@classytic/arc 2.33.0 → 2.34.0

package/dist/{BaseController-CaQC5EXX.mjs → BaseController-CbkuhNI2.mjs}

@@ -1,12 +1,12 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BxCoxmiN.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
 import { n as getUserRoles, t as getUserId } from "./userHelpers-CWF5pbZD.mjs";
 import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
 import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
+import { n as toRepositoryFilter } from "./repositoryFilter-BANpz6BX.mjs";
 import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CojeUkS4.mjs";
 import { g as ArcQueryParser, n as scheduleBackground } from "./utils-h1V_sT-t.mjs";
 import { t as buildQueryKey } from "./keys-WeKvY1dE.mjs";
@@ -801,9 +801,43 @@ var QueryResolver = class {
 	* Combines what was previously _buildContext + _parseQueryOptions + _applyFilters.
 	*/
 	resolve(req, meta) {
-		const parsed = this.queryParser.parse(req.query);
+		/**
+		* Strip `_policyFilters` BEFORE the parse, not after.
+		*
+		* **Reachable only when a CLIENT puts it in the URL.** Trusted policy is a
+		* request DECORATION (`request._policyFilters`, set by the permission
+		* middleware) that `createRequestContext` lifts into `metadata` — it never
+		* enters `req.query`, which is Fastify's parsed querystring. So the key
+		* arriving here is always user-supplied, always inert (the authoritative
+		* copy is read from `arcContext` below), and must simply not reach the
+		* parser.
+		*
+		* The previous `delete` ran on `parsed.filters` — AFTER
+		* `queryParser.parse()` — so on the one path that needed it, it could
+		* never run: a KIT parser validates every key against the resource's
+		* `allowedFilterFields` and throws during the parse, before the cleanup
+		* line. Arc's own parser skips the key via `RESERVED_QUERY_PARAMS`, so the
+		* two parsers disagreed on the same request: arc ignored a probe, kits
+		* 400'd it.
+		*
+		* Stripping here makes them agree, and agrees with arc. Nothing is
+		* weakened — the client's value was already inert — but note the trade:
+		* under a kit parser `?_policyFilters=…` used to be a loud 400 and is now
+		* silently dropped. The alternative, teaching every kit's reserved-key list
+		* about an arc-internal key, spreads one framework's leak across the
+		* ecosystem for the same outcome.
+		*
+		* Copy only when present: the hot path allocates nothing, and `req.query`
+		* is never mutated (it is shared with the rest of the request).
+		*/
+		const rawQuery = req.query;
+		let query = rawQuery;
+		if (rawQuery && "_policyFilters" in rawQuery) {
+			const { _policyFilters: _ignored, ...rest } = rawQuery;
+			query = rest;
+		}
+		const parsed = this.queryParser.parse(query);
 		const arcContext = meta ?? req.metadata;
-		delete parsed.filters?._policyFilters;
 		const limit = Math.min(Math.max(1, parsed.limit || this.defaultLimit), this.maxLimit);
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
 		const sortString = parsed.sort ? Object.entries(parsed.sort).map(([k, v]) => v === -1 ? `-${k}` : k).join(",") : this.permittedDefaultSort();

package/dist/auth/index.mjs

@@ -3,7 +3,7 @@ import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as A
 import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
 import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
 import { o as toJsonSchema } from "../schemaConverter-XH1RZRyu.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-BAfwgBxc.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-CP47jdi7.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/{authorizationDecision-B3mP_QTy.mjs → authorizationDecision-CMMLWmuZ.mjs}

@@ -91,6 +91,10 @@ function conjoinPolicyFilters(base, incoming) {
 		delete result[key];
 	}
 	if (andParts.length > 0) result.$and = andParts;
+	for (const source of [base, incoming]) for (const symbol of Object.getOwnPropertySymbols(source)) {
+		const descriptor = Object.getOwnPropertyDescriptor(source, symbol);
+		if (descriptor) Object.defineProperty(result, symbol, descriptor);
+	}
 	return result;
 }
 //#endregion

package/dist/{buildHandler-DLE9xX-V.mjs → buildHandler-BrdYrG_1.mjs}

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-CMMLWmuZ.mjs";
+import { n as toRepositoryFilter } from "./repositoryFilter-BANpz6BX.mjs";
 import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CdQlz52F.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**

