@classytic/arc 2.38.0 → 2.41.0

package/dist/events/transports/redis-stream-entry.mjs

@@ -1,5 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "../../workScope-BhsWde4k.mjs";
 import sjson from "secure-json-parse";
+import { matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/transports/redis-stream.ts
 /**
 * Redis Stream Event Transport — Durable Event Delivery
@@ -183,7 +185,7 @@ var RedisStreamTransport = class {
 		this.generation++;
 		this.handlers.clear();
 		this.failureContext.clear();
-		if (this.pollPromise) {
+		if (this.pollPromise !== null) {
 			if (await Promise.race([this.pollPromise.then(() => "drained"), this.sleep(this.closeTimeoutMs).then(() => "timeout")]) === "timeout") {
 				if (!this.externalLifecycle) {
 					if (typeof this.redis.disconnect === "function") this.redis.disconnect();
@@ -232,14 +234,23 @@ var RedisStreamTransport = class {
 	* still sequential inside `processEntry`.
 	*/
 	async processEntries(entries) {
+		const live = [];
+		const ghostIds = [];
+		for (const [messageId, fields] of entries) if (fields) live.push([messageId, fields]);
+		else ghostIds.push(messageId);
+		if (ghostIds.length > 0) try {
+			await this.redis.xack(this.stream, this.group, ...ghostIds);
+		} catch (err) {
+			this.logger.error(`[RedisStreamTransport] Failed to ack ${ghostIds.length} trimmed entr(ies):`, err);
+		}
 		if (this.processingConcurrency <= 1) {
-			for (const [messageId, fields] of entries) await this.processEntry(messageId, fields);
+			for (const [messageId, fields] of live) await this.processEntry(messageId, fields);
 			return;
 		}
 		let next = 0;
-		const workers = Array.from({ length: Math.min(this.processingConcurrency, entries.length) }, async () => {
-			while (next < entries.length) {
-				const entry = entries[next++];
+		const workers = Array.from({ length: Math.min(this.processingConcurrency, live.length) }, async () => {
+			while (next < live.length) {
+				const entry = live[next++];
 				if (entry) await this.processEntry(entry[0], entry[1]);
 			}
 		});
@@ -278,14 +289,16 @@ var RedisStreamTransport = class {
 		let allSucceeded = true;
 		let lastError;
 		let lastHandlerName;
-		for (const handler of matchingHandlers) try {
-			await handler(event);
-		} catch (err) {
-			allSucceeded = false;
-			lastError = err instanceof Error ? err : new Error(String(err));
-			lastHandlerName = handler.name || lastHandlerName;
-			this.logger.error(`[RedisStreamTransport] Handler error for ${event.type}:`, err);
-		}
+		await runWorkScope(workSeedFromEvent(event), async () => {
+			for (const handler of matchingHandlers) try {
+				await handler(event);
+			} catch (err) {
+				allSucceeded = false;
+				lastError = err instanceof Error ? err : new Error(String(err));
+				lastHandlerName = handler.name || lastHandlerName;
+				this.logger.error(`[RedisStreamTransport] Handler error for ${event.type}:`, err);
+			}
+		});
 		if (allSucceeded) {
 			await this.redis.xack(this.stream, this.group, messageId);
 			this.failureContext.delete(messageId);
@@ -306,20 +319,17 @@ var RedisStreamTransport = class {
 			if (oldest !== void 0) this.failureContext.delete(oldest);
 		}
 	}
+	/**
+	* The canonical matcher from primitives — the SAME glob rules the memory
+	* transport speaks. A private matcher here once accepted `prefix.*` but not
+	* `prefix:*`, so an `order:*` subscription that worked in-process received
+	* nothing after a move to the stream, with no error.
+	*/
 	getMatchingHandlers(eventType) {
 		const matched = [];
-		for (const [pattern, handlers] of this.handlers) if (this.matchesPattern(pattern, eventType)) for (const h of handlers) matched.push(h);
+		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, eventType)) for (const h of handlers) matched.push(h);
 		return matched;
 	}
-	matchesPattern(pattern, eventType) {
-		if (pattern === "*") return true;
-		if (pattern === eventType) return true;
-		if (pattern.endsWith(".*")) {
-			const prefix = pattern.slice(0, -2);
-			return eventType.startsWith(`${prefix}.`);
-		}
-		return false;
-	}
 	async moveToDlq(ids) {
 		if (this.deadLetterStream === false) {
 			for (const id of ids) {

package/dist/events/transports/redis.d.mts

@@ -1,5 +1,5 @@
 
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-Cx60_s-6.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-CbUKDzZZ.mjs";
 //#region src/events/transports/redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/events/transports/redis.mjs

