@classytic/arc 2.15.4 → 2.16.0

package/dist/{memory-UBydS5ku.mjs → memory-QOLe11D5.mjs}

@@ -108,6 +108,7 @@ var MemoryCacheStore = class {
 			const oldestKey = this.cache.keys().next().value;
 			if (!oldestKey) break;
 			const entry = this.cache.get(oldestKey);
+			if (!entry) break;
 			this.removeEntry(oldestKey, entry);
 			this._evictions++;
 		}
@@ -118,6 +119,7 @@ var MemoryCacheStore = class {
 			const oldestKey = this.cache.keys().next().value;
 			if (!oldestKey) break;
 			const entry = this.cache.get(oldestKey);
+			if (!entry) break;
 			this.removeEntry(oldestKey, entry);
 			this._evictions++;
 			if (this.currentBytes <= target) break;

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BswOSJCE.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CkW0flkU.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/middleware/index.mjs

@@ -1,4 +1,4 @@
-import { t as CRUD_OPERATIONS } from "../constants-Cxde4rpC.mjs";
+import { t as CRUD_OPERATIONS } from "../constants-TrJVIJl0.mjs";
 import { t as multipartBody } from "../multipartBody-BOvVSVCD.mjs";
 //#region src/middleware/middleware.ts
 /**

