@classytic/arc 2.41.0 → 2.43.0

package/dist/{index-DHbyPo5j.d.mts → index-mqaqZNpe.d.mts}

@@ -1,15 +1,16 @@
 
 import { P as ArcHeaders, i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-CxrV1LmG.mjs";
-import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
-import "./elevation-BXCfVcNG.mjs";
-import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";
+import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-CZyixEQR.mjs";
+import { a as QueryCacheConfig } from "./QueryCache--5uAuYPW.mjs";
+import "./elevation-BW2J3tNj.mjs";
+import "./requirement-CbiLdQ1n.mjs";
+import { n as FieldPermissionMap } from "./fields-BBSpf8pS.mjs";
 import { n as EncryptionDirective } from "./types-ByHn9rEO.mjs";
-import { n as DomainEvent } from "./EventTransport-CbUKDzZZ.mjs";
+import { n as DomainEvent } from "./EventTransport-CiicKz2Z.mjs";
 import { Filter } from "@classytic/repo-core/filter";
-import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
+import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
-import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
+import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { DataAdapter, RepositoryLike } from "@classytic/repo-core/adapter";
 import { LookupSpec } from "@classytic/repo-core/lookup";
 import { FieldRule, SchemaBuilderOptions } from "@classytic/repo-core/schema";
@@ -608,6 +609,12 @@ interface ControllerConfigurableOptions {
    * own `idField` when unset.
    */
   idField?: string;
+  /**
+   * Further unique keys a single-row read and an action target accept, tried in order after
+   * `idField` (e.g. `['rmaNumber']` beside `_id`). Each lookup carries the same tenant and row
+   * policy as the primary one — an alternate key never widens what a caller can reach.
+   */
+  lookupFields?: readonly string[];
   /**
    * Custom filter matching for policy enforcement.
    * Provided by the DataAdapter for non-MongoDB databases (SQL, etc.).
@@ -645,6 +652,10 @@ interface ControllerConfigurableOptions {
    * `configure()` like `writes`.
    */
   transactional?: boolean;
+  /** Optimistic concurrency — see `ResourceConfig.concurrency`. */
+  concurrency?: {
+    versionField?: string;
+  };
 }
 /**
  * Full constructor options — union of construction-only + configurable.
@@ -1103,9 +1114,9 @@ declare class QueryResolver {
   /** Sanitize advanced populate options against allowedPopulate */
   private sanitizePopulateOptions;
   /**
-   * Sanitize lookup/join options. Deny-by-default: `allowedLookups` must be
-   * configured for any client-driven lookup to pass; listed collections are
-   * then structurally validated to prevent injection.
+   * Client lookups, deny-by-default. An allowed one is structurally validated, and its joined side
+   * is filtered by the resource's server-owned `LookupPolicy.scope` — the base collection's tenant
+   * filter never reaches a join, and a client-supplied `where` is replaced, never merged.
    */
   private sanitizeLookups;
   /**
@@ -1147,10 +1158,7 @@ declare class QueryResolver {
 //#region src/core/BaseCrudController.d.ts
 /**
  * Framework-agnostic CRUD controller implementing IController.
- *
- * Composes AccessControl, BodySanitizer, and QueryResolver. All shared
- * state and helpers are `protected` so the preset mixins (SoftDelete,
- * Tree, Slug, Bulk) can extend cleanly.
+ * Composes AccessControl, BodySanitizer, and QueryResolver.
  *
  * @template TDoc - The document type.
  * @template TRepository - The repository type (defaults to RepositoryLike).
@@ -1164,29 +1172,14 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected resourceName?: string;
   protected tenantField: string | false;
   protected idField: string;
-  /**
-   * Composable access control (ID filtering, policy checks, org scope, ownership).
-   *
-   * Not `readonly` — `configure()` rebuilds it when the host
-   * supplies tenant/idField/matchesFilter post-construction. Same model as
-   * `queryResolver` after `setQueryParser` shipped in 2.10.9.
-   */
+  /** Alternate unique keys, each with its own access control over the SAME scope. */
+  protected lookupAccess: AccessControl[];
+  private _lookupFields;
+  /** Access control (ID filtering, policy checks, org scope, ownership). */
   accessControl: AccessControl;
-  /**
-   * Composable body sanitization (field permissions, system fields).
-   *
-   * Not `readonly` — `configure()` rebuilds it when the host
-   * supplies schemaOptions/onFieldWriteDenied post-construction.
-   */
+  /** Body sanitization (field permissions, system fields). */
   bodySanitizer: BodySanitizer;
-  /**
-   * Composable query resolution (parsing, pagination, sort, select/populate).
-   *
-   * Not `readonly` — `setQueryParser()` rebuilds this resolver to swap in a
-   * different parser (e.g. mongokit's `QueryParser`). `defineResource` calls
-   * it automatically when a resource supplies both `controller` and
-   * `queryParser`.
-   */
+  /** Query resolution (parsing, pagination, sort, select/populate). */
   queryResolver: QueryResolver;
   protected _matchesFilter?: (item: unknown, filters: Record<string, unknown>) => boolean;
   protected _presetFields: {
@@ -1195,82 +1188,51 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   };
   protected _cacheConfig?: ResourceCacheConfig;
   /**
-   * Retained construction-time values so partial `configure()` rebuilds
-   * (e.g. `configure({ schemaOptions })`) reuse them instead of silently
-   * falling back to the sub-component defaults (`-createdAt` sort,
-   * `reject` write-denial) — `defaultSort: false` matters for kits
-   * without a `createdAt` column, `strip` for legacy write semantics.
+   * Retained so partial `configure()` rebuilds reuse them instead of falling back
+   * to sub-component defaults (`-createdAt` sort breaks kits without that column).
    */
   protected _defaultSort?: string | false;
   protected _onFieldWriteDenied?: FieldWriteDenialPolicy;
   protected _onImmutableWrite?: FieldWriteDenialPolicy;
   /**
-   * Domain commands bound to the write slots (`ResourceWrites`). Consulted at
-   * the PERSISTENCE step only — everything upstream of it (sanitizer, tenant
-   * injection, actor stamp, hook sandwich) runs exactly as it does without
-   * one, which is the entire point of the seam.
+   * Domain commands bound to the write slots. Consulted at the PERSISTENCE step
+   * only — sanitizer, tenant injection, actor stamp, and hooks run unchanged.