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "../../workScope-BhsWde4k.mjs";
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis.ts
 /**
@@ -107,14 +108,16 @@ var RedisEventTransport = class {
 		} catch {
 			return;
 		}
-		for (const handler of handlers) try {
-			const result = handler(event);
-			if (result && typeof result === "object" && "catch" in result) result.catch((err) => {
+		runWorkScope(workSeedFromEvent(event), () => {
+			for (const handler of handlers) try {
+				const result = handler(event);
+				if (result && typeof result === "object" && "catch" in result) result.catch((err) => {
+					this.logger.error(`[RedisEventTransport] Handler error for ${event.type}:`, err);
+				});
+			} catch (err) {
 				this.logger.error(`[RedisEventTransport] Handler error for ${event.type}:`, err);
-			});
-		} catch (err) {
-			this.logger.error(`[RedisEventTransport] Handler error for ${event.type}:`, err);
-		}
+			}
+		});
 	}
 	/**
 	* Convert an Arc event pattern to a Redis channel/pattern string.

package/dist/factory/index.d.mts

@@ -1,8 +1,8 @@
 
-import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-BRU-Kd3t.mjs";
-import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-D2uIUSQk.mjs";
-import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-jYA2oHyL.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-BbBkNkqK.mjs";
+import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-DfVDvkdP.mjs";
+import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-CFfLKMH4.mjs";
+import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-Cq2nHVaW.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-CjS2OfpU.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**
@@ -19,7 +19,7 @@ import { FastifyInstance, FastifyServerOptions } from "fastify";
  * their own `redact` and arc steps aside — this default never overrides
  * an explicit setting.
  */
-declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
+declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', 'req.headers["x-device-token"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
 /**
  * Create a production-ready Fastify application with Arc framework.
  *

package/dist/factory/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-Bh0N_FLk.mjs";
-import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-DlhH81py.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-BQXHxMEk.mjs";
-import { t as loadResources } from "../loadResources-CNd1DWnK.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-CxQzbJmr.mjs";
+import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-Bbp4QJ8V.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-BkQEesNQ.mjs";
+import { t as loadResources } from "../loadResources-CblF7xt2.mjs";
 //#region src/factory/module/extend.ts
 /** Concatenate two contributions, resolving factories only when arc asks. */
 function mergeContribution(own, extra) {

package/dist/{fastify-augmentation-jYA2oHyL.d.mts → fastify-augmentation-Cq2nHVaW.d.mts}

@@ -1,8 +1,8 @@
 
-import { on as HookSystem, z as ResourceRegistry } from "./index-B78WZom8.mjs";
+import { on as HookSystem, z as ResourceRegistry } from "./index-DHbyPo5j.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
-import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-BRU-Kd3t.mjs";
-import { s as ModuleState } from "./index-D2uIUSQk.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-DfVDvkdP.mjs";
+import { s as ModuleState } from "./index-CFfLKMH4.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/factory/module/descriptor.d.ts
 /**

package/dist/{fields-Cha2QCKH.mjs → fields-BTyPLHK0.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions

package/dist/{generate-BUP4Oydg.mjs → generate-D_YmiCNf.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-Da7IT_qJ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-2_U6QZQg.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts
@@ -470,7 +470,8 @@ export default ${camel}Resource;
  */
 
 import { defineTool } from '@classytic/arc/mcp';
-${ts ? "import { z } from 'zod';\n" : "const { z } = require('zod');\n"}
+import { z } from 'zod';
+
 // Example: domain-specific action tool
 // export const activate${name}Tool = defineTool('activate_${fileName}', {
 //   description: 'Activate a ${name.toLowerCase()} by ID',

