@classytic/arc 2.41.1 → 2.44.0

package/dist/{index-DHbyPo5j.d.mts → index-WH7xgvxS.d.mts}

@@ -1,15 +1,16 @@
 
 import { P as ArcHeaders, i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-CxrV1LmG.mjs";
-import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
-import "./elevation-BXCfVcNG.mjs";
-import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";
+import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-CZyixEQR.mjs";
+import { a as QueryCacheConfig } from "./QueryCache--5uAuYPW.mjs";
+import "./elevation-BW2J3tNj.mjs";
+import "./requirement-CbiLdQ1n.mjs";
+import { n as FieldPermissionMap } from "./fields-BBSpf8pS.mjs";
 import { n as EncryptionDirective } from "./types-ByHn9rEO.mjs";
-import { n as DomainEvent } from "./EventTransport-CbUKDzZZ.mjs";
+import { n as DomainEvent } from "./EventTransport-CiicKz2Z.mjs";
 import { Filter } from "@classytic/repo-core/filter";
-import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
+import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
-import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
+import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { DataAdapter, RepositoryLike } from "@classytic/repo-core/adapter";
 import { LookupSpec } from "@classytic/repo-core/lookup";
 import { FieldRule, SchemaBuilderOptions } from "@classytic/repo-core/schema";
@@ -608,6 +609,12 @@ interface ControllerConfigurableOptions {
    * own `idField` when unset.
    */
   idField?: string;
+  /**
+   * Further unique keys a single-row read and an action target accept, tried in order after
+   * `idField` (e.g. `['rmaNumber']` beside `_id`). Each lookup carries the same tenant and row
+   * policy as the primary one — an alternate key never widens what a caller can reach.
+   */
+  lookupFields?: readonly string[];
   /**
    * Custom filter matching for policy enforcement.
    * Provided by the DataAdapter for non-MongoDB databases (SQL, etc.).
@@ -645,6 +652,10 @@ interface ControllerConfigurableOptions {
    * `configure()` like `writes`.
    */
   transactional?: boolean;
+  /** Optimistic concurrency — see `ResourceConfig.concurrency`. */
+  concurrency?: {
+    versionField?: string;
+  };
 }
 /**
  * Full constructor options — union of construction-only + configurable.
@@ -1031,6 +1042,50 @@ declare class AccessControl {
   private _meta;
 }
 //#endregion
+//#region src/core/entityHelpers.d.ts
+/**
+ * Read the resource's configured `idField` for the current request.
+ * Falls back to the framework default (`_id`) when the route hasn't
+ * bound an idField — keeps handlers safe to author without checking
+ * the resource config.
+ */
+declare function getEntityIdField(req: RequestWithExtras): string;
+/**
+ * Read the URL `:id` path param value as the resource handle.
+ * Returns `undefined` when the route has no `:id` segment (collection
+ * routes) — handlers that need the entity must be on row routes.
+ */
+declare function getEntityId(req: RequestWithExtras): string | undefined;
+/**
+ * Compose a `findOne` filter that resolves the current request's
+ * entity, regardless of whether the resource binds `_id` or a custom
+ * field. Idiomatic shape for arc action handlers.
+ *
+ * ```ts
+ * const doc = await Model.findOne(getEntityQuery(req));
+ * ```
+ *
+ * Returns `{}` when the route has no entity context (collection routes
+ * or tests bypassing the router) — caller decides what that means.
+ */
+declare function getEntityQuery(req: RequestWithExtras): Record<string, string>;
+/** The action-target fence's answer and, when it read one, the row (`GET /:id`'s scope). */
+interface ActionTargetCheck {
+  readonly visible: boolean;
+  readonly doc?: unknown;
+}
+/**
+ * The row the action-target fence loaded for this request, so the handler need not read it
+ * again. `undefined` when no fence read happened (untenanted resource, `scope: 'handler'`,
+ * id-less action) — load it yourself then. It is a snapshot taken after the idempotency lock
+ * and before the handler: a guarded write must still carry its precondition in the filter.
+ */
+declare function getActionTarget<TDoc = Record<string, unknown>>(req: {
+  readonly arc?: {
+    readonly actionTarget?: unknown;
+  };
+}): TDoc | undefined;
+//#endregion
 //#region src/core/QueryResolver.d.ts
 interface QueryResolverConfig {
   /** Query parser instance (default: Arc built-in parser) */
@@ -1103,9 +1158,9 @@ declare class QueryResolver {
   /** Sanitize advanced populate options against allowedPopulate */
   private sanitizePopulateOptions;
   /**
-   * Sanitize lookup/join options. Deny-by-default: `allowedLookups` must be
-   * configured for any client-driven lookup to pass; listed collections are
-   * then structurally validated to prevent injection.
+   * Client lookups, deny-by-default. An allowed one is structurally validated, and its joined side
+   * is filtered by the resource's server-owned `LookupPolicy.scope` — the base collection's tenant
+   * filter never reaches a join, and a client-supplied `where` is replaced, never merged.
    */
   private sanitizeLookups;
   /**
@@ -1147,10 +1202,7 @@ declare class QueryResolver {
 //#region src/core/BaseCrudController.d.ts
 /**
  * Framework-agnostic CRUD controller implementing IController.
- *
- * Composes AccessControl, BodySanitizer, and QueryResolver. All shared
- * state and helpers are `protected` so the preset mixins (SoftDelete,
- * Tree, Slug, Bulk) can extend cleanly.
+ * Composes AccessControl, BodySanitizer, and QueryResolver.
  *
  * @template TDoc - The document type.
  * @template TRepository - The repository type (defaults to RepositoryLike).
@@ -1164,29 +1216,14 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected resourceName?: string;
   protected tenantField: string | false;
   protected idField: string;
-  /**
-   * Composable access control (ID filtering, policy checks, org scope, ownership).
-   *
-   * Not `readonly` — `configure()` rebuilds it when the host
-   * supplies tenant/idField/matchesFilter post-construction. Same model as
-   * `queryResolver` after `setQueryParser` shipped in 2.10.9.
-   */
+  /** Alternate unique keys, each with its own access control over the SAME scope. */
+  protected lookupAccess: AccessControl[];
+  private _lookupFields;
+  /** Access control (ID filtering, policy checks, org scope, ownership). */
   accessControl: AccessControl;
-  /**
-   * Composable body sanitization (field permissions, system fields).
-   *
-   * Not `readonly` — `configure()` rebuilds it when the host
-   * supplies schemaOptions/onFieldWriteDenied post-construction.
-   */
+  /** Body sanitization (field permissions, system fields). */
   bodySanitizer: BodySanitizer;
-  /**
-   * Composable query resolution (parsing, pagination, sort, select/populate).
