@classytic/arc 1.1.0 → 2.1.2

package/dist/types/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/types/index.ts"],"mappings":";;;;;;;;;YAgCY,cAAA;IAkBgB;IAhBxB,KAAA,EAAO,YAAA;IAAP;IAIA,IAAA,EAAM,MAAA;IAAN;IAIA,cAAA,GAAiB,MAAA;IAAjB;IAEA,SAAA;MAAc,OAAA;MAAoB,OAAA;IAAA;IAElC;IAAA,cAAA,GAAiB,MAAA;IAEjB;IAAA,QAAA;IAEkB;IAAlB,eAAA,GAAkB,MAAA;EAAA;AAAA;AAAA,KAkCV,SAAA,GAAY,MAAA;AAAA,KACZ,QAAA,GAAW,KAAA,CAAM,QAAA;AAA7B;;;;;AAQA;AARA,KAQY,QAAA,GAAW,QAAA;8BAErB,KAAA;AAAA;AAMF;;;AAAA,iBAAgB,SAAA,CAAU,IAAA,EAAM,QAAA;AAAA,KAapB,cAAA,SAAuB,WAAA,CAAY,IAAA;AAAA,UAE9B,WAAA;EACf,OAAA;EACA,IAAA,GAAO,CAAA;EACP,KAAA;EACA,OAAA;EACA,IAAA,GAAO,MAAA;AAAA;AAAA,UASQ,gBAAA;EACf,MAAA;EACA,cAAA;EAAA,CACC,GAAA;AAAA;AAAA,UAGc,UAAA;EACf,GAAA;EAAA,CACC,GAAA;AAAA;AAAA,UAOc,cAAA;EACf,SAAA;EACA,IAAA;EACA,OAAA,GAAU,MAAA;EAAA,CACT,GAAA;AAAA;;;;;;UAQc,mBAAA,SAA4B,cAAA;EAxB/B;EA0BZ,cAAA,GAAiB,MAAA;EAvBF;EAyBf,MAAA,GAFuB,YAAA;;EAIvB,eAAA;IAAoB,KAAA;IAAe,MAAA;EAAA;;EAEnC,GAAA;IACE,KAAA,GAL+C,UAAA;IAM/C,MAAA,GADmD,kBAAA;IAAA,CAElD,GAAA;EAAA;AAAA;;;AAXL;;UAmBiB,sBAAA;EACf,IAAA;EACA,KAAA;EACA,IAAA,YAAgB,MAAA;EAbqC;EAerD,QAAA,uBAA+B,MAAA;EAxB0B;;;;EA6BzD,eAAA,GAAkB,cAAA;EAClB,MAAA,uBAA6B,MAAA;EAC7B,OAAA,GAAU,MAAA;EACV,MAAA;EACA,IAAA;EACA,KAAA;EACA,IAAA;EACA,OAAA,GAAU,MAAA;EA3BH;EAAA,CA6BN,GAAA;AAAA;;;;AAnBH;;;;;;;UAgCiB,cAAA;EAfL;EAiBV,IAAA;EAjBgB;EAmBhB,MAAA;EAlCA;EAoCA,KAAA,GAAQ,MAAA;EAnCQ;EAqChB,OAAA;IACE,KAAA;IACA,IAAA,GAAO,MAAA;IACP,IAAA;EAAA;EAhC2B;EAmC7B,QAAA,GAAW,cAAA;AAAA;;;;;;;;UAUI,WAAA;EACf,OAAA,GAAU,MAAA;EACV,KAAA;EACA,IAAA,YAAgB,MAAA;;EAEhB,QAAA,uBAA+B,MAAA;EAnBtB;;;;;EAyBT,eAAA,GAAkB,cAAA;EAClB,MAAA;EACA,IAAA;EACA,KAAA;EACA,MAAA,uBAA6B,MAAA;EA7B3B;EAAA,CA+BD,GAAA;AAAA;;;;;AAjBH;;;;;;UA8BiB,oBAAA;EACf,KAAA,CAAM,KAAA,EAAO,MAAA,uCAA6C,WAAA;EAhBvB;;;;EAsBnC,cAAA;IACE,IAAA;IACA,UAAA,EAAY,MAAA;IACZ,QAAA;EAAA;AAAA;AAAA,UAIa,oBAAA;EACf,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,iBAAA,SAA0B,cAAA;EAjCzC;;;;EAsCA,GAAA;IACE,YAAA;IACA,aAAA,GAAgB,kBAAA;IAChB,WAAA,GAAc,mBAAA;EAAA;EAEhB,OAAA,GAAU,MAAA;EACV,cAAA,GAAiB,MAAA;EACjB,SAAA;IAAc,OAAA;IAAoB,OAAA;EAAA;EAClC,eAAA,GAAkB,MAAA;AAAA;AAAA,KAGR,eAAA,GAAkB,eAAA;EAC5B,YAAA,GAAe,OAAA,EAAS,cAAA,EAAgB,KAAA,EAAO,YAAA,KAAiB,OAAA;AAAA;;;;;UAOjD,YAAA;EA5BoB;EA8BnC,KAAA,EAF2B,UAAA;EA3B3B;EA+BA,QAAA,EAFkD,gBAAA;EA1BnC;EA8Bf,UAAA;AAAA;;;;;UAOe,eAAA;EArC0B;EAuCzC,OAAA,MAAa,IAAA,UAAc,OAAA,EAAS,CAAA,EAAG,IAAA,GAAO,OAAA;IAAU,EAAA;IAAY,SAAA,EAAW,IAAA;EAAA,OAAY,OAAA;EAjCzF;EAmCF,SAAA,GAAY,OAAA,UAAiB,OAAA,GAAU,KAAA,qBAA0B,OAAA,WAAkB,OAAA;EAlCjE;EAoClB,aAAA;AAAA;;;;;KAOU,qBAAA,GAAwB,eAAA;EAElC,GAAA,GAAM,YAAA;EAGN,MAAA,GAAS,eAAA;EAGT,YAAA,IAAgB,OAAA,EAAS,cAAA,EAAgB,KAAA,EAAO,YAAA,KAAiB,OAAA;EACjE,oBAAA,IAAwB,OAAA,EAAS,cAAA,EAAgB,KAAA,EAAO,YAAA,KAAiB,OAAA;EAGzE,kBAAA,IAAsB,OAAA;IAAY,QAAA;EAAA,MAAyB,oBAAA;EAAA,CAG1D,GAAA;AAAA;AAAA,UAGc,cAAA;EACf,KAAA;EACA,SAAA;AAAA;;;;;;;;;;;AA9CF;;;;;;;;;;UA2EiB,mBAAA;EA9DA;EAgEf,SAAA;EAhE8B;EAkE9B,MAAA;EAhE+E;EAkE/E,IAAA;IAAS,SAAA;IAAoB,MAAA;EAAA;EAC7B,IAAA;IAAS,SAAA;IAAoB,MAAA;EAAA;EAnEhB;EAqEb,IAAA;EArE2B;;;;;EA2E3B,YAAA,GAAe,MAAA;EA3E4E;EA6E3F,QAAA;AAAA;AAAA,UAGe,eAAA;EA9EkD;EAgFjE,GAAA;EAhFmF;EAkFnF,UAAA;AAAA;AAAA,UAGe,cAAA,QAAsB,SAAA;EACrC,IAAA;EACA,WAAA;EACA,GAAA;EACA,MAAA;EACA,OAAA,GAAU,WAAA,CAAY,IAAA;EA5Eb;EA8ET,UAAA,GAAa,WAAA,CAAY,IAAA,IAAQ,cAAA;EACjC,WAAA;EACA,WAAA,GAAc,mBAAA;EACd,aAAA,GAAgB,kBAAA;EAChB,cAAA,GAAiB,cAAA;EACjB,aAAA,GAAgB,OAAA,CAAQ,WAAA;EACxB,OAAA,GAAU,KAAA,UAAe,YAAA;IAAiB,IAAA;IAAA,CAAe,GAAA;EAAA;EACzD,KAAA,GAAQ,aAAA;EAxFF;;;;;;;;;;;;;;;EAwGN,IAAA,GAhBqB,cAAA;EA9Ea;;;;;;AAMpC;;;;;AA+BA;EAsEE,MAAA,GAboD,kBAAA;EAcpD,WAAA,GAAc,gBAAA;EACd,gBAAA,GAAmB,eAAA;EACnB,WAAA;EACA,oBAAA;EACA,cAAA,GAAiB,YAAA;EArER;;;;;EA2ET,WAAA;EAlEA;;;;EAuEA,OAAA;EACA,MAAA;EACA,MAAA,GAAS,MAAA,SAAe,eAAA;EACxB,cAAA;EACA,YAAA;EACA,eAAA;EAhEe;EAkEf,YAAA;EAlE6B;;;;;EAwE7B,SAAA,GAAY,eAAA;EAjEqB;;;;;EAuEjC,KAAA,GAAQ,mBAAA;AAAA;;;;;UAOO,mBAAA;EACf,IAAA,GAAO,eAAA;EACP,GAAA,GAAM,eAAA;EACN,MAAA,GAAS,eAAA;EACT,MAAA,GAAS,eAAA;EACT,MAAA,GAAS,eAAA;AAAA;AAAA,UAGM,aAAA;EACf,YAAA,IAAgB,IAAA,EAAM,SAAA,KAAc,OAAA,CAAQ,SAAA,IAAa,SAAA;EACzD,WAAA,IAAe,GAAA,EAAK,SAAA,KAAc,OAAA;EAClC,YAAA,IAAgB,EAAA,UAAY,IAAA,EAAM,SAAA,KAAc,OAAA,CAAQ,SAAA,IAAa,SAAA;EACrE,WAAA,IAAe,GAAA,EAAK,SAAA,KAAc,OAAA;EAClC,YAAA,IAAgB,EAAA,aAAe,OAAA;EAC/B,WAAA,IAAe,EAAA,aAAe,OAAA;AAAA;;;;UAMf,eAAA;EAlGF;EAoGb,MAAA;EApGiC;EAsGjC,IAAA;EApGA;;;;EAyGA,OAAA,WAAkB,oBAAA,KAAuB,OAAA,EAAS,cAAA,EAAgB,KAAA,EAAO,YAAA;EAvGxD;EA0GjB,WAAA,EAAa,eAAA;EAzGG;;;;;EAgHhB,WAAA;EA/GyD;;;;;;;;;EA0HzD,SAAA;EA1FmB;EA6FnB,OAAA;EA3FA;EA6FA,WAAA;EA5FiB;EA8FjB,IAAA;EAnFA;;;;;;;;;EA8FA,UAAA,GAAa,oBAAA,OAAyB,OAAA,EAAS,eAAA,KAAoB,oBAAA;EAjFvD;EAoFZ,MAAA,GAAS,MAAA;AAAA;AAAA,UAGM,kBAAA;EACf,YAAA;EACA,cAAA;EACA,cAAA;EACA,cAAA;EACA,aAAA;EACA,UAAA,GAAa,MAAA;IAAiB,aAAA;IAAA,CAA0B,GAAA;EAAA;EACxD,KAAA,GAAQ,MAAA;AAAA;AAAA,UAGO,SAAA;EACf,KAAA;EACA,QAAA;EACA,QAAA;EACA,MAAA;AAAA;;;;;;;AAhFF;;;;;;;;;UAkGiB,WAAA;EA/FyC;EAiGxD,IAAA;IACE,WAAA,GAAc,MAAA;IACd,QAAA,GAAW,MAAA;IAAA,CACV,GAAA;EAAA;EAjG2B;EAqG9B,GAAA;IACE,MAAA,GAAS,MAAA;IACT,QAAA,GAAW,MAAA;IAAA,CACV,GAAA;EAAA;EA7GiC;EAiHpC,MAAA;IACE,IAAA,GAAO,MAAA;IACP,QAAA,GAAW,MAAA;IAAA,CACV,GAAA;EAAA;EAnH+B;EAuHlC,MAAA;IACE,MAAA,GAAS,MAAA;IACT,IAAA,GAAO,MAAA;IACP,QAAA,GAAW,MAAA;IAAA,CACV,GAAA;EAAA;EA1HkE;EA8HrE,MAAA;IACE,MAAA,GAAS,MAAA;IACT,QAAA,GAAW,MAAA;IAAA,CACV,GAAA;EAAA;EAAA,CAIF,GAAA;AAAA;AAAA,UAGc,cAAA;EACf,MAAA;EACA,UAAA;EACA,UAAA;EACA,MAAA;EACA,SAAA;EApI8B;;;;;;;;;;;;;;;;;;;EAwJ9B,QAAA;EAAA,CACC,GAAA;AAAA;;KAIS,iBAAA,IAAqB,OAAA,EAAS,iBAAA,EAAmB,KAAA,EAAO,YAAA,KAAiB,OAAA;AAAA,KACzE,YAAA;AAAA,UAMK,gBAAA;EACf,IAAA,GAAO,iBAAA;EACP,GAAA,GAAM,iBAAA;EACN,MAAA,GAAS,iBAAA;EACT,MAAA,GAAS,iBAAA;EACT,MAAA,GAAS,iBAAA;EAAA,CACR,GAAA,WAAc,iBAAA;AAAA;;;;AApHjB;UA+HiB,UAAA;;EAEf,MAAA,OAAa,MAAA,mBAAyB,KAAA,aAAkB,CAAA;EAhIxD;EAkIA,IAAA,GAAO,OAAA,EAAS,MAAA,mBAAyB,OAAA;IAAY,SAAA;EAAA;EA9HrD;EAgIA,MAAA,OAAa,MAAA,mBAAyB,KAAA,aAAkB,CAAA;AAAA;;;;UAMzC,oBAAA;EApID;EAsId,GAAA,EAAK,UAAA;EAnIU;EAqIf,OAAA,EAAS,eAAA;AAAA;;;;;;;;AA/GX;;;;;;;;;;;;;;;;;;;;;;;;;KAkJY,aAAA,IACV,OAAA,EAAS,cAAA,EACT,OAAA,EAAS,oBAAA,KACN,OAAA;;;;UAKY,SAAA;EAzIN;EA2IT,WAAA;EA1Ia;EA4Ib,YAAA;EAvIA;EAyIA,SAAA;EAxIW;EA0IX,gBAAA;EAzIS;EA2IT,SAAA;AAAA;;;;;;;;;;;AA3HF;;;;;;;;;;UAkJiB,WAAA;EAxHH;EA0HZ,GAAA,EAAK,UAAA;EAtHK;;;;EA4HV,WAAA,GACE,OAAA,EAAS,MAAA,mBACT,OAAA;IAAY,SAAA;IAAoB,gBAAA;EAAA,MAC7B,SAAA;EA/HmC;;;EAoIxC,kBAAA,OAAyB,MAAA,mBAAyB,KAAA,aAAkB,CAAA;AAAA;AAAA,UAGrD,cAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA,cAAoB,MAAA;EACpB,QAAA;EACA,IAAA;AAAA;AAAA,UAOe,UAAA;EACf,SAAA;EACA,KAAA;EACA,OAAA,GAAU,GAAA,EAAK,SAAA,YAAqB,OAAA,SAAgB,SAAA,GAAY,OAAA,CAAQ,SAAA;EACxE,QAAA;AAAA;AAAA,UAGe,YAAA;EACf,IAAA;EACA,gBAAA,GAAmB,eAAA,OAAsB,WAAA,EAAa,mBAAA,KAAwB,eAAA;EAC9E,WAAA,GAAc,gBAAA;EACd,aAAA,GAAgB,kBAAA;EAChB,iBAAA,GAAoB,MAAA;EACpB,KAAA,GAAQ,UAAA;AAAA;AAAA,KAGE,cAAA,IAAkB,MAAA,EAAQ,cAAA,KAAmB,YAAA;AAAA,UAMxC,uBAAA;EACf,OAAA;EACA,UAAA,SAAmB,OAAA;EACnB,OAAA,GAAU,MAAA,CAAO,OAAA;EACjB,SAAA;AAAA;AAAA,UAGe,gBAAA;EACf,UAAA;EACA,SAAA;AAAA;AAAA,UAGe,aAAA;EACf,IAAA;EACA,KAAA,SAAc,OAAA;AAAA;AAAA,UAGC,WAAA;EACf,OAAA;EACA,SAAA;EAAA,CACC,GAAA;AAAA;;;;;;;;;;;;;;;;;;;AAzJH;;;;;;;;;;AAuCA;;;;;;;;;;;;;;;AAQA;;;;;;;;;UAiKiB,iBAAA;EAvJN;AAuBX;;;EAqIE,GAAA;IA5HW,6CA8HT,MAAA,UAvHuB;IAyHvB,SAAA,WAzHmE;IA2HnE,aAAA,WAzIF;IA2IE,gBAAA,WArIF;IAuIE,IAAA,GAAO,MAAA,mBAtIP;IAwIA,MAAA,GAAS,MAAA;EAAA;EAvIT;;;;;;;;EAkJF,YAAA,GAAe,aAAA;EAzIA;;;;EA+If,SAAA,IACE,OAAA,EAAS,cAAA,EACT,KAAA,EAAO,YAAA,EACP,KAAA,GAAQ,KAAA,YACE,OAAA;EAjJZ;;;;;;EAyJA,gBAAA;EA/Ie;;;EAoJf,YAAA;AAAA;AAAA,UAIe,0BAAA;EACf,IAAA;EACA,MAAA;EACA,OAAA;EACA,SAAA;AAAA;AAAA,UAGe,iBAAA;EA5Jf;EA8JA,MAAA;EA9JU;EAiKV,WAAA,GAAc,mBAAA;EAjKsC;EAoKpD,GAAA;EApKwE;EAuKxE,OAAA,GAAU,OAAA,CAAQ,WAAA;EAtKV;EAyKR,WAAA,GAAc,gBAAA;EAtKC;EAyKf,gBAAA,GAAmB,eAAA;;EAGnB,oBAAA;EA1KsD;EA6KtD,cAAA,GAAiB,YAAA;EA5KH;EA+Kd,IAAA,GAH6B,cAAA;EA1KT;EAgLpB,YAAA;EA/KkB;EAkLlB,aAAA,GAAgB,kBAAA;EAvLhB;EA0LA,MAAA,GAHkC,kBAAA;EAtLf;EA4LnB,YAAA;EA5LyC;;;;;EAmMzC,SAAA,GAAY,eAAA;AAAA;AAAA,UAOG,gBAAA;EACf,IAAA;EACA,WAAA;EACA,GAAA;EACA,MAAA;EACA,MAAA;EACA,WAAA,GAAc,mBAAA;EACd,OAAA;EACA,gBAAA,GAAmB,eAAA;EACnB,MAAA,EAAQ,KAAA;IACN,MAAA;IACA,IAAA;IACA,OAAA;IACA,SAAA;IACA,OAAA;EAAA;EAEF,MAAA;AAAA;AAAA,UAGe,aAAA,SAAsB,gBAAA;EACrC,MAAA;EACA,OAAA;IAAY,IAAA;IAAc,IAAA;EAAA;EAC1B,MAAA;EACA,oBAAA;EACA,cAAA,GAAiB,cAAA;EACjB,YAAA;EA/M+B;EAiN/B,gBAAA,GAAmB,MAAA;IAAiB,IAAA;IAAc,KAAA;IAA2B,WAAA;EAAA;;EAE7E,aAAA,GAAgB,KAAA;IAAQ,IAAA;IAAc,IAAA;IAAc,UAAA;EAAA;EA5M/B;EA8MrB,YAAA;EA3M0B;EA6M1B,cAAA;EA7M0B;EA+M1B,SAAA,GAAY,eAAA;AAAA;AAAA,UAGG,aAAA;EACf,KAAA;EACA,cAAA;EACA,KAAA,GAAQ,MAAA;EACR,QAAA,GAAW,MAAA;EACX,WAAA,GAAc,MAAA;EACd,WAAA;EACA,WAAA;AAAA;AAAA,UAGe,iBAAA;EACf,SAAA,EAAW,gBAAA;EACX,KAAA,EAAO,aAAA;EACP,WAAA;AAAA;AAAA,UAGe,eAAA;EACf,IAAA;EACA,OAAA,GAAU,IAAA,cAAkB,OAAA;EAC5B,MAAA,GAAS,MAAA;EACT,WAAA;AAAA;AAAA,UAOe,WAAA;EACf,KAAA;EACA,OAAA;EACA,IAAA;AAAA;AAAA,UAGe,gBAAA;EACf,KAAA;EACA,MAAA,EAAQ,WAAA;AAAA;AAAA,UAGO,eAAA;EACf,MAAA;AAAA;;;;KAuBU,YAAA,MACV,CAAA,SAAU,WAAA,YACN,CAAA,GACA,CAAA,SAAU,cAAA,YACR,CAAA;AA5JR;;;;;;;;;;;AAAA,KA0KY,eAAA,MAAqB,CAAA,SAAU,WAAA,YAAuB,CAAA;AAAA,KAEtD,gBAAA,MAAsB,CAAA,SAAU,cAAA,YAA0B,CAAA;AAAA,KAC1D,mBAAA,SAA4B,cAAA,CAAe,IAAA;AAAA,KAC3C,eAAA,SAAwB,WAAA,CAAY,IAAA;AAAA,KACpC,eAAA,SAAwB,cAAA,CAAe,IAAA"}

package/dist/types/index.mjs

@@ -0,0 +1,15 @@
+import { a as getTeamId, c as isElevated, i as getOrgRoles, l as isMember, n as PUBLIC_SCOPE, o as hasOrgAccess, r as getOrgId, s as isAuthenticated, t as AUTHENTICATED_SCOPE } from "../types-Beqn1Un7.mjs";
+
+//#region src/types/index.ts
+/**
+* Extract user ID from a user object (supports both id and _id)
+*/
+function getUserId(user) {
+	if (!user) return void 0;
+	const id = user.id ?? user._id;
+	return id ? String(id) : void 0;
+}
+
+//#endregion
+export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };
+//# sourceMappingURL=index.mjs.map

package/dist/types/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/types/index.ts"],"sourcesContent":["/**\n * Arc Framework Types\n *\n * Clean, type-safe interfaces for the Arc framework.\n * Modern TypeScript patterns - no `any`, proper generics.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest, RouteHandlerMethod } from 'fastify';\nimport type { Types } from 'mongoose';\nimport type { DataAdapter } from '../adapters/interface.js';\nimport type { PermissionCheck, UserBase } from '../permissions/types.js';\nimport type { RequestScope } from '../scope/types.js';\n\n// Re-export core types\nexport type { RouteHandlerMethod } from 'fastify';\n// Re-export scope types\nexport type { RequestScope } from '../scope/types.js';\nexport {\n  isMember,\n  isElevated,\n  hasOrgAccess,\n  isAuthenticated,\n  getOrgId,\n  getOrgRoles,\n  getTeamId,\n  PUBLIC_SCOPE,\n  AUTHENTICATED_SCOPE,\n} from '../scope/types.js';\nexport type { ElevationOptions, ElevationEvent } from '../scope/elevation.js';\n\n// Fastify declaration merge — request.scope is always defined\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Request scope — set by auth adapter, read by permissions/presets/guards */\n    scope: RequestScope;\n\n    // ---- Auth / identity ----\n    /** Current user — set by auth adapter (Better Auth, JWT, custom) */\n    user: Record<string, unknown>;\n\n    // ---- Policy middleware ----\n    /** Policy-injected query filters (e.g. ownership, org-scoping) */\n    _policyFilters?: Record<string, unknown>;\n    /** Field mask — fields to include/exclude in responses */\n    fieldMask?: { include?: string[]; exclude?: string[] };\n    /** Arbitrary policy metadata for downstream consumers */\n    policyMetadata?: Record<string, unknown>;\n    /** Document loaded by policy middleware for ownership checks */\n    document?: unknown;\n    /** Ownership check context (field name + user field) */\n    _ownershipCheck?: Record<string, unknown>;\n  }\n}\n\n// Re-export from dedicated type modules\nexport type {\n  CrudRepository,\n  PaginatedResult,\n  QueryOptions,\n  PaginationParams,\n  InferDoc,\n} from './repository.js';\n\nexport type {\n  IRequestContext,\n  IControllerResponse,\n  ControllerHandler,\n  FastifyHandler,\n  RouteHandler,\n  IController,\n  ControllerLike,\n} from './handlers.js';\n\nexport type {\n  PermissionCheck,\n  PermissionContext,\n  PermissionResult,\n  UserBase,\n} from '../permissions/types.js';\n\n// ============================================================================\n// Base Types\n// ============================================================================\n\nexport type AnyRecord = Record<string, unknown>;\nexport type ObjectId = Types.ObjectId | string;\n\n/**\n * Flexible user type that accepts any object with id/ID properties.\n * Use this instead of `any` when dealing with user objects.\n * Re-exports UserBase from permissions module for convenience.\n * The actual user structure is defined by your app's auth system.\n */\nexport type UserLike = UserBase & {\n  /** User email (optional) */\n  email?: string;\n};\n\n/**\n * Extract user ID from a user object (supports both id and _id)\n */\nexport function getUserId(user: UserLike | null | undefined): string | undefined {\n  if (!user) return undefined;\n  const id = user.id ?? user._id;\n  return id ? String(id) : undefined;\n}\n\n\n// ============================================================================\n// Controller Types\n// ============================================================================\n\n/** Standard controller type alias for CRUD operations */\nimport type { IController } from './handlers.js';\nexport type CrudController<TDoc> = IController<TDoc>;\n\nexport interface ApiResponse<T = unknown> {\n  success: boolean;\n  data?: T;\n  error?: string;\n  message?: string;\n  meta?: Record<string, unknown>;\n}\n\n// ============================================================================\n// User Types\n// ============================================================================\n\n// UserBase is re-exported from permissions/types.ts\n\nexport interface UserOrganization {\n  userId: string;\n  organizationId: string;\n  [key: string]: unknown;\n}\n\nexport interface JWTPayload {\n  sub: string;\n  [key: string]: unknown;\n}\n\n// ============================================================================\n// Request Types - Flexible\n// ============================================================================\n\nexport interface RequestContext {\n  operation?: string;\n  user?: unknown; // YOUR user object\n  filters?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/**\n * Internal metadata shape injected by Arc's Fastify adapter.\n * Extends RequestContext with known internal fields so controllers\n * can access them without `as AnyRecord` casts.\n */\nexport interface ArcInternalMetadata extends RequestContext {\n  /** Policy filters from permission middleware */\n  _policyFilters?: Record<string, unknown>;\n  /** Request scope from scope resolution */\n  _scope?: import('../scope/types.js').RequestScope;\n  /** Ownership check config from ownedByUser preset */\n  _ownershipCheck?: { field: string; userId: string };\n  /** Arc instance references (hooks, field permissions, etc.) */\n  arc?: {\n    hooks?: import('../hooks/HookSystem.js').HookSystem;\n    fields?: import('../permissions/fields.js').FieldPermissionMap;\n    [key: string]: unknown;\n  };\n}\n\n/**\n * Controller-level query options - parsed from request query string\n * Includes pagination, filtering, and context data\n */\nexport interface ControllerQueryOptions {\n  page?: number;\n  limit?: number;\n  sort?: string | Record<string, 1 | -1>;\n  /** Simple populate (comma-separated string or array) */\n  populate?: string | string[] | Record<string, unknown>;\n  /**\n   * Advanced populate options (Mongoose-compatible)\n   * When set, takes precedence over simple `populate`\n   */\n  populateOptions?: PopulateOption[];\n  select?: string | string[] | Record<string, 0 | 1>; // String, array, or MongoDB projection\n  filters?: Record<string, unknown>;\n  search?: string;\n  lean?: boolean;\n  after?: string; // Cursor-based pagination\n  user?: unknown; // Current user context\n  context?: Record<string, unknown>; // Additional context\n  /** Allow additional options */\n  [key: string]: unknown;\n}\n\n/**\n * Mongoose-compatible populate option for advanced field selection\n * Used when you need to select specific fields from populated documents\n *\n * @example\n * ```typescript\n * // URL: ?populate[author][select]=name,email\n * // Generates: { path: 'author', select: 'name email' }\n * ```\n */\nexport interface PopulateOption {\n  /** Field path to populate */\n  path: string;\n  /** Fields to select (space-separated) */\n  select?: string;\n  /** Filter conditions for populated documents */\n  match?: Record<string, unknown>;\n  /** Query options (limit, sort, skip) */\n  options?: {\n    limit?: number;\n    sort?: Record<string, 1 | -1>;\n    skip?: number;\n  };\n  /** Nested populate configuration */\n  populate?: PopulateOption;\n}\n\n/**\n * Parsed query result from QueryParser\n * Includes pagination, sorting, filtering, etc.\n *\n * The index signature allows custom query parsers (like MongoKit's QueryParser)\n * to add additional fields without breaking Arc's type system.