@classytic/arc 2.41.1 → 2.44.0

package/dist/cli/commands/init.mjs

@@ -1,3 +1,2 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as init } from "../../init-CpLkjU18.mjs";
-export { init };
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+export { t as init } from "../../init-BPzK5Lnr.mjs";

package/dist/cli/commands/introspect.d.mts

@@ -6,6 +6,5 @@
  * Shows all registered resources and their configuration.
  * Requires an entry file that exports defineResource() results.
  */
-declare function introspect(args: string[]): Promise<void>;
-//#endregion
-export { introspect };
+export declare function introspect(args: string[]): Promise<void>;
+//#endregion

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-ixtfL3J2.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-MP8xEppu.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-BLRf2m3y.mjs";
-import { t as init } from "../init-CpLkjU18.mjs";
+import { t as generate } from "../generate-BXKo2Gc8.mjs";
+import { t as init } from "../init-BPzK5Lnr.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-D5Ubn1fe.mjs → constants-B2QHb6u6.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth
@@ -50,6 +50,8 @@ const DEFAULT_ID_FIELD = "_id";
 const DEFAULT_TENANT_FIELD = "organizationId";
 /** Default HTTP method for update routes */
 const DEFAULT_UPDATE_METHOD = "PATCH";
+/** Default version field under `concurrency: {}` (optimistic concurrency) */
+const DEFAULT_VERSION_FIELD = "__v";
 /** System-managed fields that cannot be set via request body */
 const SYSTEM_FIELDS = Object.freeze([
 	"_id",
@@ -88,4 +90,4 @@ const RESERVED_QUERY_PARAMS = Object.freeze(/* @__PURE__ */ new Set([
 	"_policyFilters"
 ]));
 //#endregion
-export { DEFAULT_SORT as a, HOOK_OPERATIONS as c, MAX_REGEX_LENGTH as d, MAX_SEARCH_LENGTH as f, SYSTEM_FIELDS as h, DEFAULT_MAX_LIMIT as i, HOOK_PHASES as l, RESERVED_QUERY_PARAMS as m, DEFAULT_ID_FIELD as n, DEFAULT_TENANT_FIELD as o, MUTATION_OPERATIONS as p, DEFAULT_LIMIT as r, DEFAULT_UPDATE_METHOD as s, CRUD_OPERATIONS as t, MAX_FILTER_DEPTH as u };
+export { DEFAULT_SORT as a, DEFAULT_VERSION_FIELD as c, MAX_FILTER_DEPTH as d, MAX_REGEX_LENGTH as f, SYSTEM_FIELDS as g, RESERVED_QUERY_PARAMS as h, DEFAULT_MAX_LIMIT as i, HOOK_OPERATIONS as l, MUTATION_OPERATIONS as m, DEFAULT_ID_FIELD as n, DEFAULT_TENANT_FIELD as o, MAX_SEARCH_LENGTH as p, DEFAULT_LIMIT as r, DEFAULT_UPDATE_METHOD as s, CRUD_OPERATIONS as t, HOOK_PHASES as u };

package/dist/context/index.d.mts

@@ -52,7 +52,7 @@ interface RequestStore {
  * - `run(store, fn)` — run a function with a specific store (used by Arc internals)
  * - `getStore()` — alias for get() (matches Node.js API naming)
  */
-declare const requestContext: {
+export declare const requestContext: {
   /**
    * Get the current request context.
    * Returns undefined if called outside a request lifecycle.
@@ -90,22 +90,19 @@ declare const requestContext: {
  * await outbox.store(event, { headers: traceHeaders });
  * ```
  */
-declare function getTraceHeaders(): Record<string, string> | undefined;
+export declare function getTraceHeaders(): Record<string, string> | undefined;
 //#endregion
 //#region src/context/requestScopedCache.d.ts
 /**
- * The cache for the CURRENT unit of work — a request, an event dispatch or a
- * job run (see `runWorkScope`) — or `undefined` outside one.
- *
- * Lazily created on first use, so a scope that never touches a cached
- * repository allocates nothing.
+ * The cache for the CURRENT unit of work (see `runWorkScope`), or `undefined`
+ * outside one. Lazily created on first use.