package/dist/cleanup/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { g as getUserId } from "../types-CoqIRrkY.mjs";
-import { t as defineResource } from "../defineResource-DR9vsUYy.mjs";
+import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
 import { t as defineModule } from "../module-CwKsgZXp.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-BN5cQaO2.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-CkV5mQ53.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DwaxNcE2.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
 import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-BcR2bFZQ.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Brin0ODU.mjs";
-export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-CFAJEWCX.mjs";
+export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,9 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BxCoxmiN.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CaQC5EXX.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DR9vsUYy.mjs";
+import { t as nativePolicyFilter } from "../repositoryFilter-BANpz6BX.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CbkuhNI2.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-ZhuLonLm.mjs";
 import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-q69DZzgG.mjs";
 import { t as defineAggregation } from "../defineAggregation-Nv-DwfOf.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-dxhcHhUD.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-BYKa8wHu.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/{core-dxhcHhUD.mjs → core-BYKa8wHu.mjs}

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import "./constants-BxCoxmiN.mjs";
-import { t as defineResource } from "./defineResource-DR9vsUYy.mjs";
+import { t as defineResource } from "./defineResource-ZhuLonLm.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema

package/dist/{createActionRouter-DVpoA0do.mjs → createActionRouter-D6T0jWhS.mjs}

@@ -3,7 +3,7 @@ import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import "./constants-BxCoxmiN.mjs";
 import { f as createError } from "./errors-Cd_yy7aW.mjs";
 import { a as buildRouteHooks, i as selectPluginMw, l as buildAuthMiddlewareForPermissions, n as buildRouteConfig, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
-import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-DNnd3vkz.mjs";
+import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-Ba8v0PCa.mjs";
 import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-q69DZzgG.mjs";
 import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
 //#region src/core/createActionRouter.ts

package/dist/{createAggregationRouter-B_B48JZ-.mjs → createAggregationRouter-QLV2PrWP.mjs}

@@ -1,10 +1,10 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-B3mP_QTy.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { f as createError } from "./errors-Cd_yy7aW.mjs";
 import { u as getRequestScope } from "./types-CoqIRrkY.mjs";
 import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
 import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-DLE9xX-V.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-BrdYrG_1.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is

package/dist/{createApp-CLGegqiG.mjs → createApp-zR-DEesr.mjs}

@@ -887,7 +887,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-CTkv3O59.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-G1TC6Yzc.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);

package/dist/{defineResource-DR9vsUYy.mjs → defineResource-ZhuLonLm.mjs}

@@ -4,17 +4,17 @@ import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
 import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { d as isWriteVerbCapable, p as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController, u as detectOverriddenWriteSlots } from "./BaseController-CaQC5EXX.mjs";
+import { d as isWriteVerbCapable, p as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController, u as detectOverriddenWriteSlots } from "./BaseController-CbkuhNI2.mjs";
 import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
 import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CojeUkS4.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-DNnd3vkz.mjs";
+import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-Ba8v0PCa.mjs";
 import { c as getDefaultCrudSchemas } from "./utils-h1V_sT-t.mjs";
 import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-XH1RZRyu.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-DsT1B5zJ.mjs";
 import { t as hasEvents } from "./typeGuards-jjKJDN13.mjs";
 import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
-import { B as requireAuth } from "./permissions-BAfwgBxc.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-D-h0uWtP.mjs";
+import { B as requireAuth } from "./permissions-CP47jdi7.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-BAPijK_A.mjs";
 import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
 import { isReadOnlyRepo } from "@classytic/repo-core/repository";
@@ -1429,7 +1429,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-DVpoA0do.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-D6T0jWhS.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1444,7 +1444,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B_B48JZ-.mjs"), import("./validate-CdQlz52F.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-QLV2PrWP.mjs"), import("./validate-CdQlz52F.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/docs/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { n as getUserRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BN5cQaO2.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-CkV5mQ53.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/events/index.d.mts

@@ -1,7 +1,7 @@
 
 import { i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions } from "../EventTransport-BEVP50ka.mjs";
 import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-DSNEZWfV.mjs";
-import { a as EventOutbox, c as OutboxRelayErrorKind, i as MemoryOutboxStore, l as RelayResult, n as OutboxModuleOptions, o as EventOutboxOptions, r as createOutboxModule, s as OutboxRelayErrorHandler, t as OutboxModuleExports } from "../outbox-module-D-VFq37T.mjs";
+import { a as EventOutbox, c as OutboxRelayErrorKind, i as MemoryOutboxStore, l as RelayResult, n as OutboxModuleOptions, o as EventOutboxOptions, r as createOutboxModule, s as OutboxRelayErrorHandler, t as OutboxModuleExports } from "../outbox-module-C1Bs_FXF.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
 import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-mwLWlfHG.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";

