@classytic/arc 2.34.0 → 2.36.0

package/dist/{userHelpers-CWF5pbZD.mjs → userHelpers-xQAi5bPF.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/utils/userHelpers.ts
 /**
 * Extract a user ID from a user object. Accepts `id` or `_id` — returns

package/dist/utils/index.d.mts

@@ -1,7 +1,7 @@
 
-import { F as getHeader, I as requireSingleHeaderValue, P as ArcHeaders } from "../types-ChuShpCP.mjs";
-import { f as getUserId, m as normalizeRoles, p as getUserRoles, t as AnyRecord } from "../base-Csjc2oF-.mjs";
-import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-BcR2bFZQ.mjs";
+import { F as getHeader, I as requireSingleHeaderValue, P as ArcHeaders } from "../types-Ddl9OjmE.mjs";
+import { f as getUserId, m as normalizeRoles, p as getUserRoles, t as AnyRecord } from "../base-C-NL2fTi.mjs";
+import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-C01wWGJt.mjs";
 import { n as ErrorMapper } from "../errorHandler-DI5AN2b5.mjs";
 import { a as NotFoundError, c as RateLimitError, d as ValidationError, f as createDomainError, i as ForbiddenError, l as ServiceUnavailableError, m as isArcError, n as ConflictError, o as OrgAccessDeniedError, p as createError, r as ErrorOptions, s as OrgRequiredError, t as ArcError, u as UnauthorizedError } from "../errors-BGdVwP25.mjs";
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
@@ -1243,50 +1243,24 @@ declare function convertRouteSchema(schema: Record<string, unknown>, target?: Js
  * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
  * matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
  *
- * **What it does:** for each `[key, expected]` in the filter, compares
- * `item[key]` to `expected` via string coercion (so Mongo `ObjectId` values
- * match their string representation) and returns `true` only if every
- * filter entry matches. Array item values are matched implicitly (contains).
+ * Compares `item[key]` to each filter value by string coercion, so a Mongo
+ * `ObjectId` matches its string form; array values match by contains. ALL
+ * entries must match.
  *
- * **What it does NOT do:**
- * - No `$eq` / `$ne` / `$in` / `$nin` / `$gt` / `$lt` / `$regex` / `$exists`
- * - No `$and` / `$or`
- * - No dot-path traversal (`"owner.id"`)
- * - No schema-specific coercion
+ * NOT an operator engine: no `$in`/`$ne`/`$gt`/`$regex`/`$exists`, no
+ * `$and`/`$or`, no dot paths, no schema coercion. Most `_policyFilters` from
+ * arc's built-in permission helpers are flat equality (`{ ownerId }`,
+ * `{ organizationId }`), and this covers exactly that — defense-in-depth for
+ * hosts on minimal repos with no `getOne(compoundFilter)` path.
  *
- * **Why it exists:** 95%+ of arc's `_policyFilters` are produced by built-in
- * permission helpers and are shaped like `{ ownerId: "u1" }` or
- * `{ organizationId: "org_x" }` — flat equality. For that common shape,
- * this helper is a safe, tested, 15-line defense-in-depth matcher that
- * hosts using minimal repos (no `getOne(compoundFilter)` DB path) can opt
- * into without arc shipping a full Mongo-syntax engine.
- *
- * **When to use:**
- * - Your adapter/repo doesn't natively filter on `getOne(compoundFilter)`
- * - Your `_policyFilters` are flat equality (from arc's built-in permission helpers)
- * - You want defense-in-depth on `validateItemAccess` / `fetchDetailed`'s `getById` fallback
- *
- * **When NOT to use:**
- * - Your `_policyFilters` use operators (`$in`, `$ne`, etc.) — supply a
- *   native matcher (mongokit's repo does the filter at the DB layer; for
- *   custom repos, wrap the kit's own predicate engine).
- * - You're a mongokit / sqlitekit / Prisma user — the DB-level filter
- *   applied by `getOne(compoundFilter)` already covers this.
+ * Do NOT use it with operator-shaped filters — supply a native matcher instead
+ * (a kit's predicate engine). Kit users need neither: the DB-level filter in
+ * `getOne(compoundFilter)` already applies.
  *
  * @example
  * ```ts
- * import { simpleEqualityMatcher } from '@classytic/arc/utils';
- *
- * // On a custom adapter
- * const adapter: DataAdapter = {
- *   repository,
- *   type: 'custom',
- *   name: 'in-memory',
- *   matchesFilter: simpleEqualityMatcher,
- * };
- *
- * // Or directly on BaseController for ad-hoc controllers
- * new BaseController(repo, { matchesFilter: simpleEqualityMatcher });
+ * const adapter: DataAdapter = { repository, type: 'custom', name: 'in-memory',
+ *                                matchesFilter: simpleEqualityMatcher };
  * ```
  */
 declare function simpleEqualityMatcher(item: unknown, filters: Record<string, unknown>): boolean;

