@classytic/arc 2.41.1 → 2.44.0

package/dist/presets/multiTenant.mjs

@@ -1,165 +1,27 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import "../constants-D5Ubn1fe.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CgenB1gv.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import "../constants-B2QHb6u6.mjs";
+import { t as ArcError } from "../errors-CW4anJBy.mjs";
+import { u as getRequestScope } from "../types-fvO6Ovzx.mjs";
+import { i as tagTenantPreparation, t as applyTenantPreparation } from "../tenantPreparation-CBvvAcAj.mjs";
 //#region src/presets/multiTenant.ts
-/**
-* Resolve a single TenantFieldSpec against the current scope.
-* Returns `undefined` if the source value isn't present on the scope.
-*/
-function resolveSpec(scope, spec) {
-	if ("contextKey" in spec) return getScopeContext(scope, spec.contextKey);
-	if (spec.type === "org") return getOrgId(scope);
-	if (spec.type === "team") return getTeamId(scope);
-}
-/**
-* Stash the resolved tenant field map on the request so `BaseController`
-* can forward it to the repository layer as top-level options. Needed by
-* plugin-scoped repos (mongokit's `multiTenantPlugin`) that read tenant
-* from `context.<field>` rather than from filter/query/data stamping.
-*/
-function stashTenantFields(request, resolved) {
-	if (Object.keys(resolved).length === 0) return;
-	const target = request;
-	target._tenantFields = {
-		...target._tenantFields ?? {},
-		...resolved
-	};
-}
-/** Resolve every spec — returns the partial map of fields that have a value. */
-function resolveAll(scope, specs) {
-	const resolved = {};
-	const missing = [];
-	for (const spec of specs) {
-		const value = resolveSpec(scope, spec);
-		if (value !== void 0) resolved[spec.field] = value;
-		else missing.push(spec.field);
-	}
-	return {
-		resolved,
-		missing
+function createTenantMiddleware(specs, mode) {
+	const preparation = {
+		specs,
+		mode
 	};
-}
-/**
-* Create tenant filter middleware (strict).
-* Walks the configured tenant fields and applies all of them in lockstep.
-* Fails closed if any non-elevated caller is missing a required dimension.
-*/
-function createTenantFilter(specs) {
-	return async (request, reply) => {
-		const scope = getRequestScope(request);
-		if (isElevated(scope)) {
-			const { resolved } = resolveAll(scope, specs);
-			if (Object.keys(resolved).length > 0) {
-				request._policyFilters = {
-					...request._policyFilters ?? {},
-					...resolved
-				};
-				stashTenantFields(request, resolved);
-			}
-			return;
-		}
-		if (hasOrgAccess(scope)) {
-			const { resolved, missing } = resolveAll(scope, specs);
-			if (missing.length === 0) {
-				request._policyFilters = {
-					...request._policyFilters ?? {},
-					...resolved
-				};
-				stashTenantFields(request, resolved);
-				return;
-			}
-			reply.code(403).send({
+	const middleware = async (request, reply) => {
+		try {
+			applyTenantPreparation(request, request.body, getRequestScope(request), preparation);
+		} catch (error) {
+			if (!(error instanceof ArcError)) throw error;
+			reply.code(error.status).send({
 				success: false,
-				error: "Forbidden",
-				message: `Tenant context incomplete — missing: ${missing.join(", ")}`
+				error: error.status === 401 ? "Unauthorized" : "Forbidden",
+				message: error.message
 			});
-			return;
 		}
-		if (scope.kind === "public") {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for multi-tenant resources"
-			});
-			return;
-		}
-		reply.code(403).send({
-			success: false,
-			error: "Forbidden",
-			message: "Organization context required for this operation"
-		});
-	};
-}
-/**
-* Create flexible tenant filter middleware (allowPublic).
-* Same policy as the strict variant for authenticated callers, but
-* allows public/unauthenticated requests through without filtering.
-*/
-function createFlexibleTenantFilter(specs) {
-	return async (request, reply) => {
-		const scope = getRequestScope(request);
-		if (isElevated(scope)) {
-			const { resolved } = resolveAll(scope, specs);
-			if (Object.keys(resolved).length > 0) {
-				request._policyFilters = {
-					...request._policyFilters ?? {},
-					...resolved
-				};
-				stashTenantFields(request, resolved);
-			}
-			return;
-		}
-		if (hasOrgAccess(scope)) {
-			const { resolved, missing } = resolveAll(scope, specs);
-			if (missing.length === 0) {
-				request._policyFilters = {
-					...request._policyFilters ?? {},
-					...resolved
-				};
-				stashTenantFields(request, resolved);
-				return;
-			}
-			reply.code(403).send({
-				success: false,
-				error: "Forbidden",
-				message: `Tenant context incomplete — missing: ${missing.join(", ")}`
-			});
-			return;
-		}
-	};
-}
-/**
-* Create tenant injection middleware.
-* Walks the configured tenant fields and writes each into the request body.
-* Fails closed if any required dimension is missing for non-elevated callers.
-*
-* Also stashes the resolved fields on `request._tenantFields` so
-* `BaseController.tenantRepoOptions()` can forward them to the repo layer
-* as top-level options — needed by plugin-scoped repos like mongokit's
-* `multiTenantPlugin`, which reads tenant from `context.<field>` rather
-* than from `data.<field>`. Without this forwarding, multi-field preset
-* writes (update/delete) work only when the plugin's `allowDataInjection`
-* fallback covers the operation's policy key, which is write-only.
-*/
-function createTenantInjection(specs) {
-	return async (request, reply) => {
-		const scope = getRequestScope(request);
-		if (isElevated(scope) && !getOrgId(scope)) return;
-		const { resolved, missing } = resolveAll(scope, specs);
-		if (missing.length > 0) {
-			reply.code(403).send({
-				success: false,
-				error: "Forbidden",
-				message: `Tenant context incomplete — missing: ${missing.join(", ")}`
-			});
-			return;
-		}
-		if (request.body) Object.assign(request.body, resolved);
-		request._tenantFields = {
-			...request._tenantFields ?? {},
-			...resolved
-		};
 	};
+	return tagTenantPreparation(middleware, preparation);
 }
 function multiTenantPreset(options = {}) {
 	const { tenantField, tenantFields, allowPublic = [], crossTenant = [] } = options;
@@ -169,9 +31,9 @@ function multiTenantPreset(options = {}) {
 		type: "org"
 	}];
 	if (specs.length === 0) throw new Error("multiTenantPreset: `tenantFields` must contain at least one entry");
-	const strictTenantFilter = createTenantFilter(specs);
-	const flexibleTenantFilter = createFlexibleTenantFilter(specs);
-	const tenantInjection = createTenantInjection(specs);
+	const strictTenantFilter = createTenantMiddleware(specs, "strict");
+	const flexibleTenantFilter = createTenantMiddleware(specs, "flexible");
+	const tenantInjection = createTenantMiddleware(specs, "inject");
 	const getFilter = (route) => allowPublic.includes(route) ? flexibleTenantFilter : strictTenantFilter;
 	/**
 	* A cross-tenant read MARKS the request rather than simply skipping the filter.
@@ -187,9 +49,7 @@ function multiTenantPreset(options = {}) {
 	* repository layer needs no change of its own — kits already accept `bypassTenant`, which is the
 	* same door elevated cross-tenant reads have always used.
 	*/
-	const markCrossTenantRead = async (request) => {
-		request._crossTenantRead = true;
-	};
+	const markCrossTenantRead = createTenantMiddleware(specs, "crossTenant");
 	const readMiddleware = (route) => crossTenant.includes(route) ? [markCrossTenantRead] : [getFilter(route)];
 	const fieldRules = {};
 	for (const spec of specs) fieldRules[spec.field] = {

package/dist/presets/search.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
-import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-DHbyPo5j.mjs";
+import { l as PermissionCheck } from "../base-CZyixEQR.mjs";
+import { Dt as RouteMcpConfig, Et as RouteDefinition, Ln as ControllerHandler, W as PresetResult } from "../index-WH7xgvxS.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes
@@ -46,7 +46,7 @@ import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt a
  * kit happens to ship these methods, without forcing every repo to declare
  * them.
  */
-interface SearchableRepository {
+export interface SearchableRepository {
   search?(query: unknown, options?: unknown): Promise<unknown>;
   searchSimilar?(query: unknown, options?: unknown): Promise<unknown>;
   embed?(input: unknown): Promise<number[]>;
@@ -56,8 +56,8 @@ interface SearchableRepository {
  * non-raw route handler) and returns either the raw result (wrapped into
  * `{ success: true, data }` by arc) or an explicit `IControllerResponse`.
  */
-type SearchHandler = ControllerHandler;
-interface SearchRouteConfig {
+export type SearchHandler = ControllerHandler;
+export interface SearchRouteConfig {
   /**
    * User-supplied handler. When omitted, the preset auto-synthesises a handler
    * from `options.repository` (calling `repo.search` / `repo.searchSimilar` /
@@ -95,8 +95,8 @@ interface SearchRouteConfig {
  *   - `true`                → mount with defaults, auto-wire from `repository`
  *   - `SearchRouteConfig`   → explicit config (and optional handler override)
  */
-type SearchSection = true | SearchRouteConfig;
-interface SearchPresetOptions {
+export type SearchSection = true | SearchRouteConfig;
+export interface SearchPresetOptions {
   /**
    * Repository exposing `search`/`searchSimilar`/`embed`. When provided,
    * any section without an explicit `handler` is auto-wired to the matching
@@ -135,6 +135,5 @@ interface SearchPresetOptions {
  * The preset itself stays DB-agnostic: nothing is imported from mongokit —
  * it only feature-detects the optional methods on whatever repo you pass.
  */
-declare function searchPreset(options?: SearchPresetOptions): PresetResult;
-//#endregion
-export { SearchHandler, SearchPresetOptions, SearchRouteConfig, SearchSection, SearchableRepository, searchPreset };
+export declare function searchPreset(options?: SearchPresetOptions): PresetResult;
+//#endregion

