@classytic/arc 2.9.1 → 2.10.8

package/dist/presets/multiTenant.mjs

@@ -1,4 +1,4 @@
-import "../constants-Cxde4rpC.mjs";
+import "../constants-BhY1OHoH.mjs";
 import { _ as isElevated, c as getRequestScope, f as getTeamId, h as hasOrgAccess, l as getScopeContext, o as getOrgId } from "../types-AOD8fxIw.mjs";
 //#region src/presets/multiTenant.ts
 /**
@@ -10,6 +10,20 @@ function resolveSpec(scope, spec) {
 	if (spec.type === "org") return getOrgId(scope);
 	if (spec.type === "team") return getTeamId(scope);
 }
+/**
+* Stash the resolved tenant field map on the request so `BaseController`
+* can forward it to the repository layer as top-level options. Needed by
+* plugin-scoped repos (mongokit's `multiTenantPlugin`) that read tenant
+* from `context.<field>` rather than from filter/query/data stamping.
+*/
+function stashTenantFields(request, resolved) {
+	if (Object.keys(resolved).length === 0) return;
+	const target = request;
+	target._tenantFields = {
+		...target._tenantFields ?? {},
+		...resolved
+	};
+}
 /** Resolve every spec — returns the partial map of fields that have a value. */
 function resolveAll(scope, specs) {
 	const resolved = {};
@@ -34,10 +48,13 @@ function createTenantFilter(specs) {
 		const scope = getRequestScope(request);
 		if (isElevated(scope)) {
 			const { resolved } = resolveAll(scope, specs);
-			if (Object.keys(resolved).length > 0) request._policyFilters = {
-				...request._policyFilters ?? {},
-				...resolved
-			};
+			if (Object.keys(resolved).length > 0) {
+				request._policyFilters = {
+					...request._policyFilters ?? {},
+					...resolved
+				};
+				stashTenantFields(request, resolved);
+			}
 			return;
 		}
 		if (hasOrgAccess(scope)) {
@@ -47,6 +64,7 @@ function createTenantFilter(specs) {
 					...request._policyFilters ?? {},
 					...resolved
 				};
+				stashTenantFields(request, resolved);
 				return;
 			}
 			reply.code(403).send({
@@ -81,10 +99,13 @@ function createFlexibleTenantFilter(specs) {
 		const scope = getRequestScope(request);
 		if (isElevated(scope)) {
 			const { resolved } = resolveAll(scope, specs);
-			if (Object.keys(resolved).length > 0) request._policyFilters = {
-				...request._policyFilters ?? {},
-				...resolved
-			};
+			if (Object.keys(resolved).length > 0) {
+				request._policyFilters = {
+					...request._policyFilters ?? {},
+					...resolved
+				};
+				stashTenantFields(request, resolved);
+			}
 			return;
 		}
 		if (hasOrgAccess(scope)) {
@@ -94,6 +115,7 @@ function createFlexibleTenantFilter(specs) {
 					...request._policyFilters ?? {},
 					...resolved
 				};
+				stashTenantFields(request, resolved);
 				return;
 			}
 			reply.code(403).send({
@@ -109,6 +131,14 @@ function createFlexibleTenantFilter(specs) {
 * Create tenant injection middleware.
 * Walks the configured tenant fields and writes each into the request body.
 * Fails closed if any required dimension is missing for non-elevated callers.
+*
+* Also stashes the resolved fields on `request._tenantFields` so
+* `BaseController.tenantRepoOptions()` can forward them to the repo layer
+* as top-level options — needed by plugin-scoped repos like mongokit's
+* `multiTenantPlugin`, which reads tenant from `context.<field>` rather
+* than from `data.<field>`. Without this forwarding, multi-field preset
+* writes (update/delete) work only when the plugin's `allowDataInjection`
+* fallback covers the operation's policy key, which is write-only.
 */
 function createTenantInjection(specs) {
 	return async (request, reply) => {
@@ -124,6 +154,10 @@ function createTenantInjection(specs) {
 			return;
 		}
 		if (request.body) Object.assign(request.body, resolved);
+		request._tenantFields = {
+			...request._tenantFields ?? {},
+			...resolved
+		};
 	};
 }
 function multiTenantPreset(options = {}) {

package/dist/presets/search.d.mts

@@ -1,7 +1,94 @@
-import { Lt as ControllerHandler, et as PresetResult, gt as RouteMcpConfig, mt as RouteDefinition, o as RepositoryLike } from "../interface-YrWsmKqE.mjs";
-import { t as PermissionCheck } from "../types-DZi1aYhm.mjs";
+import { Ot as ControllerHandler, Tt as RouteMcpConfig, _t as PresetResult, wt as RouteDefinition } from "../index-BGbpGVyM.mjs";
+import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 
 //#region src/presets/search.d.ts
+/**
+ * Search Preset — backend-agnostic search / vector / embed routes
+ *
+ * Arc doesn't ship a search engine. It ships the **routes** that front one.
+ * The preset mounts up to three standard routes on a resource:
+ *
+ *   POST /search           → full-text / engine-backed search (ES, OpenSearch, Algolia, Typesense, …)
+ *   POST /search-similar   → vector / semantic similarity (Atlas, Pinecone, Qdrant, Milvus, …)
+ *   POST /embed            → text / media → vector embedding
+ *
+ * Each route is OFF by default. You opt in by providing a `handler` that calls
+ * whatever backend you use. The preset contributes:
+ *   - Default path + method + permissions (customisable)
+ *   - OpenAPI description + MCP tool naming
+ *   - Arc envelope + pipeline (permissions, audit, hooks)
+ *   - Sensible Fastify route schema defaults
+ *
+ * Paths are fully customisable — if your product wants `/abc/search` or a
+ * GET-based autocomplete, pass `path`/`method` overrides or use `routes` for
+ * fully bespoke endpoints.
+ *
+ * @example MongoKit wiring (elasticSearchPlugin + vectorPlugin)
+ * ```typescript
+ * import { Repository, methodRegistryPlugin, elasticSearchPlugin } from '@classytic/mongokit';
+ * import { vectorPlugin } from '@classytic/mongokit/ai';
+ * import { searchPreset } from '@classytic/arc/presets/search';
+ *
+ * const productRepo = new Repository(Product, [
+ *   methodRegistryPlugin(),
+ *   elasticSearchPlugin({ client: esClient, indexName: 'products' }),
+ *   vectorPlugin({ fields: [{ path: 'embedding', dimensions: 1536 }], embedFn }),
+ * ]);
+ *
+ * defineResource({
+ *   name: 'product',
+ *   adapter: createMongooseAdapter({ model: Product, repository: productRepo }),
+ *   presets: [
+ *     searchPreset({
+ *       search:  { handler: (req) => productRepo.search(req.body.query, req.body) },
+ *       similar: { handler: (req) => productRepo.searchSimilar(req.body.query, req.body) },
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @example Custom vector backend (Pinecone)
+ * ```typescript
+ * searchPreset({
+ *   similar: {
+ *     path: '/vector-search',                 // custom path
+ *     handler: async (req) => {
+ *       const hits = await pinecone.query({
+ *         vector: req.body.vector,
+ *         topK: req.body.topK ?? 10,
+ *       });
+ *       return hits.matches;
+ *     },
+ *     schema: { body: { type: 'object', properties: { vector: { type: 'array' }, topK: { type: 'integer' } } } },
+ *     mcp: false,                             // no MCP tool for this one
+ *   },
+ *   // Extra app-specific route
+ *   routes: [
+ *     {
+ *       method: 'GET',
+ *       path: '/autocomplete',
+ *       handler: async (req) => algolia.suggest(req.query.q as string),
+ *       permissions: allowPublic(),
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+/**
+ * Feature-detected search surface. Arc's `RepositoryLike` is the cross-kit
+ * minimum (repo-core's `MinimalRepo & Partial<StandardRepo>`) and does not
+ * declare search/vector/embed methods — those are kit-specific (mongokit's
+ * `elasticSearchPlugin` + `vectorPlugin`, pgkit's `pgvector` extension,
+ * sqlitekit FTS5, or a standalone Pinecone/Algolia adapter). We type the
+ * `repository` option locally so the preset can auto-wire handlers when a
+ * kit happens to ship these methods, without forcing every repo to declare
+ * them.
+ */
+interface SearchableRepository {
+  search?(query: unknown, options?: unknown): Promise<unknown>;
+  searchSimilar?(query: unknown, options?: unknown): Promise<unknown>;
+  embed?(input: unknown): Promise<number[]>;
+}
 /**
  * Handler contract — receives arc's `IRequestContext` (same as any `actions` or
  * non-raw route handler) and returns either the raw result (wrapped into
@@ -57,7 +144,7 @@ interface SearchPresetOptions {
    * Sections set to `true` REQUIRE `repository` (otherwise the route is
    * skipped silently). Sections with an explicit `handler` ignore this field.
    */
-  repository?: Pick<RepositoryLike, "search" | "searchSimilar" | "embed">;
+  repository?: SearchableRepository;
   /** Full-text / engine-backed search route. Opt-in. */
   search?: SearchSection;
   /** Vector / semantic similarity route. Opt-in. */
@@ -88,4 +175,4 @@ interface SearchPresetOptions {
  */
 declare function searchPreset(options?: SearchPresetOptions): PresetResult;
 //#endregion
-export { SearchHandler, SearchPresetOptions, SearchRouteConfig, SearchSection, searchPreset };
+export { SearchHandler, SearchPresetOptions, SearchRouteConfig, SearchSection, SearchableRepository, searchPreset };

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { n as allowPublic, s as requireAuth } from "../permissions-oNZawnkR.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-wkqRwicB.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-hM4WhNWY.mjs → presets-CrwOvuXI.mjs}

@@ -1,6 +1,6 @@
 import { _ as isElevated, n as PUBLIC_SCOPE } from "./types-AOD8fxIw.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
-import { f as requireRoles, n as allowPublic, s as requireAuth } from "./permissions-oNZawnkR.mjs";
+import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-wkqRwicB.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.

package/dist/{queryCachePlugin-DbUVroUG.mjs → queryCachePlugin-ChLNZvFT.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-qcD-TVJl.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-nWQGUTu1.mjs";
 import { t as hasEvents } from "./typeGuards-Cj5Rgvlg.mjs";
-import { t as MemoryCacheStore } from "./memory-BFAYkf8H.mjs";
+import { t as MemoryCacheStore } from "./memory-DqI-449b.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {
@@ -33,17 +33,17 @@ var QueryCache = class {
 		};
 	}
 	async set(key, data, config) {
-		const staleTimeMs = (config.staleTime ?? 0) * 1e3;
-		const totalTtl = staleTimeMs + (config.gcTime ?? 60) * 1e3;
+		const staleTimeSec = config.staleTime ?? 0;
+		const totalTtlSec = staleTimeSec + (config.gcTime ?? 60);
 		const now = Date.now();
 		const envelope = {
 			data,
 			createdAt: now,
-			staleAfter: now + staleTimeMs,
-			expiresAt: now + totalTtl,
+			staleAfter: now + staleTimeSec * 1e3,
+			expiresAt: now + totalTtlSec * 1e3,
 			tags: config.tags ?? []
 		};
-		await this.store.set(key, envelope, { ttlMs: totalTtl });
+		await this.store.set(key, envelope, totalTtlSec);
 	}
 	async invalidate(key) {
 		await this.store.delete(key);
@@ -56,7 +56,7 @@ var QueryCache = class {
 	async bumpResourceVersion(resource) {
 		const key = versionKey(resource);
 		const newVersion = Date.now();
-		await this.store.set(key, newVersion, { ttlMs: 1440 * 60 * 1e3 });
+		await this.store.set(key, newVersion, 1440 * 60);
 	}
 	/** Get current version for a tag */
 	async getTagVersion(tag) {
@@ -66,7 +66,7 @@ var QueryCache = class {
 	async bumpTagVersion(tag) {
 		const key = tagVersionKey(tag);
 		const newVersion = Date.now();
-		await this.store.set(key, newVersion, { ttlMs: 1440 * 60 * 1e3 });
+		await this.store.set(key, newVersion, 1440 * 60);
 	}
 };
 //#endregion

package/dist/{queryCachePlugin-CnTZZTC5.d.mts → queryCachePlugin-Dumka73q.d.mts}

@@ -1,4 +1,4 @@
-import { i as CacheStore } from "./interface-DplgQO2e.mjs";
+import { r as CacheStore } from "./interface-yhyb_pLY.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/cache/QueryCache.d.ts

package/dist/{queryParser-Cs-6SHQK.mjs → queryParser-NR__Qiju.mjs}

@@ -1,4 +1,71 @@
-import { m as RESERVED_QUERY_PARAMS } from "./constants-Cxde4rpC.mjs";
+import { m as RESERVED_QUERY_PARAMS } from "./constants-BhY1OHoH.mjs";
+//#region src/utils/simpleEqualityMatcher.ts
+/**
+* `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
+* matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
+*
+* **What it does:** for each `[key, expected]` in the filter, compares
+* `item[key]` to `expected` via string coercion (so Mongo `ObjectId` values
+* match their string representation) and returns `true` only if every
+* filter entry matches. Array item values are matched implicitly (contains).
+*
+* **What it does NOT do:**
+* - No `$eq` / `$ne` / `$in` / `$nin` / `$gt` / `$lt` / `$regex` / `$exists`
+* - No `$and` / `$or`
+* - No dot-path traversal (`"owner.id"`)
+* - No schema-specific coercion
+*
+* **Why it exists:** 95%+ of arc's `_policyFilters` are produced by built-in
+* permission helpers and are shaped like `{ ownerId: "u1" }` or
+* `{ organizationId: "org_x" }` — flat equality. For that common shape,
+* this helper is a safe, tested, 15-line defense-in-depth matcher that
+* hosts using minimal repos (no `getOne(compoundFilter)` DB path) can opt
+* into without arc shipping a full Mongo-syntax engine.
+*
+* **When to use:**
+* - Your adapter/repo doesn't natively filter on `getOne(compoundFilter)`
+* - Your `_policyFilters` are flat equality (from arc's built-in permission helpers)
+* - You want defense-in-depth on `validateItemAccess` / `fetchDetailed`'s `getById` fallback
+*
+* **When NOT to use:**
+* - Your `_policyFilters` use operators (`$in`, `$ne`, etc.) — supply a
+*   native matcher (mongokit's repo does the filter at the DB layer; for
+*   custom repos, wrap the kit's own predicate engine).
+* - You're a mongokit / sqlitekit / Prisma user — the DB-level filter
+*   applied by `getOne(compoundFilter)` already covers this.
+*
+* @example
+* ```ts
+* import { simpleEqualityMatcher } from '@classytic/arc/utils';
+*
+* // On a custom adapter
+* const adapter: DataAdapter = {
+*   repository,
+*   type: 'custom',
+*   name: 'in-memory',
+*   matchesFilter: simpleEqualityMatcher,
+* };
+*
+* // Or directly on BaseController for ad-hoc controllers
+* new BaseController(repo, { matchesFilter: simpleEqualityMatcher });
+* ```
+*/
+function simpleEqualityMatcher(item, filters) {
+	if (!item || typeof item !== "object") return false;
+	const obj = item;
+	for (const [key, expected] of Object.entries(filters)) {
+		if (expected && typeof expected === "object" && !Array.isArray(expected) && Object.getPrototypeOf(expected) === Object.prototype && Object.keys(expected).some((k) => k.startsWith("$"))) return false;
+		const actual = obj[key];
+		if (Array.isArray(actual)) {
+			const expectedStr = String(expected);
+			if (!actual.some((v) => String(v) === expectedStr)) return false;
+			continue;
+		}
+		if (String(actual) !== String(expected)) return false;
+	}
+	return true;
+}
+//#endregion
 //#region src/utils/queryParser.ts
 /**
 * Arc Query Parser - Default URL-to-Query Parser
@@ -349,4 +416,4 @@ function createQueryParser(options) {
 	return new ArcQueryParser(options);
 }
 //#endregion
-export { createQueryParser as n, ArcQueryParser as t };
+export { createQueryParser as n, simpleEqualityMatcher as r, ArcQueryParser as t };

package/dist/{redis-stream-Bz-4q96t.d.mts → redis-stream-bkO88VHx.d.mts}

@@ -1,4 +1,4 @@
-import { i as EventLogger, n as DomainEvent, o as EventTransport, r as EventHandler } from "./EventTransport-CqZ8FyM_.mjs";
+import { i as EventLogger, n as DomainEvent, o as EventTransport, r as EventHandler } from "./EventTransport-CfVEGaEl.mjs";
 
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {

package/dist/registry/index.d.mts

@@ -1,4 +1,4 @@
-import { Gt as ResourceRegistry, V as IntrospectionPluginOptions, Wt as RegisterOptions } from "../interface-YrWsmKqE.mjs";
+import { R as RegisterOptions, k as IntrospectionPluginOptions, z as ResourceRegistry } from "../index-BGbpGVyM.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/registry/introspectionPlugin.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
 import { n as introspectionPlugin_default, t as introspectionPlugin } from "../registry-B0Wl7uVV.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-Dq3_zBQP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-CcN2LVrc.mjs";
 export { ResourceRegistry, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{requestContext-DYtmNpm5.mjs → requestContext-C38GskNt.mjs}