package/dist/utils/index.mjs

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue, t as getHeader } from "../headers-CveNO9gR.mjs";
-import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-CWF5pbZD.mjs";
-import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-Se8VrsaP.mjs";
-import { A as createCircuitBreakerRegistry, C as defineCompensation, D as CircuitBreakerRegistry, E as CircuitBreakerError, O as CircuitState, S as defineErrorMapper, T as CircuitBreaker, _ as createQueryParser, a as deleteResponse, b as NEUTRAL_DIALECT, c as getDefaultCrudSchemas, d as listResponse, f as offsetListResponse, g as ArcQueryParser, h as responses, i as bareListResponse, k as createCircuitBreaker, l as getListQueryParams, m as queryParams, n as scheduleBackground, o as errorContractSchema, p as paginationSchema, r as aggregateListResponse, s as errorDetailSchema, t as createStateMachine, u as keysetListResponse, v as handleRaw, w as withCompensation, x as defineGuard, y as MONGO_DIALECT } from "../utils-h1V_sT-t.mjs";
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-Dm88DaTW.mjs";
-import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-XH1RZRyu.mjs";
-import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-DsT1B5zJ.mjs";
-import { t as openSseStream } from "../sseStream-Bvpi-UXQ.mjs";
-import { t as hasEvents } from "../typeGuards-jjKJDN13.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-DDKni6Tz.mjs";
+import { n as requireSingleHeaderValue, t as getHeader } from "../headers-DKslnhey.mjs";
+import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-xQAi5bPF.mjs";
+import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-_9NAMHUD.mjs";
+import { A as createCircuitBreakerRegistry, C as defineCompensation, D as CircuitBreakerRegistry, E as CircuitBreakerError, O as CircuitState, S as defineErrorMapper, T as CircuitBreaker, _ as createQueryParser, a as deleteResponse, b as NEUTRAL_DIALECT, c as getDefaultCrudSchemas, d as listResponse, f as offsetListResponse, g as ArcQueryParser, h as responses, i as bareListResponse, k as createCircuitBreaker, l as getListQueryParams, m as queryParams, n as scheduleBackground, o as errorContractSchema, p as paginationSchema, r as aggregateListResponse, s as errorDetailSchema, t as createStateMachine, u as keysetListResponse, v as handleRaw, w as withCompensation, x as defineGuard, y as MONGO_DIALECT } from "../utils-DgNFsJ2c.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-jK99Ciw_.mjs";
+import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-gg0_aUPF.mjs";
+import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-CiTJW8kZ.mjs";
+import { t as openSseStream } from "../sseStream-BMHTLlhR.mjs";
+import { t as hasEvents } from "../typeGuards-IE1laMDf.mjs";
 export { ArcError, ArcQueryParser, CircuitBreaker, CircuitBreakerError, CircuitBreakerRegistry, CircuitState, ConflictError, ForbiddenError, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, declareRuntimeCapability, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };

package/dist/{utils-h1V_sT-t.mjs → utils-DgNFsJ2c.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { m as RESERVED_QUERY_PARAMS } from "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { m as RESERVED_QUERY_PARAMS } from "./constants-DUoKAGYD.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError, u as ValidationError } from "./errors-Cd_yy7aW.mjs";
+import { t as ArcError, u as ValidationError } from "./errors-DDKni6Tz.mjs";
 import { errorContractSchema as errorContractSchema$1, errorDetailSchema as errorDetailSchema$1 } from "@classytic/repo-core/errors";
 import { scheduleBackground } from "@classytic/repo-core/cache";
 //#region src/utils/circuitBreaker.ts

package/dist/{validate-CdQlz52F.mjs → validate-DI3L5V9w.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 //#region src/core/aggregation/normalize.ts
 /**
 * Framework cap on URL-driven aggregation limits when the host opts

package/dist/{versioning-rZbyLVD-.mjs → versioning-COpAyfpZ.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { d as createDomainError } from "./errors-Cd_yy7aW.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
+import { d as createDomainError } from "./errors-DDKni6Tz.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/versioning.ts
 var versioning_exports = /* @__PURE__ */ __exportAll({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.34.0",
+  "version": "2.36.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -351,8 +351,8 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.23.0",
-    "@classytic/repo-core": ">=0.24.0",
+    "@classytic/primitives": ">=0.25.0",
+    "@classytic/repo-core": ">=0.25.0",
     "@classytic/streamline": ">=2.8.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
@@ -373,7 +373,7 @@
     "@opentelemetry/sdk-node": ">=0.50.0",
     "better-auth": ">=1.6.2",
     "bullmq": ">=5.0.0",
-    "fastify": ">=5.8.5",
+    "fastify": ">=5.12.0",
     "fastify-raw-body": ">=5.0.0",
     "h3-js": ">=4.0.0",
     "ioredis": ">=5.0.0",
@@ -483,8 +483,8 @@
     "@classytic/gitkit": ">=0.1.0",
     "@classytic/mongokit": "^3.33.0",
     "@classytic/pgkit": "^0.1.0",
-    "@classytic/primitives": "^0.23.0",
-    "@classytic/repo-core": "^0.24.0",
+    "@classytic/primitives": "^0.25.0",
+    "@classytic/repo-core": "^0.25.0",
     "@classytic/sqlitekit": "^0.9.0",
     "@classytic/streamline": "^2.8.2",
     "@electric-sql/pglite": "^0.5.4",
@@ -505,12 +505,12 @@
     "@vitest/coverage-v8": "^4.1.9",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.25",
-    "better-sqlite3": "^13.0.3",
+    "better-sqlite3": "^12.4.1",
     "bullmq": "^6.1.2",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "fast-check": "^4.8.0",
-    "fastify": "^5.12.0",
+    "fastify": "^5.12.1",
     "fastify-raw-body": "^6.0.1",
     "h3-js": "^4.4.0",
     "ioredis": "^6.0.0",

package/dist/actionPermissions-CUeCmpUd.mjs

@@ -1,25 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/core/actionPermissions.ts
-/**
-* Return the effective `PermissionCheck` for a single action, or `undefined`
-* when the resource declares no gate at any level.
-*
-* Callers decide what "no gate" means:
-*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
-*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
-*     two surfaces fail closed identically so MCP can't expose an
-*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
-*     run).
-*   - OpenAPI: docs advertise the endpoint as unauthenticated.
-*/
-function resolveActionPermission(input) {
-	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
-	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
-	if (explicit) return explicit;
-	if (resourceActionPermissions) return resourceActionPermissions;
-	if (globalAuth) return globalAuth;
-	const updateFallback = resourcePermissions?.update;
-	if (updateFallback) return updateFallback;
-}
-//#endregion
-export { resolveActionPermission as t };