package/dist/{headers-DeXNifVj.mjs → headers-CNECDE6q.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-2ExmOgIJ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-C_YhELhe.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-Bh0N_FLk.mjs → health-CxQzbJmr.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts
@@ -252,7 +252,7 @@ const healthPlugin = async (fastify, opts = {}) => {
 				properties: {
 					status: {
 						type: "string",
-						enum: ["not_ready"]
+						enum: ["not_ready", "draining"]
 					},
 					timestamp: { type: "string" },
 					checks: { type: "array" }
@@ -260,6 +260,14 @@ const healthPlugin = async (fastify, opts = {}) => {
 			}
 		}
 	} }, async (_, reply) => {
+		if (fastify.hasDecorator("shutdownState") && fastify.shutdownState.draining) {
+			reply.code(503);
+			return {
+				status: "draining",
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				checks: []
+			};
+		}
 		const results = await runChecks(readinessChecks);
 		const criticalFailed = results.some((result, index) => !result.healthy && (readinessChecks[index]?.critical ?? true));
 		const response = {

package/dist/hooks/index.d.mts

@@ -1,3 +1,3 @@
 
-import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-B78WZom8.mjs";
+import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-DHbyPo5j.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-C0ikzqQf.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-CxvZBo77.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -1,6 +1,6 @@
 
 import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-DEWNOMza.mjs";
-import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-CduhKsJi.mjs";
+import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-Bzi1y3F9.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/idempotency/idempotencyPlugin.d.ts

package/dist/idempotency/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-DeXNifVj.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-CIF4RG8s.mjs";
-import { t as createIdempotencyResult } from "../interface-DYPVscCU.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-CNECDE6q.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-9DX9-1j_.mjs";
+import { t as createIdempotencyResult } from "../interface-BIpgzbZl.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/idempotency/redis.d.mts

@@ -1,3 +1,3 @@
 
-import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-CduhKsJi.mjs";
+import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-Bzi1y3F9.mjs";
 export { type IoredisLike, type RedisClient, RedisIdempotencyStore, type RedisIdempotencyStoreOptions, type UpstashRedisLike, ioredisAsIdempotencyClient, upstashAsIdempotencyClient };

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-BtYoMip1.d.mts → index-BHdZD8zK.d.mts}

@@ -1,8 +1,8 @@
 
 import { i as RequestScope, n as Mandate } from "./types-Ddl9OjmE.mjs";
-import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-C-NL2fTi.mjs";
+import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-CxrV1LmG.mjs";
 import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
-import { FastifyReply, FastifyRequest } from "fastify";
+import { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
 /**
  * Require a sender-constrained credential — the inbound token MUST carry a
@@ -441,6 +441,14 @@ interface DynamicPermissionMatrixConfig {
     /** Hard entry cap for internal memory store (default: 1000) */
     maxEntries?: number;
   };
+  /**
+   * App to declare the cache to (`declareRuntimeCapability`). This is a pure
+   * factory with no Fastify handle of its own, so without it the internal
+   * memory cache is invisible to the `runtime: 'distributed'` audit — a
+   * revocation on one replica then leaves the others honouring the old
+   * roles until TTL. Pass the instance whenever one exists at construction.
+   */
+  fastify?: FastifyInstance;
 }
 /** Minimal publish/subscribe interface for cross-node cache invalidation. */
 interface PermissionEventBus {

package/dist/{index-D2uIUSQk.d.mts → index-CFfLKMH4.d.mts}

@@ -1,5 +1,5 @@
 
-import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BRU-Kd3t.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-DfVDvkdP.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**
@@ -201,7 +201,7 @@ declare function getModuleExports<TExports = unknown>(fastify: FastifyInstance,
  * spelling that question as
  *
  * ```ts
- * (fastify as unknown as { arc?: { modules?: Record<string, unknown> } })
+ * (fastify as { arc?: { modules?: Record<string, unknown> } })
  *   .arc?.modules?.inventory;
  * ```
  *

package/dist/{index-eyg5WEcy.d.mts → index-CbJiYrfv.d.mts}

@@ -1,5 +1,5 @@
 
-import { l as PermissionCheck } from "./base-C-NL2fTi.mjs";
+import { l as PermissionCheck } from "./base-CxrV1LmG.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/integrations/jobs/execution.d.ts
 /**