-   *
-   * Not `readonly` — `setQueryParser()` rebuilds this resolver to swap in a
-   * different parser (e.g. mongokit's `QueryParser`). `defineResource` calls
-   * it automatically when a resource supplies both `controller` and
-   * `queryParser`.
-   */
+  /** Query resolution (parsing, pagination, sort, select/populate). */
   queryResolver: QueryResolver;
   protected _matchesFilter?: (item: unknown, filters: Record<string, unknown>) => boolean;
   protected _presetFields: {
@@ -1195,82 +1232,51 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   };
   protected _cacheConfig?: ResourceCacheConfig;
   /**
-   * Retained construction-time values so partial `configure()` rebuilds
-   * (e.g. `configure({ schemaOptions })`) reuse them instead of silently
-   * falling back to the sub-component defaults (`-createdAt` sort,
-   * `reject` write-denial) — `defaultSort: false` matters for kits
-   * without a `createdAt` column, `strip` for legacy write semantics.
+   * Retained so partial `configure()` rebuilds reuse them instead of falling back
+   * to sub-component defaults (`-createdAt` sort breaks kits without that column).
    */
   protected _defaultSort?: string | false;
   protected _onFieldWriteDenied?: FieldWriteDenialPolicy;
   protected _onImmutableWrite?: FieldWriteDenialPolicy;
   /**
-   * Domain commands bound to the write slots (`ResourceWrites`). Consulted at
-   * the PERSISTENCE step only — everything upstream of it (sanitizer, tenant
-   * injection, actor stamp, hook sandwich) runs exactly as it does without
-   * one, which is the entire point of the seam.
+   * Domain commands bound to the write slots. Consulted at the PERSISTENCE step
+   * only — sanitizer, tenant injection, actor stamp, and hooks run unchanged.
    */
   protected _writes?: ResourceWrites;
   /** Transactional write envelope — see `ResourceConfig.transactional`. */
   protected _transactional: boolean;
+  /** Version field under optimistic concurrency — `null` when the resource did not opt in. */
+  protected _versionField: string | null;
   constructor(repository: TRepository, options?: BaseControllerOptions);
   /**
-   * Swap the controller's query parser. Mutates the existing `QueryResolver`
-   * in place via `QueryResolver.setParser()` — the resolver instance stays
-   * referentially stable, and there is no second copy of `defaultSort` /
-   * `tenantField` / `schemaOptions` for the swap to drift away from.
-   *
-   * Closes the v2.10.9 gap where `defineResource({ controller, queryParser })`
-   * forwarded the parser only to auto-constructed controllers. `defineResource`
-   * calls this via duck-typing when both `controller` and `queryParser` are
-   * supplied; controllers that don't implement it are left untouched.
+   * Bind the resource this controller serves — hooks, audit, events and cache key on it.
+   * `defineResource` calls it for a supplied controller; an unset name is assigned, a
+   * different one throws (the controller would run another resource's hooks).
+   */
+  bindResourceName(name: string): void;
+  /**
+   * Swap the controller's query parser. Mutates the existing `QueryResolver` in
+   * place, so the resolver stays referentially stable. `defineResource` calls this
+   * (duck-typed) when a resource supplies both `controller` and `queryParser`.
    */
   setQueryParser(queryParser: QueryParserInterface): void;
   /**
-   * Apply resource-level options to a custom controller AFTER construction.
-   *
-   * Closes the pre-2.15 footgun where `defineResource({ controller, tenantField,
-   * schemaOptions, ... })` warned that the options were "dropped" because the
-   * user-supplied controller never received them. Hosts had to remember to
-   * forward each one through `super(repo, { ... })` — easy to miss, silently
-   * mis-scopes queries when missed.
-   *
-   * `defineResource()` now calls `controller.configure(resolvedOpts)` after
-   * `resolveOrAutoCreateController()` runs. Configure-aware controllers receive
-   * the resolved values; arc skips the dropped-options warn for them.
+   * Apply resource-level options to a controller AFTER construction.
+   * `defineResource()` calls this once after resolving the controller, so custom
+   * controllers receive tenant scope, field rules, sort/limit, cache, and
+   * write-denial policy without forwarding them through `super(repo, { … })`.
    *
-   * Only the keys that affect cross-cutting state (tenant scope, schema/field
-   * rules, sort/limit policy, cache, write-denial policy) are honoured —
-   * `repository` / `resourceName` are constructor-only because they participate
-   * in mixin composition. Each known key rebuilds the affected sub-component
-   * (AccessControl / BodySanitizer / QueryResolver) so referentially-stable
-   * consumers don't see stale state.
-   *
-   * Idempotent: safe to call zero, one, or many times before first request;
-   * arc calls it exactly once.
-   *
-   * Type narrowed to `ControllerConfigurableOptions` — `resourceName` is
-   * construction-only and intentionally excluded so accidental "rename
-   * the resource at runtime" calls fail to typecheck.
+   * Each key rebuilds only the affected sub-component. Idempotent.
+   * `repository` / `resourceName` are construction-only and excluded by type.
    */
   configure(options: ControllerConfigurableOptions): void;
-  /**
-   * Get the tenant field name if multi-tenant scoping is enabled.
-   * Returns `undefined` when `tenantField` is `false`.
-   */
+  /** Tenant field name, or `undefined` when `tenantField` is `false`. */
   protected getTenantField(): string | undefined;
   /**
-   * Build the canonical repo-options bag (tenant scope, audit
-   * attribution, trace correlation) from the Fastify request. Full
-   * contract + rationale on `buildTenantRepoOptions` in
-   * `crud/requestPipeline.ts` — this delegate exists so host overrides
-   * and duck-typed consumers (aggregation router, MCP bridge) keep the
-   * same `protected` entry point.
-   *
-   * Method kept named `tenantRepoOptions` for back-compat with hosts
-   * that spread `...this.tenantRepoOptions(req)` (10+ call sites in
-   * arc, plus host overrides). The bag has always grown over time —
-   * hosts that don't want audit forwarding never read those keys.
+   * Canonical repo-options bag (tenant scope, audit attribution, trace
+   * correlation) — see `buildTenantRepoOptions` in `crud/requestPipeline.ts`.
+   * Kept as a `protected` entry point for host overrides and duck-typed
+   * consumers (aggregation router, MCP bridge).
    */
   protected tenantRepoOptions(req: IRequestContext): AnyRecord;
   /** Extract typed Arc internal metadata from request */
@@ -1285,18 +1291,11 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    */
   protected resolveRepoId(id: string, existing: AnyRecord | null): string;
   /**
-   * Read-side preflight for mutable-target operations (`update`, `delete`).
-   *
-   * Bundles the four steps that every mutation must do before touching the
-   * repo: (1) extract `:id`, (2) fetch under access control + tenant scope,
-   * (3) verify ownership, (4) translate the route id to the repo's primary
-   * key. Returning `{id, existing, repoId}` keeps the call sites a single
-   * line and makes drift between `update` and `delete` structurally
-   * impossible — there is one preflight, one denial-reason mapping, one
-   * ownership check.
+   * Shared preflight for mutations: extract `:id`, fetch under access control +
+   * tenant scope, verify ownership, translate the route id to the repo primary
+   * key. One path so `update` and `delete` cannot drift.
    *
-   * Pass `extraFetchOptions` for callers (e.g. soft-delete restore) that
-   * need to widen the fetch (`{ includeDeleted: true }`).
+   * `extraFetchOptions` widens the fetch (e.g. restore's `{ includeDeleted: true }`).
    */
   protected loadMutableTarget(req: IRequestContext, extraFetchOptions?: AnyRecord): Promise<{
     id: string;
@@ -1304,18 +1303,50 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     repoId: string;
   }>;
   /**
-   * Centralized 404 thrower. Maps the denial reason from `fetchDetailed()`
-   * into a `NotFoundError` so consumers can distinguish "doc doesn't
-   * exist" from "doc filtered by policy/org scope" via the error
-   * `details.code` set by the global error handler.
+   * Whether the target of an id-bound ACTION is a row this request may read — the same
+   * compound filter (id + tenant + `_policyFilters`) `GET /:id` uses. The action router
+   * refuses the action with a 404 when it is not, so a caller can act on a row iff it can
+   * read it. Skips the read when neither tenancy nor a row policy narrows the request.
+   */
+  private buildLookupAccess;
+  /**
+   * THE single-row lookup — `GET /:id` and the action-target fence both read through it.
+   * The primary key first; when it finds nothing (or the id cannot be that key's type), each
+   * `lookupFields` key in turn, under the same tenant and row policy.
+   */
+  protected fetchByAnyKey(id: string, req: IRequestContext, options: QueryOptions | undefined): Promise<{
+    doc: TDoc | null;
+    reason: FetchDenialReason | null;
+  }>;
+  /** Whether {@link isActionTargetVisible} can answer — it reads through the repository. */
+  canFenceActionTargets(): boolean;
+  isActionTargetVisible(req: IRequestContext, id: string): Promise<boolean>;
+  /**
+   * The fence's answer plus the row it read (absent when the resource has no row scope, so
+   * nothing was read). The router hands the row to the handler as `getActionTarget(req)`.
+   */
+  loadActionTarget(req: IRequestContext, id: string): Promise<ActionTargetCheck>;
+  /** `ETag: "<version>"` for a versioned document under optimistic concurrency. */
+  protected etagHeaders(doc: unknown): Record<string, string> | undefined;
+  /**
+   * The version an update must apply at. `If-Match` must name the CURRENT version or the
+   * request fails 412 before anything is written; without it (or with `*`) the write is a CAS
+   * on the version just loaded, so a concurrent write in between is a 409, never overwritten.
+   */
+  protected expectedVersion(req: IRequestContext, existing: unknown): {
+    version?: number;
+    fromClient: boolean;
+  };
+  /**
+   * 404 thrower. Maps the `fetchDetailed()` denial reason into `details.code` so
+   * "doesn't exist" is distinguishable from "filtered by policy/org scope".
    */
   protected throwNotFound(reason?: FetchDenialReason | null): never;
   /** Resolve cache config for a specific operation, merging per-op overrides */
   protected resolveCacheConfig(operation: "list" | "byId"): QueryCacheConfig | null;
   /**
-   * Extract user/org IDs from request for cache key scoping.
-   * Only includes orgId when the resource uses tenant-scoped data (tenantField is set).
-   * Universal resources (tenantField: false) get shared cache keys.
+   * User/org IDs for cache key scoping. orgId is included only when `tenantField`
+   * is set; universal resources share cache keys.
    */
   protected cacheScope(req: IRequestContext): {
     userId?: string;
@@ -1325,20 +1356,13 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected cacheResponse<T>(data: T, cacheStatus: CacheStatus): IControllerResponse<T>;
   /** Required route-id helper shared by get/update/delete. Throws on missing id. */
   protected requireIdParam(req: IRequestContext): string;
-  /**
-   * Normalizes `repo.exists()` return shapes across adapters. Per
-   * StandardRepo's contract, `exists` may return `boolean`, `{ _id }`,
-   * or `null` — every truthy non-null shape collapses to `true`.
-   */
+  /** Normalizes `repo.exists()` (`boolean | { _id } | null`) to a boolean. */
   protected isExistsTruthy(result: unknown): boolean;
   /** Assemble the per-request hook context from the protected accessors. */
   private hookOpContext;
   /**
-   * Run `executeBefore` then `executeAround` (or just the executor if no
-   * hooks are wired). Returns the around-phase result directly. Throws an
-   * `ArcError` (status 400, code `BEFORE_<OP>_HOOK_ERROR`) when the
-   * before-hook fails. Full contract on `executeHookedOp` in
-   * `crud/requestPipeline.ts`.
+   * Run before + around hooks (or just the executor if none are wired) and
+   * return the result. A failing before-hook throws 400 `BEFORE_<OP>_HOOK_ERROR`.
    */
   protected runHookedOpUntilResult<TInput, TResult>(req: IRequestContext, args: {
     op: "create" | "update" | "delete";
@@ -1348,14 +1372,10 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   }, executor: (processed: TInput) => Promise<TResult>): Promise<TResult>;
   /**
    * Run a write's PERSISTENCE step, transactionally when the resource asked.
-   *
-   * Plain mode hands `fn` the live repository. Transactional mode runs it
-   * through repo-core's `retryingTransaction`: the callback receives the
-   * TX-BOUND repository (so declared verbs and repository calls join the same
-   * transaction), transient conflicts re-run `fn` with jittered bounded
-   * backoff, everything else — including `VersionConflictError` — surfaces
-   * once. Hooks stay OUTSIDE: before/around ran already and must not re-run;
-   * after-hooks run post-commit, which they already do by running after this.
+   * Transactional mode uses `retryingTransaction`: `fn` gets the TX-BOUND repo and
+   * re-runs on transient conflicts; anything else (incl. `VersionConflictError`)
+   * surfaces once. Hooks stay OUTSIDE so before/around never re-run and after
+   * runs post-commit.
    */
   protected runWritePersistence<T>(fn: (repo: TRepository, uow?: TransactionHandle) => Promise<T>): Promise<T>;
   /** Assemble the `WriteContext` a `create` verb receives. */
@@ -1363,43 +1383,26 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /**
    * Assemble the `MutationWriteContext` an `update` / `delete` verb receives.
    *
-   * `existing` is the document arc ALREADY loaded to run its permission and
-   * tenant checks — `loadMutableTarget` throws before any verb runs when it
-   * cannot produce one, which is why the context types it required. Handing
-   * it over rather than letting the verb re-fetch is deliberate: a second
-   * read can observe a different document than the one the request was
-   * authorised against.
-   *
-   * `id` is the REPOSITORY PRIMARY KEY (`repoId`), never the raw route param —
-   * see the note on `MutationWriteContext.id`. Callers pass `resolveRepoId`'s
-   * output.
+   * `existing` is the document the request was AUTHORISED against — handed over
+   * so the verb does not re-fetch and possibly observe a different document.
+   * `id` is the REPOSITORY PRIMARY KEY (`resolveRepoId` output), never the route param.
    */
   protected mutationWriteContext(req: IRequestContext, id: string, existing: unknown, repo?: TRepository, uow?: TransactionHandle): MutationWriteContext;
   /**
-   * Run `executeAfter` for the given op + data. No-op when hooks aren't
-   * wired or `resourceName` isn't set. Caller passes the data shape it
-   * wants downstream after-handlers to receive — typically the result for
-   * create/update, the original input (`existing`) for delete.
+   * Run after-hooks for `op`. No-op without hooks or `resourceName`. `data` is the
+   * result for create/update, `existing` for delete.
    */
   protected runAfterHook(req: IRequestContext, op: "create" | "update" | "delete" | "list" | "read", data: AnyRecord, meta?: Record<string, unknown>): Promise<void>;
   /**
-   * Per-instance single-flight for cache fills — concurrent requests for
-   * the SAME cache key coalesce onto one repository query instead of each
-   * issuing its own (a popular entry expiring under 1,000 concurrent
-   * readers must produce 1 DB query, not 1,000). Keys already encode the
-   * resolved query + user/org scope + resource version, so coalescing can
-   * never cross tenants, scopes, or invalidation generations. Per-process
-   * by design; distributed refresh leases are a store-level concern
-   * (planned with the repo-core CacheEngine façade, which ships
-   * single-flight natively).
+   * Per-process single-flight for cache fills: concurrent requests for the SAME
+   * key coalesce onto one repository query. Keys encode query + user/org scope +
+   * resource version, so coalescing never crosses tenants or invalidation generations.
    */
   private readonly inFlightCacheFills;
   private cacheSingleFlight;
   /**
-   * Register a background SWR refresh for `key` unless one is already in
-   * flight. Registration is SYNCHRONOUS (before the deferred tick) so a
-   * burst of stale readers arriving in the same tick schedules exactly one
-   * revalidation.
+   * Register a background SWR refresh for `key` unless one is in flight.
+   * Registration is SYNCHRONOUS so a same-tick burst of stale readers schedules one.
    */
   private scheduleCacheRefresh;
   /** Cached `list()` flow with SWR semantics. Returns null when cache is disabled. */
@@ -1408,19 +1411,14 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   protected withGetCache(req: IRequestContext, id: string, options: ControllerQueryOptions): Promise<IControllerResponse<TDoc> | null>;
   list(req: IRequestContext): Promise<IControllerResponse<ListResult<TDoc>>>;
   /**
-   * Resource-dispatch verbs router. Returns `null` when the request is
-   * a regular list query, otherwise returns the dispatch promise.
-   *
-   * Verbs (mutually exclusive — first match wins):
+   * Resource-dispatch verbs router; `null` for a regular list query.
+   * First match wins:
    *   - `?_count=true` → `{ count: number }` via `repo.count()`
    *   - `?_distinct=field` → `unknown[]` via `repo.distinct(field)`
    *   - `?_exists=true` → `{ exists: boolean }` via `repo.exists()`
    *
-   * All verbs share the resolved filter (parsed query + policy filters
-   * + tenant scope). Adapters that don't ship the underlying repo
-   * method get a `501` so failures surface loudly instead of falling
-   * back to a full table scan. Matching + repo invocation live in
-   * `crud/resourceVerbs.ts`.
+   * All share the resolved filter (query + policy + tenant scope). A missing repo
+   * method is a `501`, never a fallback to a full scan.
    */
   protected dispatchResourceVerb(req: IRequestContext): Promise<IControllerResponse<unknown>> | null;
   /** Resolve filter + tenant/audit options for a dispatch verb. */
@@ -1438,13 +1436,8 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     exists: boolean;
   }>>;
   /**
-   * True when `field` is safe to expose via `_distinct`.
-   *
-   * Read-side gate only — only `hidden: true` blocks. `systemManaged`
-   * is a *write* rule (clients can't PATCH the value); the field is
-   * still in every list response, so blocking `_distinct` adds nothing
-   * but inconvenience. See `core/fieldRulePredicates.ts` for the
-   * canonical predicate shared with `QueryResolver`.
+   * True when `field` is safe to expose via `_distinct`. Only `hidden: true`
+   * blocks — `systemManaged` is a write rule and the field is already readable.
    */
   protected isFieldExposedForRead(field: string): boolean;
   /** Execute list query through hooks (extracted for cache revalidation) */
@@ -1467,7 +1460,7 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
 //#region src/core/mixins/bulk.d.ts
 /** Public surface contributed by BulkMixin. */
 interface BulkExt {
-  bulkCreate(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
+  bulkCreate(req: IRequestContext): Promise<IControllerResponse<object[]>>;
   bulkUpdate(req: IRequestContext): Promise<IControllerResponse<{
     matchedCount: number;
     modifiedCount: number;
@@ -1476,69 +1469,42 @@ interface BulkExt {
     deletedCount: number;
   }>>;
 }
-declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
+declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
 //#endregion
 //#region src/core/mixins/slug.d.ts
 /** Public surface contributed by SlugMixin. */
 interface SlugExt {
-  getBySlug(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
+  getBySlug(req: IRequestContext): Promise<IControllerResponse<object>>;
 }
-declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
+declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
 //#endregion
 //#region src/core/mixins/tree.d.ts
 /** Public surface contributed by TreeMixin. */
 interface TreeExt {
-  getTree(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
-  getChildren(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
+  getTree(req: IRequestContext): Promise<IControllerResponse<object[]>>;
+  getChildren(req: IRequestContext): Promise<IControllerResponse<object[]>>;
 }
-declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
+declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
 //#endregion
 //#region src/core/mixins/softDelete.d.ts
 /** Public surface contributed by SoftDeleteMixin. */
 interface SoftDeleteExt {
-  getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<AnyRecord>>>;
-  restore(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
+  getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<object>>>;
+  restore(req: IRequestContext): Promise<IControllerResponse<object>>;
 }
-declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
+declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController<object>>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
 //#endregion
 //#region src/core/BaseController.d.ts
-/**
- * The `Arc*Result` types above stay: `src/index.ts` re-exports them from THIS
- * path. `BaseCrudController` and the four mixins (+ their `*Ext` types) were
- * also re-exported here and are not, as of 2.37.1 — `core/index.ts` takes them
- * straight from `./BaseCrudController.js` and `./mixins/*.js`, so this file's
- * copies had no importer. Two public paths to one symbol is a drift seam, not
- * convenience: composition belongs to `core/index.ts`, and this module is the
- * composed `BaseController` itself.
- */
 /**
  * Fully-composed controller shape: all CRUD methods + every preset method
  * (SoftDelete / Tree / Slug / Bulk) typed over the caller-supplied `TDoc`.
  *
- * Composes `BaseCrudController` (list/get/create/update/delete) → `BulkMixin`
- * (bulk*) → `SlugMixin` (getBySlug) → `TreeMixin` (getTree/getChildren) →
- * `SoftDeleteMixin` (getDeleted/restore). CRUD-only hosts extend
- * `BaseCrudController` for a smaller surface; others compose mixins by hand.
- *
- * DECLARATION MERGING, not a generic mixin chain: TypeScript cannot thread one
- * `TDoc` through four chained mixin factories without losing the
- * `extends Constructor<Base>` constraint. So the runtime pins the chain base to
- * `AnyRecord` while the TYPE surface threads `TDoc`, and merging bridges them.
- *
- * `TDoc extends AnyRecord` is LOAD-BEARING: inherited methods return
- * `ListResult<AnyRecord>` and the merged interface returns `ListResult<TDoc>`,
- * so TS's derived-assignable-to-base check needs the bound. Without it the
- * class declaration fails with `Type 'TDoc[]' is not assignable to type
- * 'AnyRecord[]'`. Hosts pick one of:
- *   (a) drop the generic — lose return narrowing;
- *   (b) `interface IUser extends AnyRecord` — preferred when you own the type;
- *   (c) `ArcListResult<typeof this>` etc. when overriding — reads the return
- *       type off the class, so the bound never applies.
- *
- * COST: every `TDoc`-narrowed method is redeclared on the interface, so a new
- * mixin method must be added here too.
+ * DECLARATION MERGING, not a generic mixin chain: chained mixin factories cannot thread one
+ * `TDoc`, so the runtime chain is instantiated over `object` and the TYPE surface threads `TDoc`.
+ * Any `TDoc extends object` works — an interface-typed document needs no index signature.
+ * A new mixin method must be redeclared here too.
  */
-interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> {
+interface BaseController<TDoc extends object = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> {
   accessControl: AccessControl;
   bodySanitizer: BodySanitizer;
   queryResolver: QueryResolver;
@@ -1567,14 +1533,14 @@ interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extend
     deletedCount: number;
   }>>;
 }
-declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
+declare const BaseController_base: {
+  new (repository: RepositoryLike, options?: BaseControllerOptions): BaseCrudController<object, RepositoryLike>;
+} & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
 /**
  * Fully-composed controller: `BaseCrudController` + SoftDelete + Tree +
- * Slug + Bulk. Drop-in replacement for the pre-2.11 god class. The
- * companion interface above gives every method full generic precision
- * on `TDoc` via declaration merging.
+ * Slug + Bulk. The companion interface above types every method over `TDoc`.
  */
-declare class BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> extends BaseController_base {
+declare class BaseController<TDoc extends object = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> extends BaseController_base {
   readonly _phantom?: [TDoc, _TRepository];
 }
 //#endregion
@@ -1924,6 +1890,9 @@ interface RouteDefinition {
    * Accepts a controller-method NAME as well, same as {@link handler} — the
    * lookup is identical and only the calling convention differs, so a
    * Fastify-native controller method stays reachable by name.
+   *
+   * An async raw handler that calls `reply.send()` must `return reply` (as `handleRaw`
+   * does): resolving `undefined` while an async `preSerialization` hook runs sends an empty body.
    */
   readonly rawHandler?: string | RawRouteHandler;
   /** Logical operation name (pipeline keys, MCP tool naming). */
@@ -1941,8 +1910,8 @@ interface RouteDefinition {
   /**
    * Opt this custom route into the multiTenant preset's tenant scoping.
    *
-   * When `true` AND the resource declares `multiTenantPreset` (or
-   * `flexibleMultiTenantPreset`), arc prepends the preset's tenant
+   * When `true` AND the resource declares `multiTenantPreset`, arc
+   * prepends the preset's tenant
    * filter + injection middleware to this route's chain — the same
    * pair `update` gets. The handler can then read the resolved tenant
    * via `getOrgId(req.scope)` / `req._tenantFields` (or, for write
@@ -2139,6 +2108,28 @@ interface ActionDefinition {
    * resource root and drops `id` from the MCP tool's input shape.
    */
   readonly id?: boolean;
+  /**
+   * Where an id-bound action's TARGET is authorized. Default: arc loads it through the
+   * resource's access control (id + tenant + row policy, as `GET /:id` does) and answers
+   * 404 when the caller could not read it. `{ scope: 'handler', reason }` hands that check
+   * to the handler — for a target that is deliberately not a row of this resource's tenant.
+   */
+  readonly target?: {
+    readonly scope: "handler";
+    readonly reason: string;
+  };
+  /**
+   * `{ required: true }`: a call of THIS action without an idempotency key is refused (400
+   * `arc.idempotency_key_required`) and a keyed one is deduplicated; other actions on the
+   * same mount stay optional. Needs `idempotencyPlugin` enabled.
+   */
+  readonly idempotency?: {
+    readonly required: boolean;
+    /** `'handler'`: the handler deduplicates; arc only demands and exposes the key. Needs `owner`. */
+    readonly dedup?: "handler";
+    /** The runner that owns at-most-once under `dedup: 'handler'`. */
+    readonly owner?: string;
+  };
   /**
    * MCP tool generation:
    * - omitted/true: auto-generate
@@ -2817,6 +2808,16 @@ interface FieldRule$1 {
 }
 //#endregion
 //#region src/types/resource/schemas.d.ts
+/**
+ * One client-requestable join. The base collection's tenant filter never reaches a joined
+ * collection, so its scope is REQUIRED and is always the server's — a client `where` is discarded.
+ */
+interface LookupPolicy {
+  /** Filter on the JOINED rows (tenant, soft-delete, visibility). `{}` only for a genuinely global collection. */
+  scope: (ctx: {
+    scope: RequestScope | undefined;
+  }) => Record<string, unknown>;
+}
 /**
  * Schema-shaping options for a resource.