package/dist/events/index.mjs

@@ -2,7 +2,7 @@
 import { n as MemoryEventTransport } from "../EventTransport-tq4CEB-q.mjs";
 import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-CLIOHsOK.mjs";
 import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-Dar8qRaj.mjs";
-import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-CXB79bvt.mjs";
+import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-D1QfHqO4.mjs";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 //#region src/events/eventTypes.ts
 /**

package/dist/factory/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { r as mergeHealthChecks, t as healthPlugin } from "../health-CasG2A28.mjs";
-import { _ as collectModuleScheduledJobs, a as developmentPreset, b as resolveModule, c as productionPreset, d as getModuleState, f as hasModule, g as collectModuleHealthChecks, h as describeResolvedModule, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as orderModules, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset, v as collectModuleWorkflows, y as resolveContribution } from "../createApp-CLGegqiG.mjs";
+import { _ as collectModuleScheduledJobs, a as developmentPreset, b as resolveModule, c as productionPreset, d as getModuleState, f as hasModule, g as collectModuleHealthChecks, h as describeResolvedModule, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as orderModules, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset, v as collectModuleWorkflows, y as resolveContribution } from "../createApp-zR-DEesr.mjs";
 import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
 import { t as loadResources } from "../loadResources-Bj-aSsXi.mjs";
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BkyqeTDz.mjs";

package/dist/idempotency/index.mjs

@@ -361,8 +361,7 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		class SelfCheckViolation extends Error {}
 		try {
 			await store.set(probeKeyA, createIdempotencyResult(299, { probe: true }, {}, 6e4));
-			const own = await store.get(probeKeyA);
-			if (!own || own.statusCode !== 299) fastify.log?.warn?.({ probe: "own-key" }, "idempotencyPlugin self-check: probe entry did not read back under its own key. This is usually the store being unreachable at boot (connection not ready), not a misconfiguration — continuing, with the adapter's per-read key-identity checks as the runtime backstop. If keyed requests later fail with IDEMPOTENCY_STORE_MISCONFIGURED, the store's key filter is being stripped (see IdempotencyStoreMisconfiguredError).");
+			if ((await store.get(probeKeyA))?.statusCode !== 299) fastify.log?.warn?.({ probe: "own-key" }, "idempotencyPlugin self-check: probe entry did not read back under its own key. This is usually the store being unreachable at boot (connection not ready), not a misconfiguration — continuing, with the adapter's per-read key-identity checks as the runtime backstop. If keyed requests later fail with IDEMPOTENCY_STORE_MISCONFIGURED, the store's key filter is being stripped (see IdempotencyStoreMisconfiguredError).");
 			else if (await store.get(probeKeyB)) throw new SelfCheckViolation("idempotencyPlugin self-check: a probe read under key B returned key A's entry — the store is ignoring the key filter, which in production replays cached responses across keys and users (observed cause: a pathless Mongoose schema under strictQuery:true strips every filter to {}). Declare the key path on the schema (e.g. _id: String) and set strictQuery: false in the schema options.");
 		} catch (err) {
 			if (err instanceof SelfCheckViolation || err?.code === "IDEMPOTENCY_STORE_MISCONFIGURED") throw err;