  */
-declare function requestScopedCache(): CacheAdapter | undefined;
+export declare function requestScopedCache(): CacheAdapter | undefined;
 /**
  * Whether the current scope has allocated a cache yet. Diagnostics and
  * tests only — never branch application behaviour on this.
  */
-declare function hasRequestScopedCache(): boolean;
+export declare function hasRequestScopedCache(): boolean;
 //#endregion
 //#region src/context/transactionContext.d.ts
 /** DB session/transaction handle. Typed as unknown — arc is DB-agnostic. */
@@ -116,7 +113,7 @@ type DbSession = unknown;
  * - `run(session, fn)` — install an active DB session for the duration of `fn`
  * - `get()` — read the current session (undefined if outside a transaction scope)
  */
-declare const transactionContext: {
+export declare const transactionContext: {
   /**
    * Run `fn` with `session` as the active DB transaction context.
    * Any call to `get()` within `fn`'s async call stack returns `session`.
@@ -139,17 +136,17 @@ interface WorkSeed {
   readonly organizationId?: string;
 }
 /** Enter a scope for `fn`, or run it inside the active one. */
-declare function runWorkScope<T>(seed: WorkSeed, fn: () => T): T;
+export declare function runWorkScope<T>(seed: WorkSeed, fn: () => T): T;
 /**
  * A per-scope memo slot: created once on first use, the same instance after.
  * `undefined` outside a scope.
  */
-declare function scopedValue<T>(slot: symbol, create: () => T): T | undefined;
+export declare function scopedValue<T>(slot: symbol, create: () => T): T | undefined;
 /**
  * The scope an event dispatch runs in. The correlation id is the scope id so a
  * child event published from a handler chains to the same correlation; the
  * tenant rides `meta`, never the payload.
  */
-declare function workSeedFromEvent(event: DomainEvent): WorkSeed;
+export declare function workSeedFromEvent(event: DomainEvent): WorkSeed;
 //#endregion
-export { type DbSession, type RequestStore, type WorkKind, type WorkSeed, getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, runWorkScope, scopedValue, transactionContext, workSeedFromEvent };
+export type { DbSession, RequestStore, WorkKind, WorkSeed };

package/dist/context/index.mjs

@@ -1,34 +1,23 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-CPbdlnVw.mjs";
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-cDkAUr-P.mjs";
-import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-CxKqoIFn.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-orvnGu4F.mjs";
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-C10UeFe5.mjs";
+import { n as evictToSize, r as touch } from "../boundedMap-DWiKW7lP.mjs";
+import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-n9a7d_lZ.mjs";
 //#region src/context/requestScopedCache.ts
 /** The memo slot the per-scope store hangs off. */
 const SLOT = Symbol.for("arc.requestScopedCache");
-/**
-* Entry cap for one scope's cache. A request touching this many distinct keys
-* is already pathological; a JOB RUN reaching it is ordinary, and that is the
-* case this exists for (see the eviction note below).
-*/
+/** Entry cap for one scope's cache — sized for long job runs, not requests. */
 const MAX_ENTRIES = 1e4;
 /**
 * A `Map`-backed `CacheAdapter` with NO TTL and LRU eviction above
 * {@link MAX_ENTRIES}.
 *
-* TTL is accepted and ignored because repo-core stamps freshness INTO the
-* envelope and re-checks on read — honouring it here too would put two clocks
-* on one question.
+* TTL is ignored: repo-core stamps freshness INTO the envelope and re-checks
+* on read, so honouring it here would put two clocks on one question.
 *
-* Eviction is newer than the rest of this file and the reason is worth
-* keeping. Unbounded was correct while a scope meant an HTTP REQUEST: the
-* store is unreachable once that async context ends, so it was garbage in
-* milliseconds and bounded by what one request touched, and an LRU would have
-* guarded a lifetime that could not occur. 2.40 extended scopes to job runs
-* and event dispatches — and `schedulesPlugin` wraps the WHOLE handler in one
-* scope, so a nightly job sweeping a million rows holds a single cache for the
-* duration. That is now a lifetime that occurs, and the old premise no longer
-* holds. Evicting is always safe here: this is a cache, so the worst a miss
-* costs is the re-read it was avoiding.
