@classytic/arc 2.11.0 → 2.11.2

package/dist/adapters/index.d.mts

@@ -1,3 +1,3 @@
-import { An as RelationMetadata, En as AdapterFactory, Mn as SchemaMetadata, Nn as ValidationResult, On as DataAdapter, jn as RepositoryLike, kn as FieldMetadata } from "../index-Cm0vUrr_.mjs";
-import { a as PrismaQueryParserOptions, c as MongooseAdapterOptions, d as DrizzleAdapterOptions, f as createDrizzleAdapter, i as PrismaQueryParser, l as createMongooseAdapter, n as PrismaAdapterOptions, o as createPrismaAdapter, r as PrismaQueryOptions, s as MongooseAdapter, t as PrismaAdapter, u as DrizzleAdapter } from "../index-DAushRTt.mjs";
+import { An as RelationMetadata, En as AdapterFactory, Mn as SchemaMetadata, Nn as ValidationResult, On as DataAdapter, jn as RepositoryLike, kn as FieldMetadata } from "../index-6u4_Gg6G.mjs";
+import { a as PrismaQueryParserOptions, c as MongooseAdapterOptions, d as DrizzleAdapterOptions, f as createDrizzleAdapter, i as PrismaQueryParser, l as createMongooseAdapter, n as PrismaAdapterOptions, o as createPrismaAdapter, r as PrismaQueryOptions, s as MongooseAdapter, t as PrismaAdapter, u as DrizzleAdapter } from "../index-BbMrcvGp.mjs";
 export { AdapterFactory, DataAdapter, DrizzleAdapter, DrizzleAdapterOptions, FieldMetadata, MongooseAdapter, MongooseAdapterOptions, PrismaAdapter, PrismaAdapterOptions, PrismaQueryOptions, PrismaQueryParser, PrismaQueryParserOptions, RelationMetadata, RepositoryLike, SchemaMetadata, ValidationResult, createDrizzleAdapter, createMongooseAdapter, createPrismaAdapter };

package/dist/audit/index.d.mts

@@ -1,4 +1,4 @@
-import { jn as RepositoryLike } from "../index-Cm0vUrr_.mjs";
+import { jn as RepositoryLike } from "../index-6u4_Gg6G.mjs";
 import { d as UserBase } from "../fields-C8Y0XLAu.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/auth/index.d.mts

@@ -1,4 +1,4 @@
-import { Ot as AuthHelpers, kt as AuthPluginOptions } from "../index-Cm0vUrr_.mjs";
+import { Ot as AuthHelpers, kt as AuthPluginOptions } from "../index-6u4_Gg6G.mjs";
 import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-Bapitwvd.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-D-oNWHz3.mjs";

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { B as ResourceDefinition, Gt as TreeMixin, Ht as SoftDeleteExt, Jt as BulkExt, Kt as SlugExt, Ut as SoftDeleteMixin, V as defineResource, Vt as BaseController, Wt as TreeExt, Yt as BulkMixin, an as QueryResolverConfig, cn as AccessControl, in as QueryResolver, ln as AccessControlConfig, nn as BaseCrudController, on as BodySanitizer, qt as SlugMixin, rn as ListResult, sn as BodySanitizerConfig, tn as BaseControllerOptions } from "../index-Cm0vUrr_.mjs";
-import { C as MAX_REGEX_LENGTH, D as RESERVED_QUERY_PARAMS, E as MutationOperation, O as SYSTEM_FIELDS, S as MAX_FILTER_DEPTH, T as MUTATION_OPERATIONS, _ as DEFAULT_UPDATE_METHOD, a as getControllerScope, b as HookOperation, c as createCrudRouter, d as CrudOperation, f as DEFAULT_ID_FIELD, g as DEFAULT_TENANT_FIELD, h as DEFAULT_SORT, i as getControllerContext, l as createPermissionMiddleware, m as DEFAULT_MAX_LIMIT, n as createFastifyHandler, o as sendControllerResponse, p as DEFAULT_LIMIT, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as CRUD_OPERATIONS, v as HOOK_OPERATIONS, w as MAX_SEARCH_LENGTH, x as HookPhase, y as HOOK_PHASES } from "../index-t8pLpPFW.mjs";
+import { B as ResourceDefinition, Gt as TreeMixin, Ht as SoftDeleteExt, Jt as BulkExt, Kt as SlugExt, Ut as SoftDeleteMixin, V as defineResource, Vt as BaseController, Wt as TreeExt, Yt as BulkMixin, an as QueryResolverConfig, cn as AccessControl, in as QueryResolver, ln as AccessControlConfig, nn as BaseCrudController, on as BodySanitizer, qt as SlugMixin, rn as ListResult, sn as BodySanitizerConfig, tn as BaseControllerOptions } from "../index-6u4_Gg6G.mjs";
+import { C as MAX_REGEX_LENGTH, D as RESERVED_QUERY_PARAMS, E as MutationOperation, O as SYSTEM_FIELDS, S as MAX_FILTER_DEPTH, T as MUTATION_OPERATIONS, _ as DEFAULT_UPDATE_METHOD, a as getControllerScope, b as HookOperation, c as createCrudRouter, d as CrudOperation, f as DEFAULT_ID_FIELD, g as DEFAULT_TENANT_FIELD, h as DEFAULT_SORT, i as getControllerContext, l as createPermissionMiddleware, m as DEFAULT_MAX_LIMIT, n as createFastifyHandler, o as sendControllerResponse, p as DEFAULT_LIMIT, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as CRUD_OPERATIONS, v as HOOK_OPERATIONS, w as MAX_SEARCH_LENGTH, x as HookPhase, y as HOOK_PHASES } from "../index-BdXnTPRj.mjs";
 export { AccessControl, AccessControlConfig, BaseController, BaseControllerOptions, BaseCrudController, BodySanitizer, BodySanitizerConfig, BulkExt, BulkMixin, CRUD_OPERATIONS, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugExt, SlugMixin, SoftDeleteExt, SoftDeleteMixin, TreeExt, TreeMixin, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };

package/dist/{createApp-DvNYEhpb.mjs → createApp-P1d6rjPy.mjs}

@@ -448,7 +448,7 @@ async function registerResources(fastify, config) {
 	let discoveryPath;
 	let discoveryYieldedZero = false;
 	if (resolvedResources === void 0 && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-YNwKHvRA.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-CPpkyKfM.mjs").then((n) => n.n);
 		const { resolve, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const rawDir = config.resourceDir;