    */
   protected _writes?: ResourceWrites;
   /** Transactional write envelope — see `ResourceConfig.transactional`. */
   protected _transactional: boolean;
+  /** Version field under optimistic concurrency — `null` when the resource did not opt in. */
+  protected _versionField: string | null;
   constructor(repository: TRepository, options?: BaseControllerOptions);
   /**
-   * Swap the controller's query parser. Mutates the existing `QueryResolver`
-   * in place via `QueryResolver.setParser()` — the resolver instance stays
-   * referentially stable, and there is no second copy of `defaultSort` /
-   * `tenantField` / `schemaOptions` for the swap to drift away from.
-   *
-   * Closes the v2.10.9 gap where `defineResource({ controller, queryParser })`
-   * forwarded the parser only to auto-constructed controllers. `defineResource`
-   * calls this via duck-typing when both `controller` and `queryParser` are
-   * supplied; controllers that don't implement it are left untouched.
+   * Bind the resource this controller serves — hooks, audit, events and cache key on it.
+   * `defineResource` calls it for a supplied controller; an unset name is assigned, a
+   * different one throws (the controller would run another resource's hooks).
+   */
+  bindResourceName(name: string): void;
+  /**
+   * Swap the controller's query parser. Mutates the existing `QueryResolver` in
+   * place, so the resolver stays referentially stable. `defineResource` calls this
+   * (duck-typed) when a resource supplies both `controller` and `queryParser`.
    */
   setQueryParser(queryParser: QueryParserInterface): void;
   /**
-   * Apply resource-level options to a custom controller AFTER construction.
-   *
-   * Closes the pre-2.15 footgun where `defineResource({ controller, tenantField,
-   * schemaOptions, ... })` warned that the options were "dropped" because the
-   * user-supplied controller never received them. Hosts had to remember to
-   * forward each one through `super(repo, { ... })` — easy to miss, silently
-   * mis-scopes queries when missed.
-   *
-   * `defineResource()` now calls `controller.configure(resolvedOpts)` after
-   * `resolveOrAutoCreateController()` runs. Configure-aware controllers receive
-   * the resolved values; arc skips the dropped-options warn for them.
-   *
-   * Only the keys that affect cross-cutting state (tenant scope, schema/field
-   * rules, sort/limit policy, cache, write-denial policy) are honoured —
-   * `repository` / `resourceName` are constructor-only because they participate
-   * in mixin composition. Each known key rebuilds the affected sub-component
-   * (AccessControl / BodySanitizer / QueryResolver) so referentially-stable
-   * consumers don't see stale state.
+   * Apply resource-level options to a controller AFTER construction.
+   * `defineResource()` calls this once after resolving the controller, so custom
+   * controllers receive tenant scope, field rules, sort/limit, cache, and
+   * write-denial policy without forwarding them through `super(repo, { … })`.
    *
-   * Idempotent: safe to call zero, one, or many times before first request;
-   * arc calls it exactly once.
-   *
-   * Type narrowed to `ControllerConfigurableOptions` — `resourceName` is
-   * construction-only and intentionally excluded so accidental "rename
-   * the resource at runtime" calls fail to typecheck.
+   * Each key rebuilds only the affected sub-component. Idempotent.
+   * `repository` / `resourceName` are construction-only and excluded by type.
    */
   configure(options: ControllerConfigurableOptions): void;
-  /**
-   * Get the tenant field name if multi-tenant scoping is enabled.
-   * Returns `undefined` when `tenantField` is `false`.
-   */
+  /** Tenant field name, or `undefined` when `tenantField` is `false`. */
   protected getTenantField(): string | undefined;
   /**
-   * Build the canonical repo-options bag (tenant scope, audit
-   * attribution, trace correlation) from the Fastify request. Full
-   * contract + rationale on `buildTenantRepoOptions` in
-   * `crud/requestPipeline.ts` — this delegate exists so host overrides
-   * and duck-typed consumers (aggregation router, MCP bridge) keep the
-   * same `protected` entry point.
-   *
-   * Method kept named `tenantRepoOptions` for back-compat with hosts
-   * that spread `...this.tenantRepoOptions(req)` (10+ call sites in
-   * arc, plus host overrides). The bag has always grown over time —
-   * hosts that don't want audit forwarding never read those keys.
+   * Canonical repo-options bag (tenant scope, audit attribution, trace
+   * correlation) — see `buildTenantRepoOptions` in `crud/requestPipeline.ts`.
+   * Kept as a `protected` entry point for host overrides and duck-typed
+   * consumers (aggregation router, MCP bridge).
    */
   protected tenantRepoOptions(req: IRequestContext): AnyRecord;
   /** Extract typed Arc internal metadata from request */
@@ -1285,18 +1247,11 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    */
   protected resolveRepoId(id: string, existing: AnyRecord | null): string;
   /**
-   * Read-side preflight for mutable-target operations (`update`, `delete`).
-   *
-   * Bundles the four steps that every mutation must do before touching the
-   * repo: (1) extract `:id`, (2) fetch under access control + tenant scope,
-   * (3) verify ownership, (4) translate the route id to the repo's primary
-   * key. Returning `{id, existing, repoId}` keeps the call sites a single
-   * line and makes drift between `update` and `delete` structurally
-   * impossible — there is one preflight, one denial-reason mapping, one
-   * ownership check.
+   * Shared preflight for mutations: extract `:id`, fetch under access control +
+   * tenant scope, verify ownership, translate the route id to the repo primary
+   * key. One path so `update` and `delete` cannot drift.
    *
-   * Pass `extraFetchOptions` for callers (e.g. soft-delete restore) that
-   * need to widen the fetch (`{ includeDeleted: true }`).
+   * `extraFetchOptions` widens the fetch (e.g. restore's `{ includeDeleted: true }`).
    */
   protected loadMutableTarget(req: IRequestContext, extraFetchOptions?: AnyRecord): Promise<{
     id: string;
@@ -1304,18 +1259,45 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     repoId: string;
   }>;
   /**
-   * Centralized 404 thrower. Maps the denial reason from `fetchDetailed()`
-   * into a `NotFoundError` so consumers can distinguish "doc doesn't
-   * exist" from "doc filtered by policy/org scope" via the error
-   * `details.code` set by the global error handler.