package/dist/{openapi-BHXhoX8O.mjs → openapi-34T9yNwd.mjs}

@@ -1,7 +1,8 @@
 import { t as getUserRoles } from "./types-D57iXYb8.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-De34B1ZG.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CyUkQu6O.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-S3MLVYot.mjs";
+import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-DUpN3Dd1.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**
@@ -383,9 +384,11 @@ function createOperation(resource, operation, summary, extras, requiresAuthOverr
 		if (!s.operations) return true;
 		return s.operations.includes(operation);
 	});
+	const summaryNoun = (resource.displayName || resource.name).toLowerCase();
+	const finalNoun = operation === "list" ? pluralize(summaryNoun) : summaryNoun;
 	const op = {
 		tags: [resource.tag || "Resource"],
-		summary: `${summary} ${(resource.displayName || resource.name).toLowerCase()}`,
+		summary: `${summary} ${finalNoun}`,
 		operationId: `${resource.name}_${operation}`,
 		...descParts.length > 0 && { description: descParts.join("\n\n") },
 		...requiresAuth && { security: [{ bearerAuth: [] }, ...additionalSecurity] },
@@ -509,49 +512,59 @@ function extractPathParams(path) {
 //#endregion
 //#region src/docs/openapi/action-paths.ts
 /**
-* Action endpoint emitter — `POST /:resource/:id/action`.
+* Action endpoint emitter — `POST /:resource/:id/action` and/or
+* `POST /:resource/action`.
 *
-* Generates a single dispatch endpoint per resource that lists every
-* declared action via the `action` discriminant. Body schema is built
-* via the SAME `buildActionBodySchema` runtime uses, so docs and
-* validation stay in sync (one source of truth for the action envelope
-* shape).
+* Generates a dispatch endpoint per mount point. Each mount has its own
+* `oneOf` body schema containing only the actions that live at that
+* mount — id-bound actions under `/:id/action`, id-less actions
+* (`id: false`) under `/action`. Body schemas come from the SAME
+* `buildActionBodySchema` the runtime uses, so docs and validation stay
+* in sync.
 *
 * NOTE: action **response** shape varies per action — the dispatcher
 * returns whatever the handler returned. We can't statically type the
-* response without the handler exposing its return type, and most
-* handlers return either the mutated resource document or a kit-defined
-* envelope. We declare the `200` body schema as an empty object (`{}`)
-* which `@hey-api/openapi-ts` and friends compile to `unknown` — that's
-* the most accurate thing we can say without lying to consumers about
-* shape. Per-action shape is documented in the `description` field;
-* future work could let resource authors declare a per-action
-* `responseSchema`.
+* response without the handler exposing its return type, so the `200`
+* body schema is `{}` (codegen → `unknown`). Per-action shape lives in
+* the operation `description`.
 */
 /**
-* Append the action-dispatch path (`POST /:basePath/:id/action`) when
-* the resource declares any `actions`.
+* Append action-dispatch paths to `paths` for the resource. Emits one
+* path per non-empty mount point — id-bound and/or id-less.
 */
 function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 	if (!resource.actions || resource.actions.length === 0) return;
-	const actionPath = toOpenApiPath(`${basePath}/:id/action`);
-	const actionEnum = resource.actions.map((a) => a.name);
+	const idBound = [];
+	const idLess = [];
+	for (const a of resource.actions) (a.id === false ? idLess : idBound).push(a);
+	if (idBound.length > 0) emitMount(paths, resource, basePath, additionalSecurity, idBound, true);
+	if (idLess.length > 0) emitMount(paths, resource, basePath, additionalSecurity, idLess, false);
+}
+/**
+* Emit one OpenAPI path for a single mount point's action subset.
+* Centralises the shared rendering (body schema, description list,
+* auth detection, response wiring) so id-bound and id-less mounts can't
+* drift in shape.
+*/
+function emitMount(paths, resource, basePath, additionalSecurity, subsetActions, hasId) {
+	const actionPath = toOpenApiPath(`${basePath}${hasId ? "/:id/action" : "/action"}`);
+	const actionEnum = subsetActions.map((a) => a.name);
 	const actionSchemas = {};
-	for (const a of resource.actions) if (a.schema) actionSchemas[a.name] = a.schema;
+	for (const a of subsetActions) if (a.schema) actionSchemas[a.name] = a.schema;
 	const bodySchema = buildActionBodySchema(actionEnum, actionSchemas);
 	const descLines = [
-		"Unified action endpoint for state transitions.",
+		hasId ? "Unified action endpoint for state transitions on an existing entity." : "Resource-root action endpoint (no `:id` — operates on the collection or creates new entities).",
 		"",
 		"**Available actions:**"
 	];
-	for (const a of resource.actions) {
+	for (const a of subsetActions) {
 		const roles = a.permissions?._roles;
 		const roleStr = roles?.length ? ` — requires: ${roles.join(" or ")}` : "";
 		const descStr = a.description ? ` — ${a.description}` : "";
 		descLines.push(`- \`${a.name}\`${roleStr}${descStr}`);
 	}
 	descLines.push("", "Response shape depends on the action handler — typically the mutated resource document or a kit-defined result envelope. See the per-action description above.");
-	const anyAuthRequired = resource.actions.some((a) => {
+	const anyAuthRequired = subsetActions.some((a) => {
 		const effective = resolveActionPermission({
 			action: { permissions: a.permissions },
 			resourcePermissions: resource.permissions,
@@ -561,13 +574,13 @@ function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 	});
 	if (!paths[actionPath]) paths[actionPath] = {};
 	paths[actionPath].post = createOperation(resource, "action", `Perform action (${actionEnum.join(" / ")})`, {
-		parameters: [{
+		...hasId ? { parameters: [{
 			name: "id",
 			in: "path",
 			required: true,
 			schema: { type: "string" },
 			description: "Resource ID"
-		}],
+		}] } : {},
 		description: descLines.join("\n"),
 		requestBody: {
 			required: true,
@@ -579,7 +592,7 @@ function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 				content: { "application/json": { schema: {} } }
 			},
 			"400": errorResponse("Invalid action or missing required fields"),
-			"404": errorResponse("Resource not found")
+			...hasId ? { "404": errorResponse("Resource not found") } : {}
 		}
 	}, anyAuthRequired, additionalSecurity);
 }
@@ -921,14 +934,12 @@ function buildOpenApiSpec(resources, options = {}, externalPaths) {
 			for (const tag of ext.tags) if (!tags.find((t) => t.name === tag.name)) tags.push(tag);
 		}
 	}
-	const externalSecuritySchemes = externalPaths?.reduce((acc, ext) => ({
-		...acc,
-		...ext.securitySchemes
-	}), {}) ?? {};
-	const externalSchemas = externalPaths?.reduce((acc, ext) => ({
-		...acc,
-		...ext.schemas
-	}), {}) ?? {};
+	const externalSecuritySchemes = {};
+	const externalSchemas = {};
+	for (const ext of externalPaths ?? []) {
+		if (ext.securitySchemes) Object.assign(externalSecuritySchemes, ext.securitySchemes);
+		if (ext.schemas) Object.assign(externalSchemas, ext.schemas);
+	}
 	return {
 		openapi: "3.0.3",
 		info: {

package/dist/permissions/index.d.mts

@@ -1,3 +1,3 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-COhcH3fk.mjs";
-import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-BTqLEvhu.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-Anj0xdih.mjs";
+import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-3oIimXQn.mjs";
 export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RequireAgentScopeOptions, RequireMandateOptions, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/permissions/index.mjs