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-Cm0vUrr_.mjs";
+import { p as RegistryEntry } from "../index-6u4_Gg6G.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-Bapitwvd.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/events/index.d.mts

@@ -1,4 +1,4 @@
-import { jn as RepositoryLike } from "../index-Cm0vUrr_.mjs";
+import { jn as RepositoryLike } from "../index-6u4_Gg6G.mjs";
 import { a as EventMeta, c as MemoryEventTransportOptions, d as createEvent, i as EventLogger, l as PublishManyResult, n as DomainEvent, o as EventTransport, r as EventHandler, s as MemoryEventTransport, t as DeadLetteredEvent, u as createChildEvent } from "../EventTransport-CfVEGaEl.mjs";
 import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-CUNjYYRY.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as ResourceLike, f as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as LoadResourcesOptions } from "../types-CgikqKAj.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as ResourceLike, f as ResourceModule, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, p as loadResources, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as LoadResourcesOptions } from "../types-BH7dEGvU.mjs";
 import { FastifyInstance } from "fastify";
 
 //#region src/factory/createApp.d.ts
@@ -95,4 +95,4 @@ declare const edgePreset: Partial<CreateAppOptions>;
  */
 declare function getPreset(name: "production" | "development" | "testing" | "edge"): Partial<CreateAppOptions>;
 //#endregion
-export { ArcFactory, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type MultipartOptions, type RawBodyOptions, type ResourceLike, type UnderPressureOptions, createApp, developmentPreset, edgePreset, getPreset, loadResources, productionPreset, testingPreset, toFetchHandler };
+export { ArcFactory, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type MultipartOptions, type RawBodyOptions, type ResourceLike, type ResourceModule, type UnderPressureOptions, createApp, developmentPreset, edgePreset, getPreset, loadResources, productionPreset, testingPreset, toFetchHandler };

package/dist/factory/index.mjs

@@ -1,5 +1,5 @@
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-DvNYEhpb.mjs";
-import { t as loadResources } from "../loadResources-YNwKHvRA.mjs";
+import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-P1d6rjPy.mjs";
+import { t as loadResources } from "../loadResources-CPpkyKfM.mjs";
 //#region src/factory/edge.ts
 /**
 * Convert a Fastify app into a Web Standards fetch handler.

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { Cn as beforeUpdate, Sn as beforeDelete, Tn as defineHook, _n as HookSystemOptions, bn as afterUpdate, dn as HookContext, fn as HookHandler, gn as HookSystem, hn as HookRegistration, mn as HookPhase, pn as HookOperation, un as DefineHookOptions, vn as afterCreate, wn as createHookSystem, xn as beforeCreate, yn as afterDelete } from "../index-Cm0vUrr_.mjs";
+import { Cn as beforeUpdate, Sn as beforeDelete, Tn as defineHook, _n as HookSystemOptions, bn as afterUpdate, dn as HookContext, fn as HookHandler, gn as HookSystem, hn as HookRegistration, mn as HookPhase, pn as HookOperation, un as DefineHookOptions, vn as afterCreate, wn as createHookSystem, xn as beforeCreate, yn as afterDelete } from "../index-6u4_Gg6G.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -1,4 +1,4 @@
-import { jn as RepositoryLike } from "../index-Cm0vUrr_.mjs";
+import { jn as RepositoryLike } from "../index-6u4_Gg6G.mjs";
 import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-CkkWm5uR.mjs";
 import { i as RedisIdempotencyStoreOptions, n as RedisClient } from "../redis-Cm1gnRDf.mjs";
 import { FastifyPluginAsync } from "fastify";