+   * Whether the target of an id-bound ACTION is a row this request may read — the same
+   * compound filter (id + tenant + `_policyFilters`) `GET /:id` uses. The action router
+   * refuses the action with a 404 when it is not, so a caller can act on a row iff it can
+   * read it. Skips the read when neither tenancy nor a row policy narrows the request.
+   */
+  private buildLookupAccess;
+  /**
+   * THE single-row lookup — `GET /:id` and the action-target fence both read through it.
+   * The primary key first; when it finds nothing (or the id cannot be that key's type), each
+   * `lookupFields` key in turn, under the same tenant and row policy.
+   */
+  protected fetchByAnyKey(id: string, req: IRequestContext, options: QueryOptions | undefined): Promise<{
+    doc: TDoc | null;
+    reason: FetchDenialReason | null;
+  }>;
+  /** Whether {@link isActionTargetVisible} can answer — it reads through the repository. */
+  canFenceActionTargets(): boolean;
+  isActionTargetVisible(req: IRequestContext, id: string): Promise<boolean>;
+  /** `ETag: "<version>"` for a versioned document under optimistic concurrency. */
+  protected etagHeaders(doc: unknown): Record<string, string> | undefined;
+  /**
+   * The version an update must apply at. `If-Match` must name the CURRENT version or the
+   * request fails 412 before anything is written; without it (or with `*`) the write is a CAS
+   * on the version just loaded, so a concurrent write in between is a 409, never overwritten.
+   */
+  protected expectedVersion(req: IRequestContext, existing: unknown): {
+    version?: number;
+    fromClient: boolean;
+  };
+  /**
+   * 404 thrower. Maps the `fetchDetailed()` denial reason into `details.code` so
+   * "doesn't exist" is distinguishable from "filtered by policy/org scope".
    */
   protected throwNotFound(reason?: FetchDenialReason | null): never;
   /** Resolve cache config for a specific operation, merging per-op overrides */
   protected resolveCacheConfig(operation: "list" | "byId"): QueryCacheConfig | null;
   /**
-   * Extract user/org IDs from request for cache key scoping.
-   * Only includes orgId when the resource uses tenant-scoped data (tenantField is set).
-   * Universal resources (tenantField: false) get shared cache keys.
+   * User/org IDs for cache key scoping. orgId is included only when `tenantField`
+   * is set; universal resources share cache keys.
    */
   protected cacheScope(req: IRequestContext): {
     userId?: string;
@@ -1325,20 +1307,13 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected cacheResponse<T>(data: T, cacheStatus: CacheStatus): IControllerResponse<T>;
   /** Required route-id helper shared by get/update/delete. Throws on missing id. */
   protected requireIdParam(req: IRequestContext): string;
-  /**
-   * Normalizes `repo.exists()` return shapes across adapters. Per
-   * StandardRepo's contract, `exists` may return `boolean`, `{ _id }`,
-   * or `null` — every truthy non-null shape collapses to `true`.
-   */
+  /** Normalizes `repo.exists()` (`boolean | { _id } | null`) to a boolean. */
   protected isExistsTruthy(result: unknown): boolean;
   /** Assemble the per-request hook context from the protected accessors. */
   private hookOpContext;
   /**
-   * Run `executeBefore` then `executeAround` (or just the executor if no
-   * hooks are wired). Returns the around-phase result directly. Throws an
-   * `ArcError` (status 400, code `BEFORE_<OP>_HOOK_ERROR`) when the
-   * before-hook fails. Full contract on `executeHookedOp` in
-   * `crud/requestPipeline.ts`.
+   * Run before + around hooks (or just the executor if none are wired) and
+   * return the result. A failing before-hook throws 400 `BEFORE_<OP>_HOOK_ERROR`.
    */
   protected runHookedOpUntilResult<TInput, TResult>(req: IRequestContext, args: {
     op: "create" | "update" | "delete";
@@ -1348,14 +1323,10 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   }, executor: (processed: TInput) => Promise<TResult>): Promise<TResult>;
   /**
    * Run a write's PERSISTENCE step, transactionally when the resource asked.
-   *
-   * Plain mode hands `fn` the live repository. Transactional mode runs it
-   * through repo-core's `retryingTransaction`: the callback receives the
-   * TX-BOUND repository (so declared verbs and repository calls join the same
-   * transaction), transient conflicts re-run `fn` with jittered bounded
-   * backoff, everything else — including `VersionConflictError` — surfaces
-   * once. Hooks stay OUTSIDE: before/around ran already and must not re-run;
-   * after-hooks run post-commit, which they already do by running after this.
+   * Transactional mode uses `retryingTransaction`: `fn` gets the TX-BOUND repo and
+   * re-runs on transient conflicts; anything else (incl. `VersionConflictError`)
+   * surfaces once. Hooks stay OUTSIDE so before/around never re-run and after
+   * runs post-commit.
    */
   protected runWritePersistence<T>(fn: (repo: TRepository, uow?: TransactionHandle) => Promise<T>): Promise<T>;
   /** Assemble the `WriteContext` a `create` verb receives. */
@@ -1363,43 +1334,26 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /**
    * Assemble the `MutationWriteContext` an `update` / `delete` verb receives.
    *
-   * `existing` is the document arc ALREADY loaded to run its permission and
-   * tenant checks — `loadMutableTarget` throws before any verb runs when it
-   * cannot produce one, which is why the context types it required. Handing
-   * it over rather than letting the verb re-fetch is deliberate: a second
-   * read can observe a different document than the one the request was
-   * authorised against.
-   *
-   * `id` is the REPOSITORY PRIMARY KEY (`repoId`), never the raw route param —
-   * see the note on `MutationWriteContext.id`. Callers pass `resolveRepoId`'s
-   * output.
+   * `existing` is the document the request was AUTHORISED against — handed over
+   * so the verb does not re-fetch and possibly observe a different document.
+   * `id` is the REPOSITORY PRIMARY KEY (`resolveRepoId` output), never the route param.
    */
   protected mutationWriteContext(req: IRequestContext, id: string, existing: unknown, repo?: TRepository, uow?: TransactionHandle): MutationWriteContext;
   /**
-   * Run `executeAfter` for the given op + data. No-op when hooks aren't
-   * wired or `resourceName` isn't set. Caller passes the data shape it
-   * wants downstream after-handlers to receive — typically the result for
-   * create/update, the original input (`existing`) for delete.