package/dist/{index-Brin0ODU.d.mts → index-CFAJEWCX.d.mts}

@@ -3,6 +3,7 @@ import { i as RequestScope } from "./types-ChuShpCP.mjs";
 import { l as PermissionCheck, t as AnyRecord } from "./base-Csjc2oF-.mjs";
 import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-BcR2bFZQ.mjs";
 import "./fastify-augmentation-DVsTAy6X.mjs";
+import { Filter } from "@classytic/repo-core/filter";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
@@ -426,6 +427,18 @@ declare function isFieldReadable(rule: ArcFieldRule | undefined): boolean;
  */
 declare function collectReadBlockedFields(schemaOptions: RouteSchemaOptions | undefined): Set<string> | null;
 //#endregion
+//#region src/core/repositoryFilter.d.ts
+declare const NATIVE_FILTER_DIALECT: unique symbol;
+type NativePolicyFilter<Dialect extends string = string> = AnyRecord & {
+  readonly [NATIVE_FILTER_DIALECT]: Dialect;
+};
+/**
+ * Mark a server-owned policy as intentionally adapter-native. This is an
+ * explicit escape hatch for semantics absent from repo-core's universal IR
+ * (for example MongoDB `$elemMatch`). Never apply it to client input.
+ */
+declare function nativePolicyFilter<const Dialect extends string>(dialect: Dialect, record: AnyRecord): NativePolicyFilter<Dialect>;
+//#endregion
 //#region src/core/validateResourceConfig.d.ts
 interface ConfigError {
   field: string;
@@ -458,4 +471,4 @@ declare function formatValidationErrors(resourceName: string, result: Validation
  */
 declare function assertValidConfig(config: ResourceConfig, options?: ValidateOptions): void;
 //#endregion
-export { DEFAULT_ID_FIELD as A, MAX_FILTER_DEPTH as B, DefineActionConfig as C, defineAggregation as D, createPermissionMiddleware as E, DEFAULT_UPDATE_METHOD as F, RESERVED_QUERY_PARAMS as G, MAX_SEARCH_LENGTH as H, HOOK_OPERATIONS as I, SYSTEM_FIELDS as K, HOOK_PHASES as L, DEFAULT_MAX_LIMIT as M, DEFAULT_SORT as N, CRUD_OPERATIONS as O, DEFAULT_TENANT_FIELD as P, HookOperation as R, mergeResourceConfig as S, createCrudRouter as T, MUTATION_OPERATIONS as U, MAX_REGEX_LENGTH as V, MutationOperation as W, getEntityQuery as _, formatValidationErrors as a, ResourceSeams as b, isFieldReadable as c, createRequestContext as d, getControllerContext as f, getEntityIdField as g, getEntityId as h, assertValidConfig as i, DEFAULT_LIMIT as j, CrudOperation as k, createCrudHandlers as l, sendControllerResponse as m, ValidateOptions as n, validateResourceConfig as o, getControllerScope as p, ValidationResult as r, collectReadBlockedFields as s, ConfigError as t, createFastifyHandler as u, defineResourceVariants as v, defineAction as w, SeamedResourceConfig as x, AdapterLike as y, HookPhase as z };
+export { CRUD_OPERATIONS as A, HookOperation as B, SeamedResourceConfig as C, createCrudRouter as D, defineAction as E, DEFAULT_SORT as F, MUTATION_OPERATIONS as G, MAX_FILTER_DEPTH as H, DEFAULT_TENANT_FIELD as I, SYSTEM_FIELDS as J, MutationOperation as K, DEFAULT_UPDATE_METHOD as L, DEFAULT_ID_FIELD as M, DEFAULT_LIMIT as N, createPermissionMiddleware as O, DEFAULT_MAX_LIMIT as P, HOOK_OPERATIONS as R, ResourceSeams as S, DefineActionConfig as T, MAX_REGEX_LENGTH as U, HookPhase as V, MAX_SEARCH_LENGTH as W, getEntityId as _, formatValidationErrors as a, defineResourceVariants as b, nativePolicyFilter as c, createCrudHandlers as d, createFastifyHandler as f, sendControllerResponse as g, getControllerScope as h, assertValidConfig as i, CrudOperation as j, defineAggregation as k, collectReadBlockedFields as l, getControllerContext as m, ValidateOptions as n, validateResourceConfig as o, createRequestContext as p, RESERVED_QUERY_PARAMS as q, ValidationResult as r, NativePolicyFilter as s, ConfigError as t, isFieldReadable as u, getEntityIdField as v, mergeResourceConfig as w, AdapterLike as x, getEntityQuery as y, HOOK_PHASES as z };

package/dist/index.d.mts

@@ -3,10 +3,10 @@ import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest,
 import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-BcR2bFZQ.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
 import "./fastify-augmentation-DVsTAy6X.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-Brin0ODU.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-CFAJEWCX.mjs";
 import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-B-DvUzsr.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, type MutationWriteContext, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type ResourceWrites, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, type WriteContext, type WriteVerbKey, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, type MutationWriteContext, type NativePolicyFilter, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type ResourceWrites, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, type WriteContext, type WriteVerbKey, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,14 +1,15 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BxCoxmiN.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Cd_yy7aW.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CaQC5EXX.mjs";
+import { t as nativePolicyFilter } from "./repositoryFilter-BANpz6BX.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CbkuhNI2.mjs";
 import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-DR9vsUYy.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-ZhuLonLm.mjs";
 import { c as getControllerScope } from "./pipeline-q69DZzgG.mjs";
 import { t as defineAggregation } from "./defineAggregation-Nv-DwfOf.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-dxhcHhUD.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-BAfwgBxc.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BYKa8wHu.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-CP47jdi7.mjs";
 //#region src/index.ts
 const version = "2.34.0";
 //#endregion
-export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-B3mP_QTy.mjs";
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-CMMLWmuZ.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-aJg5TqHi.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-DX3PHD7K.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-aJg5TqHi.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-DX3PHD7K.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-D-VFq37T.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-C1Bs_FXF.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { n as declareRuntimeCapability } from "../runtimeCapabilities-Dm88DaTW.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-CXB79bvt.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-D1QfHqO4.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent } from "@classytic/primitives/events";

