@classytic/arc 2.43.0 → 2.45.0

package/dist/idempotency/index.mjs

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { d as createDomainError } from "../errors-CtrywMHP.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BbkIF6vA.mjs";
-import { i as requestRequiresIdempotencyKey, n as idempotencyConfigProblem, r as requestDedupedByHandler, t as declaresIdempotencyFence } from "../requirement-KDdoRcOP.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-BOzk-CuX.mjs";
-import { n as createIdempotencyResult, r as operationIdentity, t as resolveIdempotencyTiming } from "../timing-qczZ0YC-.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { d as createDomainError } from "../errors-C9G4A8cN.mjs";
+import { n as requireSingleHeaderValue } from "../headers-B6DRXXzT.mjs";
+import { i as requestRequiresIdempotencyKey, n as idempotencyConfigProblem, r as requestDedupedByHandler, t as declaresIdempotencyFence } from "../requirement-tXpcD56f.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-Bxk7TDgG.mjs";
+import { n as createIdempotencyResult, r as operationIdentity, t as resolveIdempotencyTiming } from "../timing-Y6_ZpoYG.mjs";
+import { n as acquireIdempotencyKey, r as releaseIdempotencyLock } from "../acquire-BW_2Dt60.mjs";
 import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
@@ -64,22 +65,12 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 	}
 	return {
 		name: "repository",
+		completionReleasesLock: true,
 		async get(key) {
 			const doc = await safeGetOne(eq(idField, key));
 			if (!doc) return void 0;
 			assertKeyIdentity("get", doc, key);
-			if (!isCompleted(doc)) return void 0;
-			if (new Date(doc.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
-			return {
-				key,
-				...doc.result.requestFingerprint ? { requestFingerprint: doc.result.requestFingerprint } : {},
-				statusCode: doc.result.statusCode,
-				headers: doc.result.headers,
-				body: doc.result.body,
-				...doc.result.bodyEncoding ? { bodyEncoding: doc.result.bodyEncoding } : {},
-				createdAt: new Date(doc.createdAt),
-				expiresAt: new Date(doc.expiresAt)
-			};
+			return completedResult(doc, key);
 		},
 		async set(key, result) {
 			const doc = await r.findOneAndUpdate(eq(idField, key), update({
@@ -103,21 +94,66 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 			if (doc) assertKeyIdentity("set", doc, key);
 		},
 		async setIfLocked(key, requestId, result) {
-			const doc = await r.findOneAndUpdate(and(eq(idField, key), eq("lock.requestId", requestId), gt("lock.expiresAt", /* @__PURE__ */ new Date())), update({ set: {
-				result: {
-					statusCode: result.statusCode,
-					headers: result.headers,
-					body: result.body,
-					...result.requestFingerprint ? { requestFingerprint: result.requestFingerprint } : {},
-					...result.bodyEncoding ? { bodyEncoding: result.bodyEncoding } : {}
+			const doc = await r.findOneAndUpdate(and(eq(idField, key), eq("lock.requestId", requestId), gt("lock.expiresAt", /* @__PURE__ */ new Date())), update({
+				set: {
+					result: {
+						statusCode: result.statusCode,
+						headers: result.headers,
+						body: result.body,
+						...result.requestFingerprint ? { requestFingerprint: result.requestFingerprint } : {},
+						...result.bodyEncoding ? { bodyEncoding: result.bodyEncoding } : {}
+					},
+					createdAt: result.createdAt,
+					expiresAt: result.expiresAt
 				},
-				createdAt: result.createdAt,
-				expiresAt: result.expiresAt
-			} }), { returnDocument: "after" });
+				unset: ["lock"]
+			}), { returnDocument: "after" });
 			if (!doc) return false;
 			assertKeyIdentity("setIfLocked", doc, key);
 			return true;
 		},
+		async acquire(key, requestId, lockTtlMs) {
+			for (let attempt = 0; attempt < 2; attempt++) {
+				const now = /* @__PURE__ */ new Date();
+				let doc = null;
+				try {
+					doc = await r.findOneAndUpdate(and(eq(idField, key), or(exists("result.statusCode", false), lt("expiresAt", now)), or(exists("lock", false), lt("lock.expiresAt", now))), update({
+						set: {
+							lock: {
+								requestId,
+								expiresAt: new Date(now.getTime() + lockTtlMs)
+							},
+							expiresAt: new Date(now.getTime() + defaultTtlMs)
+						},
+						unset: ["result"],
+						setOnInsert: {
+							[idField]: key,
+							createdAt: now
+						}
+					}), {
+						upsert: true,
+						returnDocument: "after"
+					});
+				} catch (err) {
+					if (!isDuplicateKeyError(err)) throw err;
+				}
+				if (doc) {
+					assertKeyIdentity("acquire", doc, key);
+					return { status: "acquired" };
+				}
+				const existing = await safeGetOne(eq(idField, key));
+				if (existing) {
+					assertKeyIdentity("acquire", existing, key);
+					const result = completedResult(existing, key);
+					if (result) return {
+						status: "completed",
+						result
+					};
+					if (existing.lock && new Date(existing.lock.expiresAt) > /* @__PURE__ */ new Date()) return { status: "locked" };
+				}
+			}
+			return { status: "locked" };
+		},
 		async tryLock(key, requestId, ttlMs) {
 			const now = /* @__PURE__ */ new Date();
 			const lockExpiresAt = new Date(now.getTime() + ttlMs);
@@ -175,6 +211,21 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 		async close() {}
 	};
 }
+/** The row's unexpired completed response, or `undefined`. */
+function completedResult(doc, key) {
+	if (!isCompleted(doc)) return void 0;
+	if (new Date(doc.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
+	return {
+		key,
+		...doc.result.requestFingerprint ? { requestFingerprint: doc.result.requestFingerprint } : {},
+		statusCode: doc.result.statusCode,
+		headers: doc.result.headers,
+		body: doc.result.body,
+		...doc.result.bodyEncoding ? { bodyEncoding: doc.result.bodyEncoding } : {},
+		createdAt: new Date(doc.createdAt),
+		expiresAt: new Date(doc.expiresAt)
+	};
+}
 /**
 * A row holds a completed response only when it has a status code. A lock-only row can read back
 * with `result: {}` (a nested path in a mongoose schema); replaying that would answer nothing.
@@ -186,6 +237,7 @@ function isCompleted(doc) {
 //#region src/idempotency/stores/memory.ts
 var MemoryIdempotencyStore = class {
 	name = "memory";
+	completionReleasesLock = true;
 	results = /* @__PURE__ */ new Map();
 	locks = /* @__PURE__ */ new Map();
 	ttlMs;
@@ -223,8 +275,28 @@ var MemoryIdempotencyStore = class {
 		const lock = this.locks.get(key);
 		if (!lock || lock.requestId !== requestId || lock.expiresAt.getTime() <= Date.now()) return false;
 		this.writeResult(key, result);
+		this.locks.delete(key);
 		return true;
 	}
+	async acquire(key, requestId, lockTtlMs) {
+		const result = this.results.get(key);
+		if (result) {
+			if (Date.now() <= new Date(result.expiresAt).getTime()) return {
+				status: "completed",
+				result
+			};
+			this.results.delete(key);
+		}
+		const lock = this.locks.get(key);
+		if (lock && Date.now() <= new Date(lock.expiresAt).getTime()) return { status: "locked" };
+		this.locks.set(key, {
+			key,
+			requestId,
+			lockedAt: /* @__PURE__ */ new Date(),
+			expiresAt: new Date(Date.now() + lockTtlMs)
+		});
+		return { status: "acquired" };
+	}
 	async tryLock(key, requestId, ttlMs) {
 		const existing = this.locks.get(key);
 		if (existing) {
@@ -443,12 +515,12 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		request.idempotencyKey = idempotencyKey;
 		const fullKey = `${idempotencyKey}:${operationIdentity$1(request)}`;
 		const requestFingerprint = bodyFingerprint(request);
-		const cached = await store.get(fullKey);
-		if (cached) {
-			replay(request, reply, cached, requestFingerprint);
+		const acquisition = await acquireIdempotencyKey(store, fullKey, request.id, lockTimeoutMs);
+		if (acquisition.status === "completed") {
+			replay(request, reply, acquisition.result, requestFingerprint);
 			return reply;
 		}
-		if (!await store.tryLock(fullKey, request.id, lockTimeoutMs)) {
+		if (acquisition.status === "locked") {
 			reply.code(409).header("Retry-After", retryAfterSeconds.toString()).send({
 				code: ARC_ERROR_CODES.IDEMPOTENCY_CONFLICT,
 				message: "Request with this idempotency key is already in progress",
@@ -459,19 +531,6 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		}
 		request._idempotencyFullKey = fullKey;
 		request._idempotencyFingerprint = requestFingerprint;
-		try {
-			const completed = await store.get(fullKey);
-			if (completed) {
-				await store.unlock(fullKey, request.id);
-				request._idempotencyFullKey = void 0;
-				replay(request, reply, completed, requestFingerprint);
-				return reply;
-			}
-		} catch (err) {
-			await store.unlock(fullKey, request.id);
-			request._idempotencyFullKey = void 0;
-			throw err;
-		}
 		reply.header(HEADER_IDEMPOTENCY_KEY, idempotencyKey);
 	};
 	fastify.addHook("onRoute", (route) => {
@@ -495,6 +554,8 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		lockTimeoutMs
 	});
 	const recordedResponses = /* @__PURE__ */ new WeakSet();
+	/** Completed through `setIfLocked` — the lock is already gone when the store says so. */
+	const fencedCompletions = /* @__PURE__ */ new WeakSet();
 	async function recordResponse(request, reply, payload, binary = false) {
 		if (request.idempotencyReplayed || recordedResponses.has(request)) return;
 		const fullKey = request._idempotencyFullKey;
@@ -519,6 +580,7 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		};
 		if (store.setIfLocked && store.supportsFencedCompletion !== false) {
 			if (!await store.setIfLocked(fullKey, request.id, completion)) throw createDomainError(ARC_ERROR_CODES.IDEMPOTENCY_CONFLICT, "This request lost its idempotency lease before completion; its effect may have been applied. Retry the same key to retrieve the current owner's result.", 409);
+			fencedCompletions.add(request);
 		} else await store.set(fullKey, completion);
 		recordedResponses.add(request);
 	}
@@ -532,7 +594,7 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		if (request.idempotencyReplayed) return;
 		const fullKey = request._idempotencyFullKey;
 		if (!fullKey) return;
-		await store.unlock(fullKey, request.id);
+		await releaseIdempotencyLock(store, fullKey, request.id, fencedCompletions.has(request));
 	});
 	fastify.addHook("onClose", async () => {
 		if (ownsStore) await store.close?.();