+   * Run after-hooks for `op`. No-op without hooks or `resourceName`. `data` is the
+   * result for create/update, `existing` for delete.
    */
   protected runAfterHook(req: IRequestContext, op: "create" | "update" | "delete" | "list" | "read", data: AnyRecord, meta?: Record<string, unknown>): Promise<void>;
   /**
-   * Per-instance single-flight for cache fills — concurrent requests for
-   * the SAME cache key coalesce onto one repository query instead of each
-   * issuing its own (a popular entry expiring under 1,000 concurrent
-   * readers must produce 1 DB query, not 1,000). Keys already encode the
-   * resolved query + user/org scope + resource version, so coalescing can
-   * never cross tenants, scopes, or invalidation generations. Per-process
-   * by design; distributed refresh leases are a store-level concern
-   * (planned with the repo-core CacheEngine façade, which ships
-   * single-flight natively).
+   * Per-process single-flight for cache fills: concurrent requests for the SAME
+   * key coalesce onto one repository query. Keys encode query + user/org scope +
+   * resource version, so coalescing never crosses tenants or invalidation generations.
    */
   private readonly inFlightCacheFills;
   private cacheSingleFlight;
   /**
-   * Register a background SWR refresh for `key` unless one is already in
-   * flight. Registration is SYNCHRONOUS (before the deferred tick) so a
-   * burst of stale readers arriving in the same tick schedules exactly one
-   * revalidation.
+   * Register a background SWR refresh for `key` unless one is in flight.
+   * Registration is SYNCHRONOUS so a same-tick burst of stale readers schedules one.
    */
   private scheduleCacheRefresh;
   /** Cached `list()` flow with SWR semantics. Returns null when cache is disabled. */
@@ -1408,19 +1362,14 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected withGetCache(req: IRequestContext, id: string, options: ControllerQueryOptions): Promise<IControllerResponse<TDoc> | null>;
   list(req: IRequestContext): Promise<IControllerResponse<ListResult<TDoc>>>;
   /**
-   * Resource-dispatch verbs router. Returns `null` when the request is
-   * a regular list query, otherwise returns the dispatch promise.
-   *
-   * Verbs (mutually exclusive — first match wins):
+   * Resource-dispatch verbs router; `null` for a regular list query.
+   * First match wins:
    *   - `?_count=true` → `{ count: number }` via `repo.count()`
    *   - `?_distinct=field` → `unknown[]` via `repo.distinct(field)`
    *   - `?_exists=true` → `{ exists: boolean }` via `repo.exists()`
    *
-   * All verbs share the resolved filter (parsed query + policy filters
-   * + tenant scope). Adapters that don't ship the underlying repo
-   * method get a `501` so failures surface loudly instead of falling
-   * back to a full table scan. Matching + repo invocation live in
-   * `crud/resourceVerbs.ts`.
+   * All share the resolved filter (query + policy + tenant scope). A missing repo
+   * method is a `501`, never a fallback to a full scan.
    */
   protected dispatchResourceVerb(req: IRequestContext): Promise<IControllerResponse<unknown>> | null;
   /** Resolve filter + tenant/audit options for a dispatch verb. */
@@ -1438,13 +1387,8 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     exists: boolean;
   }>>;
   /**
-   * True when `field` is safe to expose via `_distinct`.
-   *
-   * Read-side gate only — only `hidden: true` blocks. `systemManaged`
-   * is a *write* rule (clients can't PATCH the value); the field is
-   * still in every list response, so blocking `_distinct` adds nothing
-   * but inconvenience. See `core/fieldRulePredicates.ts` for the
-   * canonical predicate shared with `QueryResolver`.
+   * True when `field` is safe to expose via `_distinct`. Only `hidden: true`
+   * blocks — `systemManaged` is a write rule and the field is already readable.
    */
   protected isFieldExposedForRead(field: string): boolean;
   /** Execute list query through hooks (extracted for cache revalidation) */
@@ -1467,7 +1411,7 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
 //#region src/core/mixins/bulk.d.ts
 /** Public surface contributed by BulkMixin. */
 interface BulkExt {
-  bulkCreate(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
+  bulkCreate(req: IRequestContext): Promise<IControllerResponse<object[]>>;
   bulkUpdate(req: IRequestContext): Promise<IControllerResponse<{
     matchedCount: number;
     modifiedCount: number;
@@ -1476,69 +1420,42 @@ interface BulkExt {
     deletedCount: number;
   }>>;
 }
-declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
+declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
 //#endregion
 //#region src/core/mixins/slug.d.ts
 /** Public surface contributed by SlugMixin. */
 interface SlugExt {
-  getBySlug(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
+  getBySlug(req: IRequestContext): Promise<IControllerResponse<object>>;
 }
-declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
+declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
 //#endregion
 //#region src/core/mixins/tree.d.ts
 /** Public surface contributed by TreeMixin. */
 interface TreeExt {
-  getTree(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
-  getChildren(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
+  getTree(req: IRequestContext): Promise<IControllerResponse<object[]>>;
+  getChildren(req: IRequestContext): Promise<IControllerResponse<object[]>>;
 }
-declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
+declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
 //#endregion
 //#region src/core/mixins/softDelete.d.ts
 /** Public surface contributed by SoftDeleteMixin. */
 interface SoftDeleteExt {
-  getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<AnyRecord>>>;
-  restore(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
+  getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<object>>>;
+  restore(req: IRequestContext): Promise<IControllerResponse<object>>;
 }
-declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
+declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
 //#endregion
 //#region src/core/BaseController.d.ts
-/**
- * The `Arc*Result` types above stay: `src/index.ts` re-exports them from THIS
- * path. `BaseCrudController` and the four mixins (+ their `*Ext` types) were
- * also re-exported here and are not, as of 2.37.1 — `core/index.ts` takes them
- * straight from `./BaseCrudController.js` and `./mixins/*.js`, so this file's
- * copies had no importer. Two public paths to one symbol is a drift seam, not
- * convenience: composition belongs to `core/index.ts`, and this module is the
- * composed `BaseController` itself.
- */
 /**
  * Fully-composed controller shape: all CRUD methods + every preset method
  * (SoftDelete / Tree / Slug / Bulk) typed over the caller-supplied `TDoc`.
  *
- * Composes `BaseCrudController` (list/get/create/update/delete) → `BulkMixin`
- * (bulk*) → `SlugMixin` (getBySlug) → `TreeMixin` (getTree/getChildren) →
- * `SoftDeleteMixin` (getDeleted/restore). CRUD-only hosts extend
- * `BaseCrudController` for a smaller surface; others compose mixins by hand.
- *
- * DECLARATION MERGING, not a generic mixin chain: TypeScript cannot thread one
- * `TDoc` through four chained mixin factories without losing the
- * `extends Constructor<Base>` constraint. So the runtime pins the chain base to
- * `AnyRecord` while the TYPE surface threads `TDoc`, and merging bridges them.
- *
- * `TDoc extends AnyRecord` is LOAD-BEARING: inherited methods return
- * `ListResult<AnyRecord>` and the merged interface returns `ListResult<TDoc>`,
- * so TS's derived-assignable-to-base check needs the bound. Without it the
- * class declaration fails with `Type 'TDoc[]' is not assignable to type
- * 'AnyRecord[]'`. Hosts pick one of:
- *   (a) drop the generic — lose return narrowing;
- *   (b) `interface IUser extends AnyRecord` — preferred when you own the type;
- *   (c) `ArcListResult<typeof this>` etc. when overriding — reads the return
- *       type off the class, so the bound never applies.
- *
- * COST: every `TDoc`-narrowed method is redeclared on the interface, so a new
- * mixin method must be added here too.
+ * DECLARATION MERGING, not a generic mixin chain: chained mixin factories cannot thread one
+ * `TDoc`, so the runtime chain is instantiated over `object` and the TYPE surface threads `TDoc`.
+ * Any `TDoc extends object` works — an interface-typed document needs no index signature.
+ * A new mixin method must be redeclared here too.
  */
-interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> {
+interface BaseController<TDoc extends object = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> {
   accessControl: AccessControl;
   bodySanitizer: BodySanitizer;
   queryResolver: QueryResolver;
@@ -1567,14 +1484,14 @@ interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extend
     deletedCount: number;
   }>>;
 }
-declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
+declare const BaseController_base: {
+  new (repository: RepositoryLike, options?: BaseControllerOptions): BaseCrudController<object, RepositoryLike>;
+} & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
 /**
  * Fully-composed controller: `BaseCrudController` + SoftDelete + Tree +
- * Slug + Bulk. Drop-in replacement for the pre-2.11 god class. The
- * companion interface above gives every method full generic precision
- * on `TDoc` via declaration merging.
+ * Slug + Bulk. The companion interface above types every method over `TDoc`.
  */
-declare class BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> extends BaseController_base {
+declare class BaseController<TDoc extends object = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> extends BaseController_base {
   readonly _phantom?: [TDoc, _TRepository];
 }
 //#endregion
@@ -1924,6 +1841,9 @@ interface RouteDefinition {
    * Accepts a controller-method NAME as well, same as {@link handler} — the
    * lookup is identical and only the calling convention differs, so a
    * Fastify-native controller method stays reachable by name.
+   *
+   * An async raw handler that calls `reply.send()` must `return reply` (as `handleRaw`
+   * does): resolving `undefined` while an async `preSerialization` hook runs sends an empty body.
    */
   readonly rawHandler?: string | RawRouteHandler;
   /** Logical operation name (pipeline keys, MCP tool naming). */
@@ -1941,8 +1861,8 @@ interface RouteDefinition {
   /**
    * Opt this custom route into the multiTenant preset's tenant scoping.
    *
-   * When `true` AND the resource declares `multiTenantPreset` (or
-   * `flexibleMultiTenantPreset`), arc prepends the preset's tenant
+   * When `true` AND the resource declares `multiTenantPreset`, arc
+   * prepends the preset's tenant
    * filter + injection middleware to this route's chain — the same
    * pair `update` gets. The handler can then read the resolved tenant
    * via `getOrgId(req.scope)` / `req._tenantFields` (or, for write
@@ -2139,6 +2059,28 @@ interface ActionDefinition {
    * resource root and drops `id` from the MCP tool's input shape.
    */
   readonly id?: boolean;
+  /**
+   * Where an id-bound action's TARGET is authorized. Default: arc loads it through the
+   * resource's access control (id + tenant + row policy, as `GET /:id` does) and answers
+   * 404 when the caller could not read it. `{ scope: 'handler', reason }` hands that check
+   * to the handler — for a target that is deliberately not a row of this resource's tenant.
+   */
+  readonly target?: {
+    readonly scope: "handler";
+    readonly reason: string;
+  };
+  /**
+   * `{ required: true }`: a call of THIS action without an idempotency key is refused (400
+   * `arc.idempotency_key_required`) and a keyed one is deduplicated; other actions on the
+   * same mount stay optional. Needs `idempotencyPlugin` enabled.
+   */
+  readonly idempotency?: {
+    readonly required: boolean;
+    /** `'handler'`: the handler deduplicates; arc only demands and exposes the key. Needs `owner`. */
+    readonly dedup?: "handler";
+    /** The runner that owns at-most-once under `dedup: 'handler'`. */
+    readonly owner?: string;
+  };
   /**
    * MCP tool generation:
    * - omitted/true: auto-generate
@@ -2817,6 +2759,16 @@ interface FieldRule$1 {
 }
 //#endregion
 //#region src/types/resource/schemas.d.ts
+/**
+ * One client-requestable join. The base collection's tenant filter never reaches a joined
+ * collection, so its scope is REQUIRED and is always the server's — a client `where` is discarded.
+ */
+interface LookupPolicy {
+  /** Filter on the JOINED rows (tenant, soft-delete, visibility). `{}` only for a genuinely global collection. */
+  scope: (ctx: {
+    scope: RequestScope | undefined;
+  }) => Record<string, unknown>;
+}
 /**
  * Schema-shaping options for a resource.
  *
@@ -2913,11 +2865,10 @@ interface RouteSchemaOptions extends SchemaBuilderOptions {
      */
     allowedPopulate?: string[];
     /**
-     * Lookup-collection whitelist for `QueryResolver.sanitizeLookups`.
-     * When set, only the listed collections may be `$lookup`'d. Omit to
-     * disable the whitelist (kit-level rules still apply).
+     * Client-requestable joins, keyed by collection, each with the SERVER-owned scope of its
+     * joined side. Omit to deny every client lookup (the default).
      */
-    allowedLookups?: string[];
+    allowedLookups?: Readonly<Record<string, LookupPolicy>>;
   };
 }
 /**
@@ -3070,6 +3021,14 @@ interface ResolvedTenantPurge {
 }
 //#endregion
 //#region src/types/resource/config.d.ts
+/**
+ * Built-in write routes whose retry must not execute twice: each listed op answers a
+ * keyless call with 400 `arc.idempotency_key_required` and dedupes a keyed one. Needs
+ * `idempotencyPlugin` enabled; boot refuses an op that is not mounted.
+ */
+interface ResourceIdempotencyConfig {
+  readonly required: readonly ("create" | "update" | "delete")[];
+}
 /** Standard controller type alias for CRUD operations. */
 type CrudController<TDoc> = IController<TDoc>;
 /** Resource-level permissions — only `PermissionCheck` functions allowed. */
@@ -3140,6 +3099,16 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * that silently degrades is the defect, not a mode.
    */
   transactional?: boolean;
+  /**
+   * Optimistic concurrency over HTTP (RFC 9110). Reads send `ETag: "<version>"`; an update
+   * with `If-Match` applies only at that version (else 412), and EVERY update is a CAS write on
+   * the version it loaded (else 409) — so the version, and the ETag, change on every write.
+   * `versionField` defaults to `'__v'`. Boot-fatal on a repository without the
+   * `optimisticConcurrency` capability.
+   */
+  concurrency?: {
+    versionField?: string;
+  };
   queryParser?: unknown;
   permissions?: ResourcePermissions;
   schemaOptions?: RouteSchemaOptions;
@@ -3382,6 +3351,11 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * ```
    */
   idField?: (keyof TDoc & string) | (string & {});
+  /**
+   * Further unique keys `GET /:id` and an action's `:id` accept, tried in order after `idField`
+   * — a business number beside `_id`. Same tenant and row-policy scope as the primary lookup.
+   */
+  lookupFields?: readonly ((keyof TDoc & string) | (string & {}))[];
   /** For grouping in registry */
   module?: string;
   /** Domain events */
@@ -3513,6 +3487,8 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * registered. Set to `false` to disable for this resource.
    */
   rateLimit?: RateLimitConfig | false;
+  /** Idempotency-key fence for the built-in write routes. See `ResourceIdempotencyConfig`. */
+  idempotency?: ResourceIdempotencyConfig;
   /**
    * QueryCache configuration for this resource. Enables
    * stale-while-revalidate and auto-invalidation. Requires
@@ -3656,7 +3632,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
   readonly permissions: ResourcePermissions;
   readonly routes: readonly RouteDefinition[];
   readonly middlewares: MiddlewareConfig;
-  readonly routeGuards?: RouteHandlerMethod$1[];
+  readonly routeGuards?: RouteHandlerMethod[];
   readonly disableDefaultRoutes: boolean;
   readonly disabledRoutes: readonly CrudRouteKey[];
   readonly actions?: ActionsMap;
@@ -3664,6 +3640,8 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
   readonly aggregations?: AggregationsMap;
   readonly events: Record<string, EventDefinition>;
   readonly rateLimit?: RateLimitConfig | false;
+  readonly idempotency?: ResourceIdempotencyConfig;
+  readonly lookupFields?: readonly string[];
   readonly audit?: boolean | {
     operations?: ("create" | "update" | "delete")[];
   };
@@ -3699,6 +3677,12 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
    */
   readonly resolvedTenantPurge: ResolvedTenantPurge;
   readonly idField?: string;
+  /**
+   * The optimistic-concurrency version field, resolved (`concurrency: {}` → `'__v'`);
+   * `undefined` when the resource did not opt in. Published in the resource manifest
+   * so a client sends `If-Match` without repeating the field name.
+   */
+  readonly versionField?: string;
   readonly queryParser?: QueryParserInterface;
   readonly _appliedPresets: string[];
   _pendingHooks: Array<{
@@ -3800,7 +3784,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
 //#region src/core/defineResource.d.ts
 /**
  * `TDoc` is **unconstrained** at this layer. The previous `TDoc
- * extends AnyRecord` bound leaked out of `BaseController`'s
+ * extends object` bound leaked out of `BaseController`'s
  * mixin-composition requirement into every host's adapter boundary:
  * Mongoose's `HydratedDocument<T>`, Prisma's generated row types,
  * and any domain interface without an explicit index signature all
@@ -3811,7 +3795,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
  * known envelope fields.
  *
  * The cast moved inside `resolveOrAutoCreateController` where
- * `BaseController<TDoc extends AnyRecord>` actually requires it.
+ * `BaseController<TDoc extends object>` actually requires it.
  * One internal boundary cast replaces N host-side casts.
  */
 /**
@@ -3864,8 +3848,19 @@ declare class ResourceRegistry {
    * runtime-only handle is still reachable.
    */
   private _adapters;
+  /** The mounted definitions, in registration order — see `getDefinitions`. */
+  private _definitions;
   private _frozen;
   constructor();
+  /**
+   * The live `ResourceDefinition`s that mounted, in registration order — what a host hands to
+   * `mcpPlugin({ resources })` or a docs generator instead of re-collecting them. A resource
+   * declaring `skipRegistry` (incl. `customRoutesOnly`) opted out and is absent. Fresh array per call.
+   * One composed module's share: `getModuleResources(fastify, name)` from `@classytic/arc/factory`.
+   */
+  getDefinitions(): ResourceDefinition<unknown>[];
+  /** The live definition registered under `name`, or `undefined`. */
+  getDefinition(name: string): ResourceDefinition<unknown> | undefined;
   /**
    * Get the live `DataAdapter` for a registered resource — the handle whose
    * `.repository` cascade / cleanup helpers actually call. Returns `undefined`
@@ -3874,8 +3869,13 @@ declare class ResourceRegistry {
    * consumers cast to their kit's adapter type at the use site.
    */
   getAdapter<T = unknown>(name: string): T | undefined;
+  /** Set only by an explicit `strictResources: false`: a duplicate name keeps the FIRST entry. */
+  private _tolerateDuplicates;
+  /** Accept a duplicate resource name (the host opted out of `strictResources`; it was warned). */
+  tolerateDuplicateNames(): void;
   /**
-   * Register a resource
+   * Register a resource. A duplicate name throws — a resource missing from the registry still
+   * serves traffic but vanishes from introspection, the permission matrix and MCP.