package/dist/{mcpPlugin-aJg5TqHi.mjs → mcpPlugin-DX3PHD7K.mjs}

@@ -1,15 +1,15 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-B3mP_QTy.mjs";
+import { r as evaluatePermissionDecision } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { p as isArcError, t as ArcError } from "./errors-Cd_yy7aW.mjs";
 import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
 import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as BaseController } from "./BaseController-CaQC5EXX.mjs";
+import { t as BaseController } from "./BaseController-CbkuhNI2.mjs";
 import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
 import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
 import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
 import { r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
 import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
-import { n as executeAggregation } from "./buildHandler-DLE9xX-V.mjs";
+import { n as executeAggregation } from "./buildHandler-BrdYrG_1.mjs";
 import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
 import { t as createIdempotencyResult } from "./interface-DznJrm9R.mjs";

package/dist/{openapi-BN5cQaO2.mjs → openapi-CkV5mQ53.mjs}

@@ -3,7 +3,7 @@ import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-XH1RZRyu.mjs";
 import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-DVpoA0do.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-D6T0jWhS.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { t as defineResource } from "../defineResource-DR9vsUYy.mjs";
+import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
 import { n as getModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
 //#region src/outbox-admin/module.ts
 /**

package/dist/{outbox-module-D-VFq37T.d.mts → outbox-module-C1Bs_FXF.d.mts}

@@ -308,8 +308,22 @@ interface OutboxModuleOptions {
    * Called for every non-fatal relay problem — publish failures, ownership mismatches,
    * acknowledge failures.
    *
-   * **Wire this.** Silence here is the failure mode that matters: the relay keeps ticking, rows
-   * keep failing, and the only symptom is revenue that never posted.
+   * Omit to report through the Arc app's structured logger. Override for metrics, tracing, or
+   * external alerting. Silence here is the failure mode that matters: the relay keeps ticking,
+   * rows keep failing, and the only symptom is revenue that never posted.
+   *
+   * **Fires per EVENT, not per batch.** With the defaults (`batchSize: 100`,
+   * `relayEveryMs: 5000`) a transport outage emits up to 100 lines per tick —
+   * ~1,200/minute — and that is UNBOUNDED without a {@link
+   * OutboxModuleOptions.failurePolicy}: with no policy the row is failed with
+   * neither `retryAt` nor `deadLetter`, so it stays pending and is retried on
+   * every poll forever.
+   *
+   * Set a `failurePolicy` first — it bounds the retry loop and the logs
+   * together. Reach for a custom `onError` when you want a different SHAPE
+   * (aggregate per batch, sample, emit a metric); `() => {}` restores the
+   * pre-2.34 silence, which is a choice worth making explicitly rather than
+   * inheriting.
    */
   onError?: OutboxRelayErrorHandler;
   /**

package/dist/{outbox-module-CXB79bvt.mjs → outbox-module-D1QfHqO4.mjs}

@@ -814,7 +814,14 @@ function createOutboxModule(options) {
 					...options.batchSize !== void 0 ? { batchSize: options.batchSize } : {},
 					...options.leaseMs !== void 0 ? { leaseMs: options.leaseMs } : {},
 					consumerId: options.consumerId ?? mintConsumerId(name),
-					...options.onError !== void 0 ? { onError: options.onError } : {},
+					onError: options.onError ?? ((info) => {
+						fastify.log.error({
+							err: info.error,
+							kind: info.kind,
+							...info.event?.meta.id !== void 0 ? { eventId: info.event.meta.id } : {},
+							...info.event?.type !== void 0 ? { eventType: info.event.type } : {}
+						}, `outbox relay "${name}" failed`);
+					}),
 					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {}
 				})
 			};

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-B3mP_QTy.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-CMMLWmuZ.mjs";
 import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
 import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CojeUkS4.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-BAfwgBxc.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-CP47jdi7.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-BAfwgBxc.mjs → permissions-CP47jdi7.mjs}