\n */\nexport interface ParsedQuery {\n  filters?: Record<string, unknown>;\n  limit?: number;\n  sort?: string | Record<string, 1 | -1>;\n  /** Simple populate (comma-separated string or array) */\n  populate?: string | string[] | Record<string, unknown>;\n  /**\n   * Advanced populate options (Mongoose-compatible)\n   * When set, takes precedence over simple `populate`\n   * @example [{ path: 'author', select: 'name email' }]\n   */\n  populateOptions?: PopulateOption[];\n  search?: string;\n  page?: number;\n  after?: string; // Cursor for cursor-based pagination\n  select?: string | string[] | Record<string, 0 | 1>; // MongoDB projection format\n  /** Allow additional fields from custom query parsers */\n  [key: string]: unknown;\n}\n\n/**\n * Query Parser Interface\n * Implement this to create custom query parsers\n *\n * @example MongoKit QueryParser\n * ```typescript\n * import { QueryParser } from '@classytic/mongokit';\n * const queryParser = new QueryParser();\n * ```\n */\nexport interface QueryParserInterface {\n  parse(query: Record<string, unknown> | null | undefined): ParsedQuery;\n\n  /**\n   * Optional: Export OpenAPI schema for query parameters\n   * Use this to document query parameters in OpenAPI/Swagger\n   */\n  getQuerySchema?(): {\n    type: 'object';\n    properties: Record<string, unknown>;\n    required?: string[];\n  };\n}\n\nexport interface FastifyRequestExtras {\n  user?: Record<string, unknown>;\n}\n\nexport interface RequestWithExtras extends FastifyRequest {\n  /**\n   * Arc metadata - set by createCrudRouter\n   * Contains resource configuration and schema options\n   */\n  arc?: {\n    resourceName?: string;\n    schemaOptions?: RouteSchemaOptions;\n    permissions?: ResourcePermissions;\n  };\n  context?: Record<string, unknown>; // Additional context data\n  _policyFilters?: Record<string, unknown>; // Policy filters from middleware\n  fieldMask?: { include?: string[]; exclude?: string[] }; // Field projection for responses\n  _ownershipCheck?: Record<string, unknown>; // Ownership validation context\n}\n\nexport type FastifyWithAuth = FastifyInstance & {\n  authenticate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;\n};\n\n/**\n * Arc core decorator interface\n * Added by arcCorePlugin to provide instance-scoped hooks and registry\n */\nexport interface ArcDecorator {\n  /** Instance-scoped hook system */\n  hooks: import('../hooks/HookSystem.js').HookSystem;\n  /** Instance-scoped resource registry */\n  registry: import('../registry/ResourceRegistry.js').ResourceRegistry;\n  /** Whether event emission is enabled */\n  emitEvents: boolean;\n}\n\n/**\n * Events decorator interface\n * Added by eventPlugin to provide event pub/sub\n */\nexport interface EventsDecorator {\n  /** Publish an event */\n  publish: <T>(type: string, payload: T, meta?: Partial<{ id: string; timestamp: Date }>) => Promise<void>;\n  /** Subscribe to events */\n  subscribe: (pattern: string, handler: (event: unknown) => void | Promise<void>) => Promise<() => void>;\n  /** Get transport name */\n  transportName: string;\n}\n\n/**\n * Fastify instance with Arc decorators\n * Arc adds these decorators via plugins/presets\n */\nexport type FastifyWithDecorators = FastifyInstance & {\n  // Arc core decorator (from arcCorePlugin)\n  arc?: ArcDecorator;\n\n  // Events decorator (from eventPlugin)\n  events?: EventsDecorator;\n\n  // Auth decorators (from auth plugin)\n  authenticate?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;\n  optionalAuthenticate?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;\n\n  // Organization-scoped filtering (from multiTenant preset)\n  organizationScoped?: (options?: { required?: boolean }) => RouteHandlerMethod;\n\n  // Custom decorators from your app\n  [key: string]: unknown;\n};\n\nexport interface OwnershipCheck {\n  field: string;\n  userField?: string;\n}\n\n// ============================================================================\n// Resource & Route Types\n// ============================================================================\n\nimport type { ControllerLike } from './handlers.js';\n\n/**\n * Per-resource rate limit configuration.\n *\n * Applied to all routes of the resource when `@fastify/rate-limit` is registered\n * on the Fastify instance. Set to `false` to explicitly disable rate limiting\n * for a resource even when a global rate limit is configured.\n *\n * @example\n * ```typescript\n * defineResource({\n *   name: 'product',\n *   rateLimit: { max: 100, timeWindow: '1 minute' },\n * });\n * ```\n */\n/**\n * Per-resource cache configuration for QueryCache.\n * Enables stale-while-revalidate, auto-invalidation on mutations,\n * and cross-resource tag-based invalidation.\n */\nexport interface ResourceCacheConfig {\n  /** Seconds data is \"fresh\" (no revalidation). Default: 0 */\n  staleTime?: number;\n  /** Seconds stale data stays cached (SWR window). Default: 60 */\n  gcTime?: number;\n  /** Per-operation overrides */\n  list?: { staleTime?: number; gcTime?: number };\n  byId?: { staleTime?: number; gcTime?: number };\n  /** Tags for cross-resource invalidation grouping */\n  tags?: string[];\n  /**\n   * Cross-resource invalidation: event pattern → tag targets.\n   * When matched event fires, all caches with those tags are invalidated.\n   * @example { 'category.*': ['catalog'] }\n   */\n  invalidateOn?: Record<string, string[]>;\n  /** Disable caching for this resource */\n  disabled?: boolean;\n}\n\nexport interface RateLimitConfig {\n  /** Maximum number of requests allowed within the time window */\n  max: number;\n  /** Time window for rate limiting (e.g., '1 minute', '15 seconds', '1 hour') */\n  timeWindow: string;\n}\n\nexport interface ResourceConfig<TDoc = AnyRecord> {\n  name: string;\n  displayName?: string;\n  tag?: string;\n  prefix?: string; // Defaults to `/${name}s` if not provided\n  adapter?: DataAdapter<TDoc>; // Optional for service-pattern resources\n  /** Controller instance - accepts any object with CRUD methods */\n  controller?: IController<TDoc> | ControllerLike;\n  queryParser?: unknown;\n  permissions?: ResourcePermissions;\n  schemaOptions?: RouteSchemaOptions;\n  openApiSchemas?: OpenApiSchemas;\n  customSchemas?: Partial<CrudSchemas>; // Custom JSON schemas\n  presets?: Array<string | PresetResult | { name: string; [key: string]: unknown }>; // Preset names, objects, or PresetResult\n  hooks?: ResourceHooks;\n  /**\n   * Functional pipeline — guards, transforms, and interceptors.\n   * Can be a flat array (all operations) or per-operation map.\n   *\n   * @example\n   * ```typescript\n   * import { pipe, guard, transform, intercept } from '@classytic/arc';\n   *\n   * resource('product', {\n   *   pipe: pipe(isActive, slugify, timing),\n   *   // OR per-operation:\n   *   pipe: { create: pipe(isActive, slugify), list: pipe(timing) },\n   * });\n   * ```\n   */\n  pipe?: import('../pipeline/types.js').PipelineConfig;\n  /**\n   * Field-level permissions — control visibility and writability per role.\n   *\n   * @example\n   * ```typescript\n   * import { fields } from '@classytic/arc';\n   * fields: {\n   *   salary: fields.visibleTo(['admin', 'hr']),\n   *   password: fields.hidden(),\n   * }\n   * ```\n   */\n  fields?: import('../permissions/fields.js').FieldPermissionMap;\n  middlewares?: MiddlewareConfig;\n  additionalRoutes?: AdditionalRoute[];\n  disableCrud?: boolean;\n  disableDefaultRoutes?: boolean;\n  disabledRoutes?: CrudRouteKey[]; // Specific routes to disable\n  /**\n   * Field name used for multi-tenant scoping (default: 'organizationId').\n   * Override to match your schema: 'workspaceId', 'tenantId', 'teamId', etc.\n   * Takes effect when org context is present (via multiTenant preset).\n   */\n  tenantField?: string;\n  /**\n   * Primary key field name (default: '_id').\n   * Override for non-MongoDB adapters (e.g., 'id' for SQL databases).\n   */\n  idField?: string;\n  module?: string; // For grouping in registry\n  events?: Record<string, EventDefinition>; // Domain events\n  skipValidation?: boolean; // Skip schema validation\n  skipRegistry?: boolean; // Don't register in introspection\n  _appliedPresets?: string[]; // Internal: track applied presets\n  /** HTTP method for update routes. Default: 'PATCH' */\n  updateMethod?: 'PUT' | 'PATCH' | 'both';\n  /**\n   * Per-resource rate limiting.\n   * Requires `@fastify/rate-limit` to be registered on the Fastify instance.\n   * Set to `false` to disable rate limiting for this resource.\n   */\n  rateLimit?: RateLimitConfig | false;\n  /**\n   * QueryCache configuration for this resource.\n   * Enables stale-while-revalidate and auto-invalidation.\n   * Requires `queryCachePlugin` to be registered.