package/dist/{index-BRoDtjek.d.mts → index-D4u76eQW.d.mts}

@@ -1,8 +1,8 @@
 
 import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-B78WZom8.mjs";
-import "./fastify-augmentation-jYA2oHyL.mjs";
+import { l as PermissionCheck, t as AnyRecord } from "./base-CxrV1LmG.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-DHbyPo5j.mjs";
+import "./fastify-augmentation-Cq2nHVaW.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";

package/dist/{index-B78WZom8.d.mts → index-DHbyPo5j.d.mts}

@@ -1,11 +1,11 @@
 
 import { P as ArcHeaders, i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
+import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-CxrV1LmG.mjs";
 import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
 import "./elevation-BXCfVcNG.mjs";
 import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";
 import { n as EncryptionDirective } from "./types-ByHn9rEO.mjs";
-import { n as DomainEvent } from "./EventTransport-Cx60_s-6.mjs";
+import { n as DomainEvent } from "./EventTransport-CbUKDzZZ.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
@@ -516,6 +516,17 @@ type ArcControllerLike = {
   update: (...args: never[]) => unknown;
   delete: (...args: never[]) => unknown;
 };
+/**
+ * Constructor constraint for the four preset mixins (`BulkMixin`, `SlugMixin`,
+ * `SoftDeleteMixin`, `TreeMixin`).
+ *
+ * This is the ONE place `any[]` is unavoidable: TypeScript requires a mixin's
+ * base-class constraint to be `new (...args: any[]) => T` — `unknown[]` and
+ * `never[]` are both rejected with "A mixin class must have a constructor with
+ * a single rest parameter of type 'any[]'". Each mixin used to carry its own
+ * copy of this line and its own lint waiver; one definition, one waiver.
+ */
+type MixinConstructor<T> = new (...args: any[]) => T;
 /**
  * Return type of the controller's `list` method.
  *
@@ -1104,6 +1115,33 @@ declare class QueryResolver {
    * doesn't gate visibility — see `core/fieldRulePredicates.ts`.
    */
   private getBlockedFields;
+  /**
+   * Is this projection path blocked — by its own name, or by a hidden ANCESTOR?
+   *
+   * `hidden: { secret: true }` hides the object, and an exact-name match left its children
+   * reachable: `?select=secret.value` projected the very field the rule exists to withhold.
+   * A rule on a parent covers everything under it, which is what "hidden" already means to
+   * whoever wrote it.
+   */
+  private isBlockedProjection;
+  /**
+   * Refuse a read that FILTERS or SORTS on a `hidden` field.
+   *
+   * `hidden` was enforced on the surfaces that RETURN a value — the response, `select=`,
+   * `_distinct`, aggregations — but a filter key never returns the field, it INTERROGATES it:
+   * `?passwordHash[like]=^ab` narrows the result set, so the row count answers a question about
+   * a value the caller may not read. A resource with no `allowedFilterFields` was a blind
+   * existence oracle over every hidden field it declared.
+   *
+   * Rejected rather than dropped, unlike `select`. Dropping a projection narrows what comes
+   * back; dropping a filter WIDENS the rows, which is the silent-permissive shape this
+   * framework fails loudly on everywhere else.
+   *
+   * Compound keys (`$or`, `$and`) are walked, because the offending key can be nested inside
+   * one. A dotted path is blocked by its own name or by a hidden ancestor, so a rule on
+   * `secret` also covers `secret.value`.
+   */
+  private assertNoBlockedReadKeys;
 }
 //#endregion
 //#region src/core/BaseCrudController.d.ts
@@ -1392,7 +1430,9 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     count: number;
   }>>;
   /** `?_distinct=field` → `repo.distinct(field, filter)` */
-  protected dispatchDistinct(req: IRequestContext, field: string): Promise<IControllerResponse<unknown[]>>;
+  protected dispatchDistinct(req: IRequestContext, field: string): Promise<IControllerResponse<{
+    values: unknown[];
+  }>>;
   /** `?_exists=true` → `repo.exists(filter)` */
   protected dispatchExists(req: IRequestContext): Promise<IControllerResponse<{
     exists: boolean;
@@ -1425,7 +1465,6 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
 }
 //#endregion
 //#region src/core/mixins/bulk.d.ts
-type Constructor$3<T> = new (...args: any[]) => T;
 /** Public surface contributed by BulkMixin. */
 interface BulkExt {
   bulkCreate(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
@@ -1437,33 +1476,30 @@ interface BulkExt {
     deletedCount: number;
   }>>;
 }
-declare function BulkMixin<TBase extends Constructor$3<BaseCrudController>>(Base: TBase): TBase & Constructor$3<BulkExt>;
+declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
 //#endregion