package/dist/idempotency/redis.d.mts

@@ -1,3 +1,3 @@
 
-import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-vLvtcGy_.mjs";
+import { a as UpstashRedisLike, i as RedisIdempotencyStoreOptions, n as RedisClient, o as ioredisAsIdempotencyClient, r as RedisIdempotencyStore, s as upstashAsIdempotencyClient, t as IoredisLike } from "../redis-BDgv9Glw.mjs";
 export { type IoredisLike, type RedisClient, RedisIdempotencyStore, type RedisIdempotencyStoreOptions, type UpstashRedisLike, ioredisAsIdempotencyClient, upstashAsIdempotencyClient };

package/dist/idempotency/redis.mjs

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { t as acquireBySteps } from "../acquire-BW_2Dt60.mjs";
 import { createHash } from "node:crypto";
 //#region src/idempotency/stores/redis.ts
 /**
@@ -21,6 +22,8 @@ import { createHash } from "node:crypto";
 var RedisIdempotencyStore = class {
 	name = "redis";
 	supportsFencedCompletion;
+	/** The fenced completion script deletes the lock; it needs `eval`, as fencing does. */
+	completionReleasesLock;
 	client;
 	prefix;
 	lockPrefix;
@@ -28,6 +31,7 @@ var RedisIdempotencyStore = class {
 	constructor(options) {
 		this.client = options.client;
 		this.supportsFencedCompletion = typeof options.client.eval === "function";
+		this.completionReleasesLock = this.supportsFencedCompletion;
 		this.prefix = options.prefix ?? "idem:";
 		this.lockPrefix = options.lockPrefix ?? "idem:lock:";
 		if (this.prefix.match(/\{([^}]+)\}/)?.[1] !== this.lockPrefix.match(/\{([^}]+)\}/)?.[1]) throw new Error("Redis idempotency prefixes must use the same Redis Cluster hash tag or neither may use one.");
@@ -40,7 +44,9 @@ var RedisIdempotencyStore = class {
 		return `${this.lockPrefix}${key}:{${createHash("sha256").update(key).digest("hex")}}`;
 	}
 	async get(key) {
-		const data = await this.client.get(this.resultKey(key));
+		return this.parseResult(await this.client.get(this.resultKey(key)));
+	}
+	parseResult(data) {
 		if (!data) return void 0;
 		try {
 			const result = JSON.parse(data);
@@ -69,6 +75,27 @@ var RedisIdempotencyStore = class {
 			NX: true
 		}) === "OK";
 	}
+	async acquire(key, requestId, lockTtlMs) {
+		const client = this.client;
+		if (typeof client.eval !== "function") return acquireBySteps(this, key, requestId, lockTtlMs);
+		const reply = await client.eval(`
+      local done = redis.call("get", KEYS[2])
+      if done then return {1, done} end
+      if redis.call("set", KEYS[1], ARGV[1], "NX", "PX", ARGV[2]) then return {2} end
+      return {0}
+    `, 2, this.lockKey(key), this.resultKey(key), requestId, Math.max(1, Math.ceil(lockTtlMs)));
+		const tag = Number(reply?.[0]);
+		if (tag === 2) return { status: "acquired" };
+		if (tag === 1) {
+			const result = this.parseResult(reply?.[1] ?? null);
+			if (result) return {
+				status: "completed",
+				result
+			};
+			return await this.tryLock(key, requestId, lockTtlMs) ? { status: "acquired" } : { status: "locked" };
+		}
+		return { status: "locked" };
+	}
 	async setIfLocked(key, requestId, result) {
 		if (typeof this.client.eval !== "function") throw new Error("Redis idempotency fenced completion requires eval; proxy eval through your Redis client adapter.");
 		const ttlMs = new Date(result.expiresAt).getTime() - Date.now();
@@ -76,6 +103,7 @@ var RedisIdempotencyStore = class {
 		const saved = await this.client.eval(`
       if redis.call("get", KEYS[1]) ~= ARGV[1] then return 0 end
       redis.call("set", KEYS[2], ARGV[2], "PX", ARGV[3])
+      redis.call("del", KEYS[1])
       return 1
     `, 2, this.lockKey(key), this.resultKey(key), requestId, JSON.stringify({
 			key,