\n   */\n  cache?: ResourceCacheConfig;\n}\n\n/**\n * Resource-level permissions\n * ONLY PermissionCheck functions allowed - no string arrays\n */\nexport interface ResourcePermissions {\n  list?: PermissionCheck;\n  get?: PermissionCheck;\n  create?: PermissionCheck;\n  update?: PermissionCheck;\n  delete?: PermissionCheck;\n}\n\nexport interface ResourceHooks {\n  beforeCreate?: (data: AnyRecord) => Promise<AnyRecord> | AnyRecord;\n  afterCreate?: (doc: AnyRecord) => Promise<void> | void;\n  beforeUpdate?: (id: string, data: AnyRecord) => Promise<AnyRecord> | AnyRecord;\n  afterUpdate?: (doc: AnyRecord) => Promise<void> | void;\n  beforeDelete?: (id: string) => Promise<void> | void;\n  afterDelete?: (id: string) => Promise<void> | void;\n}\n\n/**\n * Additional route definition for custom endpoints\n */\nexport interface AdditionalRoute {\n  /** HTTP method */\n  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  /** Route path (relative to resource prefix) */\n  path: string;\n  /**\n   * Handler - string (controller method name) or function\n   * Function can be Fastify handler or (request, reply) => Promise<unknown>\n   */\n  handler: string | RouteHandlerMethod | ((request: FastifyRequest, reply: FastifyReply) => unknown);\n\n  /** Permission check - REQUIRED */\n  permissions: PermissionCheck;\n\n  /**\n   * Handler type - REQUIRED, no auto-detection\n   * true = ControllerHandler (receives context object)\n   * false = FastifyHandler (receives request, reply)\n   */\n  wrapHandler: boolean;\n\n  /**\n   * Logical operation name for pipeline keys and permission actions.\n   * Defaults to handler name (string handlers) or method+path slug.\n   * Prevents collisions when multiple routes share the same HTTP method.\n   *\n   * @example\n   * operation: 'listDeleted'  // Used as pipeline key and permission action\n   * operation: 'restore'\n   */\n  operation?: string;\n\n  /** OpenAPI summary */\n  summary?: string;\n  /** OpenAPI description */\n  description?: string;\n  /** OpenAPI tags */\n  tags?: string[];\n\n  /**\n   * Custom route-level middleware\n   * Can be an array of handlers or a function that receives fastify and returns handlers\n   * @example\n   * // Direct array\n   * preHandler: [myMiddleware]\n   * // Function that receives fastify (for accessing decorators)\n   * preHandler: (fastify) => [fastify.customerContext({ required: true })]\n   */\n  preHandler?: RouteHandlerMethod[] | ((fastify: FastifyInstance) => RouteHandlerMethod[]);\n\n  /** Fastify route schema */\n  schema?: Record<string, unknown>;\n}\n\nexport interface RouteSchemaOptions {\n  hiddenFields?: string[];\n  readonlyFields?: string[];\n  requiredFields?: string[];\n  optionalFields?: string[];\n  excludeFields?: string[];\n  fieldRules?: Record<string, { systemManaged?: boolean; [key: string]: unknown }>;\n  query?: Record<string, unknown>; // Query parameter schema for OpenAPI\n}\n\nexport interface FieldRule {\n  field: string;\n  required?: boolean;\n  readonly?: boolean;\n  hidden?: boolean;\n}\n\n/**\n * CRUD Route Schemas (Fastify Native Format)\n *\n * @example\n * {\n *   list: {\n *     querystring: { type: 'object', properties: { page: { type: 'number' } } },\n *     response: { 200: { type: 'object', properties: { docs: { type: 'array' } } } }\n *   },\n *   create: {\n *     body: { type: 'object', properties: { name: { type: 'string' } } },\n *     response: { 201: { type: 'object' } }\n *   }\n * }\n */\nexport interface CrudSchemas {\n  /** GET / - List all resources */\n  list?: {\n    querystring?: Record<string, unknown>;\n    response?: Record<number, unknown>;\n    [key: string]: unknown;\n  };\n\n  /** GET /:id - Get single resource */\n  get?: {\n    params?: Record<string, unknown>;\n    response?: Record<number, unknown>;\n    [key: string]: unknown;\n  };\n\n  /** POST / - Create resource */\n  create?: {\n    body?: Record<string, unknown>;\n    response?: Record<number, unknown>;\n    [key: string]: unknown;\n  };\n\n  /** PATCH /:id - Update resource */\n  update?: {\n    params?: Record<string, unknown>;\n    body?: Record<string, unknown>;\n    response?: Record<number, unknown>;\n    [key: string]: unknown;\n  };\n\n  /** DELETE /:id - Delete resource */\n  delete?: {\n    params?: Record<string, unknown>;\n    response?: Record<number, unknown>;\n    [key: string]: unknown;\n  };\n\n  // Allow custom operation schemas\n  [key: string]: unknown;\n}\n\nexport interface OpenApiSchemas {\n  entity?: unknown;\n  createBody?: unknown;\n  updateBody?: unknown;\n  params?: unknown;\n  listQuery?: unknown;\n  /**\n   * Explicit response schema for OpenAPI documentation.\n   * If provided, this will be used as-is for the response schema.\n   * If not provided, response schema is auto-generated from createBody.\n   *\n   * Note: This is for OpenAPI docs only - does NOT affect Fastify serialization.\n   *\n   * @example\n   * response: {\n   *   type: 'object',\n   *   properties: {\n   *     _id: { type: 'string' },\n   *     name: { type: 'string' },\n   *     email: { type: 'string' },\n   *     // Exclude password, include virtuals\n   *     fullName: { type: 'string' },\n   *   }\n   * }\n   */\n  response?: unknown;\n  [key: string]: unknown;\n}\n\n/** Handler for middleware functions */\nexport type MiddlewareHandler = (request: RequestWithExtras, reply: FastifyReply) => Promise<unknown>;\nexport type CrudRouteKey = 'list' | 'get' | 'create' | 'update' | 'delete';\n\n// ============================================================================\n// Middleware & Config Types\n// ============================================================================\n\nexport interface MiddlewareConfig {\n  list?: MiddlewareHandler[];\n  get?: MiddlewareHandler[];\n  create?: MiddlewareHandler[];\n  update?: MiddlewareHandler[];\n  delete?: MiddlewareHandler[];\n  [key: string]: MiddlewareHandler[] | undefined;\n}\n\n// ============================================================================\n// Auth Types - Flexible, Database-Agnostic\n// ============================================================================\n\n/**\n * JWT utilities provided to authenticator\n * Arc provides these helpers, app uses them as needed\n */\nexport interface JwtContext {\n  /** Verify a JWT token and return decoded payload */\n  verify: <T = Record<string, unknown>>(token: string) => T;\n  /** Sign a payload and return JWT token */\n  sign: (payload: Record<string, unknown>, options?: { expiresIn?: string }) => string;\n  /** Decode without verification (for inspection) */\n  decode: <T = Record<string, unknown>>(token: string) => T | null;\n}\n\n/**\n * Context passed to app's authenticator function\n */\nexport interface AuthenticatorContext {\n  /** JWT utilities (available if jwt.secret provided) */\n  jwt: JwtContext | null;\n  /** Fastify instance for advanced use cases */\n  fastify: FastifyInstance;\n}\n\n/**\n * App-provided authenticator function\n *\n * Arc calls this for every non-public route.\n * App has FULL control over authentication logic.\n *\n * @example\n * ```typescript\n * // Simple JWT auth\n * authenticate: async (request, { jwt }) => {\n *   const token = request.headers.authorization?.split(' ')[1];\n *   if (!token || !jwt) return null;\n *   const decoded = jwt.verify(token);\n *   return userRepo.findById(decoded.id);\n * }\n *\n * // Multi-strategy (JWT + API Key)\n * authenticate: async (request, { jwt }) => {\n *   const apiKey = request.headers['x-api-key'];\n *   if (apiKey) {\n *     const result = await apiKeyService.verify(apiKey);\n *     if (result) return { _id: result.userId, isApiKey: true };\n *   }\n *   const token = request.headers.authorization?.split(' ')[1];\n *   if (token && jwt) {\n *     const decoded = jwt.verify(token);\n *     return userRepo.findById(decoded.id);\n *   }\n *   return null;\n * }\n * ```\n */\nexport type Authenticator = (\n  request: FastifyRequest,\n  context: AuthenticatorContext\n) => Promise<unknown | null> | unknown | null;\n\n/**\n * Token pair returned by issueTokens helper\n */\nexport interface TokenPair {\n  /** Access token (JWT) */\n  accessToken: string;\n  /** Refresh token (JWT with longer expiry) */\n  refreshToken?: string;\n  /** Access token expiry in seconds */\n  expiresIn: number;\n  /** Refresh token expiry in seconds */\n  refreshExpiresIn?: number;\n  /** Token type (always 'Bearer') */\n  tokenType: 'Bearer';\n}\n\n/**\n * Auth helpers available on fastify.auth\n *\n * @example\n * ```typescript\n * // In login handler\n * const user = await userRepo.findByEmail(email);\n * if (!user || !await bcrypt.compare(password, user.password)) {\n *   return reply.code(401).send({ error: 'Invalid credentials' });\n * }\n *\n * const tokens = fastify.auth.issueTokens({\n *   id: user._id,\n *   email: user.email,\n *   roles: user.roles,\n * });\n *\n * return { success: true, ...tokens, user };\n * ```\n */\nexport interface AuthHelpers {\n  /** JWT utilities (if configured) */\n  jwt: JwtContext | null;\n\n  /**\n   * Issue access + refresh tokens for a user\n   * App calls this after validating credentials\n   */\n  issueTokens: (\n    payload: Record<string, unknown>,\n    options?: { expiresIn?: string; refreshExpiresIn?: string }\n  ) => TokenPair;\n\n  /**\n   * Verify a refresh token and return decoded payload\n   */\n  verifyRefreshToken: <T = Record<string, unknown>>(token: string) => T;\n}\n\nexport interface ServiceContext {\n  user?: unknown;\n  requestId?: string;\n  select?: string[] | Record<string, 0 | 