+* The cap matters because `schedulesPlugin` wraps a WHOLE job handler in one
+* scope, so a long sweep holds a single cache throughout. Evicting is always
+* safe — a miss costs only the re-read it was avoiding.
 */
 function createRequestCacheAdapter() {
 	const map = /* @__PURE__ */ new Map();
@@ -36,25 +25,19 @@ function createRequestCacheAdapter() {
 		async get(key) {
 			if (!map.has(key)) return void 0;
 			const value = map.get(key);
-			map.delete(key);
-			map.set(key, value);
+			touch(map, key, value);
 			return value;
 		},
 		async set(key, value, _ttlSeconds) {
-			map.delete(key);
-			map.set(key, value);
-			if (map.size > MAX_ENTRIES) {
-				const oldest = map.keys().next();
-				if (!oldest.done) map.delete(oldest.value);
-			}
+			touch(map, key, value);
+			evictToSize(map, MAX_ENTRIES);
 		},
 		async delete(key) {
 			map.delete(key);
 		},
 		/**
-		* Ignores the pattern and wipes the whole store. Over-invalidating within
-		* one request costs at most a re-read; pattern matching is complexity a
-		* store that dies in milliseconds does not earn.
+		* Ignores the pattern and wipes the whole store — over-invalidating a
+		* short-lived store costs at most a re-read.
 		*/
 		async clear(_pattern) {
 			map.clear();
@@ -62,11 +45,8 @@ function createRequestCacheAdapter() {
 	};
 }
 /**
-* The cache for the CURRENT unit of work — a request, an event dispatch or a
-* job run (see `runWorkScope`) — or `undefined` outside one.
-*
-* Lazily created on first use, so a scope that never touches a cached
-* repository allocates nothing.
+* The cache for the CURRENT unit of work (see `runWorkScope`), or `undefined`
+* outside one. Lazily created on first use.
 */
 function requestScopedCache() {
 	return scopedValue(SLOT, createRequestCacheAdapter);

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-DHbyPo5j.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-D4u76eQW.mjs";
-export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };
+import { $t as AccessControl, An as MixinConstructor, Bt as TreeMixin, Dn as ControllerConfigurableOptions, En as BaseControllerOptions, F as ResourceDefinition, Gt as BaseCrudController, Ht as SlugMixin, It as BaseController, Jt as ActionTargetCheck, Kt as QueryResolver, Lt as SoftDeleteExt, Mn as BodySanitizerConfig, On as ControllerConstructionOptions, P as defineResource, Qt as getEntityQuery, Rt as SoftDeleteMixin, Ut as BulkExt, Vt as SlugExt, Wt as BulkMixin, Xt as getEntityId, Yt as getActionTarget, Zt as getEntityIdField, at as AggregationCacheConfig, ct as AggregationIndexHint, dt as AggregationRateLimit, en as AccessControlConfig, ft as AggregationsMap, it as AggMeasureShorthand, jn as BodySanitizer, kn as ListResult, lt as AggregationMaterializedContext, nn as FetchDenialReason, ot as AggregationConfig, qt as QueryResolverConfig, rn as FetchResult, rt as AggMeasureInput, st as AggregationDateRangeRequirement, tn as AccessControlRepository, ut as AggregationMaterializedResult, zt as TreeExt } from "../index-WH7xgvxS.mjs";
+import { A as CrudOperation, B as HookOperation, C as mergeResourceConfig, D as createPermissionMiddleware, E as createCrudRouter, F as DEFAULT_TENANT_FIELD, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_UPDATE_METHOD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_VERSION_FIELD, M as DEFAULT_LIMIT, N as DEFAULT_MAX_LIMIT, O as defineAggregation, P as DEFAULT_SORT, R as HOOK_OPERATIONS, S as SeamedResourceConfig, T as defineAction, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as VariantsMap, a as formatValidationErrors, b as AdapterLike, c as nativePolicyFilter, d as createFastifyHandler, f as createRequestContext, g as VariantOverride, h as sendControllerResponse, i as assertValidConfig, j as DEFAULT_ID_FIELD, k as CRUD_OPERATIONS, l as collectReadBlockedFields, m as getControllerScope, n as ValidateOptions, o as validateResourceConfig, p as getControllerContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as VariantsResult, w as DefineActionConfig, x as ResourceSeams, y as defineResourceVariants, z as HOOK_PHASES } from "../index-Beg3aNnK.mjs";
+export { AccessControl, type AccessControlConfig, type AccessControlRepository, type ActionTargetCheck, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DEFAULT_VERSION_FIELD, type DefineActionConfig, type FetchDenialReason, type FetchResult, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MixinConstructor, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, type VariantOverride, type VariantsMap, type VariantsResult, assertValidConfig, collectReadBlockedFields, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getActionTarget, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-D5Ubn1fe.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CYEwjyjN.mjs";