  *
@@ -2913,11 +2914,10 @@ interface RouteSchemaOptions extends SchemaBuilderOptions {
      */
     allowedPopulate?: string[];
     /**
-     * Lookup-collection whitelist for `QueryResolver.sanitizeLookups`.
-     * When set, only the listed collections may be `$lookup`'d. Omit to
-     * disable the whitelist (kit-level rules still apply).
+     * Client-requestable joins, keyed by collection, each with the SERVER-owned scope of its
+     * joined side. Omit to deny every client lookup (the default).
      */
-    allowedLookups?: string[];
+    allowedLookups?: Readonly<Record<string, LookupPolicy>>;
   };
 }
 /**
@@ -3070,6 +3070,14 @@ interface ResolvedTenantPurge {
 }
 //#endregion
 //#region src/types/resource/config.d.ts
+/**
+ * Built-in write routes whose retry must not execute twice: each listed op answers a
+ * keyless call with 400 `arc.idempotency_key_required` and dedupes a keyed one. Needs
+ * `idempotencyPlugin` enabled; boot refuses an op that is not mounted.
+ */
+interface ResourceIdempotencyConfig {
+  readonly required: readonly ("create" | "update" | "delete")[];
+}
 /** Standard controller type alias for CRUD operations. */
 type CrudController<TDoc> = IController<TDoc>;
 /** Resource-level permissions — only `PermissionCheck` functions allowed. */
@@ -3140,6 +3148,16 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * that silently degrades is the defect, not a mode.
    */
   transactional?: boolean;
+  /**
+   * Optimistic concurrency over HTTP (RFC 9110). Reads send `ETag: "<version>"`; an update
+   * with `If-Match` applies only at that version (else 412), and EVERY update is a CAS write on
+   * the version it loaded (else 409) — so the version, and the ETag, change on every write.
+   * `versionField` defaults to `'__v'`. Boot-fatal on a repository without the
+   * `optimisticConcurrency` capability.
+   */
+  concurrency?: {
+    versionField?: string;
+  };
   queryParser?: unknown;
   permissions?: ResourcePermissions;
   schemaOptions?: RouteSchemaOptions;
@@ -3382,6 +3400,11 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * ```
    */
   idField?: (keyof TDoc & string) | (string & {});
+  /**
+   * Further unique keys `GET /:id` and an action's `:id` accept, tried in order after `idField`
+   * — a business number beside `_id`. Same tenant and row-policy scope as the primary lookup.
+   */
+  lookupFields?: readonly ((keyof TDoc & string) | (string & {}))[];
   /** For grouping in registry */
   module?: string;
   /** Domain events */
@@ -3513,6 +3536,8 @@ interface ResourceConfig<TDoc = AnyRecord> {
    * registered. Set to `false` to disable for this resource.
    */
   rateLimit?: RateLimitConfig | false;
+  /** Idempotency-key fence for the built-in write routes. See `ResourceIdempotencyConfig`. */
+  idempotency?: ResourceIdempotencyConfig;
   /**
    * QueryCache configuration for this resource. Enables
    * stale-while-revalidate and auto-invalidation. Requires
@@ -3656,7 +3681,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
   readonly permissions: ResourcePermissions;
   readonly routes: readonly RouteDefinition[];
   readonly middlewares: MiddlewareConfig;
-  readonly routeGuards?: RouteHandlerMethod$1[];
+  readonly routeGuards?: RouteHandlerMethod[];
   readonly disableDefaultRoutes: boolean;
   readonly disabledRoutes: readonly CrudRouteKey[];
   readonly actions?: ActionsMap;
@@ -3664,6 +3689,8 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
   readonly aggregations?: AggregationsMap;
   readonly events: Record<string, EventDefinition>;
   readonly rateLimit?: RateLimitConfig | false;
+  readonly idempotency?: ResourceIdempotencyConfig;
+  readonly lookupFields?: readonly string[];
   readonly audit?: boolean | {
     operations?: ("create" | "update" | "delete")[];
   };
@@ -3699,6 +3726,12 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
    */
   readonly resolvedTenantPurge: ResolvedTenantPurge;
   readonly idField?: string;
+  /**
+   * The optimistic-concurrency version field, resolved (`concurrency: {}` → `'__v'`);
+   * `undefined` when the resource did not opt in. Published in the resource manifest
+   * so a client sends `If-Match` without repeating the field name.
+   */
+  readonly versionField?: string;
   readonly queryParser?: QueryParserInterface;
   readonly _appliedPresets: string[];
   _pendingHooks: Array<{
@@ -3800,7 +3833,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
 //#region src/core/defineResource.d.ts
 /**
  * `TDoc` is **unconstrained** at this layer. The previous `TDoc
- * extends AnyRecord` bound leaked out of `BaseController`'s
+ * extends object` bound leaked out of `BaseController`'s
  * mixin-composition requirement into every host's adapter boundary:
  * Mongoose's `HydratedDocument<T>`, Prisma's generated row types,
  * and any domain interface without an explicit index signature all
@@ -3811,7 +3844,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
  * known envelope fields.
  *
  * The cast moved inside `resolveOrAutoCreateController` where
- * `BaseController<TDoc extends AnyRecord>` actually requires it.
+ * `BaseController<TDoc extends object>` actually requires it.
  * One internal boundary cast replaces N host-side casts.
  */
 /**
@@ -3864,8 +3897,19 @@ declare class ResourceRegistry {
    * runtime-only handle is still reachable.
    */
   private _adapters;
+  /** The mounted definitions, in registration order — see `getDefinitions`. */
+  private _definitions;
   private _frozen;
   constructor();
+  /**
+   * The live `ResourceDefinition`s that mounted, in registration order — what a host hands to
+   * `mcpPlugin({ resources })` or a docs generator instead of re-collecting them. A resource
+   * declaring `skipRegistry` (incl. `customRoutesOnly`) opted out and is absent. Fresh array per call.
+   * One composed module's share: `getModuleResources(fastify, name)` from `@classytic/arc/factory`.
+   */
+  getDefinitions(): ResourceDefinition<unknown>[];
+  /** The live definition registered under `name`, or `undefined`. */
+  getDefinition(name: string): ResourceDefinition<unknown> | undefined;
   /**
    * Get the live `DataAdapter` for a registered resource — the handle whose
    * `.repository` cascade / cleanup helpers actually call. Returns `undefined`
@@ -3874,8 +3918,13 @@ declare class ResourceRegistry {
    * consumers cast to their kit's adapter type at the use site.
    */
   getAdapter<T = unknown>(name: string): T | undefined;
+  /** Set only by an explicit `strictResources: false`: a duplicate name keeps the FIRST entry. */
+  private _tolerateDuplicates;
+  /** Accept a duplicate resource name (the host opted out of `strictResources`; it was warned). */
+  tolerateDuplicateNames(): void;
   /**
-   * Register a resource
+   * Register a resource. A duplicate name throws — a resource missing from the registry still
+   * serves traffic but vanishes from introspection, the permission matrix and MCP.