 //#region src/core/mixins/slug.d.ts
-type Constructor$2<T> = new (...args: any[]) => T;
 /** Public surface contributed by SlugMixin. */
 interface SlugExt {
   getBySlug(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
 }
-declare function SlugMixin<TBase extends Constructor$2<BaseCrudController>>(Base: TBase): TBase & Constructor$2<SlugExt>;
+declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
 //#endregion
 //#region src/core/mixins/tree.d.ts
-type Constructor$1<T> = new (...args: any[]) => T;
 /** Public surface contributed by TreeMixin. */
 interface TreeExt {
   getTree(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
   getChildren(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
 }
-declare function TreeMixin<TBase extends Constructor$1<BaseCrudController>>(Base: TBase): TBase & Constructor$1<TreeExt>;
+declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
 //#endregion
 //#region src/core/mixins/softDelete.d.ts
-type Constructor<T> = new (...args: any[]) => T;
 /** Public surface contributed by SoftDeleteMixin. */
 interface SoftDeleteExt {
   getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<AnyRecord>>>;
   restore(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
 }
-declare function SoftDeleteMixin<TBase extends Constructor<BaseCrudController>>(Base: TBase): TBase & Constructor<SoftDeleteExt>;
+declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
 //#endregion
 //#region src/core/BaseController.d.ts
 /**
@@ -1531,7 +1567,7 @@ interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extend
     deletedCount: number;
   }>>;
 }
-declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & (new (...args: any[]) => BulkExt) & (new (...args: any[]) => SlugExt) & (new (...args: any[]) => TreeExt) & (new (...args: any[]) => SoftDeleteExt);
+declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
 /**
  * Fully-composed controller: `BaseCrudController` + SoftDelete + Tree +
  * Slug + Bulk. Drop-in replacement for the pre-2.11 god class. The
@@ -4035,6 +4071,8 @@ interface GracefulShutdownOptions {
   onShutdown?: () => Promise<void> | void;
   signals?: NodeJS.Signals[];
   logEvents?: boolean;
+  /** Lame-duck window (ms) between failing readiness and closing. Default 0. */
+  drainDelayMs?: number;
 }
 interface RequestIdOptions {
   headerName?: string;
@@ -4133,6 +4171,8 @@ interface ArcInternalMetadata extends RequestContext {
   _policyFilters?: Record<string, unknown>;
   /** Request scope from scope resolution */
   _scope?: RequestScope;
+  /** This read is deliberately unscoped by tenant — see `_crossTenantRead` on FastifyRequest. */
+  _crossTenantRead?: boolean;
   /** Ownership check config from ownedByUser preset */
   _ownershipCheck?: {
     field: string;

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-C-NL2fTi.mjs";
-import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-B78WZom8.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-CxrV1LmG.mjs";
+import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-DHbyPo5j.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-jYA2oHyL.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-BRoDtjek.mjs";
-import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-BtYoMip1.mjs";
+import "./fastify-augmentation-Cq2nHVaW.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-D4u76eQW.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-BHdZD8zK.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BONghE1Y.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-2ExmOgIJ.mjs";
-import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CYaDvmOB.mjs";
-import { t as defineAggregation } from "./defineAggregation-0KBvqEEC.mjs";
-import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { l as getControllerScope } from "./actionPermissions-jlFZ1it4.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-BMdyRelW.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-8She7FgF.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BxLgNFF7.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-C_YhELhe.mjs";
+import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DYJRZ0EJ.mjs";
+import { t as defineAggregation } from "./defineAggregation-UyeurGkp.mjs";
+import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { l as getControllerScope } from "./actionPermissions-DPwPWPOV.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-DzGT-2LP.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-iNGqYerO.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-DiHXy8Ck.mjs";
 //#region src/index.ts
-const version = "2.38.0";
+const version = "2.41.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };