@classytic/arc 2.43.0 → 2.45.0

package/dist/{openapi-DT_G4VhY.mjs → openapi-BCOaGAgE.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-aklawRaK.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-BORek3O-.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-BotX1YOa.mjs";
-import { t as pluralize } from "./pluralize-CVIOcgMF.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-xjqonMRO.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-Nc5ePCsf.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-rzBovk00.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-TAc_6LCw.mjs";
+import { t as pluralize } from "./pluralize-B4FcZEyI.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BgPCYU2U.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -80,6 +80,6 @@ interface OutboxAdminModuleDeps {
    */
   relayLagUnhealthyMs?: number;
 }
-declare function createOutboxAdminModule(deps: OutboxAdminModuleDeps): ArcModule<void>;
+export declare function createOutboxAdminModule(deps: OutboxAdminModuleDeps): ArcModule<void>;
 //#endregion
-export { type OutboxAdminModuleDeps, type OutboxAdminPermissions, type OutboxAdminStore, createOutboxAdminModule };
+export type { OutboxAdminModuleDeps, OutboxAdminPermissions, OutboxAdminStore };

package/dist/outbox-admin/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-CtrywMHP.mjs";
-import { t as defineResource } from "../defineResource-DIC7JZGU.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-BSvOQC7E.mjs";
-import { r as readOutboxHealth } from "../health-D-Ft6JM6.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-C9G4A8cN.mjs";
+import { t as defineResource } from "../defineResource-CRkhRRSj.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-BtdcGn_E.mjs";
+import { r as readOutboxHealth } from "../health-hRGgxnOC.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-Bjgzl6tg.mjs → outbox-module-BVDiMwXb.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "./transactionContext-DjFkrNG6.mjs";
-import { n as requestContext } from "./requestContext-Dsu9P1bV.mjs";
-import { n as evictToSize, r as touch } from "./boundedMap-BULzfXYU.mjs";
-import { i as resolveEventTransport } from "./EventTransport-tzA7CAB4.mjs";
-import { t as emitObserved } from "./eventPlugin-Q6BhzHzs.mjs";
-import { n as canReportHealth, r as readOutboxHealth } from "./health-D-Ft6JM6.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-BOzk-CuX.mjs";
-import { t as claimedAttempts } from "./claimed-B10RTfkM.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-BWp0MBGL.mjs";
+import { n as requestContext } from "./requestContext-B8JKbeb7.mjs";
+import { n as evictToSize, r as touch } from "./boundedMap-DQfXgxMo.mjs";
+import { i as resolveEventTransport } from "./EventTransport-Ci6hGO1Y.mjs";
+import { t as emitObserved } from "./eventPlugin-Dghr7iL5.mjs";
+import { n as canReportHealth, r as readOutboxHealth } from "./health-hRGgxnOC.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-Bxk7TDgG.mjs";
+import { t as claimedAttempts } from "./claimed-CnEEOHuL.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxConflictError, OutboxOwnershipError, outboxPayloadFingerprint } from "@classytic/primitives/outbox";

package/dist/permissions/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as conjoinPolicyFilters } from "../filter-merge-IpGywvym.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-aklawRaK.mjs";
-import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-ToPYpMqS.mjs";
-import { i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-DQYrkl5f.mjs";
-import { i as resolveResourceRateLimiter, t as createMemoryResourceRateLimiter } from "../resourceRateLimit-dSjVr1pk.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-Cm0uYHvd.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { t as conjoinPolicyFilters } from "../filter-merge-BYKBa9b2.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Nc5ePCsf.mjs";
+import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-Da--1DNS.mjs";
+import { i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-BixzgirP.mjs";
+import { i as resolveResourceRateLimiter, t as createMemoryResourceRateLimiter } from "../resourceRateLimit-DWob9nQ8.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-IdHJ0_5V.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createMemoryResourceRateLimiter, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, resolveResourceRateLimiter, roles, scopeOf, when };