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-D8TBH44E.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-C5ijIz5Q.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-ZJSPgmT2.mjs → presets-CONf2Qem.mjs}

@@ -1,102 +1,8 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-BH7YU_9O.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CgenB1gv.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-D8TBH44E.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-CW4anJBy.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-fvO6Ovzx.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-C5ijIz5Q.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
-//#region src/presets/ownedByUser.ts
-/**
-* Create ownership check middleware.
-*
-* FAIL-CLOSED: ownership is meaningless without an authenticated identity, so a
-* request with no user (or a user with no id) is DENIED here rather than sliding
-* through with no ownership check installed. Elevated scope (platform admin)
-* bypasses the check by design.
-*/
-function createOwnershipCheck(ownerField, missingOwner) {
-	return async (request, _reply) => {
-		const scope = request.scope ?? PUBLIC_SCOPE;
-		if (isElevated(scope)) return;
-		const user = request.user;
-		if (!user) throw new UnauthorizedError("Authentication required for this operation");
-		const userWithId = user;
-		const userId = userWithId._id ?? userWithId.id;
-		if (!userId) throw new UnauthorizedError("Authenticated identity has no usable id");
-		request._ownershipCheck = {
-			field: ownerField,
-			userId,
-			missingOwner
-		};
-	};
-}
-function ownedByUserPreset(options = {}) {
-	const { ownerField = "userId", missingOwner = "deny" } = options;
-	const ownershipMiddleware = createOwnershipCheck(ownerField, missingOwner);
-	return {
-		name: "ownedByUser",
-		permissions: {
-			update: requireAuth(),
-			delete: requireAuth()
-		},
-		middlewares: {
-			update: [ownershipMiddleware],
-			delete: [ownershipMiddleware]
-		}
-	};
-}
-//#endregion
-//#region src/presets/slugLookup.ts
-/**
-* Slug Lookup Preset
-*
-* Adds a route to get resource by slug.
-*/
-function slugLookupPreset(options = {}) {
-	const { slugField = "slug" } = options;
-	return {
-		name: "slugLookup",
-		routes: (permissions) => [{
-			method: "GET",
-			path: `/slug/:${slugField}`,
-			handler: "getBySlug",
-			summary: "Get by slug",
-			permissions: permissions.get ?? allowPublic(),
-			operation: "getBySlug"
-		}],
-		controllerOptions: { slugField }
-	};
-}
-//#endregion
-//#region src/presets/softDelete.ts
-/**
-* Soft Delete Preset
-*
-* Adds routes for listing deleted items and restoring them.
-* The actual soft-delete behavior (deletedAt field, query filtering)
-* is handled by the repository/adapter layer (e.g., MongoKit's softDelete plugin).
-*/
-function softDeletePreset() {
-	return {
-		name: "softDelete",
-		routes: (permissions) => [{
-			method: "GET",
-			path: "/deleted",
-			handler: "getDeleted",
-			summary: "Get soft-deleted items",
-			permissions: permissions.list ?? requireRoles(["admin"]),
-			operation: "listDeleted",
-			_presetSource: "softDelete"
-		}, {
-			method: "POST",
-			path: "/:id/restore",
-			handler: "restore",
-			summary: "Restore soft-deleted item",
-			permissions: permissions.update ?? requireRoles(["admin"]),
-			operation: "restore",
-			_presetSource: "softDelete"
-		}]
-	};
-}
-//#endregion
 //#region src/presets/audited.ts
 /**
 * Audited preset - adds createdBy/updatedBy tracking
@@ -236,6 +142,100 @@ function bulkPreset(opts) {
 	};
 }
 //#endregion
+//#region src/presets/ownedByUser.ts
+/**
+* Create ownership check middleware.
+*