package/dist/{index-CRoPtISf.d.mts → index-Beg3aNnK.d.mts}

@@ -1,8 +1,8 @@
 
 import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
 import { l as PermissionCheck, t as AnyRecord } from "./base-CZyixEQR.mjs";
-import { A as RequestWithExtras, Dt as RouteMcpConfig, F as ResourceDefinition, I as CrudController, In as IControllerResponse, L as ResourceConfig, Ln as IRequestContext, O as FastifyWithDecorators, St as ActionDefinition, X as RouteSchemaOptions, Z as ArcFieldRule, g as RequestContext, ot as AggregationConfig, v as CrudRouterOptions } from "./index-mqaqZNpe.mjs";
-import "./fastify-augmentation-DhUJ-mvo.mjs";
+import { A as RequestWithExtras, Dt as RouteMcpConfig, F as ResourceDefinition, Hn as IRequestContext, I as CrudController, L as ResourceConfig, O as FastifyWithDecorators, St as ActionDefinition, Vn as IControllerResponse, X as RouteSchemaOptions, Z as ArcFieldRule, g as RequestContext, ot as AggregationConfig, v as CrudRouterOptions } from "./index-WH7xgvxS.mjs";
+import "./fastify-augmentation-DRlCIWE9.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
@@ -271,34 +271,6 @@ type VariantsResult<TDoc, V extends VariantsMap<TDoc>> = { [K in keyof V]: Resou
  */
 declare function defineResourceVariants<TDoc extends object = AnyRecord, V extends VariantsMap<TDoc> = VariantsMap<TDoc>>(base: Omit<ResourceConfig<TDoc>, "name" | "prefix">, variants: V): VariantsResult<TDoc, V>;
 //#endregion
-//#region src/core/entityHelpers.d.ts
-/**
- * Read the resource's configured `idField` for the current request.
- * Falls back to the framework default (`_id`) when the route hasn't
- * bound an idField — keeps handlers safe to author without checking
- * the resource config.
- */
-declare function getEntityIdField(req: RequestWithExtras): string;
-/**
- * Read the URL `:id` path param value as the resource handle.
- * Returns `undefined` when the route has no `:id` segment (collection
- * routes) — handlers that need the entity must be on row routes.
- */
-declare function getEntityId(req: RequestWithExtras): string | undefined;
-/**
- * Compose a `findOne` filter that resolves the current request's
- * entity, regardless of whether the resource binds `_id` or a custom
- * field. Idiomatic shape for arc action handlers.
- *
- * ```ts
- * const doc = await Model.findOne(getEntityQuery(req));
- * ```
- *
- * Returns `{}` when the route has no entity context (collection routes
- * or tests bypassing the router) — caller decides what that means.
- */
-declare function getEntityQuery(req: RequestWithExtras): Record<string, string>;
-//#endregion
 //#region src/core/fastifyAdapter.d.ts
 /**
  * Project `FastifyRequest` into the `IRequestContext` controllers receive,
@@ -396,4 +368,4 @@ declare function formatValidationErrors(resourceName: string, result: Validation
  */
 declare function assertValidConfig(config: ResourceConfig, options?: ValidateOptions): void;
 //#endregion
-export { createPermissionMiddleware as A, DEFAULT_VERSION_FIELD as B, AdapterLike as C, DefineActionConfig as D, mergeResourceConfig as E, DEFAULT_LIMIT as F, MAX_FILTER_DEPTH as G, HOOK_PHASES as H, DEFAULT_MAX_LIMIT as I, MUTATION_OPERATIONS as J, MAX_REGEX_LENGTH as K, DEFAULT_SORT as L, CRUD_OPERATIONS as M, CrudOperation as N, defineAction as O, DEFAULT_ID_FIELD as P, DEFAULT_TENANT_FIELD as R, defineResourceVariants as S, SeamedResourceConfig as T, HookOperation as U, HOOK_OPERATIONS as V, HookPhase as W, RESERVED_QUERY_PARAMS as X, MutationOperation as Y, SYSTEM_FIELDS as Z, getEntityIdField as _, formatValidationErrors as a, VariantsMap as b, nativePolicyFilter as c, createFastifyHandler as d, createRequestContext as f, getEntityId as g, sendControllerResponse as h, assertValidConfig as i, defineAggregation as j, createCrudRouter as k, collectReadBlockedFields as l, getControllerScope as m, ValidateOptions as n, validateResourceConfig as o, getControllerContext as p, MAX_SEARCH_LENGTH as q, ValidationResult as r, NativePolicyFilter as s, ConfigError as t, isFieldReadable as u, getEntityQuery as v, ResourceSeams as w, VariantsResult as x, VariantOverride as y, DEFAULT_UPDATE_METHOD as z };
+export { CrudOperation as A, HookOperation as B, mergeResourceConfig as C, createPermissionMiddleware as D, createCrudRouter as E, DEFAULT_TENANT_FIELD as F, MUTATION_OPERATIONS as G, MAX_FILTER_DEPTH as H, DEFAULT_UPDATE_METHOD as I, SYSTEM_FIELDS as J, MutationOperation as K, DEFAULT_VERSION_FIELD as L, DEFAULT_LIMIT as M, DEFAULT_MAX_LIMIT as N, defineAggregation as O, DEFAULT_SORT as P, HOOK_OPERATIONS as R, SeamedResourceConfig as S, defineAction as T, MAX_REGEX_LENGTH as U, HookPhase as V, MAX_SEARCH_LENGTH as W, VariantsMap as _, formatValidationErrors as a, AdapterLike as b, nativePolicyFilter as c, createFastifyHandler as d, createRequestContext as f, VariantOverride as g, sendControllerResponse as h, assertValidConfig as i, DEFAULT_ID_FIELD as j, CRUD_OPERATIONS as k, collectReadBlockedFields as l, getControllerScope as m, ValidateOptions as n, validateResourceConfig as o, getControllerContext as p, RESERVED_QUERY_PARAMS as q, ValidationResult as r, NativePolicyFilter as s, ConfigError as t, isFieldReadable as u, VariantsResult as v, DefineActionConfig as w, ResourceSeams as x, defineResourceVariants as y, HOOK_PHASES as z };

package/dist/{index-JdbZAIsm.d.mts → index-CUJvoyw3.d.mts}

@@ -1,5 +1,5 @@
 
-import { F as ResourceDefinition } from "./index-mqaqZNpe.mjs";
+import { F as ResourceDefinition } from "./index-WH7xgvxS.mjs";
 import { h as ModuleSetupContext, i as ArcModuleRegistry, l as ModuleContribution, n as ArcModule, o as ArcPorts, p as PortName, r as ArcModuleInput, u as ModuleName } from "./types-BJ-2XqVF.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/graph.d.ts

package/dist/{index-mqaqZNpe.d.mts → index-WH7xgvxS.d.mts}

@@ -1042,6 +1042,50 @@ declare class AccessControl {
   private _meta;
 }
 //#endregion
+//#region src/core/entityHelpers.d.ts
+/**
+ * Read the resource's configured `idField` for the current request.
+ * Falls back to the framework default (`_id`) when the route hasn't
+ * bound an idField — keeps handlers safe to author without checking
+ * the resource config.
+ */
+declare function getEntityIdField(req: RequestWithExtras): string;
+/**
+ * Read the URL `:id` path param value as the resource handle.
+ * Returns `undefined` when the route has no `:id` segment (collection
+ * routes) — handlers that need the entity must be on row routes.
+ */
+declare function getEntityId(req: RequestWithExtras): string | undefined;
+/**
+ * Compose a `findOne` filter that resolves the current request's
+ * entity, regardless of whether the resource binds `_id` or a custom
+ * field. Idiomatic shape for arc action handlers.
+ *
+ * ```ts
+ * const doc = await Model.findOne(getEntityQuery(req));
+ * ```
+ *
+ * Returns `{}` when the route has no entity context (collection routes
+ * or tests bypassing the router) — caller decides what that means.
+ */
+declare function getEntityQuery(req: RequestWithExtras): Record<string, string>;
+/** The action-target fence's answer and, when it read one, the row (`GET /:id`'s scope). */
+interface ActionTargetCheck {
+  readonly visible: boolean;
+  readonly doc?: unknown;
+}
+/**
+ * The row the action-target fence loaded for this request, so the handler need not read it
+ * again. `undefined` when no fence read happened (untenanted resource, `scope: 'handler'`,
+ * id-less action) — load it yourself then. It is a snapshot taken after the idempotency lock
+ * and before the handler: a guarded write must still carry its precondition in the filter.
+ */
+declare function getActionTarget<TDoc = Record<string, unknown>>(req: {
+  readonly arc?: {
+    readonly actionTarget?: unknown;
+  };
+}): TDoc | undefined;
+//#endregion
 //#region src/core/QueryResolver.d.ts
 interface QueryResolverConfig {
   /** Query parser instance (default: Arc built-in parser) */
@@ -1277,6 +1321,11 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /** Whether {@link isActionTargetVisible} can answer — it reads through the repository. */
   canFenceActionTargets(): boolean;
   isActionTargetVisible(req: IRequestContext, id: string): Promise<boolean>;
+  /**
+   * The fence's answer plus the row it read (absent when the resource has no row scope, so
+   * nothing was read). The router hands the row to the handler as `getActionTarget(req)`.
+   */
+  loadActionTarget(req: IRequestContext, id: string): Promise<ActionTargetCheck>;
   /** `ETag: "<version>"` for a versioned document under optimistic concurrency. */
   protected etagHeaders(doc: unknown): Record<string, string> | undefined;
   /**
@@ -3994,6 +4043,8 @@ interface RequestWithExtras extends FastifyRequest {
      * can still read the entity handle.
      */
     entityId?: string;
+    /** The id-bound action's target as the fence read it — read via `getActionTarget(req)`. */
+    actionTarget?: unknown;
   };
   context?: Record<string, unknown>;
   _policyFilters?: Record<string, unknown>;
@@ -4605,4 +4656,4 @@ type InferDocType<T> = T extends DataAdapter<infer D> ? D : T extends ResourceCo
 type InferAdapterDoc<A> = A extends DataAdapter<infer D> ? D : unknown;
 type InferResourceDoc<T> = T extends ResourceConfig<infer D> ? D : never;
 //#endregion
-export { ResourceHookContext as $, AroundHookHandler as $t, RequestWithExtras as A, WriteContext as An, AuthHelpers as At, OnTenantDeleteConfig as B, ServerAccessor as Bn, TreeMixin as Bt, RequestIdOptions as C, ControllerConstructionOptions as Cn, ActionEntry as Ct, FastifyWithAuth as D, BodySanitizerConfig as Dn, RouteMcpConfig as Dt, FastifyRequestExtras as E, BodySanitizer as En, RouteDefinition as Et, ResourceDefinition as F, IController as Fn, TokenPair as Ft, CrudRouteKey as G, BaseCrudController as Gt, PresetFunction as H, SlugMixin as Ht, CrudController as I, IControllerResponse as In, BaseController as It, MiddlewareConfig as J, AccessControl as Jt, CrudSchemas as K, QueryResolver as Kt, ResourceConfig as L, IRequestContext as Ln, SoftDeleteExt as Lt, ResourceRegistry as M, ControllerHandler as Mn, Authenticator as Mt, RouteRow as N, ControllerLike as Nn, AuthenticatorContext as Nt, FastifyWithDecorators as O, MutationWriteContext as On, RouteMethod as Ot, defineResource as P, FastifyHandler as Pn, JwtContext as Pt, FieldRule$1 as Q, FetchResult as Qt, ResourceIdempotencyConfig as R, RawRouteHandler as Rn, SoftDeleteMixin as Rt, IntrospectionPluginOptions as S, ControllerConfigurableOptions as Sn, ActionDefinition as St, EventsDecorator as T, MixinConstructor as Tn, ActionsMap as Tt, PresetHook as U, BulkExt as Ut, ResolvedTenantPurge as V, SlugExt as Vt, PresetResult as W, BulkMixin as Wt, RouteSchemaOptions as X, AccessControlRepository as Xt, OpenApiSchemas as Y, AccessControlConfig as Yt, ArcFieldRule as Z, FetchDenialReason as Zt, ServiceContext as _, ArcDeleteResult as _n, PipelineConfig as _t, IntrospectionData as a, HookRegistration as an, AggregationCacheConfig as at, HealthCheck as b, ArcUpdateResult as bn, Transform as bt, ResourceMetadata as c, afterCreate as cn, AggregationIndexHint as ct, LookupOption as d, beforeCreate as dn, AggregationRateLimit as dt, DefineHookOptions as en, ResourceHooks as et, OwnershipCheck as f, beforeDelete as fn, AggregationsMap as ft, RequestContext as g, ArcCreateResult as gn, OperationFilter as gt, QueryParserInterface as h, defineHook as hn, NextFunction as ht, PaginationResult as i, HookPhase as in, AggMeasureShorthand as it, RegisterOptions as j, WriteVerbKey as jn, AuthPluginOptions as jt, MiddlewareHandler as k, ResourceWrites as kn, RateLimitConfig as kt, ArcInternalMetadata as l, afterDelete as ln, AggregationMaterializedContext as lt, PopulateOption as m, createHookSystem as mn, Interceptor as mt, InferDocType as n, HookHandler as nn, EventDefinition as nt, RegistryEntry as o, HookSystem as on, AggregationConfig as ot, ParsedQuery as p, beforeUpdate as pn, Guard as pt, LookupPolicy as q, QueryResolverConfig as qt, InferResourceDoc as r, HookOperation as rn, AggMeasureInput as rt, RegistryStats as s, HookSystemOptions as sn, AggregationDateRangeRequirement as st, InferAdapterDoc as t, HookContext as tn, ResourceExtensions as tt, ControllerQueryOptions as u, afterUpdate as un, AggregationMaterializedResult as ut, CrudRouterOptions as v, ArcGetResult as vn, PipelineContext as vt, ArcDecorator as w, ListResult as wn, ActionHandlerFn as wt, HealthOptions as x, BaseControllerOptions as xn, ResourceCacheConfig as xt, GracefulShutdownOptions as y, ArcListResult as yn, PipelineStep as yt, ResourcePermissions as z, RouteHandler as zn, TreeExt as zt };
+export { ResourceHookContext as $, AccessControl as $t, RequestWithExtras as A, MixinConstructor as An, AuthHelpers as At, OnTenantDeleteConfig as B, IController as Bn, TreeMixin as Bt, RequestIdOptions as C, ArcGetResult as Cn, ActionEntry as Ct, FastifyWithAuth as D, ControllerConfigurableOptions as Dn, RouteMcpConfig as Dt, FastifyRequestExtras as E, BaseControllerOptions as En, RouteDefinition as Et, ResourceDefinition as F, WriteContext as Fn, TokenPair as Ft, CrudRouteKey as G, ServerAccessor as Gn, BaseCrudController as Gt, PresetFunction as H, IRequestContext as Hn, SlugMixin as Ht, CrudController as I, WriteVerbKey as In, BaseController as It, MiddlewareConfig as J, ActionTargetCheck as Jt, CrudSchemas as K, QueryResolver as Kt, ResourceConfig as L, ControllerHandler as Ln, SoftDeleteExt as Lt, ResourceRegistry as M, BodySanitizerConfig as Mn, Authenticator as Mt, RouteRow as N, MutationWriteContext as Nn, AuthenticatorContext as Nt, FastifyWithDecorators as O, ControllerConstructionOptions as On, RouteMethod as Ot, defineResource as P, ResourceWrites as Pn, JwtContext as Pt, FieldRule$1 as Q, getEntityQuery as Qt, ResourceIdempotencyConfig as R, ControllerLike as Rn, SoftDeleteMixin as Rt, IntrospectionPluginOptions as S, ArcDeleteResult as Sn, ActionDefinition as St, EventsDecorator as T, ArcUpdateResult as Tn, ActionsMap as Tt, PresetHook as U, RawRouteHandler as Un, BulkExt as Ut, ResolvedTenantPurge as V, IControllerResponse as Vn, SlugExt as Vt, PresetResult as W, RouteHandler as Wn, BulkMixin as Wt, RouteSchemaOptions as X, getEntityId as Xt, OpenApiSchemas as Y, getActionTarget as Yt, ArcFieldRule as Z, getEntityIdField as Zt, ServiceContext as _, beforeDelete as _n, PipelineConfig as _t, IntrospectionData as a, DefineHookOptions as an, AggregationCacheConfig as at, HealthCheck as b, defineHook as bn, Transform as bt, ResourceMetadata as c, HookOperation as cn, AggregationIndexHint as ct, LookupOption as d, HookSystem as dn, AggregationRateLimit as dt, AccessControlConfig as en, ResourceHooks as et, OwnershipCheck as f, HookSystemOptions as fn, AggregationsMap as ft, RequestContext as g, beforeCreate as gn, OperationFilter as gt, QueryParserInterface as h, afterUpdate as hn, NextFunction as ht, PaginationResult as i, AroundHookHandler as in, AggMeasureShorthand as it, RegisterOptions as j, BodySanitizer as jn, AuthPluginOptions as jt, MiddlewareHandler as k, ListResult as kn, RateLimitConfig as kt, ArcInternalMetadata as l, HookPhase as ln, AggregationMaterializedContext as lt, PopulateOption as m, afterDelete as mn, Interceptor as mt, InferDocType as n, FetchDenialReason as nn, EventDefinition as nt, RegistryEntry as o, HookContext as on, AggregationConfig as ot, ParsedQuery as p, afterCreate as pn, Guard as pt, LookupPolicy as q, QueryResolverConfig as qt, InferResourceDoc as r, FetchResult as rn, AggMeasureInput as rt, RegistryStats as s, HookHandler as sn, AggregationDateRangeRequirement as st, InferAdapterDoc as t, AccessControlRepository as tn, ResourceExtensions as tt, ControllerQueryOptions as u, HookRegistration as un, AggregationMaterializedResult as ut, CrudRouterOptions as v, beforeUpdate as vn, PipelineContext as vt, ArcDecorator as w, ArcListResult as wn, ActionHandlerFn as wt, HealthOptions as x, ArcCreateResult as xn, ResourceCacheConfig as xt, GracefulShutdownOptions as y, createHookSystem as yn, PipelineStep as yt, ResourcePermissions as z, FastifyHandler as zn, TreeExt as zt };

package/dist/{index-C8zVGYsk.d.mts → index-uhkUA5-U.d.mts}

@@ -1,5 +1,5 @@
 
-import { Mt as Authenticator } from "./index-mqaqZNpe.mjs";
+import { Mt as Authenticator } from "./index-WH7xgvxS.mjs";
 import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 import { n as ElevationOptions } from "./elevation-BW2J3tNj.mjs";
 import { a as EventTransport } from "./EventTransport-CiicKz2Z.mjs";
@@ -7,10 +7,10 @@ import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
 import { r as QueryCachePluginOptions } from "./queryCachePlugin-C2lZjTxk.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler--4rSMMvq.mjs";
 import { S as SchedulesPluginOptions, T as HealthOptions, _ as ResourceLike, o as ArcPorts, r as ArcModuleInput } from "./types-BJ-2XqVF.mjs";
-import { H as ModuleGraphOptions } from "./index-JdbZAIsm.mjs";
+import { H as ModuleGraphOptions } from "./index-CUJvoyw3.mjs";
 import { t as EventPluginOptions } from "./eventPlugin-BtmA4-3P.mjs";
-import { a as MetricsOptions, c as RealtimeOptions, f as CachingOptions, h as GracefulShutdownOptions, t as VersioningOptions, u as SSEOptions } from "./versioning-Bsb51gGT.mjs";
-import { r as IdempotencyStore } from "./interface-C0395yUN.mjs";
+import { a as MetricsOptions, c as RealtimeOptions, g as GracefulShutdownOptions, p as CachingOptions, t as VersioningOptions, u as SSEOptions } from "./versioning-Bqm_57Qt.mjs";
+import { i as IdempotencyStore } from "./interface-JJzwH4Ro.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
 //#region src/factory/types/assets.d.ts
 /**

package/dist/index.d.mts

@@ -1,12 +1,12 @@
 
 import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-CZyixEQR.mjs";
-import { A as RequestWithExtras, An as WriteContext, Bt as TreeMixin, C as RequestIdOptions, Cn as ControllerConstructionOptions, D as FastifyWithAuth, E as FastifyRequestExtras, F as ResourceDefinition, Fn as IController, G as CrudRouteKey, Gt as BaseCrudController, H as PresetFunction, Ht as SlugMixin, I as CrudController, In as IControllerResponse, It as BaseController, J as MiddlewareConfig, K as CrudSchemas, L as ResourceConfig, Ln as IRequestContext, Lt as SoftDeleteExt, Nn as ControllerLike, O as FastifyWithDecorators, On as MutationWriteContext, P as defineResource, Q as FieldRule, Rn as RawRouteHandler, Rt as SoftDeleteMixin, S as IntrospectionPluginOptions, Sn as ControllerConfigurableOptions, Ut as BulkExt, Vt as SlugExt, W as PresetResult, Wt as BulkMixin, X as RouteSchemaOptions, _ as ServiceContext, _n as ArcDeleteResult, a as IntrospectionData, at as AggregationCacheConfig, b as HealthCheck, bn as ArcUpdateResult, c as ResourceMetadata, ct as AggregationIndexHint, dt as AggregationRateLimit, f as OwnershipCheck, ft as AggregationsMap, g as RequestContext, gn as ArcCreateResult, h as QueryParserInterface, i as PaginationResult, it as AggMeasureShorthand, jn as WriteVerbKey, jt as AuthPluginOptions, kn as ResourceWrites, kt as RateLimitConfig, l as ArcInternalMetadata, lt as AggregationMaterializedContext, n as InferDocType, nt as EventDefinition, o as RegistryEntry, ot as AggregationConfig, r as InferResourceDoc, rt as AggMeasureInput, s as RegistryStats, st as AggregationDateRangeRequirement, t as InferAdapterDoc, ut as AggregationMaterializedResult, v as CrudRouterOptions, vn as ArcGetResult, wn as ListResult, x as HealthOptions, xn as BaseControllerOptions, y as GracefulShutdownOptions, yn as ArcListResult, zn as RouteHandler, zt as TreeExt } from "./index-mqaqZNpe.mjs";
+import { A as RequestWithExtras, Bn as IController, Bt as TreeMixin, C as RequestIdOptions, Cn as ArcGetResult, D as FastifyWithAuth, Dn as ControllerConfigurableOptions, E as FastifyRequestExtras, En as BaseControllerOptions, F as ResourceDefinition, Fn as WriteContext, G as CrudRouteKey, Gt as BaseCrudController, H as PresetFunction, Hn as IRequestContext, Ht as SlugMixin, I as CrudController, In as WriteVerbKey, It as BaseController, J as MiddlewareConfig, K as CrudSchemas, L as ResourceConfig, Lt as SoftDeleteExt, Nn as MutationWriteContext, O as FastifyWithDecorators, On as ControllerConstructionOptions, P as defineResource, Pn as ResourceWrites, Q as FieldRule, Rn as ControllerLike, Rt as SoftDeleteMixin, S as IntrospectionPluginOptions, Sn as ArcDeleteResult, Tn as ArcUpdateResult, Un as RawRouteHandler, Ut as BulkExt, Vn as IControllerResponse, Vt as SlugExt, W as PresetResult, Wn as RouteHandler, Wt as BulkMixin, X as RouteSchemaOptions, _ as ServiceContext, a as IntrospectionData, at as AggregationCacheConfig, b as HealthCheck, c as ResourceMetadata, ct as AggregationIndexHint, dt as AggregationRateLimit, f as OwnershipCheck, ft as AggregationsMap, g as RequestContext, h as QueryParserInterface, i as PaginationResult, it as AggMeasureShorthand, jt as AuthPluginOptions, kn as ListResult, kt as RateLimitConfig, l as ArcInternalMetadata, lt as AggregationMaterializedContext, n as InferDocType, nt as EventDefinition, o as RegistryEntry, ot as AggregationConfig, r as InferResourceDoc, rt as AggMeasureInput, s as RegistryStats, st as AggregationDateRangeRequirement, t as InferAdapterDoc, ut as AggregationMaterializedResult, v as CrudRouterOptions, wn as ArcListResult, x as HealthOptions, xn as ArcCreateResult, y as GracefulShutdownOptions, zt as TreeExt } from "./index-WH7xgvxS.mjs";
 import { a as applyFieldReadPermissions, n as FieldPermissionMap, o as applyFieldWritePermissions, s as fields, t as FieldPermission } from "./fields-BBSpf8pS.mjs";
-import "./fastify-augmentation-DhUJ-mvo.mjs";
-import { C as AdapterLike, E as mergeResourceConfig, F as DEFAULT_LIMIT, G as MAX_FILTER_DEPTH, H as HOOK_PHASES, I as DEFAULT_MAX_LIMIT, J as MUTATION_OPERATIONS, K as MAX_REGEX_LENGTH, L as DEFAULT_SORT, M as CRUD_OPERATIONS, N as CrudOperation, O as defineAction, P as DEFAULT_ID_FIELD, R as DEFAULT_TENANT_FIELD, S as defineResourceVariants, T as SeamedResourceConfig, U as HookOperation, V as HOOK_OPERATIONS, W as HookPhase, X as RESERVED_QUERY_PARAMS, Y as MutationOperation, Z as SYSTEM_FIELDS, c as nativePolicyFilter, j as defineAggregation, m as getControllerScope, q as MAX_SEARCH_LENGTH, s as NativePolicyFilter, w as ResourceSeams, z as DEFAULT_UPDATE_METHOD } from "./index-CRoPtISf.mjs";
+import "./fastify-augmentation-DRlCIWE9.mjs";
+import { A as CrudOperation, B as HookOperation, C as mergeResourceConfig, F as DEFAULT_TENANT_FIELD, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_UPDATE_METHOD, J as SYSTEM_FIELDS, K as MutationOperation, M as DEFAULT_LIMIT, N as DEFAULT_MAX_LIMIT, O as defineAggregation, P as DEFAULT_SORT, R as HOOK_OPERATIONS, S as SeamedResourceConfig, T as defineAction, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as AdapterLike, c as nativePolicyFilter, j as DEFAULT_ID_FIELD, k as CRUD_OPERATIONS, m as getControllerScope, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, x as ResourceSeams, y as defineResourceVariants, z as HOOK_PHASES } from "./index-Beg3aNnK.mjs";
 import { C as requireScopeContext, G as createDynamicPermissionMatrix, H as DynamicPermissionMatrix, J as PublicPolicy, K as createOrgPermissions, Q as anyOf, S as requireOrgRole, T as requireTeamMembership, U as DynamicPermissionMatrixConfig, Y as allOf, Z as allowPublic, _ as publicRead, at as requireRoles, b as requireOrgInScope, d as adminOnly, et as denyAll, f as authenticated, g as presets_d_exports, m as ownerWithAdminBypass, nt as requireAuth, p as fullPublic, q as AllowPublicOptions, rt as requireOwnership, st as when, v as publicReadAdminWrite, w as requireServiceScope, x as requireOrgMembership, y as readOnly } from "./index-Bxriq3so.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-JYc9vwqE.mjs";
 //#region src/index.d.ts
-declare const version: string;
+export declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AllowPublicOptions, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, type MutationWriteContext, type NativePolicyFilter, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type PublicPolicy, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type ResourceWrites, type RouteHandler, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, UnauthorizedError, type UserBase, type UserOrganization, ValidationError, type WriteContext, type WriteVerbKey, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AllowPublicOptions, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, type MutationWriteContext, type NativePolicyFilter, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type PublicPolicy, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type ResourceWrites, type RouteHandler, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, UnauthorizedError, type UserBase, type UserOrganization, ValidationError, type WriteContext, type WriteVerbKey, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, when };