package/dist/defineAggregation-Nv-DwfOf.mjs

@@ -1,48 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/core/aggregation/defineAggregation.ts
-/**
-* Declare a single resource aggregation. Exported configs flow into
-* `defineResource({ aggregations: { ... } })` either as named keys or
-* via auto-discovery patterns (loadAggregations — future).
-*
-* @example Inline
-* ```ts
-* defineResource({
-*   name: 'order',
-*   aggregations: {
-*     revenueByStatus: defineAggregation({
-*       groupBy: 'status',
-*       measures: { count: 'count', revenue: 'sum:totalPrice' },
-*       permissions: requireRoles(['admin']),
-*     }),
-*   },
-* });
-* ```
-*
-* @example Multi-file
-* ```ts
-* // orders/aggregations/revenue-by-status.ts
-* import { defineAggregation } from '@classytic/arc';
-*
-* export const revenueByStatus = defineAggregation({
-*   groupBy: 'status',
-*   measures: { count: 'count', revenue: 'sum:totalPrice' },
-*   permissions: requireRoles(['admin']),
-*   timeout: 5000,
-*   cache: { staleTime: 60 },
-* });
-*
-* // orders/order.resource.ts
-* import * as aggregations from './aggregations/index.js';
-*
-* defineResource({
-*   name: 'order',
-*   aggregations,                                  // 30+ entries flow in
-* });
-* ```
-*/
-function defineAggregation(config) {
-	return config;
-}
-//#endregion
-export { defineAggregation as t };

package/dist/preloadResources-BkyqeTDz.mjs

@@ -1,46 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/factory/preloadResources.ts
-/**
-* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
-*
-* Accepts either:
-* - `{ import: 'default' }` form: values are the resource directly
-* - default form: values are the full module — picks first export with `toPlugin()`
-*
-* Throws if any module doesn't yield a valid `ResourceLike`.
-*/
-function preloadResources(globResult) {
-	const resources = [];
-	for (const [path, value] of Object.entries(globResult)) {
-		const resource = pickResource(value);
-		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		resources.push(resource);
-	}
-	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-/**
-* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
-*
-* Use this when resources depend on prior bootstrap (e.g., engine init) and
-* cannot be evaluated at import time of the preload file.
-*/
-async function preloadResourcesAsync(globResult) {
-	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
-		const resource = pickResource(await loader());
-		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		return resource;
-	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-function pickResource(value) {
-	if (!value || typeof value !== "object") return void 0;
-	if (typeof value.toPlugin === "function") return value;
-	const mod = value;
-	const candidates = [
-		mod.default,
-		mod.resource,
-		...Object.values(mod)
-	];
-	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
-}
-//#endregion
-export { preloadResourcesAsync as n, preloadResources as t };