+* FAIL-CLOSED: ownership is meaningless without an authenticated identity, so a
+* request with no user (or a user with no id) is DENIED here rather than sliding
+* through with no ownership check installed. Elevated scope (platform admin)
+* bypasses the check by design.
+*/
+function createOwnershipCheck(ownerField, missingOwner) {
+	return async (request, _reply) => {
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const user = request.user;
+		if (!user) throw new UnauthorizedError("Authentication required for this operation");
+		const userWithId = user;
+		const userId = userWithId._id ?? userWithId.id;
+		if (!userId) throw new UnauthorizedError("Authenticated identity has no usable id");
+		request._ownershipCheck = {
+			field: ownerField,
+			userId,
+			missingOwner
+		};
+	};
+}
+function ownedByUserPreset(options = {}) {
+	const { ownerField = "userId", missingOwner = "deny" } = options;
+	const ownershipMiddleware = createOwnershipCheck(ownerField, missingOwner);
+	return {
+		name: "ownedByUser",
+		permissions: {
+			update: requireAuth(),
+			delete: requireAuth()
+		},
+		middlewares: {
+			update: [ownershipMiddleware],
+			delete: [ownershipMiddleware]
+		}
+	};
+}
+//#endregion
+//#region src/presets/slugLookup.ts
+/**
+* Slug Lookup Preset
+*
+* Adds a route to get resource by slug.
+*/
+function slugLookupPreset(options = {}) {
+	const { slugField = "slug" } = options;
+	return {
+		name: "slugLookup",
+		routes: (permissions) => [{
+			method: "GET",
+			path: `/slug/:${slugField}`,
+			handler: "getBySlug",
+			summary: "Get by slug",
+			permissions: permissions.get ?? allowPublic(),
+			operation: "getBySlug"
+		}],
+		controllerOptions: { slugField }
+	};
+}
+//#endregion
+//#region src/presets/softDelete.ts
+/**
+* Soft Delete Preset
+*
+* Adds routes for listing deleted items and restoring them.
+* The actual soft-delete behavior (deletedAt field, query filtering)
+* is handled by the repository/adapter layer (e.g., MongoKit's softDelete plugin).
+*/
+function softDeletePreset() {
+	return {
+		name: "softDelete",
+		routes: (permissions) => [{
+			method: "GET",
+			path: "/deleted",
+			handler: "getDeleted",
+			summary: "Get soft-deleted items",
+			permissions: permissions.list ?? requireRoles(["admin"]),
+			operation: "listDeleted",
+			_presetSource: "softDelete"
+		}, {
+			method: "POST",
+			path: "/:id/restore",
+			handler: "restore",
+			summary: "Restore soft-deleted item",
+			permissions: permissions.update ?? requireRoles(["admin"]),
+			operation: "restore",
+			_presetSource: "softDelete"
+		}]
+	};
+}
+//#endregion
 //#region src/presets/tree.ts
 /**
 * Tree Preset
@@ -266,14 +266,6 @@ function treePreset(options = {}) {
 }
 //#endregion
 //#region src/presets/index.ts
-/**
-* Convenience alias for multiTenantPreset with public list/get routes
-* Equivalent to: multiTenantPreset({ allowPublic: ['list', 'get'] })
-*/
-const flexibleMultiTenantPreset = (options = {}) => multiTenantPreset({
-	...options,
-	allowPublic: ["list", "get"]
-});
 const presetRegistry = {
 	softDelete: softDeletePreset,
 	slugLookup: slugLookupPreset,
@@ -409,4 +401,4 @@ function mergePreset(config, preset) {
 	return result;
 }
 //#endregion
-export { registerPreset as a, auditedPreset as c, ownedByUserPreset as d, getPreset as i, softDeletePreset as l, flexibleMultiTenantPreset as n, treePreset as o, getAvailablePresets as r, bulkPreset as s, applyPresets as t, slugLookupPreset as u };
+export { treePreset as a, ownedByUserPreset as c, registerPreset as i, bulkPreset as l, getAvailablePresets as n, softDeletePreset as o, getPreset as r, slugLookupPreset as s, applyPresets as t, auditedPreset as u };