    */
   register(resource: ResourceDefinition<unknown>, options?: RegisterOptions): this;
   /**
@@ -3955,10 +3955,6 @@ declare class ResourceRegistry {
    * iterate over a defunct registry entry. Clear both halves together.
    */
   reset(): void;
-  /** @internal Alias for unfreeze() */
-  _unfreeze(): void;
-  /** @internal Alias for reset() */
-  _clear(): void;
   /**
    * Group by key
    */
@@ -4132,6 +4128,8 @@ interface CrudRouterOptions {
    * registered. Set to `false` to disable for this resource.
    */
   rateLimit?: RateLimitConfig | false;
+  /** Idempotency-key fence for the built-in write routes. */
+  idempotency?: ResourceIdempotencyConfig;
   /** PreHandler guards applied to every route (CRUD + custom + preset). */
   routeGuards?: RouteHandlerMethod[];
   /**
@@ -4167,6 +4165,8 @@ interface RequestContext {
  * them without `as AnyRecord` casts.
  */
 interface ArcInternalMetadata extends RequestContext {
+  /** Trusted resolved tenant dimensions forwarded across transports. */
+  _tenantFields?: Record<string, unknown>;
   /** Policy filters from permission middleware */
   _policyFilters?: Record<string, unknown>;
   /** Request scope from scope resolution */
@@ -4241,6 +4241,8 @@ interface LookupOption {
   single?: boolean;
   /** Field selection on the joined collection */
   select?: string | Record<string, 0 | 1>;
+  /** Filter on the joined rows — set by arc from the resource's `LookupPolicy`, never by the client. */
+  where?: Record<string, unknown>;
 }
 /**
  * Mongoose-compatible populate option for advanced field selection.
@@ -4375,6 +4377,12 @@ interface ResourceMetadata {
     capability?: string;
     raw?: boolean;
     schema?: unknown;
+    /** The route's `config.idempotency` — `required: true` means a key is mandatory. */
+    idempotency?: {
+      required?: boolean;
+      dedup?: "handler";
+      owner?: string;
+    };
   }>;
   routes: Array<{
     method: string;
@@ -4400,6 +4408,10 @@ interface RegistryEntry extends ResourceMetadata {
    * without re-reading the resource definition.
    */
   tenantField?: string | false;
+  /** The resource's primary key field (`_id` when unset). */
+  idField?: string;
+  /** Resolved optimistic-concurrency version field — set only under `concurrency`. */
+  versionField?: string;
   /**
    * Resolved tenant-purge strategy — what arc actually runs when
    * `cascadeDeleteForOrganization` fires for this resource. Computed
@@ -4436,6 +4448,8 @@ interface RegistryEntry extends ResourceMetadata {
   disabledRoutes?: string[];
   /** Rate limit config */
   rateLimit?: RateLimitConfig | false;
+  /** Built-in write ops that require an idempotency key (`defineResource({ idempotency })`). */
+  idempotency?: ResourceIdempotencyConfig;
   /** Per-resource audit opt-in flag (read by `auditPlugin` perResource mode) */
   audit?: boolean | {
     operations?: ("create" | "update" | "delete")[];
@@ -4461,6 +4475,12 @@ interface RegistryEntry extends ResourceMetadata {
      * reading the action definition itself.
      */
     readonly id?: boolean;
+    /** `{ required: true }` — a call of this action requires an idempotency key. */
+    readonly idempotency?: {
+      readonly required: boolean;
+      readonly dedup?: "handler";
+      readonly owner?: string;
+    };
     /** MCP tool generation flag — `false` to skip, object for overrides */
     readonly mcp?: boolean | {
       readonly description?: string;
@@ -4584,26 +4604,5 @@ type InferDocType<T> = T extends DataAdapter<infer D> ? D : T extends ResourceCo
  */
 type InferAdapterDoc<A> = A extends DataAdapter<infer D> ? D : unknown;
 type InferResourceDoc<T> = T extends ResourceConfig<infer D> ? D : never;
-type TypedResourceConfig<TDoc> = ResourceConfig<TDoc>;
-type TypedController<TDoc> = IController<TDoc>;
-type TypedRepository<TDoc> = StandardRepo<TDoc>;
-//#endregion
-//#region src/types/validation.d.ts
-/**
- * Validation result types — produced by `validateResourceConfig` and
- * consumed by `assertValidConfig` / `formatValidationErrors`.
- */
-interface ConfigError {
-  field: string;
-  message: string;
-  code?: string;
-}
-interface ValidationResult {
-  valid: boolean;
-  errors: ConfigError[];
-}
-interface ValidateOptions {
-  strict?: boolean;
-}
 //#endregion
-export { OpenApiSchemas as $, AccessControlConfig as $t, RequestIdOptions as A, WriteVerbKey as An, RouteDefinition as At, defineResource as B, BaseController as Bt, RequestContext as C, ControllerConstructionOptions as Cn, PipelineStep as Ct, HealthCheck as D, MutationWriteContext as Dn, ActionEntry as Dt, GracefulShutdownOptions as E, BodySanitizerConfig as En, ActionDefinition as Et, FastifyWithDecorators as F, IControllerResponse as Fn, AuthPluginOptions as Ft, OnTenantDeleteConfig as G, SlugExt as Gt, CrudController as H, SoftDeleteMixin as Ht, MiddlewareHandler as I, IRequestContext as In, Authenticator as It, PresetHook as J, BulkMixin as Jt, ResolvedTenantPurge as K, SlugMixin as Kt, RequestWithExtras as L, RawRouteHandler as Ln, AuthenticatorContext as Lt, EventsDecorator as M, ControllerLike as Mn, RouteMethod as Mt, FastifyRequestExtras as N, FastifyHandler as Nn, RateLimitConfig as Nt, HealthOptions as O, ResourceWrites as On, ActionHandlerFn as Ot, FastifyWithAuth as P, IController as Pn, AuthHelpers as Pt, MiddlewareConfig as Q, AccessControl as Qt, RegisterOptions as R, RouteHandler as Rn, JwtContext as Rt, QueryParserInterface as S, ControllerConfigurableOptions as