@@ -11,7 +11,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 *
 * @example
 * ```typescript
-* import { requestContext } from '@classytic/arc';
+* import { requestContext } from '@classytic/arc/context';
 *
 * // Anywhere in the call stack — no parameter passing needed
 * async function auditAction(action: string) {

package/dist/{resourceToTools-C3cWymnW.mjs → resourceToTools-BhF3JV5p.mjs}

@@ -1,5 +1,6 @@
-import { t as BaseController } from "./BaseController-Vu2yc56T.mjs";
-import { n as normalizePermissionResult } from "./applyPermissionResult-bqGpo9ML.mjs";
+import { t as BaseController } from "./BaseController-DVNKvoX4.mjs";
+import { n as normalizePermissionResult } from "./applyPermissionResult-QhV1Pa-g.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-TUVR3uiZ.mjs";
 import { t as pluralize } from "./pluralize-CWP6MB39.mjs";
 import { z } from "zod";
 //#region src/integrations/mcp/createMcpServer.ts
@@ -655,7 +656,11 @@ function resourceToTools(resource, config = {}) {
 		}
 		const toolName = prefix ? `${prefix}_${actionName}_${resource.name}` : `${actionName}_${resource.name}`;
 		const handler = typeof entry === "function" ? entry : def.handler;
-		const actionPerms = (typeof def !== "function" ? def.permissions : void 0) ?? resource.actionPermissions;
+		const actionPerms = resolveActionPermission({
+			action: entry,
+			resourcePermissions: resource.permissions,
+			resourceActionPermissions: resource.actionPermissions
+		});
 		tools.push({
 			name: toolName,
 			description: String(description),

package/dist/scope/index.d.mts

@@ -1,5 +1,5 @@
-import { _ as isAuthenticated, a as getClientId, b as isOrgInScope, c as getOrgRoles, d as getScopeContextMap, f as getServiceScopes, g as hasOrgAccess, h as getUserRoles, i as getAncestorOrgIds, l as getRequestScope, m as getUserId, n as PUBLIC_SCOPE, o as getOrgContext, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, u as getScopeContext, v as isElevated, x as isService, y as isMember } from "../types-BD85MlEK.mjs";
-import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-B6S5csVA.mjs";
+import { _ as isAuthenticated, a as getClientId, b as isOrgInScope, c as getOrgRoles, d as getScopeContextMap, f as getServiceScopes, g as hasOrgAccess, h as getUserRoles, i as getAncestorOrgIds, l as getRequestScope, m as getUserId, n as PUBLIC_SCOPE, o as getOrgContext, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, u as getScopeContext, v as isElevated, x as isService, y as isMember } from "../types-tgR4Pt8F.mjs";
+import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-s5ykdNHr.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 
 //#region src/scope/rateLimitKey.d.ts

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
 import { _ as isElevated, a as getOrgContext, b as isService, c as getRequestScope, d as getServiceScopes, f as getTeamId, g as isAuthenticated, h as hasOrgAccess, i as getClientId, l as getScopeContext, m as getUserRoles, n as PUBLIC_SCOPE, o as getOrgId, p as getUserId, r as getAncestorOrgIds, s as getOrgRoles, t as AUTHENTICATED_SCOPE, u as getScopeContextMap, v as isMember, y as isOrgInScope } from "../types-AOD8fxIw.mjs";
-import { n as normalizeRoles } from "../types-ZUu_h0jp.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-DxQ6ACbt.mjs";
+import { n as normalizeRoles } from "../types-D57iXYb8.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-Dci0AYLT.mjs";
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/{sse-CJpt7LGI.mjs → sse-D8UeDwis.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { arcLog } from "./logger/index.mjs";
 import { n as PUBLIC_SCOPE, o as getOrgId } from "./types-AOD8fxIw.mjs";
-import { t as arcLog } from "./logger-CDjpjySd.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({

package/dist/{store-helpers-DFiZl5TL.mjs → store-helpers-DYYUQbQN.mjs}

@@ -18,6 +18,10 @@ function isNotFoundError(err) {
 * Build a `safeGetOne(filter)` that papers over the throw-vs-null split
 * in kit implementations. Real errors propagate; miss returns `null`.
 * Throws if the repository lacks `getOne` — callers must check.
+*
+* Accepts `FilterInput` (the repo-core union) so callers can compose
+* portable Filter IR (`and(eq(...), gt(...))`) OR pass a flat kit-native
+* record. Both forms reach the kit's `getOne` unchanged — kits dispatch.
