@spinekit/purchase 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.4.0 — 2026-09-04
+
+### Added — `disabledRoutes` and `extraActions` on `SupplierResourceDeps`
+
+`createSupplierResource` now accepts two additional optional knobs:
+
+- `disabledRoutes` — passed straight to `defineResource`. Lets the host omit CRUD
+  slots that should not exist for a given deployment (e.g. disable `delete` when the
+  supplier is a party-identity facet so nothing silently orphans the role grant).
+- `extraActions` — passed to `defineResource` as `actions`. Additional verbs on
+  `POST /:id/action`; each carries its own `permissions`. Intended for the retirement
+  verb that replaces a disabled delete, and any other vertical-specific verb.
+
+Both props are optional with no default, so the existing `0.3.0` surface is unchanged.
+
+### Changed — peer floors raised to current
+
+- `@classytic/arc` `>=2.36.0` → **`>=2.38.0`**
+- `@classytic/primitives` `>=0.26.2` → **`>=0.26.4`**
+- `@spinekit/kit` `>=0.1.0` → **`>=0.4.0`**
+
 ## 0.3.0 - 2026-08-24
 
 ### Added

package/dist/{entity-model-D-03ovSg.mjs → entity-model-DUlcwEr1.mjs}

@@ -1,7 +1,4 @@
 //#region src/entity-model.ts
-function asEntityModel(model) {
-	return model;
-}
 /**
 * Arc's resource layer (custom-controller path) speaks `AnyRecord` — an
 * index-signed record — while the kernel repository is typed on the CLOSED
@@ -20,4 +17,4 @@ function asRecord(doc) {
 	return doc;
 }
 //#endregion
-export { asRecord as n, asRecordRepository as r, asEntityModel as t };
+export { asRecordRepository as n, asRecord as t };

package/dist/resources/purchase-order/purchase-order.resource.mjs

@@ -1,4 +1,4 @@
-import { n as asRecord, r as asRecordRepository, t as asEntityModel } from "../../entity-model-D-03ovSg.mjs";
+import { n as asRecordRepository, t as asRecord } from "../../entity-model-DUlcwEr1.mjs";
 import { BaseController, defineResource } from "@classytic/arc";
 import { permissionMatrix } from "@classytic/arc/permissions";
 import { getUserId, scopeFirstCtx } from "@classytic/arc/scope";
@@ -120,7 +120,7 @@ function createPurchaseOrderResource(args) {
 		audit: true,
 		tenantField: false,
 		adapter: createMongooseAdapter({
-			model: asEntityModel(engine.models.PurchaseOrder),
+			model: engine.models.PurchaseOrder,
 			repository: asRecordRepository(engine.repositories.purchaseOrder)
 		}),
 		controller: new PurchaseOrderModuleController(),

package/dist/resources/supplier/supplier.resource.d.mts

@@ -28,6 +28,28 @@ interface SupplierResourceDeps<TSupplier extends SupplierFacet = SupplierFacet>
    * Absent, behaviour is unchanged — this is additive.
    */
   queryParser?: Parameters<typeof defineResource>[0]['queryParser'];
+  /**
+   * CRUD slots to leave UNMOUNTED. Absent ⇒ all five mount, unchanged.
+   *
+   * The route surface is the host's to shape: a supplier-management portal wants
+   * full CRUD, while a deployment where the supplier is a facet of a party
+   * identity must not hard-delete one — the identity root would keep granting the
+   * `supplier` role with nothing left pointing at it, and no event would say so.
+   *
+   * `disabledRoutes`, not a deny-gate: the declared surface IS the intended
+   * surface, so a slot the host excludes should not exist rather than exist
+   * behind a lock (FAIL LOUD rule 5).
+   */
+  disabledRoutes?: Parameters<typeof defineResource>[0]['disabledRoutes'];
+  /**
+   * Host actions mounted on `POST /:id/action` — the retirement verb that
+   * replaces `delete` when the host disables it, and anything else a vertical
+   * needs.
+   *
+   * Each action carries its OWN `permissions`; this factory does not supply a
+   * default, so an ungated action is the host's declaration, not an inherited one.
+   */
+  extraActions?: Parameters<typeof defineResource>[0]['actions'];
 }
 declare function createSupplierResource<TSupplier extends SupplierFacet = SupplierFacet>(deps: SupplierResourceDeps<TSupplier>): import("@classytic/arc").ResourceDefinition<AnyRecord>;
 //#endregion