-import { t as defineAggregation } from "../defineAggregation-D_eJjm5A.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-BoPGQ5-4.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DxkMTjRn.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-5lazhva9.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as DEFAULT_VERSION_FIELD, d as MAX_FILTER_DEPTH, f as MAX_REGEX_LENGTH, g as SYSTEM_FIELDS, h as RESERVED_QUERY_PARAMS, i as DEFAULT_MAX_LIMIT, l as HOOK_OPERATIONS, m as MUTATION_OPERATIONS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MAX_SEARCH_LENGTH, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as HOOK_PHASES } from "../constants-B2QHb6u6.mjs";
+import { S as nativePolicyFilter, b as BodySanitizer, c as BaseController, d as SlugMixin, f as BulkMixin, g as isFieldReadable, h as collectReadBlockedFields, l as TreeMixin, m as QueryResolver, o as createCrudRouter, p as BaseCrudController, s as createPermissionMiddleware, u as SoftDeleteMixin, x as AccessControl } from "../plugin-DALd9dcF.mjs";
+import { t as defineAggregation } from "../defineAggregation--3xguLkk.mjs";
+import { C as sendControllerResponse, S as getControllerScope, b as createRequestContext, x as getControllerContext, y as createFastifyHandler } from "../actionPermissions-5N04zBL4.mjs";
+import { a as defineResourceVariants, i as getEntityQuery, n as getEntityId, o as mergeResourceConfig, r as getEntityIdField, s as defineAction, t as getActionTarget } from "../core-COcqo0Cp.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, r as formatValidationErrors, t as defineResource } from "../defineResource-gUp9ug66.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DEFAULT_VERSION_FIELD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getActionTarget, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/{core-5lazhva9.mjs → core-COcqo0Cp.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import "./constants-D5Ubn1fe.mjs";
-import { t as defineResource } from "./defineResource-DxkMTjRn.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import "./constants-B2QHb6u6.mjs";
+import { t as defineResource } from "./defineResource-gUp9ug66.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema
@@ -19,7 +19,8 @@ function defineAction(config) {
 		schema: config.schema,
 		description: config.description,
 		id: config.id,
-		mcp: config.mcp
+		mcp: config.mcp,
+		...config.idempotency ? { idempotency: config.idempotency } : {}
 	};
 }
 //#endregion
@@ -172,5 +173,14 @@ function getEntityQuery(req) {
 	if (id === void 0) return {};
 	return { [getEntityIdField(req)]: id };
 }
+/**
+* The row the action-target fence loaded for this request, so the handler need not read it
+* again. `undefined` when no fence read happened (untenanted resource, `scope: 'handler'`,
+* id-less action) — load it yourself then. It is a snapshot taken after the idempotency lock
+* and before the handler: a guarded write must still carry its precondition in the filter.
+*/
+function getActionTarget(req) {
+	return req.arc?.actionTarget;
+}
 //#endregion
-export { mergeResourceConfig as a, defineResourceVariants as i, getEntityIdField as n, defineAction as o, getEntityQuery as r, getEntityId as t };
+export { defineResourceVariants as a, getEntityQuery as i, getEntityId as n, mergeResourceConfig as o, getEntityIdField as r, defineAction as s, getActionTarget as t };

package/dist/{createActionRouter-DNqoaK81.mjs → createActionRouter-zG13rpPJ.mjs}

@@ -1,16 +1,34 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
-import "./constants-D5Ubn1fe.mjs";
-import { f as createError } from "./errors-BH7YU_9O.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-BoPGQ5-4.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-Bsnk6NiZ.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CTvPDoPB.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
+import "./constants-B2QHb6u6.mjs";
+import { f as createError, i as NotFoundError, u as ValidationError } from "./errors-CW4anJBy.mjs";
+import { C as sendControllerResponse, _ as buildArcDecorator, a as resolveRouterPluginMw, f as buildRouteHooks, g as buildAuthMiddlewareForPermissions, i as buildRouteConfig, l as resolvePipelineSteps, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, r as buildRateLimitConfig, s as buildActionPipelineHandler, u as buildActionPermissionMw } from "./actionPermissions-5N04zBL4.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-BA0Hb21Y.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
 	createActionRouter: () => createActionRouter
 });
 /**
+* Record a successful action. The actor and organization come from the request's
+* validated scope (`auditContext`); a failed write is logged, never turned into a 500
+* after the action has already happened.