package/dist/{index-Cm0vUrr_.d.mts → index-6u4_Gg6G.d.mts}

@@ -1776,6 +1776,40 @@ interface RouteSchemaOptions extends SchemaBuilderOptions {
    * post-kit by `mergeFieldRuleConstraints`.
    */
   fieldRules?: Record<string, ArcFieldRule>;
+  /**
+   * Query-time security whitelists + the kit's `filterableFields`.
+   *
+   * Extends repo-core's `SchemaBuilderOptions['query']` with arc-specific
+   * runtime features that `QueryResolver` reads at request time:
+   *
+   * - **`allowedPopulate`** — populate-path whitelist consumed by
+   *   `QueryResolver.sanitizePopulate` / `sanitizeAdvancedPopulate`.
+   *   When set, only paths in the list pass through; everything else is
+   *   stripped silently. Shrinks the auto-wired `?populate=` attack surface.
+   *
+   * - **`allowedLookups`** — lookup-collection whitelist consumed by
+   *   `QueryResolver.sanitizeLookups`. When set, only the listed
+   *   collections may be `$lookup`'d into the pipeline.
+   *
+   * Both are pre-2.11.2 runtime features — the type was missing them, so
+   * hosts wrote `as Record<string, unknown>` at every call site. Arc's own
+   * `QueryResolver` had to cast its own input via `as AnyRecord` for the
+   * same reason. Adding the type dropped both casts.
+   */
+  query?: SchemaBuilderOptions["query"] & {
+    /**
+     * Populate-path whitelist. When set, `QueryResolver.sanitizePopulate`
+     * strips any `?populate=<path>` not in this list. Omit to allow all
+     * paths the kit recognizes.
+     */
+    allowedPopulate?: string[];
+    /**
+     * Lookup-collection whitelist for `QueryResolver.sanitizeLookups`.
+     * When set, only the listed collections may be `$lookup`'d. Omit to
+     * disable the whitelist (kit-level rules still apply).
+     */
+    allowedLookups?: string[];
+  };
 }
 interface FieldRule$1 {
   field: string;
@@ -1942,10 +1976,13 @@ interface ActionDefinition {
   readonly permissions?: PermissionCheck;
   /**
    * JSON Schema or Zod v4 schema for action-specific body fields.
-   * Per-field values are typed `unknown` so Zod class instances assign
-   * without casts.
+   *
+   * Typed `unknown` (not `Record<string, unknown>`) so Zod class instances
+   * — `ZodObject<...>` carries no string index signature — assign without
+   * a cast. Same convention as `RouteDefinition.schema.body` / `customSchemas`.
+   * Runtime feature-detects via `convertRouteSchema` / `toJsonSchema`.
    */
-  readonly schema?: Record<string, unknown>;
+  readonly schema?: unknown;
   /** Description for OpenAPI docs and MCP tool */
   readonly description?: string;
   /**
@@ -2060,8 +2097,12 @@ interface EventDefinition {
   name: string;
   /** Optional handler — events are published via `fastify.events.publish()`. */
   handler?: (data: unknown) => Promise<void> | void;
-  /** JSON schema for event payload */
-  schema?: Record<string, unknown>;
+  /**
+   * JSON Schema or Zod v4 schema for event payload. Typed `unknown` so Zod
+   * class instances assign without a cast (same convention as
+   * `ActionDefinition.schema` and `RouteDefinition.schema`).
+   */
+  schema?: unknown;
   description?: string;
 }
 /** Resource-level permissions — only `PermissionCheck` functions allowed. */
@@ -2361,7 +2402,7 @@ declare class ResourceDefinition<TDoc = AnyRecord> {
   getEvents(): Array<{
     name: string;
     module: string;
-    schema?: AnyRecord;
+    schema?: unknown;
     description?: string;
   }>;
   /**
@@ -2762,7 +2803,7 @@ interface ResourceMetadata {
     description?: string;
     permissions?: PermissionCheck;
     raw?: boolean;
-    schema?: Record<string, unknown>;
+    schema?: unknown;
   }>;
   routes: Array<{
     method: string;
@@ -2814,7 +2855,7 @@ interface RegistryEntry extends ResourceMetadata {
   actions?: Array<{
     readonly name: string;
     readonly description?: string; /** Raw per-action schema (JSON Schema, Zod v4, or legacy field map) */
-    readonly schema?: Record<string, unknown>; /** Per-action permission check (if different from resource-level `actionPermissions`) */
+    readonly schema?: unknown; /** Per-action permission check (if different from resource-level `actionPermissions`) */
     readonly permissions?: PermissionCheck; /** MCP tool generation flag — `false` to skip, object for overrides */
     readonly mcp?: boolean | {
       readonly description?: string;

package/dist/{index-DAushRTt.d.mts → index-BbMrcvGp.d.mts}

@@ -1,4 +1,4 @@
-import { $ as OpenApiSchemas, Dn as AdapterSchemaContext, Mn as SchemaMetadata, Nn as ValidationResult, On as DataAdapter, S as QueryParserInterface, b as ParsedQuery, ft as RouteSchemaOptions, jn as RepositoryLike } from "./index-Cm0vUrr_.mjs";
+import { $ as OpenApiSchemas, Dn as AdapterSchemaContext, Mn as SchemaMetadata, Nn as ValidationResult, On as DataAdapter, S as QueryParserInterface, b as ParsedQuery, ft as RouteSchemaOptions, jn as RepositoryLike } from "./index-6u4_Gg6G.mjs";
 import { StandardRepo } from "@classytic/repo-core/repository";
 import { Model } from "mongoose";
 

package/dist/{index-t8pLpPFW.d.mts → index-BdXnTPRj.d.mts}

@@ -1,4 +1,4 @@
-import { B as ResourceDefinition, C as RequestContext, F as FastifyWithDecorators, Pt as AnyRecord, T as CrudRouterOptions, _t as IControllerResponse, at as ResourceConfig, gt as IController, q as CrudController, vt as IRequestContext } from "./index-Cm0vUrr_.mjs";
+import { B as ResourceDefinition, C as RequestContext, F as FastifyWithDecorators, Pt as AnyRecord, T as CrudRouterOptions, _t as IControllerResponse, at as ResourceConfig, gt as IController, q as CrudController, vt as IRequestContext } from "./index-6u4_Gg6G.mjs";
 import { r as RequestScope } from "./types-tgR4Pt8F.mjs";
 import { c as PermissionCheck } from "./fields-C8Y0XLAu.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";

package/dist/{index-DsJ1MNfC.d.mts → index-DdQ3O9Pg.d.mts}

@@ -1,4 +1,4 @@
-import { $ as OpenApiSchemas, Pt as AnyRecord, S as QueryParserInterface, at as ResourceConfig, b as ParsedQuery, zt as UserLike } from "./index-Cm0vUrr_.mjs";
+import { $ as OpenApiSchemas, Pt as AnyRecord, S as QueryParserInterface, at as ResourceConfig, b as ParsedQuery, zt as UserLike } from "./index-6u4_Gg6G.mjs";
 import { n as ErrorMapper } from "./errorHandler-Co3lnVmJ.mjs";
 import { FastifyInstance, FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 

package/dist/index.d.mts

@@ -1,9 +1,9 @@
-import { $t as ArcListResult, A as RequestIdOptions, An as RelationMetadata, B as ResourceDefinition, Bt as UserOrganization, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Ft as ApiResponse, Gt as TreeMixin, Ht as SoftDeleteExt, It as ArcRequest, J as CrudRouteKey, Jt as BulkExt, Kt as SlugExt, L as RequestWithExtras, Lt as JWTPayload, Mn as SchemaMetadata, N as FastifyRequestExtras, Nn as ValidationResult, O as HealthOptions, On as DataAdapter, P as FastifyWithAuth, Pt as AnyRecord, Q as MiddlewareConfig, Qt as ArcGetResult, S as QueryParserInterface, T as CrudRouterOptions, Ut as SoftDeleteMixin, V as defineResource, Vt as BaseController, Wt as TreeExt, X as EventDefinition, Xt as ArcCreateResult, Y as CrudSchemas, Yt as BulkMixin, Z as FieldRule, Zt as ArcDeleteResult, _t as IControllerResponse, a as InferAdapterDoc, at as ResourceConfig, c as TypedController, d as PaginationResult, en as ArcUpdateResult, et as PresetFunction, f as IntrospectionData, ft as RouteSchemaOptions, g as ArcInternalMetadata, gt as IController, h as ResourceMetadata, i as ValidationResult$1, jn as RepositoryLike, k as IntrospectionPluginOptions, kn as FieldMetadata, kt as AuthPluginOptions, l as TypedRepository, m as RegistryStats, mt as ControllerLike, n as ConfigError, nn as BaseCrudController, nt as PresetResult, o as InferDocType, p as RegistryEntry, q as CrudController, qt as SlugMixin, r as ValidateOptions, rn as ListResult, rt as RateLimitConfig, s as InferResourceDoc, t as RouteHandlerMethod, tn as BaseControllerOptions, u as TypedResourceConfig, vt as IRequestContext, w as ServiceContext, y as OwnershipCheck, yt as RouteHandler } from "./index-Cm0vUrr_.mjs";
+import { $t as ArcListResult, A as RequestIdOptions, An as RelationMetadata, B as ResourceDefinition, Bt as UserOrganization, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Ft as ApiResponse, Gt as TreeMixin, Ht as SoftDeleteExt, It as ArcRequest, J as CrudRouteKey, Jt as BulkExt, Kt as SlugExt, L as RequestWithExtras, Lt as JWTPayload, Mn as SchemaMetadata, N as FastifyRequestExtras, Nn as ValidationResult, O as HealthOptions, On as DataAdapter, P as FastifyWithAuth, Pt as AnyRecord, Q as MiddlewareConfig, Qt as ArcGetResult, S as QueryParserInterface, T as CrudRouterOptions, Ut as SoftDeleteMixin, V as defineResource, Vt as BaseController, Wt as TreeExt, X as EventDefinition, Xt as ArcCreateResult, Y as CrudSchemas, Yt as BulkMixin, Z as FieldRule, Zt as ArcDeleteResult, _t as IControllerResponse, a as InferAdapterDoc, at as ResourceConfig, c as TypedController, d as PaginationResult, en as ArcUpdateResult, et as PresetFunction, f as IntrospectionData, ft as RouteSchemaOptions, g as ArcInternalMetadata, gt as IController, h as ResourceMetadata, i as ValidationResult$1, jn as RepositoryLike, k as IntrospectionPluginOptions, kn as FieldMetadata, kt as AuthPluginOptions, l as TypedRepository, m as RegistryStats, mt as ControllerLike, n as ConfigError, nn as BaseCrudController, nt as PresetResult, o as InferDocType, p as RegistryEntry, q as CrudController, qt as SlugMixin, r as ValidateOptions, rn as ListResult, rt as RateLimitConfig, s as InferResourceDoc, t as RouteHandlerMethod, tn as BaseControllerOptions, u as TypedResourceConfig, vt as IRequestContext, w as ServiceContext, y as OwnershipCheck, yt as RouteHandler } from "./index-6u4_Gg6G.mjs";
 import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-C8Y0XLAu.mjs";
-import { l as createMongooseAdapter, o as createPrismaAdapter, s as MongooseAdapter, t as PrismaAdapter } from "./index-DAushRTt.mjs";
-import { C as MAX_REGEX_LENGTH, D as RESERVED_QUERY_PARAMS, E as MutationOperation, O as SYSTEM_FIELDS, S as MAX_FILTER_DEPTH, T as MUTATION_OPERATIONS, _ as DEFAULT_UPDATE_METHOD, a as getControllerScope, b as HookOperation, d as CrudOperation, f as DEFAULT_ID_FIELD, g as DEFAULT_TENANT_FIELD, h as DEFAULT_SORT, m as DEFAULT_MAX_LIMIT, p as DEFAULT_LIMIT, s as defineResourceVariants, u as CRUD_OPERATIONS, v as HOOK_OPERATIONS, w as MAX_SEARCH_LENGTH, x as HookPhase, y as HOOK_PHASES } from "./index-t8pLpPFW.mjs";
+import { l as createMongooseAdapter, o as createPrismaAdapter, s as MongooseAdapter, t as PrismaAdapter } from "./index-BbMrcvGp.mjs";
+import { C as MAX_REGEX_LENGTH, D as RESERVED_QUERY_PARAMS, E as MutationOperation, O as SYSTEM_FIELDS, S as MAX_FILTER_DEPTH, T as MUTATION_OPERATIONS, _ as DEFAULT_UPDATE_METHOD, a as getControllerScope, b as HookOperation, d as CrudOperation, f as DEFAULT_ID_FIELD, g as DEFAULT_TENANT_FIELD, h as DEFAULT_SORT, m as DEFAULT_MAX_LIMIT, p as DEFAULT_LIMIT, s as defineResourceVariants, u as CRUD_OPERATIONS, v as HOOK_OPERATIONS, w as MAX_SEARCH_LENGTH, x as HookPhase, y as HOOK_PHASES } from "./index-BdXnTPRj.mjs";
 import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-BYCqHCVu.mjs";
-import { ft as UnauthorizedError, j as envelope, mt as createDomainError, ot as ForbiddenError, pt as ValidationError, rt as ArcError, st as NotFoundError, t as getUserId } from "./index-DsJ1MNfC.mjs";
+import { ft as UnauthorizedError, j as envelope, mt as createDomainError, ot as ForbiddenError, pt as ValidationError, rt as ArcError, st as NotFoundError, t as getUserId } from "./index-DdQ3O9Pg.mjs";
 
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -7,6 +7,6 @@ import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r a
 import { _ as getControllerScope } from "./routerShared-DeESFp4a.mjs";
 import { n as ResourceDefinition, r as defineResource, t as defineResourceVariants } from "./core-DXdSSFW-.mjs";
 //#region src/index.ts
-const version = "2.11.0";
+const version = "2.11.2";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MongooseAdapter, NotFoundError, PrismaAdapter, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createMongooseAdapter, createOrgPermissions, createPrismaAdapter, defineResource, defineResourceVariants, denyAll, envelope, fields, fullPublic, getControllerScope, getUserId, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
 import { a as WebSocketMessage, i as WebSocketClient, o as WebSocketPluginOptions } from "../websocket-CyJ1VIFI.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpResourceConfig, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler } from "../types-D9NqiYIw.mjs";
+import { c as McpResourceConfig, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler } from "../types-9beEMe25.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export { type BetterAuthHandler, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type EventGatewayOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobsPluginOptions, type McpAuthResult, type McpPluginOptions, type McpResourceConfig, type PromptDefinition, type QueueStats, type StreamlinePluginOptions, type ToolAnnotations, type ToolContext, type ToolDefinition, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, type WebhookDeliveryRecord, type WebhookManager, type WebhookPluginOptions, type WebhookStore, type WebhookSubscription, type WorkflowLike, type WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,5 +1,5 @@
-import { B as ResourceDefinition } from "../../index-Cm0vUrr_.mjs";
-import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-D9NqiYIw.mjs";
+import { B as ResourceDefinition } from "../../index-6u4_Gg6G.mjs";
+import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-9beEMe25.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
 

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { o as McpAuthResult, s as McpPluginOptions } from "../../types-D9NqiYIw.mjs";
+import { o as McpAuthResult, s as McpPluginOptions } from "../../types-9beEMe25.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/{loadResources-YNwKHvRA.mjs → loadResources-CPpkyKfM.mjs}

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -58,7 +59,7 @@ var loadResources_exports = /* @__PURE__ */ __exportAll({ loadResources: () => l
 * ```
 */
 async function loadResources(dir, options = {}) {
-	const { suffix = ".resource", recursive = true, exclude, include, silent = false } = options;
+	const { suffix = ".resource", recursive = true, exclude, include } = options;
 	const absDir = resolve(dir.startsWith("file://") ? dirname(fileURLToPath(dir)) : dir);
 	const files = await collectFiles(absDir, new RegExp(`${escapeRegex(suffix)}\\.(ts|js|mts|mjs)$`), recursive);
 	files.sort();
@@ -99,13 +100,30 @@ async function loadResources(dir, options = {}) {
 		return null;
 	}));
 	const resources = [];
+	const factoryFailed = [];
 	for (const result of results) {
 		if (!result) continue;
-		let resource = result.mod.default ?? result.mod.resource;
-		if (!resource || typeof resource.toPlugin !== "function") {
-			for (const value of Object.values(result.mod)) if (value && typeof value === "object" && typeof value.toPlugin === "function") {
-				resource = value;
-				break;
+		let resource;
+		const rawDefault = result.mod.default;
+		if (typeof rawDefault === "function" && !("toPlugin" in rawDefault)) try {
+			const built = await rawDefault(options.context);
+			if (built && typeof built === "object" && typeof built.toPlugin === "function") resource = built;
+			else {
+				factoryFailed.push(`${result.file}: factory returned non-resource value`);
+				continue;
+			}
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			factoryFailed.push(`${result.file}: factory threw: ${msg}`);
+			continue;
+		}
+		else {
+			resource = rawDefault ?? result.mod.resource;
+			if (!resource || typeof resource.toPlugin !== "function") {
+				for (const value of Object.values(result.mod)) if (value && typeof value === "object" && typeof value.toPlugin === "function") {
+					resource = value;
+					break;
+				}
 			}
 		}
 		if (!resource || typeof resource.toPlugin !== "function") {
@@ -119,12 +137,16 @@ async function loadResources(dir, options = {}) {
 		}
 		resources.push(resource);
 	}
-	const log = silent ? void 0 : options?.logger;
+	const log = options?.logger ?? arcLog("loadResources");
 	if (log) {
 		if (failed.length) {
 			log.warn(`[arc] loadResources: ${failed.length} file(s) failed to import:`);
 			for (const f of failed) log.warn(`  - ${f}`);
 		}
+		if (factoryFailed.length) {
+			log.warn(`[arc] loadResources: ${factoryFailed.length} factory export(s) failed (function default that returned non-resource or threw):`);
+			for (const f of factoryFailed) log.warn(`  - ${f}`);
+		}
 		if (skipped.length) {
 			log.warn(`[arc] loadResources: ${skipped.length} file(s) skipped (no default export with toPlugin):`);
 			for (const f of skipped) log.warn(`  - ${f}`);

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-Cm0vUrr_.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-6u4_Gg6G.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/org/index.d.mts

@@ -1,4 +1,4 @@
-import { yt as RouteHandler } from "../index-Cm0vUrr_.mjs";
+import { yt as RouteHandler } from "../index-6u4_Gg6G.mjs";
 import { d as UserBase } from "../fields-C8Y0XLAu.mjs";
 import { InvitationAdapter, InvitationDoc, MemberDoc, OrgAdapter, OrgDoc, OrgPermissionStatement, OrgRole, OrganizationPluginOptions } from "./types.mjs";
 import { FastifyPluginAsync, RouteHandlerMethod } from "fastify";

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ct as OperationFilter, Dt as Transform, Et as PipelineStep, St as NextFunction, Tt as PipelineContext, _t as IControllerResponse, bt as Guard, wt as PipelineConfig, xt as Interceptor } from "../index-Cm0vUrr_.mjs";
+import { Ct as OperationFilter, Dt as Transform, Et as PipelineStep, St as NextFunction, Tt as PipelineContext, _t as IControllerResponse, bt as Guard, wt as PipelineConfig, xt as Interceptor } from "../index-6u4_Gg6G.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/plugins/index.d.mts

@@ -1,4 +1,4 @@
-import { Pt as AnyRecord, Q as MiddlewareConfig, ft as RouteSchemaOptions, gn as HookSystem, lt as RouteDefinition, tt as PresetHook, z as ResourceRegistry } from "../index-Cm0vUrr_.mjs";
+import { Pt as AnyRecord, Q as MiddlewareConfig, ft as RouteSchemaOptions, gn as HookSystem, lt as RouteDefinition, tt as PresetHook, z as ResourceRegistry } from "../index-6u4_Gg6G.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-Bapitwvd.mjs";
 import { a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6 } from "../versioning-M9lNLhO8.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-Co3lnVmJ.mjs";

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.11.0";
+	const resolvedVersion = serviceVersion ?? "2.11.2";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/presets/filesUpload.d.mts

@@ -1,4 +1,4 @@
-import { nt as PresetResult } from "../index-Cm0vUrr_.mjs";
+import { nt as PresetResult } from "../index-6u4_Gg6G.mjs";
 import { r as RequestScope } from "../types-tgR4Pt8F.mjs";
 import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-BwGQXUpd.mjs";

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Pt as AnyRecord, _t as IControllerResponse, at as ResourceConfig, d as PaginationResult, nt as PresetResult, vt as IRequestContext } from "../index-Cm0vUrr_.mjs";
+import { Pt as AnyRecord, _t as IControllerResponse, at as ResourceConfig, d as PaginationResult, nt as PresetResult, vt as IRequestContext } from "../index-6u4_Gg6G.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, nt as PresetResult } from "../index-Cm0vUrr_.mjs";
+import { J as CrudRouteKey, nt as PresetResult } from "../index-6u4_Gg6G.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/search.d.mts

@@ -1,4 +1,4 @@
-import { lt as RouteDefinition, nt as PresetResult, pt as ControllerHandler, ut as RouteMcpConfig } from "../index-Cm0vUrr_.mjs";
+import { lt as RouteDefinition, nt as PresetResult, pt as ControllerHandler, ut as RouteMcpConfig } from "../index-6u4_Gg6G.mjs";
 import { c as PermissionCheck } from "../fields-C8Y0XLAu.mjs";
 
 //#region src/presets/search.d.ts

package/dist/registry/index.d.mts

@@ -1,4 +1,4 @@
-import { R as RegisterOptions, k as IntrospectionPluginOptions, z as ResourceRegistry } from "../index-Cm0vUrr_.mjs";
+import { R as RegisterOptions, k as IntrospectionPluginOptions, z as ResourceRegistry } from "../index-6u4_Gg6G.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/registry/introspectionPlugin.d.ts

package/dist/testing/index.d.mts

@@ -1,5 +1,5 @@
-import { B as ResourceDefinition, Pt as AnyRecord } from "../index-Cm0vUrr_.mjs";
-import { d as ResourceLike, r as CreateAppOptions } from "../types-CgikqKAj.mjs";
+import { B as ResourceDefinition, Pt as AnyRecord } from "../index-6u4_Gg6G.mjs";
+import { d as ResourceLike, r as CreateAppOptions } from "../types-BH7dEGvU.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";

package/dist/testing/index.mjs

@@ -1081,7 +1081,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-DvNYEhpb.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-P1d6rjPy.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as OpenApiSchemas, A as RequestIdOptions, At as Authenticator, Bt as UserOrganization, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Ft as ApiResponse, G as ActionsMap, H as ActionDefinition, I as MiddlewareHandler, It as ArcRequest, J as CrudRouteKey, K as ArcFieldRule, L as RequestWithExtras, Lt as JWTPayload, M as EventsDecorator, Mt as JwtContext, N as FastifyRequestExtras, Nt as TokenPair, O as HealthOptions, Ot as AuthHelpers, P as FastifyWithAuth, Pt as AnyRecord, Q as MiddlewareConfig, Rt as ObjectId, S as QueryParserInterface, T as CrudRouterOptions, U as ActionEntry, W as ActionHandlerFn, X as EventDefinition, Y as CrudSchemas, Z as FieldRule, _ as ControllerQueryOptions, _t as IControllerResponse, a as InferAdapterDoc, at as ResourceConfig, b as ParsedQuery, c as TypedController, ct as ResourcePermissions, d as PaginationResult, dt as RouteMethod, et as PresetFunction, f as IntrospectionData, ft as RouteSchemaOptions, g as ArcInternalMetadata, gt as IController, h as ResourceMetadata, ht as FastifyHandler, i as ValidationResult, it as ResourceCacheConfig, j as ArcDecorator, jt as AuthenticatorContext, k as IntrospectionPluginOptions, kt as AuthPluginOptions, l as TypedRepository, lt as RouteDefinition, m as RegistryStats, mt as ControllerLike, n as ConfigError, nt as PresetResult, o as InferDocType, ot as ResourceHookContext, p as RegistryEntry, pt as ControllerHandler, q as CrudController, r as ValidateOptions, rt as RateLimitConfig, s as InferResourceDoc, st as ResourceHooks, t as RouteHandlerMethod, tn as BaseControllerOptions, tt as PresetHook, u as TypedResourceConfig, ut as RouteMcpConfig, v as LookupOption, vt as IRequestContext, w as ServiceContext, x as PopulateOption, y as OwnershipCheck, yt as RouteHandler, zt as UserLike } from "../index-Cm0vUrr_.mjs";