package/dist/registerRoute-Ba8v0PCa.mjs

@@ -1,113 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { f as createError } from "./errors-Cd_yy7aW.mjs";
-import { u as getRequestScope } from "./types-CoqIRrkY.mjs";
-//#region src/core/middlewares/permissions.ts
-/**
-* Build a PermissionContext from a Fastify request. Extracted so the CRUD
-* permission middleware and the dynamic action-permission check use the same
-* field layout — divergence here silently broke policy filters for actions.
-*/
-function buildPermissionContext(req, opts) {
-	const reqWithExtras = req;
-	const params = req.params;
-	return {
-		user: reqWithExtras.user ?? null,
-		scope: getRequestScope(req),
-		request: req,
-		resource: opts.resource,
-		action: opts.action,
-		resourceId: opts.resourceId ?? params?.id,
-		params,
-		data: opts.data ?? req.body
-	};
-}
-/**
-* Static per-route CRUD permission gate. The permission and action are known
-* at route-registration time, so the gate is a plain preHandler.
-*
-* Actions use the dynamic counterpart `buildActionPermissionMw` — their
-* permission is resolved from `body.action` at request time.
-*/
-function buildCrudPermissionMw(permissionCheck, resourceName, action) {
-	if (!permissionCheck) return null;
-	return async (req, reply) => {
-		const context = buildPermissionContext(req, {
-			resource: resourceName,
-			action
-		});
-		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
-	};
-}
-/**
-* Dynamic per-action permission gate for the action router.
-*
-* Resolves the permission from `body.action` at request time and runs
-* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
-* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
-* (idempotency) and `routeGuards` run. Previously this check lived inside
-* the main action handler, which meant idempotency recorded unauthorized
-* requests and route guards saw unfiltered scope — the very divergence
-* routerShared exists to prevent.
-*
-* Also acts as a defensive fallback for invalid action names — the
-* `oneOf` body schema normally rejects these at AJV validation, but
-* hosts that disable schema validation still get a 400 here.
-*/
-function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
-	const enumSet = new Set(actionEnum);
-	const validActions = [...actionEnum];
-	return async (req, reply) => {
-		const body = req.body ?? {};
-		const action = body.action;
-		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
-		const permissionCheck = actionPermissions[action] ?? globalAuth;
-		if (!permissionCheck) return;
-		const { action: _discard, ...data } = body;
-		const params = req.params;
-		const context = buildPermissionContext(req, {
-			resource: resourceName,
-			action,
-			resourceId: params?.id,
-			data
-		});
-		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
-	};
-}
-//#endregion
-//#region src/core/middlewares/registerRoute.ts
-/**
-* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
-*
-* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
-* overlaps before Fastify ever runs, but a few cases still slip through to
-* Fastify itself: two presets contributing the same `routes` entry, hosts
-* mounting two resources at the same prefix, custom routes that share a
-* URL with another plugin. Fastify's default message ("Method 'GET'
-* already declared for route '/'") gives no hint at the resource-shaped
-* fix — `disabledRoutes: ['list']` — so wrap it with one.
-*/
-function tryRegisterRoute(fastify, opts, context) {
-	try {
-		fastify.route(opts);
-	} catch (err) {
-		const fastifyErr = err;
-		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
-		const method = opts.method;
-		const url = opts.url;
-		const opHint = context.op ? ` (op: ${context.op})` : "";
-		const fixHint = context.op && [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
-		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
-		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
-		enhanced.cause = err;
-		throw enhanced;
-	}
-}
-//#endregion
-export { buildActionPermissionMw as n, buildCrudPermissionMw as r, tryRegisterRoute as t };

package/dist/repositoryFilter-BANpz6BX.mjs

@@ -1,78 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { arcLog } from "./logger/index.mjs";
-import { policyRecordToFilter } from "@classytic/repo-core/filter";
-//#region src/core/repositoryFilter.ts
-const NATIVE_FILTER_DIALECT = Symbol.for("@classytic/arc/native-filter-dialect");
-/**
-* Mark a server-owned policy as intentionally adapter-native. This is an
-* explicit escape hatch for semantics absent from repo-core's universal IR
-* (for example MongoDB `$elemMatch`). Never apply it to client input.
-*/
-function nativePolicyFilter(dialect, record) {
-	return Object.freeze({
-		...record,
-		[NATIVE_FILTER_DIALECT]: dialect
-	});
-}
-function nativeDialects(value, found = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value !== "object") return found;
-	const dialect = value[NATIVE_FILTER_DIALECT];
-	if (typeof dialect === "string") found.add(dialect);
-	if (Array.isArray(value)) for (const entry of value) nativeDialects(entry, found);
-	else for (const entry of Object.values(value)) nativeDialects(entry, found);
-	return found;
-}
-function stripNativeMarkers(value) {
-	if (Array.isArray(value)) return value.map(stripNativeMarkers);
-	if (value === null || typeof value !== "object" || value instanceof Date) return value;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) out[key] = stripNativeMarkers(entry);
-	return out;
-}
-const log = arcLog("repository-filter");
-let warnedUnconvertible = false;
-/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
-function isOperatorObject(value) {
-	if (value === null || typeof value !== "object") return false;
-	if (Array.isArray(value) || value instanceof Date) return false;
-	const keys = Object.keys(value);
-	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
-}
-/**
-* Does this compound filter contain any `$`-operator (top-level logical like
-* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
-* pure flat equality and portable as-is.
-*/
-function filterHasDollarOperator(record) {
-	for (const [key, value] of Object.entries(record)) {
-		if (key.startsWith("$")) return true;
-		if (isOperatorObject(value)) return true;
-	}
-	return false;
-}
-/**
-* Normalize a compound query/policy filter for the repository layer. Flat
-* equality records pass through unchanged; anything carrying `$`-operators is
-* converted to repo-core {@link Filter} IR so semantics stay explicit. Common
-* operators compile identically across kits; capability-specific operators
-* such as array-element matching fail loudly on adapters that cannot model them.
-*/
-function toRepositoryFilter(record) {
-	const dialects = nativeDialects(record);
-	if (dialects.size > 0) {
-		if (dialects.size > 1) throw new Error(`Cannot compose native policy-filter dialects: ${[...dialects].sort().join(", ")}`);
-		return stripNativeMarkers(record);
-	}
-	if (!filterHasDollarOperator(record)) return record;
-	try {
-		return policyRecordToFilter(record);
-	} catch (err) {
-		if (!warnedUnconvertible) {
-			warnedUnconvertible = true;
-			log.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
-		}
-		return record;
-	}
-}
-//#endregion
-export { toRepositoryFilter as n, nativePolicyFilter as t };