package/dist/resources/supplier/supplier.resource.mjs

@@ -1,4 +1,4 @@
-import { r as asRecordRepository } from "../../entity-model-D-03ovSg.mjs";
+import { n as asRecordRepository } from "../../entity-model-DUlcwEr1.mjs";
 import { defineResource } from "@classytic/arc";
 import { ValidationError } from "@classytic/arc/utils";
 import { createMongooseAdapter } from "@classytic/mongokit/adapter";
@@ -23,7 +23,7 @@ import { buildCrudSchemasFromModel } from "@classytic/mongokit/utils";
 /** Import batch ceiling. Row-by-row work is linear, so the cap bounds the request, not the loop. */
 const IMPORT_MAX_ROWS = 500;
 function createSupplierResource(deps) {
-	const { model, repository, permissions, prefix = "/inventory/suppliers", extraFilterableFields, queryParser } = deps;
+	const { model, repository, permissions, prefix = "/inventory/suppliers", extraFilterableFields, queryParser, disabledRoutes, extraActions } = deps;
 	/**
 	* Wire schemas derived FROM THE MODEL, so a country pack's `extraFields` are accepted without
 	* anyone remembering to widen a hand-written schema — and `strictAdditionalProperties` still
@@ -87,6 +87,8 @@ function createSupplierResource(deps) {
 	};
 	return defineResource({
 		...queryParser ? { queryParser } : {},
+		...disabledRoutes?.length ? { disabledRoutes } : {},
+		...extraActions ? { actions: extraActions } : {},
 		name: "supplier",
 		displayName: "Suppliers",
 		tag: "Inventory - Suppliers",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spinekit/purchase",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Arc module for @classytic/purchase — supplier purchase orders (draft→approve→receive with CAS + compensation + pendingStockReceipt crash heal) composed into arc apps. Paisa money wire; catalog/stockReceipt/sequence kernel ports injected; accounting posting + approval stay host seams.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -83,19 +83,19 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@classytic/arc": ">=2.34.0",
-    "@spinekit/kit": ">=0.1.0",
-    "@classytic/mongokit": ">=3.34.0",
-    "@classytic/primitives": ">=0.23.0",
+    "@classytic/arc": ">=2.38.0",
+    "@classytic/mongokit": ">=3.36.0",
+    "@classytic/primitives": ">=0.26.4",
     "@classytic/purchase": ">=0.6.0",
+    "@spinekit/kit": ">=0.4.0",
     "mongoose": ">=9.4.1",
     "zod": ">=4.0.0"
   },
   "devDependencies": {
-    "@classytic/arc": "^2.34.0",
+    "@classytic/arc": "^2.38.0",
     "@classytic/arc-testkit": "^0.4.0",
-    "@classytic/mongokit": ">=3.34.0",
-    "@classytic/primitives": ">=0.23.0",
+    "@classytic/mongokit": "^3.36.0",
+    "@classytic/primitives": ">=0.26.4",
     "@classytic/purchase": ">=0.6.0",
     "@types/node": "^24.3.0",
     "fastify": "^5.12.0",
@@ -105,7 +105,7 @@
     "typescript": "^7.0.2",
     "vitest": "^3.2.4",
     "zod": "^4.3.6",
-    "@spinekit/kit": "0.2.0"
+    "@spinekit/kit": "0.4.0"
   },
   "author": "Classytic",
   "homepage": "https://www.npmjs.com/package/@spinekit/purchase",