@@ -1,7 +1,7 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-B3mP_QTy.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
 import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CoqIRrkY.mjs";
 import { t as MemoryCacheStore } from "./memory-qYSB7rMQ.mjs";

package/dist/plugins/index.mjs

@@ -9,7 +9,7 @@ import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_defaul
 import { n as caching_default, t as cachingPlugin } from "../caching-BcGmvnHh.mjs";
 import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-C7xBqHsI.mjs";
 import { n as metrics_default, t as metricsPlugin } from "../metrics-D7uchLjN.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-CTkv3O59.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-G1TC6Yzc.mjs";
 import { t as replyHelpersPlugin } from "../replyHelpers-BSBVCwL3.mjs";
 import { n as schedules_default, t as schedulesPlugin } from "../schedules-CAcZgia0.mjs";
 import { n as sse_default, t as ssePlugin } from "../sse-Cf0jUHsh.mjs";

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,7 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
 import { c as getOrgId, g as getUserId } from "../types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-BAfwgBxc.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-CP47jdi7.mjs";
 import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-D-h0uWtP.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BAPijK_A.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-BAfwgBxc.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-CP47jdi7.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-D-h0uWtP.mjs → presets-BAPijK_A.mjs}

@@ -1,7 +1,7 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { l as UnauthorizedError } from "./errors-Cd_yy7aW.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-BAfwgBxc.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-CP47jdi7.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{realtime-CTkv3O59.mjs → realtime-G1TC6Yzc.mjs}

@@ -1,7 +1,7 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-B3mP_QTy.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
 import { c as getOrgId } from "./types-CoqIRrkY.mjs";
 import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";

package/dist/{registerRoute-DNnd3vkz.mjs → registerRoute-Ba8v0PCa.mjs}

@@ -1,5 +1,5 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-B3mP_QTy.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
 import { f as createError } from "./errors-Cd_yy7aW.mjs";
 import { u as getRequestScope } from "./types-CoqIRrkY.mjs";
 //#region src/core/middlewares/permissions.ts

package/dist/{repositoryFilter-DKny7PDn.mjs → repositoryFilter-BANpz6BX.mjs}

@@ -2,6 +2,33 @@
 import { arcLog } from "./logger/index.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 //#region src/core/repositoryFilter.ts
+const NATIVE_FILTER_DIALECT = Symbol.for("@classytic/arc/native-filter-dialect");
+/**
+* Mark a server-owned policy as intentionally adapter-native. This is an
+* explicit escape hatch for semantics absent from repo-core's universal IR
+* (for example MongoDB `$elemMatch`). Never apply it to client input.
+*/
+function nativePolicyFilter(dialect, record) {
+	return Object.freeze({
+		...record,
+		[NATIVE_FILTER_DIALECT]: dialect
+	});
+}
+function nativeDialects(value, found = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value !== "object") return found;
+	const dialect = value[NATIVE_FILTER_DIALECT];
+	if (typeof dialect === "string") found.add(dialect);
+	if (Array.isArray(value)) for (const entry of value) nativeDialects(entry, found);
+	else for (const entry of Object.values(value)) nativeDialects(entry, found);
+	return found;
+}
+function stripNativeMarkers(value) {
+	if (Array.isArray(value)) return value.map(stripNativeMarkers);
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) out[key] = stripNativeMarkers(entry);
+	return out;
+}
 const log = arcLog("repository-filter");
 let warnedUnconvertible = false;
 /** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
@@ -26,10 +53,16 @@ function filterHasDollarOperator(record) {
 /**
 * Normalize a compound query/policy filter for the repository layer. Flat
 * equality records pass through unchanged; anything carrying `$`-operators is
-* converted to the portable repo-core {@link Filter} IR so it compiles
-* identically on Mongo, SQLite, Postgres, and custom adapters.
+* converted to repo-core {@link Filter} IR so semantics stay explicit. Common
+* operators compile identically across kits; capability-specific operators
+* such as array-element matching fail loudly on adapters that cannot model them.
 */
 function toRepositoryFilter(record) {
+	const dialects = nativeDialects(record);
+	if (dialects.size > 0) {
+		if (dialects.size > 1) throw new Error(`Cannot compose native policy-filter dialects: ${[...dialects].sort().join(", ")}`);
+		return stripNativeMarkers(record);
+	}
 	if (!filterHasDollarOperator(record)) return record;
 	try {
 		return policyRecordToFilter(record);
@@ -42,4 +75,4 @@ function toRepositoryFilter(record) {
 	}
 }
 //#endregion
-export { toRepositoryFilter as t };
+export { toRepositoryFilter as n, nativePolicyFilter as t };