    */
   register(resource: ResourceDefinition<unknown>, options?: RegisterOptions): this;
   /**
@@ -3955,10 +4004,6 @@ declare class ResourceRegistry {
    * iterate over a defunct registry entry. Clear both halves together.
    */
   reset(): void;
-  /** @internal Alias for unfreeze() */
-  _unfreeze(): void;
-  /** @internal Alias for reset() */
-  _clear(): void;
   /**
    * Group by key
    */
@@ -3998,6 +4043,8 @@ interface RequestWithExtras extends FastifyRequest {
      * can still read the entity handle.
      */
     entityId?: string;
+    /** The id-bound action's target as the fence read it — read via `getActionTarget(req)`. */
+    actionTarget?: unknown;
   };
   context?: Record<string, unknown>;
   _policyFilters?: Record<string, unknown>;
@@ -4132,6 +4179,8 @@ interface CrudRouterOptions {
    * registered. Set to `false` to disable for this resource.
    */
   rateLimit?: RateLimitConfig | false;
+  /** Idempotency-key fence for the built-in write routes. */
+  idempotency?: ResourceIdempotencyConfig;
   /** PreHandler guards applied to every route (CRUD + custom + preset). */
   routeGuards?: RouteHandlerMethod[];
   /**
@@ -4167,6 +4216,8 @@ interface RequestContext {
  * them without `as AnyRecord` casts.
  */
 interface ArcInternalMetadata extends RequestContext {
+  /** Trusted resolved tenant dimensions forwarded across transports. */
+  _tenantFields?: Record<string, unknown>;
   /** Policy filters from permission middleware */
   _policyFilters?: Record<string, unknown>;
   /** Request scope from scope resolution */
@@ -4241,6 +4292,8 @@ interface LookupOption {
   single?: boolean;
   /** Field selection on the joined collection */
   select?: string | Record<string, 0 | 1>;
+  /** Filter on the joined rows — set by arc from the resource's `LookupPolicy`, never by the client. */
+  where?: Record<string, unknown>;
 }
 /**
  * Mongoose-compatible populate option for advanced field selection.
@@ -4375,6 +4428,12 @@ interface ResourceMetadata {
     capability?: string;
     raw?: boolean;
     schema?: unknown;
+    /** The route's `config.idempotency` — `required: true` means a key is mandatory. */
+    idempotency?: {
+      required?: boolean;
+      dedup?: "handler";
+      owner?: string;
+    };
   }>;
   routes: Array<{
     method: string;
@@ -4400,6 +4459,10 @@ interface RegistryEntry extends ResourceMetadata {
    * without re-reading the resource definition.
    */
   tenantField?: string | false;
+  /** The resource's primary key field (`_id` when unset). */
+  idField?: string;
+  /** Resolved optimistic-concurrency version field — set only under `concurrency`. */
+  versionField?: string;
   /**
    * Resolved tenant-purge strategy — what arc actually runs when
    * `cascadeDeleteForOrganization` fires for this resource. Computed
@@ -4436,6 +4499,8 @@ interface RegistryEntry extends ResourceMetadata {
   disabledRoutes?: string[];
   /** Rate limit config */
   rateLimit?: RateLimitConfig | false;
+  /** Built-in write ops that require an idempotency key (`defineResource({ idempotency })`). */
+  idempotency?: ResourceIdempotencyConfig;
   /** Per-resource audit opt-in flag (read by `auditPlugin` perResource mode) */
   audit?: boolean | {
     operations?: ("create" | "update" | "delete")[];
@@ -4461,6 +4526,12 @@ interface RegistryEntry extends ResourceMetadata {
      * reading the action definition itself.
      */
     readonly id?: boolean;
+    /** `{ required: true }` — a call of this action requires an idempotency key. */
+    readonly idempotency?: {
+      readonly required: boolean;
+      readonly dedup?: "handler";
+      readonly owner?: string;
+    };
     /** MCP tool generation flag — `false` to skip, object for overrides */
     readonly mcp?: boolean | {
       readonly description?: string;
@@ -4584,26 +4655,5 @@ type InferDocType<T> = T extends DataAdapter<infer D> ? D : T extends ResourceCo
  */
 type InferAdapterDoc<A> = A extends DataAdapter<infer D> ? D : unknown;
 type InferResourceDoc<T> = T extends ResourceConfig<infer D> ? D : never;
-type TypedResourceConfig<TDoc> = ResourceConfig<TDoc>;
-type TypedController<TDoc> = IController<TDoc>;
-type TypedRepository<TDoc> = StandardRepo<TDoc>;
-//#endregion
-//#region src/types/validation.d.ts
-/**
- * Validation result types — produced by `validateResourceConfig` and
- * consumed by `assertValidConfig` / `formatValidationErrors`.