+*/
+async function auditAction(req, resource, id, action) {
+	const audit = req.server.audit;
+	if (!audit?.custom || audit._noop === true) return;
+	try {
+		await audit.custom(resource, id, action, { ...req.auditMetadata ?? {} }, req.auditContext);
+	} catch (err) {
+		req.log.error({
+			err,
+			resource,
+			id,
+			action
+		}, "[arc] action audit write failed");
+	}
+}
+/**
 * Register the unified action endpoint: `POST /:id/action`.
 *
 * Shares every lifecycle primitive with the CRUD router — the preHandler
@@ -19,7 +37,8 @@ var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 * (keyed by `body.action` at request time).
 */
 function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [], extensions } = config;
+	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], tenantMiddlewares = [], pipeline, rateLimit, idLessActionNames = [], extensions, isTargetVisible, loadTarget, handlerScopedActionNames = [], idempotentActionNames = [], handlerDedupOwners = {}, auditActions = false } = config;
+	const handlerScoped = new Set(handlerScopedActionNames);
 	const allActionNames = Object.keys(actions);
 	if (allActionNames.length === 0) {
 		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
@@ -82,23 +101,26 @@ function createActionRouter(fastify, config) {
 			} },
 			required: ["id"]
 		};
+		const actionDispatchCheck = async (req, _reply) => {
+			if (!req.validationError) return;
+			const body = req.body;
+			const submitted = typeof body?.action === "string" ? body.action : void 0;
+			if (submitted && subsetSet.has(submitted)) return;
+			const wrongMount = submitted && allActionNames.includes(submitted) ? submitted : void 0;
+			const otherMount = hasId ? "/action" : "/:id/action";
+			const message = wrongMount ? `Action '${wrongMount}' on '${resourceName}' is mounted at 'POST ${otherMount}', not 'POST ${urlPath}'` : submitted ? `Unknown action '${submitted}' on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}` : `Missing 'action' field on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}`;
+			throw createError(400, message, {
+				code: "arc.invalid_action",
+				validActions: actionSubset,
+				mount: urlPath,
+				...submitted ? { submitted } : {},
+				...wrongMount ? { mountedAt: otherMount } : {}
+			});
+		};
 		const actionValidationFormatter = async (req, _reply) => {
 			const validationError = req.validationError;
 			if (!validationError) return;
-			const body = req.body;
-			const submitted = typeof body?.action === "string" ? body.action : void 0;
-			if (!submitted || !subsetSet.has(submitted)) {
-				const wrongMount = submitted && allActionNames.includes(submitted) ? submitted : void 0;
-				const otherMount = hasId ? "/action" : "/:id/action";
-				const message = wrongMount ? `Action '${wrongMount}' on '${resourceName}' is mounted at 'POST ${otherMount}', not 'POST ${urlPath}'` : submitted ? `Unknown action '${submitted}' on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}` : `Missing 'action' field on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}`;
-				throw createError(400, message, {
-					code: "arc.invalid_action",
-					validActions: actionSubset,
-					mount: urlPath,
-					...submitted ? { submitted } : {},
-					...wrongMount ? { mountedAt: otherMount } : {}
-				});
-			}
+			const submitted = req.body.action;
 			const branchPath = `/oneOf/${actionSubset.indexOf(submitted)}/`;
 			const ajvErrors = validationError.validation ?? [];
 			const scoped = ajvErrors.filter((e) => e.keyword !== "oneOf" && (e.schemaPath?.includes(branchPath) || !e.schemaPath?.includes("/oneOf/")));
@@ -111,24 +133,30 @@ function createActionRouter(fastify, config) {
 			scopedError.meta = { action: submitted };
 			throw scopedError;
 		};
