ -0,0 +1,45 @@
+//#region src/factory/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { preloadResourcesAsync as n, preloadResources as t };

package/dist/presets/filesUpload.d.mts

@@ -1,6 +1,6 @@
-import { Y as PresetResult } from "../index-DPRH0Cme.mjs";
+import { Y as PresetResult } from "../index-Q5gzEIWY.mjs";
 import { i as RequestScope } from "../types-DjC-KUCz.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
+import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,6 +1,6 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
 import { c as getOrgId, g as getUserId } from "../types-CSyCxl2V.mjs";
-import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
+import { I as requireAuth, j as allowPublic } from "../permissions-Bfu_8y1U.mjs";
 import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";

package/dist/presets/index.d.mts

@@ -1,11 +1,23 @@
-import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-DPRH0Cme.mjs";
-import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
+import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-Q5gzEIWY.mjs";
+import { l as AnyRecord } from "../types-ChvvVNP8.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";
 //#region src/presets/ownedByUser.d.ts
 interface OwnedByUserOptions {
   ownerField?: string;
+  /**
+   * What to do when a target record has NO value in `ownerField` (legacy /
+   * unowned records).
+   *
+   * - `"deny"` (default): fail closed — an unowned record is NOT modifiable
+   *   through an ownership-gated route. This is the secure default; ownership
+   *   that silently passes for records missing the owner is not an ownership
+   *   primitive.
+   * - `"allow"`: legacy compatibility — permit modifying records that predate
+   *   the owner field. Visibly unsafe; opt in only for a bounded migration.
+   */
+  missingOwner?: "deny" | "allow";
 }
 declare function ownedByUserPreset(options?: OwnedByUserOptions): PresetResult;
 //#endregion

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-DwFDVKP0.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CJOEXLuk.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { X as CrudRouteKey, Y as PresetResult } from "../index-DPRH0Cme.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-Q5gzEIWY.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-DPRH0Cme.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
+import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-Q5gzEIWY.mjs";
+import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
+import { I as requireAuth, j as allowPublic } from "../permissions-Bfu_8y1U.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-DwFDVKP0.mjs → presets-CJOEXLuk.mjs}

@@ -1,29 +1,40 @@
+import { l as UnauthorizedError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
-import { A as requireAuth, E as allowPublic, M as requireRoles } from "./permissions-BrtiBKGs.mjs";
+import { I as requireAuth, R as requireRoles, j as allowPublic } from "./permissions-Bfu_8y1U.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.
-* Elevated scope (platform admin) bypasses ownership checks.
+*
+* FAIL-CLOSED: ownership is meaningless without an authenticated identity, so a
+* request with no user (or a user with no id) is DENIED here rather than sliding
+* through with no ownership check installed. Elevated scope (platform admin)
+* bypasses the check by design.
 */
-function createOwnershipCheck(ownerField) {
+function createOwnershipCheck(ownerField, missingOwner) {
 	return async (request, _reply) => {
-		const user = request.user;
-		if (!user) return;
 		if (isElevated(request.scope ?? PUBLIC_SCOPE)) return;
+		const user = request.user;
+		if (!user) throw new UnauthorizedError("Authentication required for this operation");
 		const userWithId = user;
 		const userId = userWithId._id ?? userWithId.id;
-		if (userId) request._ownershipCheck = {
+		if (!userId) throw new UnauthorizedError("Authenticated identity has no usable id");
+		request._ownershipCheck = {
 			field: ownerField,
-			userId
+			userId,
+			missingOwner
 		};
 	};
 }
 function ownedByUserPreset(options = {}) {
-	const { ownerField = "userId" } = options;
-	const ownershipMiddleware = createOwnershipCheck(ownerField);
+	const { ownerField = "userId", missingOwner = "deny" } = options;
+	const ownershipMiddleware = createOwnershipCheck(ownerField, missingOwner);
 	return {
 		name: "ownedByUser",
+		permissions: {
+			update: requireAuth(),
+			delete: requireAuth()
+		},
 		middlewares: {
 			update: [ownershipMiddleware],
 			delete: [ownershipMiddleware]
@@ -366,6 +377,11 @@ function mergePreset(config, preset) {
 			result.middlewares[key] = [...result.middlewares[key] ?? [], ...mws ?? []];
 		}
 	}
+	if (preset.permissions) {
+		const merged = { ...result.permissions };
+		for (const [op, check] of Object.entries(preset.permissions)) if (merged[op] === void 0 && check !== void 0) merged[op] = check;
+		result.permissions = merged;
+	}
 	if (preset.schemaOptions) result.schemaOptions = {
 		...result.schemaOptions,
 		...preset.schemaOptions,

package/dist/projection-UBDgfMwu.mjs

@@ -0,0 +1,17 @@
+import { c as getOrgId, g as getUserId, x as isMember } from "./types-CSyCxl2V.mjs";
+//#region src/scope/projection.ts
+/**
+* Compute the request-scope projection. Returns `undefined` when no
+* scope is attached (public / unscoped routes) so hosts can idiomatically
+* write `ctx.scope?.organizationId` without a double-null check.
+*/
+function buildRequestScopeProjection(scope) {
+	if (!scope) return void 0;
+	return {
+		organizationId: getOrgId(scope),
+		userId: getUserId(scope),
+		orgRoles: isMember(scope) ? scope.orgRoles : void 0
+	};
+}
+//#endregion
+export { buildRequestScopeProjection as t };