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, d as MAX_FILTER_DEPTH, f as MAX_REGEX_LENGTH, g as SYSTEM_FIELDS, h as RESERVED_QUERY_PARAMS, i as DEFAULT_MAX_LIMIT, l as HOOK_OPERATIONS, m as MUTATION_OPERATIONS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MAX_SEARCH_LENGTH, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as HOOK_PHASES } from "./constants-Cu7Mx7_U.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-CtrywMHP.mjs";
-import { S as nativePolicyFilter, c as BaseController, d as SlugMixin, f as BulkMixin, l as TreeMixin, p as BaseCrudController, u as SoftDeleteMixin } from "./plugin-BccET1tL.mjs";
-import { t as defineAggregation } from "./defineAggregation-Bm8RjMbq.mjs";
-import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-ToPYpMqS.mjs";
-import { S as getControllerScope } from "./actionPermissions-BotX1YOa.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-Cb0LjccA.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-DIC7JZGU.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-Cm0uYHvd.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, d as MAX_FILTER_DEPTH, f as MAX_REGEX_LENGTH, g as SYSTEM_FIELDS, h as RESERVED_QUERY_PARAMS, i as DEFAULT_MAX_LIMIT, l as HOOK_OPERATIONS, m as MUTATION_OPERATIONS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MAX_SEARCH_LENGTH, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as HOOK_PHASES } from "./constants-B90SnSQn.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-C9G4A8cN.mjs";
+import { S as nativePolicyFilter, c as BaseController, d as SlugMixin, f as BulkMixin, l as TreeMixin, p as BaseCrudController, u as SoftDeleteMixin } from "./plugin-BDBOS3-c.mjs";
+import { t as defineAggregation } from "./defineAggregation-CwD8_XNd.mjs";
+import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-Da--1DNS.mjs";
+import { S as getControllerScope } from "./actionPermissions-TAc_6LCw.mjs";
+import { a as defineResourceVariants, o as mergeResourceConfig, s as defineAction } from "./core-DV9PSXtr.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-CRkhRRSj.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-IdHJ0_5V.mjs";
 //#region src/index.ts
-const version = "2.43.0";
+const version = "2.45.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-B_oUYDXI.mjs → init-lpaUB-Ph.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";

package/dist/integrations/event-gateway.d.mts

@@ -3,7 +3,7 @@ import { n as DomainEvent } from "../EventTransport-CiicKz2Z.mjs";
 import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-Cs4awVyD.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/integrations/event-gateway.d.ts
-interface EventGatewayOptions {
+export interface EventGatewayOptions {
   /** Require auth for all real-time connections (default: true) */
   auth?: boolean;
   /** Custom auth function for WebSocket upgrade */
@@ -46,6 +46,5 @@ interface EventGatewayOptions {
     onDisconnect?: (client: WebSocketClient) => void | Promise<void>;
   };
 }
-declare const eventGatewayPlugin: FastifyPluginAsync<EventGatewayOptions>;
-//#endregion
-export { EventGatewayOptions, eventGatewayPlugin };
+export declare const eventGatewayPlugin: FastifyPluginAsync<EventGatewayOptions>;
+//#endregion

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-CYzQBVFe.mjs").then((n) => n.n);
+		const { default: ssePlugin } = await import("../sse-D8AgoUN3.mjs").then((n) => n.n);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -2,7 +2,7 @@
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-Cs4awVyD.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-Chgz3d0i.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-B4Aq4Sdj.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-D3Ixsh00.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
 export {};