+import { $ as OpenApiSchemas, A as RequestIdOptions, At as Authenticator, Bt as UserOrganization, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Ft as ApiResponse, G as ActionsMap, H as ActionDefinition, I as MiddlewareHandler, It as ArcRequest, J as CrudRouteKey, K as ArcFieldRule, L as RequestWithExtras, Lt as JWTPayload, M as EventsDecorator, Mt as JwtContext, N as FastifyRequestExtras, Nt as TokenPair, O as HealthOptions, Ot as AuthHelpers, P as FastifyWithAuth, Pt as AnyRecord, Q as MiddlewareConfig, Rt as ObjectId, S as QueryParserInterface, T as CrudRouterOptions, U as ActionEntry, W as ActionHandlerFn, X as EventDefinition, Y as CrudSchemas, Z as FieldRule, _ as ControllerQueryOptions, _t as IControllerResponse, a as InferAdapterDoc, at as ResourceConfig, b as ParsedQuery, c as TypedController, ct as ResourcePermissions, d as PaginationResult, dt as RouteMethod, et as PresetFunction, f as IntrospectionData, ft as RouteSchemaOptions, g as ArcInternalMetadata, gt as IController, h as ResourceMetadata, ht as FastifyHandler, i as ValidationResult, it as ResourceCacheConfig, j as ArcDecorator, jt as AuthenticatorContext, k as IntrospectionPluginOptions, kt as AuthPluginOptions, l as TypedRepository, lt as RouteDefinition, m as RegistryStats, mt as ControllerLike, n as ConfigError, nt as PresetResult, o as InferDocType, ot as ResourceHookContext, p as RegistryEntry, pt as ControllerHandler, q as CrudController, r as ValidateOptions, rt as RateLimitConfig, s as InferResourceDoc, st as ResourceHooks, t as RouteHandlerMethod, tn as BaseControllerOptions, tt as PresetHook, u as TypedResourceConfig, ut as RouteMcpConfig, v as LookupOption, vt as IRequestContext, w as ServiceContext, x as PopulateOption, y as OwnershipCheck, yt as RouteHandler, zt as UserLike } from "../index-6u4_Gg6G.mjs";
 import { r as RequestScope } from "../types-tgR4Pt8F.mjs";
 import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-C8Y0XLAu.mjs";
 import { n as ElevationOptions, t as ElevationEvent } from "../elevation-s5ykdNHr.mjs";

package/dist/{types-D9NqiYIw.d.mts → types-9beEMe25.d.mts}

@@ -1,4 +1,4 @@
-import { B as ResourceDefinition } from "./index-Cm0vUrr_.mjs";
+import { B as ResourceDefinition } from "./index-6u4_Gg6G.mjs";
 import { z } from "zod";
 
 //#region src/integrations/mcp/types.d.ts

package/dist/{types-CgikqKAj.d.mts → types-BH7dEGvU.d.mts}

@@ -1,4 +1,4 @@
-import { At as Authenticator } from "./index-Cm0vUrr_.mjs";
+import { At as Authenticator } from "./index-6u4_Gg6G.mjs";
 import { r as CacheStore } from "./interface-Da0r7Lna.mjs";
 import { n as ElevationOptions } from "./elevation-s5ykdNHr.mjs";
 import { o as EventTransport } from "./EventTransport-CfVEGaEl.mjs";
@@ -74,11 +74,63 @@ interface ResourceLike {
   /** Applied preset names */
   _appliedPresets?: string[];
 }
-interface LoadResourcesOptions {
+/**
+ * Resource module — what a `.resource.ts` file's default (or named) export
+ * may resolve to.
+ *
+ * Two shapes accepted:
+ *   1. **Plain `ResourceLike`** — the result of `defineResource({...})`.
+ *      Used as-is; no engine wiring needed.
+ *   2. **Factory `(ctx: TContext) => ResourceLike | Promise<ResourceLike>`**
+ *      — a function arc calls with the `context` from `LoadResourcesOptions`.
+ *      Eliminates the parallel `createXResource(engine)` factory files +
+ *      `exclude: [...]` bookkeeping that engine-bound resources used to need.
+ *
+ * Detection is by `typeof === 'function'`: `ResourceDefinition` instances
+ * (returned by `defineResource()`) are class instances (`typeof === 'object'`),
+ * so the two shapes are unambiguous in practice.
+ */
+type ResourceModule<TContext = unknown> = ResourceLike | ((ctx: TContext) => ResourceLike | Promise<ResourceLike>);
+interface LoadResourcesOptions<TContext = unknown> {
   /** File pattern suffix (default: '.resource'). Matches `*.resource.{ts,js,mts,mjs}`. */
   suffix?: string;
   /** Recurse into subdirectories (default: true) */
   recursive?: boolean;
+  /**
+   * Context passed to factory-style default exports. Resources whose default
+   * export is a function `(ctx) => ResourceLike` are called with this value;
+   * plain `ResourceLike` exports are returned unchanged.
+   *
+   * Use this to thread engine handles into engine-bound resources without
+   * creating parallel factory files outside `loadResources`'s sweep:
+   *
+   * ```ts
+   * // category.resource.ts
+   * import type { AppContext } from '#core/app/context.js';
+   * export default (ctx: AppContext) =>
+   *   defineResource({
+   *     name: 'category',
+   *     adapter: createMongooseAdapter(
+   *       ctx.catalog.models.Category,
+   *       ctx.catalog.repositories.category,
+   *     ),
+   *   });
+   *
+   * // create-arc-app-options.ts
+   * resources: async () => {
+   *   const [catalog, flow] = await Promise.all([
+   *     ensureCatalogEngine(),
+   *     ensureFlowEngine(),
+   *   ]);
+   *   return loadResources(import.meta.url, { context: { catalog, flow } });
+   * }
+   * ```
+   *
+   * Backwards compatible — pre-2.11.1 callers omit `context`, plain exports
+   * keep working unchanged. Factories that need a context but receive
+   * `undefined` should narrow defensively.
+   */
+  context?: TContext;
   /**
    * Resource names to exclude. Matched against the resource's `.name` property
    * after import, so you use the resource name (not the filename).
@@ -101,14 +153,26 @@ interface LoadResourcesOptions {
    */
   include?: string[];
   /**
-   * Suppress warning logs for skipped/failed files.
-   * Useful when your resources directory contains factory files or helpers
-   * that don't export a resource (e.g., `account.resource.ts` exporting a factory).
+   * Optional logger override for diagnostics. When omitted, warnings flow
+   * through arc's standard logger (`arcLog('loadResources')`) — same path
+   * as every other arc-internal warning, controlled by `ARC_SUPPRESS_WARNINGS=1`
+   * and routable via `configureArcLogger({ writer })`.
    *
-   * @default false
+   * Pass any object with `warn(msg)` to override (e.g. `fastify.log` —
+   * which is what `registerResources` passes automatically when arc's
+   * factory triggers auto-discovery via `resourceDir`).
+   *
+   * Pre-2.11.1 had a `silent: boolean` flag and "silent by default" semantics;
+   * both removed. Migration:
+   *
+   * ```ts
+   * // Pre-2.11.1                                // 2.11.1+
+   * loadResources(url, { silent: true });            // ARC_SUPPRESS_WARNINGS=1 (env)
+   *                                                  //   OR configureArcLogger({ writer })
+   * loadResources(url, { silent: !isDev });          // ARC_SUPPRESS_WARNINGS=1 in prod
+   * loadResources(url, { logger: pinoAdapter });     // unchanged — still works
+   * ```
    */
-  silent?: boolean;
-  /** Optional logger for diagnostics. No output when omitted (silent by default). */
   logger?: {
     warn: (msg: string) => void;
   };
@@ -137,7 +201,7 @@ interface LoadResourcesOptions {
  * await loadResources('./src/resources');
  * ```
  */
-declare function loadResources(dir: string, options?: LoadResourcesOptions): Promise<ResourceLike[]>;
+declare function loadResources<TContext = unknown>(dir: string, options?: LoadResourcesOptions<TContext>): Promise<ResourceLike[]>;
 //#endregion
 //#region src/factory/types.d.ts
 type CorsOptions = Record<string, unknown> & {
@@ -870,4 +934,4 @@ interface RawBodyOptions {
   runFirst?: boolean;
 }
 //#endregion
-export { CustomPluginAuthOption as a, RawBodyOptions as c, ResourceLike as d, loadResources as f, CustomAuthenticatorOption as i, UnderPressureOptions as l, BetterAuthOption as n, JwtAuthOption as o, CreateAppOptions as r, MultipartOptions as s, AuthOption as t, LoadResourcesOptions as u };
+export { CustomPluginAuthOption as a, RawBodyOptions as c, ResourceLike as d, ResourceModule as f, CustomAuthenticatorOption as i, UnderPressureOptions as l, BetterAuthOption as n, JwtAuthOption as o, loadResources as p, CreateAppOptions as r, MultipartOptions as s, AuthOption as t, LoadResourcesOptions as u };