 */
 function createSafeGetOne(repository) {
 	if (typeof repository.getOne !== "function") throw new Error("createSafeGetOne: repository.getOne is required");

package/dist/testing/index.d.mts

@@ -1,9 +1,10 @@
-import { Kt as ResourceDefinition, Xt as CrudRepository, p as AnyRecord } from "../interface-YrWsmKqE.mjs";
-import { d as ResourceLike, r as CreateAppOptions } from "../types-CunEX4UX.mjs";
+import { B as ResourceDefinition, Yt as AnyRecord } from "../index-BGbpGVyM.mjs";
+import { d as ResourceLike, r as CreateAppOptions } from "../types-CVdgPXBW.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import Fastify, { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Connection } from "mongoose";
 import { Mock } from "vitest";
+import { StandardRepo } from "@classytic/repo-core/repository";
 
 //#region src/testing/authHelpers.d.ts
 interface BetterAuthTestHelpersOptions {
@@ -478,7 +479,7 @@ declare function createHttpTestHarness<T = unknown>(resource: ResourceDefinition
 /**
  * Extended repository interface for testing (includes optional preset methods)
  */
-interface MockRepository<T> extends CrudRepository<T> {
+interface MockRepository<T> extends StandardRepo<T> {
   getBySlug?: Mock;
   getDeleted?: Mock;
   restore?: Mock;
@@ -519,8 +520,8 @@ declare function createMockReply(): unknown;
 /**
  * Create a mock controller for testing
  */
-declare function createMockController(repository: CrudRepository<AnyRecord>): {
-  repository: CrudRepository<AnyRecord>;
+declare function createMockController(repository: StandardRepo<AnyRecord>): {
+  repository: StandardRepo<AnyRecord>;
   list: Mock<(...args: any[]) => any>;
   get: Mock<(...args: any[]) => any>;
   create: Mock<(...args: any[]) => any>;

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { t as CRUD_OPERATIONS } from "../constants-Cxde4rpC.mjs";
-import { n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-CU6FlaDV.mjs";
+import { t as CRUD_OPERATIONS } from "../constants-BhY1OHoH.mjs";
+import { n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-CTMWOUDt.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import mongoose from "mongoose";
@@ -566,7 +566,10 @@ var HttpTestHarness = class {
 		this.resource = resource;
 		this.optionsOrGetter = optionsOrGetter;
 		if (typeof optionsOrGetter === "function") this.eagerBaseUrl = null;
-		else this.eagerBaseUrl = `${optionsOrGetter.apiPrefix ?? "/api"}${resource.prefix}`;
+		else {
+			const apiPrefix = optionsOrGetter.apiPrefix ?? "/api";
+			this.eagerBaseUrl = `${apiPrefix}${resource.prefix}`;
+		}
 		const disabled = new Set(resource.disabledRoutes ?? []);
 		this.enabledRoutes = new Set(resource.disableDefaultRoutes ? [] : CRUD_OPERATIONS.filter((op) => !disabled.has(op)));
 		this.updateMethod = resource.updateMethod === "PUT" ? "PUT" : "PATCH";
@@ -877,12 +880,6 @@ function createHttpTestHarness(resource, optionsOrGetter) {
 //#endregion
 //#region src/testing/mocks.ts
 /**
-* Testing Utilities - Mock Factories
-*
-* Create mock repositories, controllers, and services for testing.
-* Uses Vitest for mocking (compatible with Jest API).
-*/
-/**
 * Create a mock repository for testing
 *
 * @example
@@ -896,6 +893,7 @@ function createHttpTestHarness(resource, optionsOrGetter) {
 function createMockRepository(overrides = {}) {
 	return {
 		getAll: vi.fn().mockResolvedValue({
+			method: "offset",
 			docs: [],
 			total: 0,
 			page: 1,
@@ -917,6 +915,15 @@ function createMockRepository(overrides = {}) {
 			success: true,
 			message: "Deleted"
 		}),
+		updateMany: vi.fn().mockResolvedValue({
+			acknowledged: true,
+			matchedCount: 0,
+			modifiedCount: 0
+		}),
+		deleteMany: vi.fn().mockResolvedValue({
+			acknowledged: true,
+			deletedCount: 0
+		}),
 		getBySlug: vi.fn().mockResolvedValue(null),
 		getDeleted: vi.fn().mockResolvedValue([]),
 		restore: vi.fn().mockResolvedValue(null),
@@ -1743,7 +1750,7 @@ function runEventTests(resourceName, displayName, events) {
 * ```
 */
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-CBJUJKGP.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-BwnEAO2h.mjs").then((n) => n.r);
 	const { useInMemoryDb = true, mongoUri: providedMongoUri, ...appOptions } = options;
 	const defaultAuth = {
 		type: "jwt",