1>; // Field projection for responses\n  populate?: string | string[]; // Relations to populate\n  lean?: boolean; // Return plain objects\n}\n\n// ============================================================================\n// Preset Types\n// ============================================================================\n\nexport interface PresetHook {\n  operation: 'create' | 'update' | 'delete' | 'read' | 'list';\n  phase: 'before' | 'after';\n  handler: (ctx: AnyRecord) => void | Promise<void> | AnyRecord | Promise<AnyRecord>;\n  priority?: number;\n}\n\nexport interface PresetResult {\n  name: string;\n  additionalRoutes?: AdditionalRoute[] | ((permissions: ResourcePermissions) => AdditionalRoute[]);\n  middlewares?: MiddlewareConfig;\n  schemaOptions?: RouteSchemaOptions;\n  controllerOptions?: Record<string, unknown>;\n  hooks?: PresetHook[];\n}\n\nexport type PresetFunction = (config: ResourceConfig) => PresetResult;\n\n// ============================================================================\n// Plugin Types\n// ============================================================================\n\nexport interface GracefulShutdownOptions {\n  timeout?: number;\n  onShutdown?: () => Promise<void> | void;\n  signals?: NodeJS.Signals[];\n  logEvents?: boolean;\n}\n\nexport interface RequestIdOptions {\n  headerName?: string;\n  generator?: () => string;\n}\n\nexport interface HealthOptions {\n  path?: string;\n  check?: () => Promise<unknown>;\n}\n\nexport interface HealthCheck {\n  healthy: boolean;\n  timestamp: string;\n  [key: string]: unknown;\n}\n\n/**\n * Auth Plugin Options - Clean, Minimal Configuration\n *\n * Arc provides JWT infrastructure and calls your authenticator.\n * You control ALL authentication logic.\n *\n * @example\n * ```typescript\n * // Minimal: just JWT (uses default jwtVerify)\n * auth: {\n *   jwt: { secret: process.env.JWT_SECRET },\n * }\n *\n * // With custom authenticator (recommended)\n * auth: {\n *   jwt: { secret: process.env.JWT_SECRET },\n *   authenticate: async (request, { jwt }) => {\n *     const token = request.headers.authorization?.split(' ')[1];\n *     if (!token) return null;\n *     const decoded = jwt.verify(token);\n *     return userRepo.findById(decoded.id);\n *   },\n * }\n *\n * // Multi-strategy (JWT + API Key)\n * auth: {\n *   jwt: { secret: process.env.JWT_SECRET },\n *   authenticate: async (request, { jwt }) => {\n *     // Try API key first (faster)\n *     const apiKey = request.headers['x-api-key'];\n *     if (apiKey) {\n *       const result = await apiKeyService.verify(apiKey);\n *       if (result) return { _id: result.userId, isApiKey: true };\n *     }\n *     // Try JWT\n *     const token = request.headers.authorization?.split(' ')[1];\n *     if (token) {\n *       const decoded = jwt.verify(token);\n *       return userRepo.findById(decoded.id);\n *     }\n *     return null;\n *   },\n *   onFailure: (request, reply) => {\n *     reply.code(401).send({\n *       success: false,\n *       error: 'Authentication required',\n *       message: 'Use Bearer token or X-API-Key header',\n *     });\n *   },\n * }\n * ```\n */\nexport interface AuthPluginOptions {\n  /**\n   * JWT configuration (optional but recommended)\n   * If provided, jwt utilities are available in authenticator context\n   */\n  jwt?: {\n    /** JWT secret (required for JWT features) */\n    secret: string;\n    /** Access token expiry (default: '15m') */\n    expiresIn?: string;\n    /** Refresh token secret (defaults to main secret) */\n    refreshSecret?: string;\n    /** Refresh token expiry (default: '7d') */\n    refreshExpiresIn?: string;\n    /** Additional @fastify/jwt sign options */\n    sign?: Record<string, unknown>;\n    /** Additional @fastify/jwt verify options */\n    verify?: Record<string, unknown>;\n  };\n\n  /**\n   * Custom authenticator function (recommended)\n   *\n   * Arc calls this for non-public routes.\n   * Return user object to authenticate, null/undefined to reject.\n   *\n   * If not provided and jwt.secret is set, uses default jwtVerify.\n   */\n  authenticate?: Authenticator;\n\n  /**\n   * Custom auth failure handler\n   * Customize the 401 response when authentication fails\n   */\n  onFailure?: (\n    request: FastifyRequest,\n    reply: FastifyReply,\n    error?: Error\n  ) => void | Promise<void>;\n\n  /**\n   * Expose detailed auth error messages in 401 responses.\n   * When false (default), returns generic \"Authentication required\".\n   * When true, includes the actual error message for debugging.\n   * Decoupled from log level — set explicitly per environment.\n   */\n  exposeAuthErrors?: boolean;\n\n  /**\n   * Property name to store user on request (default: 'user')\n   */\n  userProperty?: string;\n}\n\n\nexport interface IntrospectionPluginOptions {\n  path?: string;\n  prefix?: string;\n  enabled?: boolean;\n  authRoles?: string[];\n}\n\nexport interface CrudRouterOptions {\n  /** Route prefix */\n  prefix?: string;\n\n  /** Permission checks for CRUD operations */\n  permissions?: ResourcePermissions;\n\n  /** OpenAPI tag for grouping routes */\n  tag?: string;\n\n  /** JSON schemas for CRUD operations */\n  schemas?: Partial<CrudSchemas>;\n\n  /** Middlewares for each CRUD operation */\n  middlewares?: MiddlewareConfig;\n\n  /** Additional custom routes (from presets or user-defined) */\n  additionalRoutes?: AdditionalRoute[];\n\n  /** Disable all default CRUD routes */\n  disableDefaultRoutes?: boolean;\n\n  /** Disable specific CRUD routes */\n  disabledRoutes?: CrudRouteKey[];\n\n  /** Functional pipeline (guard/transform/intercept) */\n  pipe?: import('../pipeline/types.js').PipelineConfig;\n\n  /** Resource name for lifecycle hooks */\n  resourceName?: string;\n\n  /** Schema generation options */\n  schemaOptions?: RouteSchemaOptions;\n\n  /** Field-level permissions (visibility, writability per role) */\n  fields?: import('../permissions/fields.js').FieldPermissionMap;\n\n  /** HTTP method for update routes. Default: 'PATCH' */\n  updateMethod?: 'PUT' | 'PATCH' | 'both';\n\n  /**\n   * Per-resource rate limiting.\n   * Requires `@fastify/rate-limit` to be registered on the Fastify instance.\n   * Set to `false` to disable rate limiting for this resource.\n   */\n  rateLimit?: RateLimitConfig | false;\n}\n\n// ============================================================================\n// Registry & Metadata Types\n// ============================================================================\n\nexport interface ResourceMetadata {\n  name: string;\n  displayName?: string;\n  tag?: string;\n  prefix: string;\n  module?: string;\n  permissions?: ResourcePermissions;\n  presets: string[];\n  additionalRoutes?: AdditionalRoute[];\n  routes: Array<{\n    method: string;\n    path: string;\n    handler?: string;\n    operation?: string;\n    summary?: string;\n  }>;\n  events?: string[];\n}\n\nexport interface RegistryEntry extends ResourceMetadata {\n  plugin: unknown;\n  adapter?: { type: string; name: string } | null;\n  events?: string[];\n  disableDefaultRoutes?: boolean;\n  openApiSchemas?: OpenApiSchemas;\n  registeredAt?: string;\n  /** Field-level permissions metadata (for OpenAPI docs) */\n  fieldPermissions?: Record<string, { type: string; roles?: readonly string[]; redactValue?: unknown }>;\n  /** Pipeline step names (for OpenAPI docs) */\n  pipelineSteps?: Array<{ type: string; name: string; operations?: string[] }>;\n  /** Update HTTP method(s) used for this resource */\n  updateMethod?: 'PUT' | 'PATCH' | 'both';\n  /** Routes disabled for this resource */\n  disabledRoutes?: string[];\n  /** Rate limit config */\n  rateLimit?: RateLimitConfig | false;\n}\n\nexport interface RegistryStats {\n  total?: number;\n  totalResources: number;\n  byTag?: Record<string, number>;\n  byModule?: Record<string, number>;\n  presetUsage?: Record<string, number>;\n  totalRoutes?: number;\n  totalEvents?: number;\n}\n\nexport interface IntrospectionData {\n  resources: ResourceMetadata[];\n  stats: RegistryStats;\n  generatedAt?: string;\n}\n\nexport interface EventDefinition {\n  name: string;\n  handler: (data: unknown) => Promise<void> | void;\n  schema?: Record<string, unknown>; // JSON schema for event payload\n  description?: string; // Event documentation\n}\n\n// ============================================================================\n// Validation Types\n// ============================================================================\n\nexport interface ConfigError {\n  field: string;\n  message: string;\n  code?: string;\n}\n\nexport interface ValidationResult {\n  valid: boolean;\n  errors: ConfigError[];\n}\n\nexport interface ValidateOptions {\n  strict?: boolean;\n}\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\n/**\n * Infer document type from DataAdapter, Repository, or ResourceConfig.