+		const requiredActions = actionSubset.filter((name) => idempotentActionNames.includes(name));
+		const handlerDedup = Object.fromEntries(requiredActions.flatMap((name) => {
+			const owner = handlerDedupOwners[name];
+			return owner === void 0 ? [] : [[name, owner]];
+		}));
 		const hooks = buildRouteHooks({
 			arcDecorator,
 			authMw,
+			prePermission: actionDispatchCheck,
 			permissionMw,
+			validationFormatter: actionValidationFormatter,
 			pluginMw: selectPluginMw("POST", pluginMw),
-			routeGuards
+			routeGuards,
+			customMws: tenantMiddlewares
 		});
-		const preHandler = [actionValidationFormatter, ...hooks.preHandler];
 		tryRegisterRoute(fastify, {
 			method: "POST",
 			url: urlPath,
 			schema: routeSchema,
-			attachValidation: true,
-			...routeHookOptions({
-				onRequest: hooks.onRequest,
-				preHandler
-			}),
-			...buildRouteConfig(rateLimitConfig, extensions),
+			...routeHookOptions(hooks),
+			...buildRouteConfig(rateLimitConfig, extensions, void 0, requiredActions.length > 0 ? {
+				requiredActions,
+				...Object.keys(handlerDedup).length > 0 ? { handlerDedup } : {}
+			} : void 0),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;
 				const id = hasId ? req.params.id : "";
@@ -141,8 +169,20 @@ function createActionRouter(fastify, config) {
 				}
 				const handler = wrappedHandlers.get(action);
 				if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionSubset.join(", ")}`, { validActions: actionSubset });
+				if (hasId && (loadTarget || isTargetVisible) && !handlerScoped.has(action)) {
+					const target = loadTarget ? await loadTarget(id, req) : { visible: await isTargetVisible(id, req) };
+					if (!target.visible) throw new NotFoundError(resourceName);
+					if (target.doc !== void 0) {
+						const reqWithExtras = req;
+						reqWithExtras.arc = {
+							...reqWithExtras.arc ?? {},
+							actionTarget: target.doc
+						};
+					}
+				}
 				try {
 					const response = await handler(id, data, req);
+					if (auditActions && (response.status ?? 200) < 400) await auditAction(req, resourceName, id, action);
 					sendControllerResponse(reply, response, req);
 					return reply;
 				} catch (error) {
@@ -150,6 +190,8 @@ function createActionRouter(fastify, config) {
 						const { statusCode, error: errorMsg, code } = onError(error, action, id);
 						throw createError(statusCode, errorMsg, code ? { code } : void 0);
 					}
+					const validation = zodIssues(error);
+					if (validation) throw new ValidationError(`Invalid '${action}' payload`, validation);
 					const err = error;
 					const statusCode = err.statusCode || err.status || 500;
 					const errorCode = err.code || "ACTION_FAILED";
@@ -190,7 +232,7 @@ function createActionRouter(fastify, config) {
 * `action: { const }` and carrying its own `required`.
 *
 * EVERY BRANCH LISTS THE FULL PROPERTY UNION — the non-obvious part. AJV's
-* `removeAdditional: 'all'` (Fastify's default) strips a field during a
+* `removeAdditional` (Fastify's default strips) strips a field during a
 * branch's evaluation when that branch's `properties` omits it, EVEN IF
 * another branch would have allowed it. The strip mutates the body before
 * `oneOf` finishes discriminating, so the winning branch receives a body that
@@ -199,11 +241,10 @@ function createActionRouter(fastify, config) {
 * every branch makes each walk see every field as its own, so nothing is
 * stripped; `required` stays per-action, so dispatch still gates correctly.
 *
-* Per-branch `additionalProperties: false` survives but cannot reject
-* sibling-action fields under host `removeAdditional: 'all'` — those strip at
-* top level instead. That is the host's opt-in; arc's job is only to stop
-* losing an action's OWN declared fields. Under arc's `createApp`
-* (`removeAdditional: false`) strict rejection works normally.