@@ -1,3 +1,3 @@
-import { A as roles, C as allowPublic, D as requireAuth, E as not, F as applyPermissionResult, L as normalizePermissionResult, M as requireAgentScope, N as requireDPoP, O as requireOwnership, P as requireMandate, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as createRoleHierarchy, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, p as resolveEffectiveRoles, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "../permissions-ohQyv50e.mjs";
+import { A as roles, C as allowPublic, D as requireAuth, E as not, F as applyPermissionResult, L as normalizePermissionResult, M as requireAgentScope, N as requireDPoP, O as requireOwnership, P as requireMandate, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as createRoleHierarchy, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, p as resolveEffectiveRoles, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "../permissions-CTxMrreC.mjs";
 import { n as normalizeRoles, t as getUserRoles } from "../types-D57iXYb8.mjs";
 export { adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/{permissions-ohQyv50e.mjs → permissions-CTxMrreC.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { S as isService, _ as hasOrgAccess, a as getDPoPJkt, b as isMember, d as getScopeContext, f as getScopeContextMap, h as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, x as isOrgInScope, y as isElevated } from "./types-C_s5moIu.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Bi0r0vjG.mjs";
 import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { t as MemoryCacheStore } from "./memory-UBydS5ku.mjs";
+import { t as MemoryCacheStore } from "./memory-QOLe11D5.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/applyPermissionResult.ts
 /**

package/dist/{pipe-Zr0KXjQe.mjs → pipe-DiCyvyPN.mjs}

@@ -53,6 +53,7 @@ async function executePipeline(steps, ctx, handler, operation) {
 	let chain = () => handler(currentCtx);
 	for (let i = interceptors.length - 1; i >= 0; i--) {
 		const interceptor = interceptors[i];
+		if (!interceptor) continue;
 		const next = chain;
 		chain = () => interceptor.handler(currentCtx, next);
 	}

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { At as Guard, Ft as PipelineContext, It as PipelineStep, Lt as Transform, Mt as NextFunction, Nt as OperationFilter, Pt as PipelineConfig, _t as IControllerResponse, jt as Interceptor } from "../index-BswOSJCE.mjs";
+import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-CkW0flkU.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/pipeline/index.mjs

@@ -1,4 +1,4 @@
-import { n as pipe, t as executePipeline } from "../pipe-Zr0KXjQe.mjs";
+import { n as pipe, t as executePipeline } from "../pipe-DiCyvyPN.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,8 +1,8 @@
-import { On as HookSystem, Q as MiddlewareConfig, Wt as AnyRecord, ft as RouteSchemaOptions, lt as RouteDefinition, tt as PresetHook, z as ResourceRegistry } from "../index-BswOSJCE.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BD5nw6St.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-hmkPcDlX.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DFr45ZG4.mjs";
-import { t as TracingOptions } from "../tracing-QJVprktp.mjs";
+import { An as HookSystem, Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook, z as ResourceRegistry } from "../index-CkW0flkU.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-DFg-2KTp.mjs";
+import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-ZwX9tmbS.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-mHuyWzZE.mjs";
+import { t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";

package/dist/plugins/index.mjs

@@ -1,15 +1,15 @@
-import { p as MUTATION_OPERATIONS } from "../constants-Cxde4rpC.mjs";
-import { c as getOrgId } from "../types-C_s5moIu.mjs";
+import { p as MUTATION_OPERATIONS } from "../constants-TrJVIJl0.mjs";
+import { c as getOrgId } from "../types-Bi0r0vjG.mjs";
 import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
 import { t as hasEvents } from "../typeGuards-BzkXkvVv.mjs";
-import { t as HookSystem } from "../HookSystem-Iiebom92.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CTERg_2x.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-SM8gghN6.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bk-AGhkU.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-Qnvwc-LQ.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-CK-FNO8E.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-Bz-5ZeTt.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-BUrT5aP4.mjs";
+import { t as HookSystem } from "../HookSystem-Cmf7-Etp.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-f48hFk3m.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-TeHE8G-v.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DpoXQHZ9.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-TuOmguhi.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-C-gD32oF.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-BY6sTy4P.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-B6mimogM.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.mjs