\n * Smart inference that works with multiple sources.\n *\n * @example\n * ```typescript\n * type Doc1 = InferDocType<typeof adapter>;     // From DataAdapter\n * type Doc2 = InferDocType<typeof repository>;  // From Repository\n * type Doc3 = InferDocType<typeof resource>;    // From ResourceConfig\n * ```\n */\nimport type { CrudRepository } from './repository.js';\n\n/**\n * Infer document type from DataAdapter or ResourceConfig\n */\nexport type InferDocType<T> =\n  T extends DataAdapter<infer D>\n    ? D\n    : T extends ResourceConfig<infer D>\n      ? D\n      : never;\n\n/**\n * Infer document type from a DataAdapter.\n * Falls back to `unknown` (not `never`) — safe for generic constraints.\n *\n * @example\n * ```typescript\n * const adapter = createMongooseAdapter({ model: ProductModel, repository: productRepo });\n * type ProductDoc = InferAdapterDoc<typeof adapter>;\n * // ProductDoc = the document type inferred from the adapter\n * ```\n */\nexport type InferAdapterDoc<A> = A extends DataAdapter<infer D> ? D : unknown;\n\nexport type InferResourceDoc<T> = T extends ResourceConfig<infer D> ? D : never;\nexport type TypedResourceConfig<TDoc> = ResourceConfig<TDoc>;\nexport type TypedController<TDoc> = IController<TDoc>;\nexport type TypedRepository<TDoc> = CrudRepository<TDoc>;\n\n// ============================================================================\n// Base Controller Options (canonical definition in core/BaseController.ts)\n// ============================================================================\n\nexport type { BaseControllerOptions } from '../core/BaseController.js';\n"],"mappings":";;;;;;AAqGA,SAAgB,UAAU,MAAuD;AAC/E,KAAI,CAAC,KAAM,QAAO;CAClB,MAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,QAAO,KAAK,OAAO,GAAG,GAAG"}

package/dist/types-Beqn1Un7.mjs

@@ -0,0 +1,39 @@
+//#region src/scope/types.ts
+/** Check if scope is `member` kind */
+function isMember(scope) {
+	return scope.kind === "member";
+}
+/** Check if scope is `elevated` kind */
+function isElevated(scope) {
+	return scope.kind === "elevated";
+}
+/** Check if scope has org access (member OR elevated) */
+function hasOrgAccess(scope) {
+	return scope.kind === "member" || scope.kind === "elevated";
+}
+/** Check if request is authenticated (any kind except public) */
+function isAuthenticated(scope) {
+	return scope.kind !== "public";
+}
+/** Get organizationId from scope (if present) */
+function getOrgId(scope) {
+	if (scope.kind === "member") return scope.organizationId;
+	if (scope.kind === "elevated") return scope.organizationId;
+}
+/** Get org roles from scope (empty array if not a member) */
+function getOrgRoles(scope) {
+	if (scope.kind === "member") return scope.orgRoles;
+	return [];
+}
+/** Get team ID from scope (only available on member kind) */
+function getTeamId(scope) {
+	if (scope.kind === "member") return scope.teamId;
+}
+/** Default public scope — used as initial decoration value */
+const PUBLIC_SCOPE = Object.freeze({ kind: "public" });
+/** Default authenticated scope — used when user is logged in but no org */
+const AUTHENTICATED_SCOPE = Object.freeze({ kind: "authenticated" });
+
+//#endregion
+export { getTeamId as a, isElevated as c, getOrgRoles as i, isMember as l, PUBLIC_SCOPE as n, hasOrgAccess as o, getOrgId as r, isAuthenticated as s, AUTHENTICATED_SCOPE as t };
+//# sourceMappingURL=types-Beqn1Un7.mjs.map

package/dist/types-Beqn1Un7.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-Beqn1Un7.mjs","names":[],"sources":["../src/scope/types.ts"],"sourcesContent":["/**\n * Request Scope — The One Standard\n *\n * Discriminated union representing the access context of every request.\n * Replaces scattered orgScope/orgRoles/organizationId/bypassRoles.\n *\n * Set once by auth adapters, read everywhere by permissions/presets/guards.\n *\n * @example\n * ```typescript\n * // In a permission check\n * const scope = request.scope;\n * if (isElevated(scope)) return true;\n * if (isMember(scope) && scope.orgRoles.includes('admin')) return true;\n * ```\n */\n\n// ============================================================================\n// Core Type\n// ============================================================================\n\n/**\n * Request scope — 4 kinds, 4 states, no ambiguity.\n *\n * | Kind          | Meaning                           |\n * |---------------|-----------------------------------|\n * | public        | No authentication                 |\n * | authenticated | Logged in, no org context          |\n * | member        | In an org with specific roles      |\n * | elevated      | Platform admin, explicit elevation |\n */\nexport type RequestScope =\n  | { kind: 'public' }\n  | { kind: 'authenticated' }\n  | { kind: 'member'; organizationId: string; orgRoles: string[]; teamId?: string }\n  | { kind: 'elevated'; organizationId?: string; elevatedBy: string };\n\n// ============================================================================\n// Type Guards\n// ============================================================================\n\n/** Check if scope is `member` kind */\nexport function isMember(scope: RequestScope): scope is Extract<RequestScope, { kind: 'member' }> {\n  return scope.kind === 'member';\n}\n\n/** Check if scope is `elevated` kind */\nexport function isElevated(scope: RequestScope): scope is Extract<RequestScope, { kind: 'elevated' }> {\n  return scope.kind === 'elevated';\n}\n\n/** Check if scope has org access (member OR elevated) */\nexport function hasOrgAccess(scope: RequestScope): boolean {\n  return scope.kind === 'member' || scope.kind === 'elevated';\n}\n\n/** Check if request is authenticated (any kind except public) */\nexport function isAuthenticated(scope: RequestScope): boolean {\n  return scope.kind !== 'public';\n}\n\n// ============================================================================\n// Accessors\n// ============================================================================\n\n/** Get organizationId from scope (if present) */\nexport function getOrgId(scope: RequestScope): string | undefined {\n  if (scope.kind === 'member') return scope.organizationId;\n  if (scope.kind === 'elevated') return scope.organizationId;\n  return undefined;\n}\n\n/** Get org roles from scope (empty array if not a member) */\nexport function getOrgRoles(scope: RequestScope): string[] {\n  if (scope.kind === 'member') return scope.orgRoles;\n  return [];\n}\n\n/** Get team ID from scope (only available on member kind) */\nexport function getTeamId(scope: RequestScope): string | undefined {\n  if (scope.kind === 'member') return scope.teamId;\n  return undefined;\n}\n\n// ============================================================================\n// Constants\n// ============================================================================\n\n/** Default public scope — used as initial decoration value */\nexport const PUBLIC_SCOPE: Readonly<RequestScope> = Object.freeze({ kind: 'public' as const });\n\n/** Default authenticated scope — used when user is logged in but no org */\nexport const AUTHENTICATED_SCOPE: Readonly<RequestScope> = Object.freeze({ kind: 'authenticated' as const });\n"],"mappings":";;AA0CA,SAAgB,SAAS,OAAyE;AAChG,QAAO,MAAM,SAAS;;;AAIxB,SAAgB,WAAW,OAA2E;AACpG,QAAO,MAAM,SAAS;;;AAIxB,SAAgB,aAAa,OAA8B;AACzD,QAAO,MAAM,SAAS,YAAY,MAAM,SAAS;;;AAInD,SAAgB,gBAAgB,OAA8B;AAC5D,QAAO,MAAM,SAAS;;;AAQxB,SAAgB,SAAS,OAAyC;AAChE,KAAI,MAAM,SAAS,SAAU,QAAO,MAAM;AAC1C,KAAI,MAAM,SAAS,WAAY,QAAO,MAAM;;;AAK9C,SAAgB,YAAY,OAA+B;AACzD,KAAI,MAAM,SAAS,SAAU,QAAO,MAAM;AAC1C,QAAO,EAAE;;;AAIX,SAAgB,UAAU,OAAyC;AACjE,KAAI,MAAM,SAAS,SAAU,QAAO,MAAM;;;AAS5C,MAAa,eAAuC,OAAO,OAAO,EAAE,MAAM,UAAmB,CAAC;;AAG9F,MAAa,sBAA8C,OAAO,OAAO,EAAE,MAAM,iBAA0B,CAAC"}

package/dist/types-CIgB7UUl.d.mts

@@ -0,0 +1,446 @@
+import { n as ElevationOptions } from "./elevation-B_2dRLVP.mjs";
+import { Authenticator } from "./types/index.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-DlINfKbP.mjs";
+import { i as CacheStore } from "./interface-CZe8IkMf.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-7THaI5mt.mjs";
+import { i as EventTransport } from "./EventTransport-BD2U0BTc.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-CTrLH3mt.mjs";
+import { o as CachingOptions, r as SSEOptions, t as ErrorHandlerOptions } from "./errorHandler-BbcgBmIH.mjs";
+import { r as IdempotencyStore } from "./interface-B01JvPVc.mjs";
+import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
+import { FastifyCorsOptions } from "@fastify/cors";
+import { FastifyHelmetOptions } from "@fastify/helmet";
+import { RateLimitOptions } from "@fastify/rate-limit";
+
+//#region src/factory/types.d.ts
+/**
+ * Arc's built-in JWT auth
+ *
+ * Registers @fastify/jwt, wires up `fastify.authenticate`, and
+ * exposes `fastify.auth` helpers (issueTokens, verifyRefreshToken).