- */
-interface ConfigError {
-  field: string;
-  message: string;
-  code?: string;
-}
-interface ValidationResult {
-  valid: boolean;
-  errors: ConfigError[];
-}
-interface ValidateOptions {
-  strict?: boolean;
-}
 //#endregion
-export { OpenApiSchemas as $, AccessControlConfig as $t, RequestIdOptions as A, WriteVerbKey as An, RouteDefinition as At, defineResource as B, BaseController as Bt, RequestContext as C, ControllerConstructionOptions as Cn, PipelineStep as Ct, HealthCheck as D, MutationWriteContext as Dn, ActionEntry as Dt, GracefulShutdownOptions as E, BodySanitizerConfig as En, ActionDefinition as Et, FastifyWithDecorators as F, IControllerResponse as Fn, AuthPluginOptions as Ft, OnTenantDeleteConfig as G, SlugExt as Gt, CrudController as H, SoftDeleteMixin as Ht, MiddlewareHandler as I, IRequestContext as In, Authenticator as It, PresetHook as J, BulkMixin as Jt, ResolvedTenantPurge as K, SlugMixin as Kt, RequestWithExtras as L, RawRouteHandler as Ln, AuthenticatorContext as Lt, EventsDecorator as M, ControllerLike as Mn, RouteMethod as Mt, FastifyRequestExtras as N, FastifyHandler as Nn, RateLimitConfig as Nt, HealthOptions as O, ResourceWrites as On, ActionHandlerFn as Ot, FastifyWithAuth as P, IController as Pn, AuthHelpers as Pt, MiddlewareConfig as Q, AccessControl as Qt, RegisterOptions as R, RouteHandler as Rn, JwtContext as Rt, QueryParserInterface as S, ControllerConfigurableOptions as Sn, PipelineContext as St, CrudRouterOptions as T, BodySanitizer as Tn, ResourceCacheConfig as Tt, ResourceConfig as U, TreeExt as Ut, ResourceDefinition as V, SoftDeleteExt as Vt, ResourcePermissions as W, TreeMixin as Wt, CrudRouteKey as X, QueryResolver as Xt, PresetResult as Y, BaseCrudController as Yt, CrudSchemas as Z, QueryResolverConfig as Zt, ControllerQueryOptions as _, ArcDeleteResult as _n, Guard as _t, InferAdapterDoc as a, HookRegistration as an, ResourceExtensions as at, ParsedQuery as b, ArcUpdateResult as bn, OperationFilter as bt, TypedController as c, afterCreate as cn, AggMeasureShorthand as ct, PaginationResult as d, beforeCreate as dn, AggregationDateRangeRequirement as dt, DefineHookOptions as en, RouteSchemaOptions as et, IntrospectionData as f, beforeDelete as fn, AggregationIndexHint as ft, ArcInternalMetadata as g, ArcCreateResult as gn, AggregationsMap as gt, ResourceMetadata as h, defineHook as hn, AggregationRateLimit as ht, ValidationResult as i, HookPhase as in, ResourceHooks as it, ArcDecorator as j, ControllerHandler as jn, RouteMcpConfig as jt, IntrospectionPluginOptions as k, WriteContext as kn, ActionsMap as kt, TypedRepository as l, afterDelete as ln, AggregationCacheConfig as lt, RegistryStats as m, createHookSystem as mn, AggregationMaterializedResult as mt, ConfigError as n, HookHandler as nn, FieldRule$1 as nt, InferDocType as o, HookSystem as on, EventDefinition as ot, RegistryEntry as p, beforeUpdate as pn, AggregationMaterializedContext as pt, PresetFunction as q, BulkExt as qt, ValidateOptions as r, HookOperation as rn, ResourceHookContext as rt, InferResourceDoc as s, HookSystemOptions as sn, AggMeasureInput as st, RouteHandlerMethod$1 as t, HookContext as tn, ArcFieldRule as tt, TypedResourceConfig as u, afterUpdate as un, AggregationConfig as ut, LookupOption as v, ArcGetResult as vn, Interceptor as vt, ServiceContext as w, ListResult as wn, Transform as wt, PopulateOption as x, BaseControllerOptions as xn, PipelineConfig as xt, OwnershipCheck as y, ArcListResult as yn, NextFunction as yt, ResourceRegistry as z, ServerAccessor as zn, TokenPair as zt };
+export { ResourceHookContext as $, AccessControl as $t, RequestWithExtras as A, MixinConstructor as An, AuthHelpers as At, OnTenantDeleteConfig as B, IController as Bn, TreeMixin as Bt, RequestIdOptions as C, ArcGetResult as Cn, ActionEntry as Ct, FastifyWithAuth as D, ControllerConfigurableOptions as Dn, RouteMcpConfig as Dt, FastifyRequestExtras as E, BaseControllerOptions as En, RouteDefinition as Et, ResourceDefinition as F, WriteContext as Fn, TokenPair as Ft, CrudRouteKey as G, ServerAccessor as Gn, BaseCrudController as Gt, PresetFunction as H, IRequestContext as Hn, SlugMixin as Ht, CrudController as I, WriteVerbKey as In, BaseController as It, MiddlewareConfig as J, ActionTargetCheck as Jt, CrudSchemas as K, QueryResolver as Kt, ResourceConfig as L, ControllerHandler as Ln, SoftDeleteExt as Lt, ResourceRegistry as M, BodySanitizerConfig as Mn, Authenticator as Mt, RouteRow as N, MutationWriteContext as Nn, AuthenticatorContext as Nt, FastifyWithDecorators as O, ControllerConstructionOptions as On, RouteMethod as Ot, defineResource as P, ResourceWrites as Pn, JwtContext as Pt, FieldRule$1 as Q, getEntityQuery as Qt, ResourceIdempotencyConfig as R, ControllerLike as Rn, SoftDeleteMixin as Rt, IntrospectionPluginOptions as S, ArcDeleteResult as Sn, ActionDefinition as St, EventsDecorator as T, ArcUpdateResult as Tn, ActionsMap as Tt, PresetHook as U, RawRouteHandler as Un, BulkExt as Ut, ResolvedTenantPurge as V, IControllerResponse as Vn, SlugExt as Vt, PresetResult as W, RouteHandler as Wn, BulkMixin as Wt, RouteSchemaOptions as X, getEntityId as Xt, OpenApiSchemas as Y, getActionTarget as Yt, ArcFieldRule as Z, getEntityIdField as Zt, ServiceContext as _, beforeDelete as _n, PipelineConfig as _t, IntrospectionData as a, DefineHookOptions as an, AggregationCacheConfig as at, HealthCheck as b, defineHook as bn, Transform as bt, ResourceMetadata as c, HookOperation as cn, AggregationIndexHint as ct, LookupOption as d, HookSystem as dn, AggregationRateLimit as dt, AccessControlConfig as en, ResourceHooks as et, OwnershipCheck as f, HookSystemOptions as fn, AggregationsMap as ft, RequestContext as g, beforeCreate as gn, OperationFilter as gt, QueryParserInterface as h, afterUpdate as hn, NextFunction as ht, PaginationResult as i, AroundHookHandler as in, AggMeasureShorthand as it, RegisterOptions as j, BodySanitizer as jn, AuthPluginOptions as jt, MiddlewareHandler as k, ListResult as kn, RateLimitConfig as kt, ArcInternalMetadata as l, HookPhase as ln, AggregationMaterializedContext as lt, PopulateOption as m, afterDelete as mn, Interceptor as mt, InferDocType as n, FetchDenialReason as nn, EventDefinition as nt, RegistryEntry as o, HookContext as on, AggregationConfig as ot, ParsedQuery as p, afterCreate as pn, Guard as pt, LookupPolicy as q, QueryResolverConfig as qt, InferResourceDoc as r, FetchResult as rn, AggMeasureInput as rt, RegistryStats as s, HookHandler as sn, AggregationDateRangeRequirement as st, InferAdapterDoc as t, AccessControlRepository as tn, ResourceExtensions as tt, ControllerQueryOptions as u, HookRegistration as un, AggregationMaterializedResult as ut, CrudRouterOptions as v, beforeUpdate as vn, PipelineContext as vt, ArcDecorator as w, ArcListResult as wn, ActionHandlerFn as wt, HealthOptions as x, ArcCreateResult as xn, ResourceCacheConfig as xt, GracefulShutdownOptions as y, createHookSystem as yn, PipelineStep as yt, ResourcePermissions as z, FastifyHandler as zn, TreeExt as zt };