package/dist/{projection-BzIgzoKZ.mjs → projection-wFoLqdss.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CgenB1gv.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-fvO6Ovzx.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{pushref-registry-Dov9l4qE.d.mts → pushref-registry-UxCkoA4C.d.mts}

@@ -435,4 +435,4 @@ declare class PushRefRegistry {
   private hydrateEnvelope;
 }
 //#endregion
-export { PushRefRegistry as a, SerializedEntry as c, Principal as i, EnvelopeWriter as l, FencedWriteOutcome as n, PushRefRegistryOptions as o, MemoryPushRefStore as r, PushRefStore as s, EnvelopeSnapshot as t };
+export { PushRefRegistry as a, SerializedEntry as c, Principal as i, EnvelopeWriter as l, FencedWriteOutcome as n, PushRefRegistryOptions as o, MemoryPushRefStore as r, PushRefStore as s, EnvelopeSnapshot as t, DeadQueueEntry as u };

package/dist/{queryCachePlugin-DZHPOm9p.mjs → queryCachePlugin-BATECpyh.mjs}

@@ -1,11 +1,15 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-cpZCtcIE.mjs";
-import { n as declareRuntimeCapability } from "./runtimeCapabilities-CkhS6jn6.mjs";
-import { t as hasEvents } from "./typeGuards-BLjPgVBm.mjs";
-import { t as MemoryCacheStore } from "./memory-Iotz0cCx.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-CpoiZ8hU.mjs";
+import { n as declareRuntimeCapability } from "./runtimeCapabilities-DIMKMV2G.mjs";
+import { t as hasEvents } from "./typeGuards-kEaP_WmO.mjs";
+import { t as MemoryCacheStore } from "./memory-CTa5pOCW.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
+const MISS = Object.freeze({
+	status: "miss",
+	data: void 0
+});
 var QueryCache = class {
 	store;
 	constructor(store) {
@@ -13,17 +17,11 @@ var QueryCache = class {
 	}
 	async get(key) {
 		const envelope = await this.store.get(key);
-		if (!envelope?.createdAt) return {
-			data: void 0,
-			status: "miss"
-		};
+		if (!envelope?.createdAt) return MISS;
 		const now = Date.now();
 		if (now >= envelope.expiresAt) {
 			await this.store.delete(key);
-			return {
-				data: void 0,
-				status: "miss"
-			};
+			return MISS;
 		}
 		if (now < envelope.staleAfter) return {
 			data: envelope.data,

package/dist/{queryCachePlugin-BzqxconG.d.mts → queryCachePlugin-C2lZjTxk.d.mts}

@@ -1,6 +1,6 @@
 
 import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
-import { i as QueryCache } from "./QueryCache-DFA-QrU9.mjs";
+import { i as QueryCache } from "./QueryCache--5uAuYPW.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/cache/queryCachePlugin.d.ts
 interface QueryCachePluginOptions {

package/dist/{rateLimitKey-BvOvcBDi.mjs → rateLimitKey-DVEZ_UpV.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 /**
 * Marks a key generator as SCOPE-AWARE, so `buildRateLimitOpts` can place the rate-limit