package/dist/types/index.d.mts

@@ -1,5 +1,5 @@
-import { _ as isAuthenticated, c as getOrgRoles, g as hasOrgAccess, n as PUBLIC_SCOPE, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, v as isElevated, y as isMember } from "../types-BD85MlEK.mjs";
-import { $ as PresetHook, $t as DeleteResult, A as FastifyRequestExtras, At as BaseControllerOptions, B as IntrospectionData, Bt as IController, C as ControllerQueryOptions, Ct as UserLike, D as CrudSchemas, Dt as envelope, E as CrudRouterOptions, Et as ValidationResult, F as HealthCheck, G as MiddlewareConfig, H as JWTPayload, Ht as IRequestContext, I as HealthOptions, J as OpenApiSchemas, Jt as BulkWriteOperation, K as MiddlewareHandler, L as InferAdapterDoc, Lt as ControllerHandler, M as FastifyWithDecorators, N as FieldRule, O as EventDefinition, Ot as getUserId, P as GracefulShutdownOptions, Q as PresetFunction, Qt as DeleteOptions, R as InferDocType, Rt as ControllerLike, S as ConfigError, St as TypedResourceConfig, T as CrudRouteKey, Tt as ValidateOptions, U as JwtContext, Ut as RouteHandler, V as IntrospectionPluginOptions, Vt as IControllerResponse, W as LookupOption, X as ParsedQuery, Xt as CrudRepository, Y as OwnershipCheck, Yt as BulkWriteResult, Z as PopulateOption, Zt as DeleteManyResult, _ as ArcRequest, _t as RouteSchemaOptions, an as PaginationParams, at as RequestContext, b as Authenticator, bt as TypedController, cn as RepositorySession, ct as ResourceCacheConfig, d as ActionHandlerFn, dt as ResourceHooks, en as FindOneAndUpdateOptions, et as PresetResult, f as ActionsMap, ft as ResourceMetadata, g as ArcInternalMetadata, gt as RouteMcpConfig, h as ArcDecorator, ht as RouteHandlerMethod, in as PaginatedResult, it as RegistryStats, j as FastifyWithAuth, k as EventsDecorator, l as ActionDefinition, ln as UpdateManyResult, lt as ResourceConfig, m as ApiResponse, mt as RouteDefinition, nn as KeysetPaginatedResult, nt as RateLimitConfig, on as PaginationResult, ot as RequestIdOptions, p as AnyRecord, pt as ResourcePermissions, q as ObjectId, rn as OffsetPaginatedResult, rt as RegistryEntry, sn as QueryOptions, st as RequestWithExtras, tn as InferDoc, tt as QueryParserInterface, u as ActionEntry, un as WriteOptions, ut as ResourceHookContext, v as AuthHelpers, vt as ServiceContext, w as CrudController, wt as UserOrganization, x as AuthenticatorContext, xt as TypedRepository, y as AuthPluginOptions, yt as TokenPair, z as InferResourceDoc, zt as FastifyHandler } from "../interface-YrWsmKqE.mjs";
-import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "../types-DZi1aYhm.mjs";
-import { n as ElevationOptions, t as ElevationEvent } from "../elevation-B6S5csVA.mjs";
-export { AUTHENTICATED_SCOPE, ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ApiResponse, ArcDecorator, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, BulkWriteOperation, BulkWriteResult, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRepository, CrudRouteKey, CrudRouterOptions, CrudSchemas, DeleteManyResult, DeleteOptions, DeleteResult, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, FindOneAndUpdateOptions, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, KeysetPaginatedResult, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OffsetPaginatedResult, OpenApiSchemas, OwnershipCheck, PUBLIC_SCOPE, PaginatedResult, PaginationParams, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryOptions, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RepositorySession, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResourceCacheConfig, ResourceConfig, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UpdateManyResult, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult, WriteOptions, envelope, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };
+import { $t as ObjectId, A as RequestIdOptions, At as FastifyHandler, C as RequestContext, Ct as ResourcePermissions, D as HealthCheck, Dt as RouteSchemaOptions, E as GracefulShutdownOptions, Et as RouteMethod, F as FastifyWithDecorators, Gt as Authenticator, I as MiddlewareHandler, Jt as TokenPair, Kt as AuthenticatorContext, L as RequestWithExtras, M as EventsDecorator, Mt as IControllerResponse, N as FastifyRequestExtras, Nt as IRequestContext, O as HealthOptions, Ot as ControllerHandler, P as FastifyWithAuth, Pt as RouteHandler, Qt as JWTPayload, S as QueryParserInterface, St as ResourceHooks, T as CrudRouterOptions, Tt as RouteMcpConfig, Ut as AuthHelpers, Wt as AuthPluginOptions, Xt as ApiResponse, Yt as AnyRecord, Zt as ArcRequest, _ as ControllerQueryOptions, _t as PresetResult, a as InferAdapterDoc, an as BaseControllerOptions, at as ActionEntry, b as ParsedQuery, bt as ResourceConfig, c as TypedController, ct as CrudController, d as PaginationResult, dt as EventDefinition, en as UserLike, f as IntrospectionData, ft as FieldRule, g as ArcInternalMetadata, gt as PresetHook, h as ResourceMetadata, ht as PresetFunction, i as ValidationResult, it as ActionDefinition, j as ArcDecorator, jt as IController, k as IntrospectionPluginOptions, kt as ControllerLike, l as TypedRepository, lt as CrudRouteKey, m as RegistryStats, mt as OpenApiSchemas, n as ConfigError, nn as envelope, o as InferDocType, ot as ActionHandlerFn, p as RegistryEntry, pt as MiddlewareConfig, qt as JwtContext, r as ValidateOptions, rn as getUserId, s as InferResourceDoc, st as ActionsMap, t as RouteHandlerMethod, tn as UserOrganization, u as TypedResourceConfig, ut as CrudSchemas, v as LookupOption, vt as RateLimitConfig, w as ServiceContext, wt as RouteDefinition, x as PopulateOption, xt as ResourceHookContext, y as OwnershipCheck, yt as ResourceCacheConfig } from "../index-BGbpGVyM.mjs";
+import { _ as isAuthenticated, c as getOrgRoles, g as hasOrgAccess, n as PUBLIC_SCOPE, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, v as isElevated, y as isMember } from "../types-tgR4Pt8F.mjs";
+import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-C8Y0XLAu.mjs";
+import { n as ElevationOptions, t as ElevationEvent } from "../elevation-s5ykdNHr.mjs";
+export { AUTHENTICATED_SCOPE, ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ApiResponse, ArcDecorator, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OpenApiSchemas, OwnershipCheck, PUBLIC_SCOPE, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResourceCacheConfig, ResourceConfig, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult, envelope, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };

package/dist/types/index.mjs

@@ -1,33 +1,3 @@
 import { _ as isElevated, f as getTeamId, g as isAuthenticated, h as hasOrgAccess, n as PUBLIC_SCOPE, o as getOrgId, s as getOrgRoles, t as AUTHENTICATED_SCOPE, v as isMember } from "../types-AOD8fxIw.mjs";
-//#region src/types/index.ts
-/**
-* Response envelope helper — wraps data in Arc's standard `{ success, data }` format.
-*
-* @example
-* ```typescript
-* import { envelope } from '@classytic/arc';
-*
-* handler: async (req, reply) => {
-*   const data = await getResults();
-*   return envelope(data);
-*   // → { success: true, data }
-* }
-* ```
-*/
-function envelope(data, meta) {
-	return {
-		success: true,
-		data,
-		...meta
-	};
-}
-/**
-* Extract user ID from a user object (supports both id and _id)
-*/
-function getUserId(user) {
-	if (!user) return void 0;
-	const id = user.id ?? user._id;
-	return id ? String(id) : void 0;
-}
-//#endregion
+import { n as getUserId, t as envelope } from "../types-CDnTEpga.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, envelope, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };

package/dist/types-CDnTEpga.mjs

@@ -0,0 +1,27 @@
+//#region src/types/base.ts
+/** Extract user ID from a user object (supports both id and _id). */
+function getUserId(user) {
+	if (!user) return void 0;
+	const id = user.id ?? user._id;
+	return id ? String(id) : void 0;
+}
+/**
+* Wrap data in Arc's standard `{ success: true, data }` envelope.
+*
+* @example
+* ```typescript
+* handler: async (req, reply) => {
+*   const data = await getResults();
+*   return envelope(data);  // → { success: true, data }
+* }
+* ```
+*/
+function envelope(data, meta) {
+	return {
+		success: true,
+		data,
+		...meta
+	};
+}
+//#endregion
+export { getUserId as n, envelope as t };