package/dist/{permissions-Cm0uYHvd.mjs → permissions-IdHJ0_5V.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
-import { t as arcLog } from "./logger-DXjfIqjV.mjs";
-import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
-import { n as getUserRoles } from "./userHelpers-aklawRaK.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Bk9NOgOC.mjs";
-import { i as normalizeToDecision } from "./authorizationDecision-DQYrkl5f.mjs";
-import { n as declareRuntimeCapability } from "./runtimeCapabilities-0tccjRlj.mjs";
-import { t as MemoryCacheStore } from "./memory-9Cp7611C.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-AD16t29l.mjs";
+import { t as arcLog } from "./logger-vxu0DXf_.mjs";
+import { t as conjoinPolicyFilters } from "./filter-merge-BYKBa9b2.mjs";
+import { n as getUserRoles } from "./userHelpers-Nc5ePCsf.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-4JKkSvds.mjs";
+import { i as normalizeToDecision } from "./authorizationDecision-BixzgirP.mjs";
+import { n as declareRuntimeCapability } from "./runtimeCapabilities-C7gAbIxC.mjs";
+import { t as MemoryCacheStore } from "./memory-DJN6kyC8.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**

package/dist/{pipe-BqeGT6UO.mjs → pipe-BPJPifhi.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-CtrywMHP.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-C9G4A8cN.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,5 +1,5 @@
 
-import { In as IControllerResponse, _t as PipelineConfig, bt as Transform, gt as OperationFilter, ht as NextFunction, mt as Interceptor, pt as Guard, vt as PipelineContext, yt as PipelineStep } from "../index-mqaqZNpe.mjs";
+import { Vn as IControllerResponse, _t as PipelineConfig, bt as Transform, gt as OperationFilter, ht as NextFunction, mt as Interceptor, pt as Guard, vt as PipelineContext, yt as PipelineStep } from "../index-WH7xgvxS.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;
@@ -11,7 +11,7 @@ interface GuardOptions {
  * @param name - Guard name (for debugging/introspection)
  * @param handlerOrOptions - Handler function or options object
  */
-declare function guard(name: string, handlerOrOptions: ((ctx: PipelineContext) => boolean | Promise<boolean>) | GuardOptions): Guard;
+export declare function guard(name: string, handlerOrOptions: ((ctx: PipelineContext) => boolean | Promise<boolean>) | GuardOptions): Guard;
 //#endregion
 //#region src/pipeline/intercept.d.ts
 interface InterceptOptions {
@@ -24,14 +24,14 @@ interface InterceptOptions {
  * @param name - Interceptor name (for debugging/introspection)
  * @param handlerOrOptions - Handler function or options object
  */
-declare function intercept(name: string, handlerOrOptions: ((ctx: PipelineContext, next: NextFunction) => Promise<IControllerResponse<unknown>>) | InterceptOptions): Interceptor;
+export declare function intercept(name: string, handlerOrOptions: ((ctx: PipelineContext, next: NextFunction) => Promise<IControllerResponse<unknown>>) | InterceptOptions): Interceptor;
 //#endregion
 //#region src/pipeline/pipe.d.ts
 /**
  * Compose pipeline steps into an ordered array.
  * Accepts guards, transforms, and interceptors in any order.
  */
-declare function pipe(...steps: PipelineStep[]): PipelineStep[];
+export declare function pipe(...steps: PipelineStep[]): PipelineStep[];
 /**
  * Execute a pipeline against a request context.
  *
@@ -44,7 +44,7 @@ declare function pipe(...steps: PipelineStep[]): PipelineStep[];
  * @param operation - The CRUD operation name
  * @returns The controller response (possibly modified by interceptors)
  */
-declare function executePipeline(steps: PipelineStep[], ctx: PipelineContext, handler: (ctx: PipelineContext) => Promise<IControllerResponse<unknown>>, operation: string): Promise<IControllerResponse<unknown>>;
+export declare function executePipeline(steps: PipelineStep[], ctx: PipelineContext, handler: (ctx: PipelineContext) => Promise<IControllerResponse<unknown>>, operation: string): Promise<IControllerResponse<unknown>>;
 //#endregion
 //#region src/pipeline/transform.d.ts
 interface TransformOptions {
@@ -57,6 +57,6 @@ interface TransformOptions {
  * @param name - Transform name (for debugging/introspection)
  * @param handlerOrOptions - Handler function or options object
  */
-declare function transform(name: string, handlerOrOptions: ((ctx: PipelineContext) => PipelineContext | undefined | Promise<PipelineContext | undefined>) | TransformOptions): Transform;
+export declare function transform(name: string, handlerOrOptions: ((ctx: PipelineContext) => PipelineContext | undefined | Promise<PipelineContext | undefined>) | TransformOptions): Transform;
 //#endregion
-export { type Guard, type GuardOptions, type InterceptOptions, type Interceptor, type NextFunction, type OperationFilter, type PipelineConfig, type PipelineContext, type PipelineStep, type Transform, type TransformOptions, executePipeline, guard, intercept, pipe, transform };
+export type { Guard, GuardOptions, InterceptOptions, Interceptor, NextFunction, OperationFilter, PipelineConfig, PipelineContext, PipelineStep, Transform, TransformOptions };

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-BqeGT6UO.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-BPJPifhi.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/{plan-FVR6LP59.mjs → plan-CEedaMlr.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 import { createEventRouter, matchEventPattern } from "@classytic/primitives/events";
 //#region src/factory/module/graph.ts
 /**

package/dist/{plugin-BccET1tL.mjs → plugin-BDBOS3-c.mjs}

@@ -1,23 +1,23 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { g as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-Cu7Mx7_U.mjs";
-import { t as arcLog } from "./logger-DXjfIqjV.mjs";
-import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-CtrywMHP.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-auW8QjXN.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BbkIF6vA.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-aklawRaK.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-Bk9NOgOC.mjs";
-import { r as resolveTenancy } from "./tenancy--ed9eH_z.mjs";
-import { t as buildQueryKey } from "./keys-B2KtgMLJ.mjs";
-import { t as transactionContext } from "./transactionContext-DjFkrNG6.mjs";
-import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-ToPYpMqS.mjs";
-import { E as ArcQueryParser, v as getDefaultCrudSchemas } from "./utils-ec1oTo1n.mjs";
-import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-BORek3O-.mjs";
-import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-DjTQhZrN.mjs";
-import { _ as buildArcDecorator, a as resolveRouterPluginMw, b as createRequestContext, c as buildPipelineHandler, d as buildCrudPermissionMw, f as buildRouteHooks, h as buildAuthMiddleware, i as buildRouteConfig, l as resolvePipelineSteps, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, p as resolveRoutePreHandlers, r as buildRateLimitConfig, t as resolveActionPermission, v as createCrudHandlers, y as createFastifyHandler } from "./actionPermissions-BotX1YOa.mjs";
-import { a as withoutTenantInjection } from "./tenantPreparation-BKon6Yox.mjs";
-import { t as hasEvents } from "./typeGuards-CySF12G-.mjs";
-import { n as idempotencyConfigProblem } from "./requirement-KDdoRcOP.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { g as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-B90SnSQn.mjs";
+import { t as arcLog } from "./logger-vxu0DXf_.mjs";
+import { t as conjoinPolicyFilters } from "./filter-merge-BYKBa9b2.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-C9G4A8cN.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-WdZw6GOt.mjs";
+import { n as requireSingleHeaderValue } from "./headers-B6DRXXzT.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-Nc5ePCsf.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-4JKkSvds.mjs";
+import { r as resolveTenancy } from "./tenancy-D7jo78AP.mjs";
+import { t as buildQueryKey } from "./keys-BoZKnBel.mjs";
+import { t as transactionContext } from "./transactionContext-BWp0MBGL.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-Da--1DNS.mjs";
+import { E as ArcQueryParser, v as getDefaultCrudSchemas } from "./utils-QWSIKqAk.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-rzBovk00.mjs";
+import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BLg1buwL.mjs";
+import { _ as buildArcDecorator, a as resolveRouterPluginMw, b as createRequestContext, c as buildPipelineHandler, d as buildCrudPermissionMw, f as buildRouteHooks, h as buildAuthMiddleware, i as buildRouteConfig, l as resolvePipelineSteps, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, p as resolveRoutePreHandlers, r as buildRateLimitConfig, t as resolveActionPermission, v as createCrudHandlers, y as createFastifyHandler } from "./actionPermissions-TAc_6LCw.mjs";