package/dist/simpleEqualityMatcher-Se8VrsaP.mjs

@@ -1,69 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/utils/simpleEqualityMatcher.ts
-/**
-* `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
-* matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
-*
-* **What it does:** for each `[key, expected]` in the filter, compares
-* `item[key]` to `expected` via string coercion (so Mongo `ObjectId` values
-* match their string representation) and returns `true` only if every
-* filter entry matches. Array item values are matched implicitly (contains).
-*
-* **What it does NOT do:**
-* - No `$eq` / `$ne` / `$in` / `$nin` / `$gt` / `$lt` / `$regex` / `$exists`
-* - No `$and` / `$or`
-* - No dot-path traversal (`"owner.id"`)
-* - No schema-specific coercion
-*
-* **Why it exists:** 95%+ of arc's `_policyFilters` are produced by built-in
-* permission helpers and are shaped like `{ ownerId: "u1" }` or
-* `{ organizationId: "org_x" }` — flat equality. For that common shape,
-* this helper is a safe, tested, 15-line defense-in-depth matcher that
-* hosts using minimal repos (no `getOne(compoundFilter)` DB path) can opt
-* into without arc shipping a full Mongo-syntax engine.
-*
-* **When to use:**
-* - Your adapter/repo doesn't natively filter on `getOne(compoundFilter)`
-* - Your `_policyFilters` are flat equality (from arc's built-in permission helpers)
-* - You want defense-in-depth on `validateItemAccess` / `fetchDetailed`'s `getById` fallback
-*
-* **When NOT to use:**
-* - Your `_policyFilters` use operators (`$in`, `$ne`, etc.) — supply a
-*   native matcher (mongokit's repo does the filter at the DB layer; for
-*   custom repos, wrap the kit's own predicate engine).
-* - You're a mongokit / sqlitekit / Prisma user — the DB-level filter
-*   applied by `getOne(compoundFilter)` already covers this.
-*
-* @example
-* ```ts
-* import { simpleEqualityMatcher } from '@classytic/arc/utils';
-*
-* // On a custom adapter
-* const adapter: DataAdapter = {
-*   repository,
-*   type: 'custom',
-*   name: 'in-memory',
-*   matchesFilter: simpleEqualityMatcher,
-* };
-*
-* // Or directly on BaseController for ad-hoc controllers
-* new BaseController(repo, { matchesFilter: simpleEqualityMatcher });
-* ```
-*/
-function simpleEqualityMatcher(item, filters) {
-	if (!item || typeof item !== "object") return false;
-	const obj = item;
-	for (const [key, expected] of Object.entries(filters)) {
-		if (expected && typeof expected === "object" && !Array.isArray(expected) && Object.getPrototypeOf(expected) === Object.prototype && Object.keys(expected).some((k) => k.startsWith("$"))) return false;
-		const actual = obj[key];
-		if (Array.isArray(actual)) {
-			const expectedStr = String(expected);
-			if (!actual.some((v) => String(v) === expectedStr)) return false;
-			continue;
-		}
-		if (String(actual) !== String(expected)) return false;
-	}
-	return true;
-}
-//#endregion
-export { simpleEqualityMatcher as t };