package/dist/utils/index.d.mts

@@ -1,2 +1,2 @@
-import { $ as ValidationResult, A as handleRaw, B as CompensationStep, C as queryParams, D as ArcQueryParser, E as wrapResponse, F as defineErrorMapper, G as CircuitBreakerOptions, H as withCompensation, I as CompensationDefinition, J as CircuitState, K as CircuitBreakerRegistry, L as CompensationError, M as Guard, N as GuardConfig, O as ArcQueryParserOptions, P as defineGuard, Q as ValidateOptions, R as CompensationHooks, S as paginationSchema, T as successResponseSchema, U as CircuitBreaker, V as defineCompensation, W as CircuitBreakerError, X as createCircuitBreakerRegistry, Y as createCircuitBreaker, Z as ConfigError, _ as getDefaultCrudSchemas, a as TransitionConfig, at as ErrorDetails, b as listResponse, c as JsonSchemaTarget, ct as OrgAccessDeniedError, d as isJsonSchema, dt as ServiceUnavailableError, et as assertValidConfig, f as isZodSchema, ft as UnauthorizedError, g as errorResponseSchema, gt as isArcError, h as deleteResponse, ht as createError, i as StateMachine, it as ConflictError, j as envelope, k as createQueryParser, l as convertOpenApiSchemas, lt as OrgRequiredError, m as JsonSchema, mt as createDomainError, n as EventsDecorator, nt as validateResourceConfig, o as createStateMachine, ot as ForbiddenError, p as toJsonSchema, pt as ValidationError, q as CircuitBreakerStats, r as hasEvents, rt as ArcError, s as simpleEqualityMatcher, st as NotFoundError, t as getUserId, tt as formatValidationErrors, u as convertRouteSchema, ut as RateLimitError, v as getListQueryParams, w as responses, x as mutationResponse, y as itemResponse, z as CompensationResult } from "../index-DsJ1MNfC.mjs";
+import { $ as ValidationResult, A as handleRaw, B as CompensationStep, C as queryParams, D as ArcQueryParser, E as wrapResponse, F as defineErrorMapper, G as CircuitBreakerOptions, H as withCompensation, I as CompensationDefinition, J as CircuitState, K as CircuitBreakerRegistry, L as CompensationError, M as Guard, N as GuardConfig, O as ArcQueryParserOptions, P as defineGuard, Q as ValidateOptions, R as CompensationHooks, S as paginationSchema, T as successResponseSchema, U as CircuitBreaker, V as defineCompensation, W as CircuitBreakerError, X as createCircuitBreakerRegistry, Y as createCircuitBreaker, Z as ConfigError, _ as getDefaultCrudSchemas, a as TransitionConfig, at as ErrorDetails, b as listResponse, c as JsonSchemaTarget, ct as OrgAccessDeniedError, d as isJsonSchema, dt as ServiceUnavailableError, et as assertValidConfig, f as isZodSchema, ft as UnauthorizedError, g as errorResponseSchema, gt as isArcError, h as deleteResponse, ht as createError, i as StateMachine, it as ConflictError, j as envelope, k as createQueryParser, l as convertOpenApiSchemas, lt as OrgRequiredError, m as JsonSchema, mt as createDomainError, n as EventsDecorator, nt as validateResourceConfig, o as createStateMachine, ot as ForbiddenError, p as toJsonSchema, pt as ValidationError, q as CircuitBreakerStats, r as hasEvents, rt as ArcError, s as simpleEqualityMatcher, st as NotFoundError, t as getUserId, tt as formatValidationErrors, u as convertRouteSchema, ut as RateLimitError, v as getListQueryParams, w as responses, x as mutationResponse, y as itemResponse, z as CompensationResult } from "../index-DdQ3O9Pg.mjs";
 export { ArcError, ArcQueryParser, ArcQueryParserOptions, CircuitBreaker, CircuitBreakerError, CircuitBreakerOptions, CircuitBreakerRegistry, CircuitBreakerStats, CircuitState, CompensationDefinition, CompensationError, CompensationHooks, CompensationResult, CompensationStep, ConfigError, ConflictError, ErrorDetails, EventsDecorator, ForbiddenError, Guard, GuardConfig, JsonSchema, JsonSchemaTarget, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, StateMachine, TransitionConfig, UnauthorizedError, ValidateOptions, ValidationError, ValidationResult, assertValidConfig, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, envelope, errorResponseSchema, formatValidationErrors, getDefaultCrudSchemas, getListQueryParams, getUserId, handleRaw, hasEvents, isArcError, isJsonSchema, isZodSchema, itemResponse, listResponse, mutationResponse, paginationSchema, queryParams, responses, simpleEqualityMatcher, successResponseSchema, toJsonSchema, validateResourceConfig, withCompensation, wrapResponse };