+import { a as withoutTenantInjection } from "./tenantPreparation-DqJnokDW.mjs";
+import { t as hasEvents } from "./typeGuards-CtZJypJO.mjs";
+import { n as idempotencyConfigProblem } from "./requirement-tXpcD56f.mjs";
 import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
@@ -1431,12 +1431,22 @@ var BaseCrudController = class {
 		return this.repository !== void 0 && this.repository !== null;
 	}
 	async isActionTargetVisible(req, id) {
+		return (await this.loadActionTarget(req, id)).visible;
+	}
+	/**
+	* The fence's answer plus the row it read (absent when the resource has no row scope, so
+	* nothing was read). The router hands the row to the handler as `getActionTarget(req)`.
+	*/
+	async loadActionTarget(req, id) {
 		const meta = this.meta(req);
 		const scoped = resolveTenancy(meta, this.tenantField).mode === "scoped";
 		const policy = meta?._policyFilters;
-		if (!scoped && (!policy || Object.keys(policy).length === 0)) return true;
+		if (!scoped && (!policy || Object.keys(policy).length === 0)) return { visible: true };
 		const { doc } = await this.fetchByAnyKey(id, req, this.tenantRepoOptions(req));
-		return doc !== null && doc !== void 0;
+		return doc === null || doc === void 0 ? { visible: false } : {
+			visible: true,
+			doc
+		};
 	}
 	/** `ETag: "<version>"` for a versioned document under optimistic concurrency. */
 	etagHeaders(doc) {
@@ -1565,7 +1575,7 @@ var BaseCrudController = class {
 	inFlightCacheFills = /* @__PURE__ */ new Map();
 	cacheSingleFlight(key, fill) {
 		const existing = this.inFlightCacheFills.get(key);
-		if (existing) return existing;
+		if (existing !== void 0) return existing;
 		const flight = fill().finally(() => {
 			this.inFlightCacheFills.delete(key);
 		});
@@ -2992,7 +3002,9 @@ function resolveActionTargetFence(resource, actionConfig) {
 		if (typeof resource.tenantField === "string" || ctrl !== void 0 && resource.tenantField !== false) throw new Error(`[Arc] Resource '${resource.name}' is tenant-scoped (tenantField '${resource.tenantField === void 0 ? "organizationId (default)" : resource.tenantField}') and declares id-bound actions [${fenced.join(", ")}], but its controller cannot authorize an action target. Use a BaseController with a repository, declare \`tenantField: false\`, or declare \`target: { scope: 'handler', reason }\` on each action.`);
 		return;
 	}
-	return (id, ctx) => check.call(ctrl, ctx, id);
+	const load = ctrl?.loadActionTarget;
+	if (typeof load === "function") return (id, ctx) => load.call(ctrl, ctx, id);
+	return async (id, ctx) => ({ visible: await check.call(ctrl, ctx, id) });
 }
 /**
 * Build the FastifyPluginAsync that materialises a `ResourceDefinition` into
@@ -3072,12 +3084,12 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-xjqonMRO.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-BgPCYU2U.mjs").then((n) => n.n);
 				const actionConfig = normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log);
 				const actionTarget = resolveActionTargetFence(resource, actionConfig);
 				createActionRouter(typedInstance, {
 					...actionConfig,
-					...actionTarget ? { isTargetVisible: (id, req) => actionTarget(id, createRequestContext(req)) } : {},
+					...actionTarget ? { loadTarget: (id, req) => actionTarget(id, createRequestContext(req)) } : {},
 					auditActions: Boolean(resource.audit),
 					resourceName: resource.name,
 					fields: resource.fields,
@@ -3092,7 +3104,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-zRYWw_5D.mjs"), import("./validate-9yzHC1e2.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-lNCkDwKe.mjs"), import("./validate-CT4umNhp.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/plugins/index.d.mts