package/dist/testing/index.mjs

@@ -1,11 +1,11 @@
 /*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { t as CRUD_OPERATIONS } from "../constants-BxCoxmiN.mjs";
 import { g as getUserId } from "../types-CoqIRrkY.mjs";
-import { t as BaseController } from "../BaseController-CaQC5EXX.mjs";
-import { t as defineResource } from "../defineResource-DR9vsUYy.mjs";
+import { t as BaseController } from "../BaseController-CbkuhNI2.mjs";
+import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
 import { t as defineAggregation } from "../defineAggregation-Nv-DwfOf.mjs";
-import { E as requireOrgRole } from "../permissions-BAfwgBxc.mjs";
-import { r as createApp } from "../createApp-CLGegqiG.mjs";
+import { E as requireOrgRole } from "../permissions-CP47jdi7.mjs";
+import { r as createApp } from "../createApp-zR-DEesr.mjs";
 import { n as getModuleExports } from "../module-CwKsgZXp.mjs";
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BkyqeTDz.mjs";
 import { runStorageContract } from "./storageContract.mjs";
@@ -1505,7 +1505,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-CLGegqiG.mjs").then((n) => n.i);
+	const { createApp } = await import("../createApp-zR-DEesr.mjs").then((n) => n.i);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.33.0",
+  "version": "2.34.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {

package/skills/arc/SKILL.md

@@ -69,13 +69,13 @@ await app.listen({ port: 8040, host: '0.0.0.0' });
 
 **Boot order (fixed):** `beforeBoot` → modules resolve → `plugins` → `bootstrap[]` → `resources` → `afterResources` → `onReady`.
 
-**`role` — one image, N deployments (2.34).** `createApp({ role })` declares what a process is FOR, so the same codebase ships as api / worker / relay / scheduler without per-deployment builds:
+**`role` — one image, N deployments (2.33).** `createApp({ role })` declares what a process is FOR, so the same codebase ships as api / worker / relay / scheduler without per-deployment builds:
 
 ```typescript
 createApp({ role: process.env.ARC_ROLE as 'api' | 'worker' | 'relay' | 'scheduler' | 'all' })
 ```
 
-`api` and `worker` mount NO module schedule arms; `relay` mounts only `kind: 'relay'` arms (the outbox relay, durable webhook delivery); `scheduler` mounts all of them. Declaring `relay`/`scheduler` together with `resources`/`resourceDir` is BOOT-FATAL — a relay process must not serve routes. Default `all` is the pre-2.34 behaviour, unchanged. `createWorker()` forwards `role`; without one it still runs everything non-HTTP.
+`api` and `worker` mount NO module schedule arms; `relay` mounts only `kind: 'relay'` arms (the outbox relay, durable webhook delivery); `scheduler` mounts all of them. Declaring `relay`/`scheduler` together with `resources`/`resourceDir` is BOOT-FATAL — a relay process must not serve routes. Default `all` is the pre-2.33 behaviour, unchanged. `createWorker()` forwards `role`; without one it still runs everything non-HTTP.
 
 `beforeBoot()` (2.21) runs before Fastify exists and before module thunks / resource files import — connect the DB there instead of dynamic-import ordering hacks.
 
@@ -321,9 +321,9 @@ Decorates `app.authenticate` / `app.optionalAuthenticate` / `app.authorize`.
 - **`verifySignature(body, …)`** throws on parsed body — pass `req.rawBody`.
 - **MCP tools fail-closed.** A resource action without per-action perm + no `actionPermissions` + no `permissions.update` fallback → throws at tool generation. Declare `allowPublic()` to opt into unauthenticated.
 - **Better Auth roles.** BA stores `member.role = "admin,recruiter"` (comma-separated). Arc splits into `scope.orgRoles = ['admin', 'recruiter']`; `?role=admin` won't match — use `role[like]=admin`.
-- **Read-only repositories refuse write ROUTES at boot (2.34).** Kits' Better Auth overlays are sealed by default (`capabilities.readOnly`) — BA owns hashing, session revocation, org cascades. Mounting `create`/`update`/`delete` over one is boot-fatal: disable those routes, or pass the kit's `unsafeWritable: true` for administrative repair only. Normal identity mutations go through `auth.api`.
-- **Arc closes only stores/transports it BUILT (2.34).** One you hand to `idempotencyPlugin` / `eventPlugin` / `queryCachePlugin` stays yours to close — arc used to close every one, which wiped a co-resident app's live idempotency records.
-- **Idempotency self-checks its store at boot (2.34).** A probe write must read back under its own key and NOT under another; registration throws otherwise. Catches a filter-stripping repository (a pathless Mongoose schema under `strictQuery: true` strips filters to `{}`), which otherwise replays cached responses across keys AND users. `selfCheck: false` to disable; the adapter's per-read identity checks remain.
+- **Read-only repositories refuse write ROUTES at boot (2.33).** Kits' Better Auth overlays are sealed by default (`capabilities.readOnly`) — BA owns hashing, session revocation, org cascades. Mounting `create`/`update`/`delete` over one is boot-fatal: disable those routes, or pass the kit's `unsafeWritable: true` for administrative repair only. Normal identity mutations go through `auth.api`.
+- **Arc closes only stores/transports it BUILT (2.33).** One you hand to `idempotencyPlugin` / `eventPlugin` / `queryCachePlugin` stays yours to close — arc used to close every one, which wiped a co-resident app's live idempotency records.
+- **Idempotency self-checks its store at boot (2.33).** A probe write must read back under its own key and NOT under another; registration throws otherwise. Catches a filter-stripping repository (a pathless Mongoose schema under `strictQuery: true` strips filters to `{}`), which otherwise replays cached responses across keys AND users. `selfCheck: false` to disable; the adapter's per-read identity checks remain.
 