+ *
+ * @example
+ * ```typescript
+ * const app = await createApp({
+ *   auth: {
+ *     type: 'jwt',
+ *     jwt: { secret: process.env.JWT_SECRET },
+ *   },
+ * });
+ *
+ * // With custom authenticator
+ * const app = await createApp({
+ *   auth: {
+ *     type: 'jwt',
+ *     jwt: { secret: process.env.JWT_SECRET },
+ *     authenticate: async (request, { jwt }) => {
+ *       const token = request.headers.authorization?.split(' ')[1];
+ *       if (!token) return null;
+ *       const decoded = jwt.verify(token);
+ *       return userRepo.findById(decoded.id);
+ *     },
+ *   },
+ * });
+ * ```
+ */
+interface JwtAuthOption {
+  type: 'jwt';
+  /**
+   * JWT configuration (optional but recommended)
+   * If provided, jwt utilities are available in authenticator context
+   */
+  jwt?: {
+    /** JWT secret (required for JWT features) */secret: string; /** Access token expiry (default: '15m') */
+    expiresIn?: string; /** Refresh token secret (defaults to main secret) */
+    refreshSecret?: string; /** Refresh token expiry (default: '7d') */
+    refreshExpiresIn?: string; /** Additional @fastify/jwt sign options */
+    sign?: Record<string, unknown>; /** Additional @fastify/jwt verify options */
+    verify?: Record<string, unknown>;
+  };
+  /**
+   * Custom authenticator function (recommended)
+   *
+   * Arc calls this for non-public routes.
+   * Return user object to authenticate, null/undefined to reject.
+   *
+   * If not provided and jwt.secret is set, uses default jwtVerify.
+   */
+  authenticate?: Authenticator;
+  /**
+   * Custom auth failure handler
+   * Customize the 401 response when authentication fails
+   */
+  onFailure?: (request: FastifyRequest, reply: FastifyReply, error?: Error) => void | Promise<void>;
+  /**
+   * Expose detailed auth error messages in 401 responses.
+   * When false (default), returns generic "Authentication required".
+   * When true, includes the actual error message for debugging.
+   * Decoupled from log level — set explicitly per environment.
+   */
+  exposeAuthErrors?: boolean;
+  /**
+   * Property name to store user on request (default: 'user')
+   */
+  userProperty?: string;
+}
+/**
+ * Better Auth adapter integration
+ *
+ * When provided, Arc registers the Better Auth plugin (which sets up
+ * auth routes and decorates fastify.authenticate) and skips Arc's
+ * built-in JWT auth setup entirely.
+ *
+ * @example
+ * ```typescript
+ * import { createBetterAuthAdapter } from '@classytic/arc-better-auth';
+ *
+ * const app = await createApp({
+ *   auth: { type: 'betterAuth', betterAuth: createBetterAuthAdapter({ auth: myBetterAuth }) },
+ * });
+ * ```
+ */
+interface BetterAuthOption {
+  type: 'betterAuth';
+  /** Better Auth adapter — pass the result of createBetterAuthAdapter() */
+  betterAuth: {
+    plugin: FastifyPluginAsync;
+    openapi?: ExternalOpenApiPaths;
+  };
+}
+/**
+ * Custom auth plugin — full control over authentication setup
+ *
+ * The plugin is registered directly on the Fastify instance.
+ * It must decorate `fastify.authenticate` for protected routes to work.
+ *
+ * @example
+ * ```typescript
+ * const app = await createApp({
+ *   auth: {
+ *     type: 'custom',
+ *     plugin: async (fastify) => {
+ *       fastify.decorate('authenticate', async (request, reply) => { ... });
+ *     },
+ *   },
+ * });
+ * ```
+ */
+interface CustomPluginAuthOption {
+  type: 'custom';
+  /** Custom Fastify plugin that sets up authentication */
+  plugin: FastifyPluginAsync;
+}
+/**
+ * Custom authenticator function — lightweight alternative to a full plugin
+ *
+ * Arc decorates `fastify.authenticate` with this function directly.
+ * No JWT setup, no Arc auth plugin — just your function.
+ *
+ * @example
+ * ```typescript
+ * const app = await createApp({
+ *   auth: {
+ *     type: 'authenticator',
+ *     authenticate: async (request, reply) => {
+ *       const session = await validateSession(request);
+ *       if (!session) reply.code(401).send({ error: 'Unauthorized' });
+ *       request.user = session.user;
+ *     },
+ *   },
+ * });
+ * ```
+ */
+interface CustomAuthenticatorOption {
+  type: 'authenticator';
+  /** Authenticate function — decorates fastify.authenticate directly */
+  authenticate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+}
+/**
+ * All supported auth configuration shapes
+ *
+ * - `false` — Disable authentication entirely
+ * - `JwtAuthOption` — Arc's built-in JWT auth (`type: 'jwt'`)
+ * - `BetterAuthOption` — Better Auth adapter integration (`type: 'betterAuth'`)
+ * - `CustomPluginAuthOption` — Your own Fastify auth plugin (`type: 'custom'`)
+ * - `CustomAuthenticatorOption` — A bare authenticate function (`type: 'authenticator'`)
+ */
+type AuthOption = false | JwtAuthOption | BetterAuthOption | CustomPluginAuthOption | CustomAuthenticatorOption;
+/**
+ * CreateApp Options
+ *
+ * Configuration for creating an Arc application.
+ *
+ * @example
+ * ```typescript
+ * // Minimal setup
+ * const app = await createApp({
+ *   preset: 'development',
+ *   auth: {
+ *     type: 'jwt',
+ *     jwt: { secret: process.env.JWT_SECRET },
+ *   },
+ * });
+ *
+ * // With custom authenticator
+ * const app = await createApp({
+ *   preset: 'production',
+ *   auth: {
+ *     type: 'jwt',
+ *     jwt: { secret: process.env.JWT_SECRET },
+ *     authenticate: async (request, { jwt }) => {
+ *       // Check API key first
+ *       const apiKey = request.headers['x-api-key'];
+ *       if (apiKey) {
+ *         const result = await apiKeyService.verify(apiKey);
+ *         if (result) return { _id: result.userId, isApiKey: true };
+ *       }
+ *       // Then check JWT
+ *       const token = request.headers.authorization?.split(' ')[1];
+ *       if (token) {
+ *         const decoded = jwt.verify(token);
+ *         return userRepo.findById(decoded.id);
+ *       }
+ *       return null;
+ *     },
+ *   },
+ * });
+ * ```
+ */
+interface CreateAppOptions {
+  /** Environment preset: 'production', 'development', 'testing', or 'edge' */
+  preset?: 'production' | 'development' | 'testing' | 'edge';
+  /**
+   * Runtime profile for store backends.
+   * - 'memory' (default): Uses in-memory stores. Suitable for single-instance deployments.
+   * - 'distributed': Requires Redis-compatible adapters for cache, events, idempotency.
+   *   Startup fails fast if any required distributed adapter is missing.
+   */
+  runtime?: 'memory' | 'distributed';
+  /**
+   * Store and transport instances for runtime profile validation.
+   * When `runtime` is `'distributed'`, Arc validates that these are
+   * not memory-backed. Provide Redis or other durable adapters.
+   */
+  stores?: {
+    /** Event transport (e.g., RedisEventTransport) */events?: EventTransport; /** Cache store (e.g., RedisCacheStore) */
+    cache?: CacheStore; /** Idempotency store (e.g., RedisIdempotencyStore) */
+    idempotency?: IdempotencyStore; /** QueryCache store (e.g., RedisCacheStore). Default: MemoryCacheStore. */
+    queryCache?: CacheStore;
+  };
+  /** Fastify logger configuration */
+  logger?: FastifyServerOptions['logger'];
+  /**
+   * Enable Arc debug logging.
+   *
+   * - `true` — all Arc modules
+   * - `string` — comma-separated module names (e.g., `'scope,elevation,sse'`)
+   * - `false` or omit — disabled (default)
+   *
+   * Also configurable via `ARC_DEBUG` environment variable.
+   *
+   * @example
+   * ```typescript
+   * // All modules
+   * const app = await createApp({ debug: true });
+   *
+   * // Specific modules
+   * const app = await createApp({ debug: 'scope,elevation' });
+   * ```
+   */
+  debug?: boolean | string;
+  /** Trust proxy headers (X-Forwarded-For, etc.) */
+  trustProxy?: boolean;
+  /**
+   * Auth configuration
+   *
+   * Set to false to disable authentication entirely.
+   * Each auth strategy requires a `type` discriminant field.
+   *
+   * @example
+   * ```typescript
+   * // Disable auth
+   * auth: false,
+   *
+   * // Arc JWT
+   * auth: {
+   *   type: 'jwt',
+   *   jwt: { secret: process.env.JWT_SECRET },
+   * },
+   *
+   * // Arc JWT + custom authenticator
+   * auth: {
+   *   type: 'jwt',
+   *   jwt: { secret: process.env.JWT_SECRET },
+   *   authenticate: async (request, { jwt }) => {
+   *     const token = request.headers.authorization?.split(' ')[1];
+   *     if (!token) return null;
+   *     const decoded = jwt.verify(token);
+   *     return userRepo.findById(decoded.id);
+   *   },
+   * },
+   *
+   * // Better Auth adapter
+   * auth: { type: 'betterAuth', betterAuth: createBetterAuthAdapter({ auth: myBetterAuth }) },
+   *
+   * // Custom auth plugin
+   * auth: {
+   *   type: 'custom',
+   *   plugin: async (fastify) => {
+   *     fastify.decorate('authenticate', async (req, reply) => { ... });
+   *   },
+   * },
+   *
+   * // Custom authenticator function
+   * auth: {
+   *   type: 'authenticator',
+   *   authenticate: async (request, reply) => {
+   *     const session = await validateSession(request);
+   *     if (!session) reply.code(401).send({ error: 'Unauthorized' });
+   *     request.user = session.user;
+   *   },
+   * },
+   * ```
+   */
+  auth?: AuthOption;
+  /**
+   * Platform admin elevation — opt-in for apps with superadmins.