@@ -1,10 +1,10 @@
 
 import { t as AnyRecord } from "../base-CZyixEQR.mjs";
-import { Et as RouteDefinition, J as MiddlewareConfig, U as PresetHook, X as RouteSchemaOptions } from "../index-mqaqZNpe.mjs";
+import { Et as RouteDefinition, J as MiddlewareConfig, U as PresetHook, X as RouteSchemaOptions } from "../index-WH7xgvxS.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler--4rSMMvq.mjs";
 import { C as _default$8, E as _default$3, S as SchedulesPluginOptions, T as HealthOptions, b as ScheduleDefinition, w as HealthCheck, x as ScheduleStats } from "../types-BJ-2XqVF.mjs";
-import { i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-DhUJ-mvo.mjs";
-import { _ as _default$2, a as MetricsOptions, c as RealtimeOptions, d as _default$9, f as CachingOptions, g as ShutdownState, h as GracefulShutdownOptions, i as MetricsCollector, l as _default$6, m as _default$1, n as _default$10, o as _default$4, p as CachingRule, r as MetricEntry, s as ChangeOperation, t as VersioningOptions, u as SSEOptions } from "../versioning-Bsb51gGT.mjs";
+import { i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-DRlCIWE9.mjs";
+import { _ as ShutdownState, a as MetricsOptions, c as RealtimeOptions, d as SSEStats, f as _default$9, g as GracefulShutdownOptions, h as _default$1, i as MetricsCollector, l as _default$6, m as CachingRule, n as _default$10, o as _default$4, p as CachingOptions, r as MetricEntry, s as ChangeOperation, t as VersioningOptions, u as SSEOptions, v as _default$2 } from "../versioning-Bqm_57Qt.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -57,7 +57,7 @@ interface ArcPlugin<TRootOpts extends object = AnyRecord, TResourceOpts extends
  * @param definition - Plugin setup functions
  * @returns ArcPlugin with forRoot() and forResource() methods
  */
-declare function createPlugin<TRootOpts extends object = AnyRecord, TResourceOpts extends object = AnyRecord>(name: string, definition: CreatePluginDefinition<TRootOpts, TResourceOpts>): ArcPlugin<TRootOpts, TResourceOpts>;
+export declare function createPlugin<TRootOpts extends object = AnyRecord, TResourceOpts extends object = AnyRecord>(name: string, definition: CreatePluginDefinition<TRootOpts, TResourceOpts>): ArcPlugin<TRootOpts, TResourceOpts>;
 //#endregion
 //#region src/plugins/pressure.d.ts
 /**
@@ -176,7 +176,7 @@ declare module "fastify" {
   }
 }
 declare function replyHelpersPluginFn(fastify: FastifyInstance): Promise<void>;
-declare const replyHelpersPlugin: typeof replyHelpersPluginFn;
+export declare const replyHelpersPlugin: typeof replyHelpersPluginFn;
 //#endregion
 //#region src/plugins/requestId.d.ts
 interface RequestIdOptions {
@@ -214,16 +214,16 @@ declare module "fastify" {
  * (repeated headers) are rejected outright — a client sending multiple
  * request-id headers is not tracing in good faith.
  */
-declare function sanitizeRequestId(value: unknown): string | undefined;
+export declare function sanitizeRequestId(value: unknown): string | undefined;
 /**
  * Build a Fastify `genReqId` function: adopt a sanitized incoming request-id
  * header, or generate one. Wire this into the `Fastify()` constructor so
  * `request.id`, `request.log`'s `reqId` binding, and the echoed response
  * header all agree — `createApp` does this automatically.
  */
-declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header" | "generator">): (req: {
+export declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header" | "generator">): (req: {
   headers: Record<string, string | string[] | undefined>;
 }) => string;
 declare const _default$7: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type ShutdownState, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, _default$1 as cachingPlugin, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, _default$2 as gracefulShutdownPlugin, _default$3 as healthPlugin, _default$4 as metricsPlugin, _default$5 as pressurePlugin, _default$6 as realtimePlugin, replyHelpersPlugin, _default$7 as requestIdPlugin, sanitizeRequestId, _default$8 as schedulesPlugin, _default$9 as ssePlugin, _default$10 as versioningPlugin };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type SSEStats, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type ShutdownState, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, _default$1 as cachingPlugin, defaultIsDuplicateKeyError, errorHandlerPlugin, _default$2 as gracefulShutdownPlugin, _default$3 as healthPlugin, _default$4 as metricsPlugin, _default$5 as pressurePlugin, _default$6 as realtimePlugin, _default$7 as requestIdPlugin, _default$8 as schedulesPlugin, _default$9 as ssePlugin, _default$10 as versioningPlugin };