package/dist/{realtime-Cuw_deA-.mjs → realtime-B9nmIY5V.mjs}

@@ -3,7 +3,8 @@ import { arcLog } from "./logger/index.mjs";
 import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
 import { c as getOrgId } from "./types-CSyCxl2V.mjs";
 import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { r as evaluateAndApplyPermission } from "./applyPermissionResult-Cf6zUCvb.mjs";
+import { t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
 import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
 import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
 import fp from "fastify-plugin";

package/dist/{registerRoute-v0Wb6Plt.mjs → registerRoute-JkxIEBJq.mjs}

@@ -1,5 +1,6 @@
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { u as getRequestScope } from "./types-CSyCxl2V.mjs";
+import { r as evaluateAndApplyPermission } from "./applyPermissionResult-Cf6zUCvb.mjs";
 //#region src/core/middlewares/permissions.ts
 /**
 * Build a PermissionContext from a Fastify request. Extracted so the CRUD
@@ -11,6 +12,7 @@ function buildPermissionContext(req, opts) {
 	const params = req.params;
 	return {
 		user: reqWithExtras.user ?? null,
+		scope: getRequestScope(req),
 		request: req,
 		resource: opts.resource,
 		action: opts.action,

package/dist/registry/index.d.mts

@@ -1,5 +1,5 @@
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DPRH0Cme.mjs";
-import "../fastify-augmentation-dPNBVeIj.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-Q5gzEIWY.mjs";
+import "../fastify-augmentation-0WhPnUH7.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-vcOCtPij.mjs";
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-BYXUUg21.mjs";
 import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-vcOCtPij.mjs → registry-BYXUUg21.mjs}

@@ -79,6 +79,9 @@ async function assertNoTenantData(registry, options) {
 *
 * - `skip` strategy: returns `path: 'skipped'` without touching the repo.
 * - `purgeByField` present: routes through it (chunked, progress, abort).
+* - `purgeByField` absent + `requireChunked`: returns `path: 'unsupported'`
+*   (`arc.purge.chunked_required`) — authoritative cleanup never runs the
+*   unbounded fallback.
 * - `purgeByField` absent + hard strategy: legacy `deleteMany` fallback.
 * - `purgeByField` absent + non-hard strategy: returns `path: 'unsupported'`
 *   with a clear error — soft/anonymize require the new primitive.
@@ -111,6 +114,18 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 			...result.error ? { error: result.error } : {}
 		};
 	}
+	if (options.requireChunked) return {
+		resource: resourceName,
+		tenantField,
+		strategy,
+		processed: 0,
+		ok: false,
+		path: "unsupported",
+		error: {
+			code: "arc.purge.chunked_required",
+			message: `Resource '${resourceName}' requires chunked purge for authoritative cleanup, but its adapter repository does not implement \`purgeByField\`. The legacy unbounded \`deleteMany\` fallback is disabled here (no chunking / progress / abort). Upgrade the adapter (@classytic/mongokit ≥ 3.13.4 / @classytic/sqlitekit ≥ 0.3.4).`
+		}
+	};
 	if (strategy.type !== "hard") return {
 		resource: resourceName,
 		tenantField,
@@ -425,7 +440,7 @@ var introspectionPlugin_default = fp(introspectionPlugin, { name: "arc-introspec
 //#endregion
 //#region src/registry/manifest.ts
 /**
-* Resource manifest for frontend code generators (v2.15.5).
+* Resource manifest for frontend code generators.
 *
 * Every host that hand-rolls a `createCrudApi('foo')` helper on the frontend
 * ends up rewriting the same shim for declarative actions: `postAction(id,

package/dist/repositoryFilter-Dz8k3S4P.mjs

@@ -0,0 +1,44 @@
+import { arcLog } from "./logger/index.mjs";
+import { policyRecordToFilter } from "@classytic/repo-core/filter";
+//#region src/core/repositoryFilter.ts
+const log = arcLog("repository-filter");
+let warnedUnconvertible = false;
+/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
+function isOperatorObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value) || value instanceof Date) return false;
+	const keys = Object.keys(value);
+	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
+}
+/**
+* Does this compound filter contain any `$`-operator (top-level logical like
+* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
+* pure flat equality and portable as-is.
+*/
+function filterHasDollarOperator(record) {
+	for (const [key, value] of Object.entries(record)) {
+		if (key.startsWith("$")) return true;
+		if (isOperatorObject(value)) return true;
+	}
+	return false;
+}
+/**
+* Normalize a compound query/policy filter for the repository layer. Flat
+* equality records pass through unchanged; anything carrying `$`-operators is
+* converted to the portable repo-core {@link Filter} IR so it compiles
+* identically on Mongo, SQLite, Postgres, and custom adapters.
+*/
+function toRepositoryFilter(record) {
+	if (!filterHasDollarOperator(record)) return record;
+	try {
+		return policyRecordToFilter(record);
+	} catch (err) {
+		if (!warnedUnconvertible) {
+			warnedUnconvertible = true;
+			log.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
+		}
+		return record;
+	}
+}
+//#endregion
+export { toRepositoryFilter as t };