+   *
+   * When configured, platform admins can explicitly elevate their scope
+   * by sending `x-arc-scope: platform` header. Without this header,
+   * superadmins are treated as normal users.
+   *
+   * Set to `false` or omit to disable elevation entirely.
+   *
+   * @example
+   * ```typescript
+   * elevation: {
+   *   platformRoles: ['superadmin'],
+   *   onElevation: (event) => auditLog.write({
+   *     action: 'platform_elevation',
+   *     userId: event.userId,
+   *     targetOrg: event.organizationId,
+   *   }),
+   * }
+   * ```
+   */
+  elevation?: ElevationOptions | false;
+  /** Helmet security headers. Set to false to disable. */
+  helmet?: FastifyHelmetOptions | false;
+  /** CORS configuration. Set to false to disable. */
+  cors?: FastifyCorsOptions | false;
+  /** Rate limiting. Set to false to disable. */
+  rateLimit?: RateLimitOptions | false;
+  /** Under pressure health monitoring. Set to false to disable. */
+  underPressure?: UnderPressureOptions | false;
+  /** @fastify/sensible (HTTP helpers). Set to false to disable. */
+  sensible?: boolean | false;
+  /** @fastify/multipart (file uploads). Set to false to disable. */
+  multipart?: MultipartOptions | false;
+  /** Raw body parsing (for webhooks). Set to false to disable. */
+  rawBody?: RawBodyOptions | false;
+  /** Enable Arc plugins (requestId, health, gracefulShutdown, events, caching, sse) */
+  arcPlugins?: {
+    /** Request ID tracking (default: true) */requestId?: boolean; /** Health endpoints (default: true) */
+    health?: boolean; /** Graceful shutdown handling (default: true) */
+    gracefulShutdown?: boolean; /** Emit events for CRUD operations (default: true) */
+    emitEvents?: boolean;
+    /**
+     * Event plugin configuration. Default: true (enabled with MemoryEventTransport).
+     * Set to false to disable event plugin registration entirely.
+     * Set to true for defaults (memory transport), or pass EventPluginOptions for fine control.
+     * Transport is sourced from `stores.events` if provided, otherwise defaults to memory.
+     *
+     * When enabled, registers `eventPlugin` which provides `fastify.events` for
+     * pub/sub. Combined with `emitEvents: true`, CRUD operations automatically
+     * emit domain events (e.g., `product.created`, `order.updated`).
+     *
+     * @example
+     * ```typescript
+     * // Memory transport (default)
+     * const app = await createApp({ arcPlugins: { events: true } });
+     *
+     * // With retry and logging
+     * const app = await createApp({
+     *   stores: { events: new RedisEventTransport({ url: 'redis://...' }) },
+     *   arcPlugins: {
+     *     events: {
+     *       logEvents: true,
+     *       retry: { maxRetries: 3, backoffMs: 1000 },
+     *     },
+     *   },
+     * });
+     * ```
+     */
+    events?: Omit<EventPluginOptions, 'transport'> | boolean;
+    /**
+     * Caching headers (ETag + Cache-Control). Default: false (opt-in).
+     * Set to true for defaults, or pass CachingOptions for fine control.
+     */
+    caching?: CachingOptions | boolean;
+    /**
+     * SSE event streaming. Default: false (opt-in).
+     * Set to true for defaults, or pass SSEOptions for fine control.
+     * Requires emitEvents to be enabled (or events plugin registered).
+     */
+    sse?: SSEOptions | boolean;
+    /**
+     * QueryCache — TanStack Query-inspired server cache with SWR.
+     * Default: false (opt-in). Set to true for memory store defaults.
+     * Requires per-resource `cache` config on defineResource().
+     */
+    queryCache?: QueryCachePluginOptions | boolean;
+  };
+  /**
+   * Type provider for schema inference.
+   *
+   * When set to `'typebox'`, enables TypeBox type provider for
+   * automatic TypeScript inference from route schemas.
+   *
+   * Requires `@sinclair/typebox` and `@fastify/type-provider-typebox` installed.
+   *
+   * @example
+   * ```typescript
+   * import { Type } from '@classytic/arc/schemas';
+   *
+   * const app = await createApp({
+   *   typeProvider: 'typebox',
+   * });
+   *
+   * // Now route schemas built with Type.* give full TS inference
+   * ```
+   */
+  typeProvider?: 'typebox';
+  /**
+   * Error handler plugin. Normalizes AJV, Mongoose, and ArcError responses
+   * into a consistent JSON envelope. Enabled by default.
+   * Set to false to disable, or pass ErrorHandlerOptions for fine control.
+   */
+  errorHandler?: ErrorHandlerOptions | false;
+  /** Custom plugin registration function */
+  plugins?: (fastify: FastifyInstance) => Promise<void>;
+  /** Hook called after all plugins are loaded and the app is ready */
+  onReady?: (fastify: FastifyInstance) => void | Promise<void>;
+  /** Hook called when the app is shutting down */
+  onClose?: (fastify: FastifyInstance) => void | Promise<void>;
+}
+interface UnderPressureOptions {
+  exposeStatusRoute?: boolean;
+  maxEventLoopDelay?: number;
+  maxHeapUsedBytes?: number;
+  maxRssBytes?: number;
+}
+interface MultipartOptions {
+  limits?: {
+    fileSize?: number;
+    files?: number;
+  };
+}
+interface RawBodyOptions {
+  field?: string;
+  global?: boolean;
+  encoding?: string;
+  runFirst?: boolean;
+}
+//#endregion
+export { CustomPluginAuthOption as a, RawBodyOptions as c, CustomAuthenticatorOption as i, UnderPressureOptions as l, BetterAuthOption as n, JwtAuthOption as o, CreateAppOptions as r, MultipartOptions as s, AuthOption as t };
+//# sourceMappingURL=types-CIgB7UUl.d.mts.map

package/dist/types-CIgB7UUl.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-CIgB7UUl.d.mts","names":[],"sources":["../src/factory/types.ts"],"mappings":";;;;;;;;;;;;;;;;;AAiDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAAiB,aAAA;EACf,IAAA;EAsCE;;;;EAhCF,GAAA;IA8CY,6CA5CV,MAAA,UA+D6B;IA7D7B,SAAA,WAgEsE;IA9DtE,aAAA,WA8DF;IA5DE,gBAAA,WA4DoB;IA1DpB,IAAA,GAAO,MAAA,mBA0D2C;IAxDlD,MAAA,GAAS,MAAA;EAAA;EA6EI;;;;;;;;EAlEf,YAAA,GAAe,aAAA;EA4FA;;;;EAtFf,SAAA,IACE,OAAA,EAAS,cAAA,EACT,KAAA,EAAO,YAAA,EACP,KAAA,GAAQ,KAAA,YACE,OAAA;EAqFoD;;;;;;EA7EhE,gBAAA;EA6E+C;;;EAxE/C,YAAA;AAAA;AAoFF;;;;;;;;;;;;;;;AAgDA;AAhDA,UAjEiB,gBAAA;EACf,IAAA;EAuIW;EArIX,UAAA;IAAc,MAAA,EAAQ,kBAAA;IAAoB,OAAA,GAAU,oBAAA;EAAA;AAAA;;;;;;;;;;;;;;;;;;;UAqBrC,sBAAA;EACf,IAAA;EA0WsD;EAxWtD,MAAA,EAAQ,kBAAA;AAAA;;;;;;;;;;;;;;;;;;;;;UAuBO,yBAAA;EACf,IAAA;EAuNY;EArNZ,YAAA,GAAe,OAAA,EAAS,cAAA,EAAgB,KAAA,EAAO,YAAA,KAAiB,OAAA;AAAA;;;;;;;;;;KAYtD,UAAA,WAER,aAAA,GACA,gBAAA,GACA,sBAAA,GACA,yBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkUJ;;;;;;;;;;AAOA;;;;;UA9RiB,gBAAA;EAiSb;EA3RF,MAAA;EA2RO;AAIT;;;;;EAvRE,OAAA;EA0RA;;;;;EAnRA,MAAA;sDAEE,MAAA,GAAS,cAAA;IAET,KAAA,GAAQ,UAAA;IAER,WAAA,GAAc,gBAAA;IAEd,UAAA,GAAa,UAAA;EAAA;;EAIf,MAAA,GAAS,oBAAA;;;;;;;;;;;;;;;;;;;EAoBT,KAAA;;EAGA,UAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyDA,IAAA,GAAO,UAAA;;;;;;;;;;;;;;;;;;;;;;EA2BP,SAAA,GAAY,gBAAA;;EAOZ,MAAA,GAAS,oBAAA;;EAGT,IAAA,GAAO,kBAAA;;EAGP,SAAA,GAAY,gBAAA;;EAUZ,aAAA,GAAgB,oBAAA;;EAOhB,QAAA;;EAGA,SAAA,GAAY,gBAAA;;EAGZ,OAAA,GAAU,cAAA;;EAOV,UAAA;8CAEE,SAAA;IAEA,MAAA;IAEA,gBAAA;IAEA,UAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4BA,MAAA,GAAS,IAAA,CA3Ca,kBAAA;;;;;IAgDtB,OAAA,GALa,cAAA;;;;;;IAWb,GAAA,GANwD,UAAA;;;;;;IAYxD,UAAA,GAN4C,uBAAA;EAAA;;;;;;;;;;;;;;;;;;;;EA4B9C,YAAA;;;;;;EAOA,YAAA,GA7B6E,mBAAA;;EAgC7E,OAAA,IAAW,OAAA,EAAS,eAAA,KAAoB,OAAA;;EAGxC,OAAA,IAAW,OAAA,EAAS,eAAA,YAA2B,OAAA;;EAG/C,OAAA,IAAW,OAAA,EAAS,eAAA,YAA2B,OAAA;AAAA;AAAA,UAKhC,oBAAA;EACf,iBAAA;EACA,iBAAA;EACA,gBAAA;EACA,WAAA;AAAA;AAAA,UAGe,gBAAA;EACf,MAAA;IACE,QAAA;IACA,KAAA;EAAA;AAAA;AAAA,UAIa,cAAA;EACf,KAAA;EACA,MAAA;EACA,QAAA;EACA,QAAA;AAAA"}