package/dist/plugins/index.mjs

@@ -1,20 +1,20 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { m as MUTATION_OPERATIONS } from "../constants-Cu7Mx7_U.mjs";
-import { t as arcLog } from "../logger-DXjfIqjV.mjs";
-import { c as getOrgId } from "../types-Bk9NOgOC.mjs";
-import { n as requestContext } from "../requestContext-Dsu9P1bV.mjs";
-import { t as hasEvents } from "../typeGuards-CySF12G-.mjs";
-import { t as HookSystem } from "../HookSystem-B6UaKRbF.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CuCARu2B.mjs";
-import { c as createRequestIdGenerator, l as requestId_default, n as health_default, u as sanitizeRequestId } from "../health-DqbsG-_w.mjs";
-import { t as caching_default } from "../caching-Cc2M1DwO.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BnfDviL1.mjs";
-import { t as metrics_default } from "../metrics-CWI11eRu.mjs";
-import { t as realtime_default } from "../realtime-DmPE9S54.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-CG_VtVgS.mjs";
-import { t as schedules_default } from "../schedules-C-OpmHBq.mjs";
-import { t as sse_default } from "../sse-CYzQBVFe.mjs";
-import { t as versioning_default } from "../versioning-fhhWHV74.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { m as MUTATION_OPERATIONS } from "../constants-B90SnSQn.mjs";
+import { t as arcLog } from "../logger-vxu0DXf_.mjs";
+import { c as getOrgId } from "../types-4JKkSvds.mjs";
+import { n as requestContext } from "../requestContext-B8JKbeb7.mjs";
+import { t as hasEvents } from "../typeGuards-CtZJypJO.mjs";
+import { t as HookSystem } from "../HookSystem-CtnnYHME.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-BNoHOx-D.mjs";
+import { c as createRequestIdGenerator, l as requestId_default, n as health_default, u as sanitizeRequestId } from "../health-pLbfckGB.mjs";
+import { t as caching_default } from "../caching-TQfW2QX7.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DbHGwrQM.mjs";
+import { t as metrics_default } from "../metrics-wfr7XFE7.mjs";
+import { t as realtime_default } from "../realtime-MPj6eIoV.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-BW_p67QD.mjs";
+import { t as schedules_default } from "../schedules-Dr9gNFzx.mjs";
+import { t as sse_default } from "../sse-D8AgoUN3.mjs";
+import { t as versioning_default } from "../versioning-JIqxO64K.mjs";
 import fp from "fastify-plugin";
 import { performance as performance$1 } from "node:perf_hooks";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.d.mts