Sn, PipelineContext as St, CrudRouterOptions as T, BodySanitizer as Tn, ResourceCacheConfig as Tt, ResourceConfig as U, TreeExt as Ut, ResourceDefinition as V, SoftDeleteExt as Vt, ResourcePermissions as W, TreeMixin as Wt, CrudRouteKey as X, QueryResolver as Xt, PresetResult as Y, BaseCrudController as Yt, CrudSchemas as Z, QueryResolverConfig as Zt, ControllerQueryOptions as _, ArcDeleteResult as _n, Guard as _t, InferAdapterDoc as a, HookRegistration as an, ResourceExtensions as at, ParsedQuery as b, ArcUpdateResult as bn, OperationFilter as bt, TypedController as c, afterCreate as cn, AggMeasureShorthand as ct, PaginationResult as d, beforeCreate as dn, AggregationDateRangeRequirement as dt, DefineHookOptions as en, RouteSchemaOptions as et, IntrospectionData as f, beforeDelete as fn, AggregationIndexHint as ft, ArcInternalMetadata as g, ArcCreateResult as gn, AggregationsMap as gt, ResourceMetadata as h, defineHook as hn, AggregationRateLimit as ht, ValidationResult as i, HookPhase as in, ResourceHooks as it, ArcDecorator as j, ControllerHandler as jn, RouteMcpConfig as jt, IntrospectionPluginOptions as k, WriteContext as kn, ActionsMap as kt, TypedRepository as l, afterDelete as ln, AggregationCacheConfig as lt, RegistryStats as m, createHookSystem as mn, AggregationMaterializedResult as mt, ConfigError as n, HookHandler as nn, FieldRule$1 as nt, InferDocType as o, HookSystem as on, EventDefinition as ot, RegistryEntry as p, beforeUpdate as pn, AggregationMaterializedContext as pt, PresetFunction as q, BulkExt as qt, ValidateOptions as r, HookOperation as rn, ResourceHookContext as rt, InferResourceDoc as s, HookSystemOptions as sn, AggMeasureInput as st, RouteHandlerMethod$1 as t, HookContext as tn, ArcFieldRule as tt, TypedResourceConfig as u, afterUpdate as un, AggregationConfig as ut, LookupOption as v, ArcGetResult as vn, Interceptor as vt, ServiceContext as w, ListResult as wn, Transform as wt, PopulateOption as x, BaseControllerOptions as xn, PipelineConfig as xt, OwnershipCheck as y, ArcListResult as yn, NextFunction as yt, ResourceRegistry as z, ServerAccessor as zn, TokenPair as zt };
+export { ResourceHookContext as $, AroundHookHandler as $t, RequestWithExtras as A, WriteContext as An, AuthHelpers as At, OnTenantDeleteConfig as B, ServerAccessor as Bn, TreeMixin as Bt, RequestIdOptions as C, ControllerConstructionOptions as Cn, ActionEntry as Ct, FastifyWithAuth as D, BodySanitizerConfig as Dn, RouteMcpConfig as Dt, FastifyRequestExtras as E, BodySanitizer as En, RouteDefinition as Et, ResourceDefinition as F, IController as Fn, TokenPair as Ft, CrudRouteKey as G, BaseCrudController as Gt, PresetFunction as H, SlugMixin as Ht, CrudController as I, IControllerResponse as In, BaseController as It, MiddlewareConfig as J, AccessControl as Jt, CrudSchemas as K, QueryResolver as Kt, ResourceConfig as L, IRequestContext as Ln, SoftDeleteExt as Lt, ResourceRegistry as M, ControllerHandler as Mn, Authenticator as Mt, RouteRow as N, ControllerLike as Nn, AuthenticatorContext as Nt, FastifyWithDecorators as O, MutationWriteContext as On, RouteMethod as Ot, defineResource as P, FastifyHandler as Pn, JwtContext as Pt, FieldRule$1 as Q, FetchResult as Qt, ResourceIdempotencyConfig as R, RawRouteHandler as Rn, SoftDeleteMixin as Rt, IntrospectionPluginOptions as S, ControllerConfigurableOptions as Sn, ActionDefinition as St, EventsDecorator as T, MixinConstructor as Tn, ActionsMap as Tt, PresetHook as U, BulkExt as Ut, ResolvedTenantPurge as V, SlugExt as Vt, PresetResult as W, BulkMixin as Wt, RouteSchemaOptions as X, AccessControlRepository as Xt, OpenApiSchemas as Y, AccessControlConfig as Yt, ArcFieldRule as Z, FetchDenialReason as Zt, ServiceContext as _, ArcDeleteResult as _n, PipelineConfig as _t, IntrospectionData as a, HookRegistration as an, AggregationCacheConfig as at, HealthCheck as b, ArcUpdateResult as bn, Transform as bt, ResourceMetadata as c, afterCreate as cn, AggregationIndexHint as ct, LookupOption as d, beforeCreate as dn, AggregationRateLimit as dt, DefineHookOptions as en, ResourceHooks as et, OwnershipCheck as f, beforeDelete as fn, AggregationsMap as ft, RequestContext as g, ArcCreateResult as gn, OperationFilter as gt, QueryParserInterface as h, defineHook as hn, NextFunction as ht, PaginationResult as i, HookPhase as in, AggMeasureShorthand as it, RegisterOptions as j, WriteVerbKey as jn, AuthPluginOptions as jt, MiddlewareHandler as k, ResourceWrites as kn, RateLimitConfig as kt, ArcInternalMetadata as l, afterDelete as ln, AggregationMaterializedContext as lt, PopulateOption as m, createHookSystem as mn, Interceptor as mt, InferDocType as n, HookHandler as nn, EventDefinition as nt, RegistryEntry as o, HookSystem as on, AggregationConfig as ot, ParsedQuery as p, beforeUpdate as pn, Guard as pt, LookupPolicy as q, QueryResolverConfig as qt, InferResourceDoc as r, HookOperation as rn, AggMeasureInput as rt, RegistryStats as s, HookSystemOptions as sn, AggregationDateRangeRequirement as st, InferAdapterDoc as t, HookContext as tn, ResourceExtensions as tt, ControllerQueryOptions as u, afterUpdate as un, AggregationMaterializedResult as ut, CrudRouterOptions as v, ArcGetResult as vn, PipelineContext as vt, ArcDecorator as w, ListResult as wn, ActionHandlerFn as wt, HealthOptions as x, BaseControllerOptions as xn, ResourceCacheConfig as xt, GracefulShutdownOptions as y, ArcListResult as yn, PipelineStep as yt, ResourcePermissions as z, RouteHandler as zn, TreeExt as zt };