package/dist/{realtime-8tIQWZz4.mjs → realtime-xyubMKSB.mjs}

@@ -1,13 +1,14 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
-import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-DawKGoXb.mjs";
-import { n as getUserRoles } from "./userHelpers-ChRvkuSZ.mjs";
-import { c as getOrgId } from "./types-CgenB1gv.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-C9bzq2gO.mjs";
-import { t as applyFieldReadPermissions } from "./fields-BHrkoF5y.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-IcRFjWQU.mjs";
-import { t as openSseStream } from "./sseStream-Ppzo-WUH.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
+import { t as arcLog } from "./logger-D4V1zGLI.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DbwIM1f1.mjs";
+import { n as getUserRoles } from "./userHelpers-C76zD5pa.mjs";
+import { n as isEventVisible, t as eventAudienceOf } from "./tenancy-DxV8OuX2.mjs";
+import { t as applyFieldReadPermissions } from "./fields-A5crhsJb.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-JzB5CAga.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-wX3SA9w_.mjs";
+import { t as openSseStream } from "./sseStream-DQChzGTs.mjs";
+import { n as arcRouteValidatorCompiler } from "./routeValidator-DHtpzrzk.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({
@@ -123,10 +124,10 @@ function resolveRowMatcher(filters, adapter) {
 * the client adds it if absent.
 */
 function resolveDelivery(event, policy, operation) {
-	if (policy.tenantScoped) {
-		const eventOrgId = event.meta?.organizationId;
-		if (eventOrgId && eventOrgId !== policy.subscriberOrgId) return { kind: "drop" };
-	}
+	if (policy.tenantScoped && !isEventVisible(event.meta?.organizationId, {
+		...policy.subscriberOrgId !== void 0 ? { orgId: policy.subscriberOrgId } : {},
+		platformView: policy.subscriberPlatformView === true
+	})) return { kind: "drop" };
 	const doc = event.payload?.data;
 	if (!(!!policy.filters && Object.keys(policy.filters).length > 0)) return {
 		kind: "deliver",
@@ -202,9 +203,8 @@ const realtimePlugin = async (fastify, opts = {}) => {
 	* when the caller should stop.
 	*/
 	const authorizeResource = async (resourceName, entry, request, reply) => {
-		const holder = request;
-		const saved = holder._policyFilters;
-		holder._policyFilters = void 0;
+		const saved = request._policyFilters;
+		request._policyFilters = void 0;
 		try {
 			const listCheck = entry.permissions?.list;
 			if (typeof listCheck === "function") {
@@ -215,7 +215,7 @@ const realtimePlugin = async (fastify, opts = {}) => {
 					action: "list"
 				}, request, reply)) return null;
 			}
-			const filters = holder._policyFilters;
+			const filters = request._policyFilters;
 			const resolution = resolveRowMatcher(filters, fastify.arc?.registry?.getAdapter(resourceName));
 			if (!resolution.enforceable) {
 				await reply.code(501).send({
@@ -226,18 +226,20 @@ const realtimePlugin = async (fastify, opts = {}) => {
 				return null;
 			}
 			const scope = request.scope;
+			const audience = eventAudienceOf(scope);
 			return {
 				name: resourceName,
 				policy: {
 					tenantScoped: entry.tenantField !== false,
-					subscriberOrgId: scope ? getOrgId(scope) : void 0,
+					subscriberOrgId: audience.orgId,
+					subscriberPlatformView: audience.platformView,
 					filters,
 					matcher: resolution.matcher
 				},
 				fields: entry.fields
 			};
 		} finally {
-			holder._policyFilters = saved;
+			request._policyFilters = saved;
 		}
 	};
 	/** Open the stream and wire every authorized subscription onto it. */
@@ -327,9 +329,11 @@ const realtimePlugin = async (fastify, opts = {}) => {
 		}
 	});
 	const multiplexPath = path.replace(/\/:resource$/, "");
+	const validatorCompiler = arcRouteValidatorCompiler(fastify);
 	fastify.route({
 		method: "GET",
 		url: multiplexPath,
+		...validatorCompiler ? { validatorCompiler } : {},
 		schema: {
 			tags: ["Events"],
 			summary: "Realtime multi-resource change feed",
@@ -384,4 +388,4 @@ var realtime_default = fp(realtimePlugin, {
 	dependencies: ["arc-events"]
 });
 //#endregion
-export { realtime_default as n, realtime_exports as r, realtimePlugin as t };
+export { realtime_exports as n, realtime_default as t };