 ## routeGuards + defineGuard
 
@@ -489,7 +489,7 @@ defineResource({
 
 POST/PATCH/DELETE bumps resource version. Response header: `x-cache: HIT | STALE | MISS`. `runtime: 'distributed'` requires `stores.queryCache: RedisCacheStore`.
 
-## Transactional writes (2.34)
+## Transactional writes (2.33)
 
 `transactional: true` runs the PERSISTENCE step inside `withTransaction`. Write verbs receive the tx-bound repository plus `ctx.uow` — the join point for work outside the repository:
 
@@ -532,9 +532,9 @@ createApp({ modules: [createOutboxModule({ store: repositoryAsOutboxStore(outbox
 // Dev: createOutboxModule({ store: new MemoryOutboxStore() })
 ```
 
-The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments drain it. It resolves the RAW transport, never the `fastify.events` facade (the facade fails open, which would acknowledge rows whose publish failed) — no transport is boot-fatal. **Fencing (2.34):** stores that support `claimPendingFenced` mint a token in the claim CAS; a relay that lost its lease mid-batch cannot ack or re-schedule a row a successor already owns. Feature-detected end to end.
+The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments drain it. It resolves the RAW transport, never the `fastify.events` facade (the facade fails open, which would acknowledge rows whose publish failed) — no transport is boot-fatal. **Fencing (2.33):** stores that support `claimPendingFenced` mint a token in the claim CAS; a relay that lost its lease mid-batch cannot ack or re-schedule a row a successor already owns. Feature-detected end to end.
 
-**Durable webhooks (2.34)** — delivery survives crash and deploy, using the outbox machinery rather than a second queue:
+**Durable webhooks (2.33)** — delivery survives crash and deploy, using the outbox machinery rather than a second queue:
 
 ```typescript
 const store = repositoryAsOutboxStore(deliveryRepo);
@@ -727,7 +727,7 @@ await app.audit.custom('order', req.params.id, 'refund', { reason }, { user });
 
 `@classytic/arc/usage` — `usagePlugin` decorates `fastify.usage` with per-actor, per-UTC-month counters (`record`/`summary`/`period`/`actorOf`; actor chain org → user → client → ip). Auto-tracks `api.requests` (default on) + `api.egress.bytes` (opt-in); recording is fail-safe (a throwing `UsageStore` never fails a request; `MemoryUsageStore` built in, Redis/kit backends are ~5 lines). Pair with `createApp({ rateLimit: { plan: { resolve, limits: { free: { max: 60 }, enterprise: false }, default: 'free' } } })` for per-plan ceilings — `false` = unlimited, unknown/throwing resolvers fall back to `default` then global `max`, and buckets follow the tenant key chain by default. Caveat: the limiter runs before route auth, so `resolve` sees the raw request.
 
-## Runtime capability registry (2.34)
+## Runtime capability registry (2.33)
 
 Under `runtime: 'distributed'`, subsystems holding process-local state must declare it — the end-of-boot audit FAILS the app on undeclared memory state, naming every violator:
 

package/skills/arc/references/api-reference.md

@@ -126,7 +126,7 @@ import {
 import { tracingPlugin } from '@classytic/arc/plugins/tracing';
 import { auditPlugin } from '@classytic/arc/audit';
 import { idempotencyPlugin } from '@classytic/arc/idempotency';
-// Runtime capability registry (2.34) — declare process-local state so a
+// Runtime capability registry (2.33) — declare process-local state so a
 // `runtime: 'distributed'` boot fails on undeclared memory state:
 import { declareRuntimeCapability } from '@classytic/arc/utils';
 ```