@@ -1,13 +1,13 @@
 
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/response-cache.d.ts
-interface ResponseCacheRule {
+export interface ResponseCacheRule {
   /** Path prefix to match (e.g., '/api/products') */
   match: string;
   /** TTL in seconds for this path (0 = don't cache) */
   ttl: number;
 }
-interface ResponseCacheOptions {
+export interface ResponseCacheOptions {
   /** Maximum number of cached entries (default: 500). LRU eviction when exceeded. */
   maxEntries?: number;
   /** Default TTL in seconds (default: 30). Set to 0 to require explicit rules. */
@@ -46,7 +46,7 @@ interface ResponseCacheOptions {
     patterns?: Record<string, string[]>;
   };
 }
-interface ResponseCacheStats {
+export interface ResponseCacheStats {
   entries: number;
   maxEntries: number;
   hits: number;
@@ -85,6 +85,5 @@ declare module "fastify" {
     __arcCacheTTL?: number;
   }
 }
-declare const responseCachePlugin: FastifyPluginAsync<ResponseCacheOptions>;
-//#endregion
-export { ResponseCacheOptions, ResponseCacheRule, ResponseCacheStats, responseCachePlugin };
+export declare const responseCachePlugin: FastifyPluginAsync<ResponseCacheOptions>;
+//#endregion

package/dist/plugins/response-cache.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
-import { t as hasEvents } from "../typeGuards-CySF12G-.mjs";
-import { n as evictToSize, r as touch, t as assertCapacity } from "../boundedMap-BULzfXYU.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-C7gAbIxC.mjs";
+import { t as hasEvents } from "../typeGuards-CtZJypJO.mjs";
+import { n as evictToSize, r as touch, t as assertCapacity } from "../boundedMap-DQfXgxMo.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -59,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.43.0";
+	const resolvedVersion = serviceVersion ?? "2.45.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-CVIOcgMF.mjs → pluralize-B4FcZEyI.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/presets/filesUpload.d.mts

@@ -1,15 +1,15 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck } from "../base-CZyixEQR.mjs";
-import { W as PresetResult } from "../index-mqaqZNpe.mjs";
+import { W as PresetResult } from "../index-WH7xgvxS.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
-interface FilesUploadPresetRoutes {
+export interface FilesUploadPresetRoutes {
   upload?: boolean;
   read?: boolean;
   delete?: boolean;
 }
-interface FilesUploadPresetPermissions {
+export interface FilesUploadPresetPermissions {
   upload?: PermissionCheck;
   read?: PermissionCheck;
   delete?: PermissionCheck;
@@ -27,8 +27,8 @@ interface FilesUploadPresetPermissions {
  * - function: custom policy. Return a string to *transform* the filename,
  *   `false` to reject (triggers `ValidationError`), or `true`/`void` to accept.
  */
-type FilenamePolicy = boolean | "*" | ((filename: string) => string | boolean | undefined);
-interface FilesUploadPresetOptions {
+export type FilenamePolicy = boolean | "*" | ((filename: string) => string | boolean | undefined);
+export interface FilesUploadPresetOptions {
   /** Any implementation of the `Storage` interface. App owns it. */
   storage: Storage;
   /** Multipart form field name. Default: `'file'`. */
@@ -66,6 +66,6 @@ interface FilesUploadPresetOptions {
  * envelope. Upload still returns the standard `{ success: true, data }`
  * envelope manually because the response is structured metadata, not bytes.
  */
-declare function filesUploadPreset(options: FilesUploadPresetOptions): PresetResult;
+export declare function filesUploadPreset(options: FilesUploadPresetOptions): PresetResult;
 //#endregion
-export { FilenamePolicy, FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, type Storage, type StorageContext, type StorageFile, type StorageReadRange, type StorageReadResult, type StorageUploadInput, filesUploadPreset };
+export type { Storage, StorageContext, StorageFile, StorageReadRange, StorageReadResult, StorageUploadInput };

package/dist/presets/filesUpload.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-CtrywMHP.mjs";
-import { c as getOrgId, g as getUserId } from "../types-Bk9NOgOC.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-Cm0uYHvd.mjs";
-import { t as multipartBody } from "../multipartBody-CXM2a-Dy.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-C9G4A8cN.mjs";
+import { c as getOrgId, g as getUserId } from "../types-4JKkSvds.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-IdHJ0_5V.mjs";
+import { t as multipartBody } from "../multipartBody-NHGOuUnG.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10485760;