+* Arc compiles this route with its own validator (`removeAdditional: false`, see
+* `./routeValidator.ts`), whatever the host's AJV says — so per-branch
+* `additionalProperties: false` rejects unknown fields on every host. The full
+* property union stays because a host-supplied `validatorCompiler` may still strip.
 *
 * Pinned by `tests/core/action-discriminator-strip.test.ts` and
 * `action-strict-schema-parity.test.ts`. Exported so OpenAPI and MCP tool
@@ -211,6 +252,7 @@ function createActionRouter(fastify, config) {
 */
 function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 	const unionProperties = {};
+	const conflicting = /* @__PURE__ */ new Set();
 	const irs = [];
 	for (const actionName of actionEnum) {
 		const ir = normalizeSchemaIR(actionSchemas[actionName]);
@@ -218,13 +260,19 @@ function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 			name: actionName,
 			ir
 		});
-		for (const [key, val] of Object.entries(ir.properties)) unionProperties[key] = val;
+		for (const [key, val] of Object.entries(ir.properties)) {
+			const prior = unionProperties[key];
+			if (prior !== void 0 && JSON.stringify(prior) !== JSON.stringify(val)) conflicting.add(key);
+			unionProperties[key] = val;
+		}
 	}
+	const topLevelProperties = { ...unionProperties };
+	for (const key of conflicting) topLevelProperties[key] = {};
 	const branches = [];
 	for (const { name, ir } of irs) branches.push(schemaIRToJsonSchemaBranch({
 		...ir,
 		properties: {
-			...unionProperties,
+			...topLevelProperties,
 			...ir.properties
 		}
 	}, {
@@ -242,7 +290,7 @@ function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 				type: "string",
 				enum: [...actionEnum]
 			},
-			...unionProperties
+			...topLevelProperties
 		},
 		oneOf: branches
 	};
@@ -261,5 +309,15 @@ function buildActionDescription(actions, actionPermissions) {
 	}
 	return lines.join("\n");
 }
+/** A ZodError's issues as `{ field, message }`, or `undefined` for any other error. */
+function zodIssues(error) {
+	if (!(error instanceof Error) || error.name !== "ZodError" || !("issues" in error)) return void 0;
+	const issues = error.issues;
+	if (!Array.isArray(issues)) return void 0;
+	return issues.map((issue) => ({
+		field: Array.isArray(issue.path) ? issue.path.map(String).join(".") || "(payload)" : "(payload)",
+		message: typeof issue.message === "string" ? issue.message : "invalid"
+	}));
+}
 //#endregion
 export { createActionRouter_exports as n, buildActionBodySchema as t };

package/dist/{createAggregationRouter-BcbQJf10.mjs → createAggregationRouter-CWRz96Vr.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-DawKGoXb.mjs";
-import { f as createError } from "./errors-BH7YU_9O.mjs";
-import { u as getRequestScope } from "./types-CgenB1gv.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-Bsnk6NiZ.mjs";
-import { n as validateAggregations } from "./validate-DrYWnOzI.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-CvxKOc0m.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { f as createError } from "./errors-CW4anJBy.mjs";
+import { u as getRequestScope } from "./types-fvO6Ovzx.mjs";
+import { _ as buildArcDecorator, a as resolveRouterPluginMw, f as buildRouteHooks, h as buildAuthMiddleware, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, r as buildRateLimitConfig } from "./actionPermissions-5N04zBL4.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-wX3SA9w_.mjs";
+import { n as validateAggregations } from "./validate-CWp-lsrm.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-Bswu_vNb.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is
@@ -68,7 +68,7 @@ function registerOne(fastify, normalized, ctx) {
 		summary: config.summary ?? `Aggregation: ${name}`,
 		description: config.description ?? "Portable aggregation generated by arc. Filters from query string compose with the declaration's base filter + tenant scope."
 	};
-	fastify.route({
+	tryRegisterRoute(fastify, {
 		method: "GET",
 		url: `/aggregations/${name}`,
 		schema: routeSchema,
@@ -86,6 +86,9 @@ function registerOne(fastify, normalized, ctx) {
 				throw createError(500, `Aggregation "${name}" failed: ${message}`);
 			}
 		}
+	}, {
+		resourceName: tag ?? name,
+		op: `aggregation:${name}`
 	});
 }
 /**