@@ -48,7 +48,7 @@ var LRUCache = class {
 		let count = 0;
 		for (const key of this.cache.keys()) {
 			const colonIdx = key.indexOf(":");
-			if ((colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0].startsWith(prefix)) {
+			if (((colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0] ?? "").startsWith(prefix)) {
 				this.cache.delete(key);
 				count++;
 			}
@@ -60,7 +60,7 @@ var LRUCache = class {
 	isPrefixLocked(key) {
 		if (this.invalidatedPrefixes.size === 0) return false;
 		const colonIdx = key.indexOf(":");
-		const pathOnly = (colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0];
+		const pathOnly = (colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0] ?? "";
 		const now = Date.now();
 		for (const [prefix, expiresAt] of this.invalidatedPrefixes.entries()) if (now > expiresAt) this.invalidatedPrefixes.delete(prefix);
 		else if (pathOnly.startsWith(prefix)) return true;
@@ -96,7 +96,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 	const invalidateMethods = new Set(invalidateOn.map((m) => m.toUpperCase()));
 	/** Find TTL for a given URL path (seconds) */
 	function getTTL(url) {
-		const path = url.split("?")[0];
+		const path = url.split("?")[0] ?? url;
 		for (const rule of rules) if (path.startsWith(rule.match)) return rule.ttl;
 		return defaultTTL;
 	}
@@ -123,7 +123,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 		if (!invalidateMethods.has(request.method.toUpperCase())) return;
 		const statusCode = reply.statusCode;
 		if (statusCode < 200 || statusCode >= 300) return;
-		const path = request.url.split("?")[0];
+		const path = request.url.split("?")[0] ?? request.url;
 		const segments = path.split("/").filter(Boolean);
 		const lastSegment = segments[segments.length - 1];
 		if (segments.length >= 2 && lastSegment != null && /^[0-9a-f]{8,}$|^\d+$/.test(lastSegment)) {
@@ -189,7 +189,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 			const parts = event.type.split(".");
 			if (parts.length !== 2) return;
 			const [resource, action] = parts;
-			if (!resource || ![
+			if (!resource || !action || ![
 				"created",
 				"updated",
 				"deleted"

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-QJVprktp.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.15.4";
+	const resolvedVersion = serviceVersion ?? "2.16.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-DQgqgifU.mjs → pluralize-B9M8xvy-.mjs}

@@ -58,7 +58,8 @@ function pluralize(word) {
 	if (UNCOUNTABLES.has(lower)) return word;
 	if (IRREGULARS[lower]) {
 		const plural = IRREGULARS[lower];
-		return word[0] === word[0]?.toUpperCase() ? plural.charAt(0).toUpperCase() + plural.slice(1) : plural;
+		const firstChar = word.charAt(0);
+		return firstChar === firstChar.toUpperCase() ? plural.charAt(0).toUpperCase() + plural.slice(1) : plural;
 	}
 	if (lower.endsWith("fe")) return `${word.slice(0, -2)}ves`;
 	if (lower.endsWith("f") && !lower.endsWith("ff") && !lower.endsWith("roof") && !lower.endsWith("chief") && !lower.endsWith("belief")) return `${word.slice(0, -1)}ves`;

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
-import { nt as PresetResult } from "../index-BswOSJCE.mjs";
-import { i as RequestScope } from "../types-CTYvcwHe.mjs";
-import { c as PermissionCheck } from "../fields-COhcH3fk.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Dfzt4VTl.mjs";
+import { rt as PresetResult } from "../index-CkW0flkU.mjs";
+import { i as RequestScope } from "../types-DVfpSfx2.mjs";
+import { c as PermissionCheck } from "../fields-Anj0xdih.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-D2KZJAmn.mjs";
 
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,6 +1,6 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-j4aJm1Wg.mjs";
-import { c as getOrgId, h as getUserId } from "../types-C_s5moIu.mjs";
-import { C as allowPublic, D as requireAuth } from "../permissions-ohQyv50e.mjs";
+import { c as getOrgId, g as getUserId } from "../types-Bi0r0vjG.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
 import { t as multipartBody } from "../multipartBody-BOvVSVCD.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Wt as AnyRecord, _t as IControllerResponse, at as ResourceConfig, d as PaginationResult, nt as PresetResult, vt as IRequestContext } from "../index-BswOSJCE.mjs";
+import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-CkW0flkU.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BbkjdPeH.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C9BE6WaZ.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, nt as PresetResult } from "../index-BswOSJCE.mjs";
+import { J as CrudRouteKey, rt as PresetResult } from "../index-CkW0flkU.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,5 @@
-import "../constants-Cxde4rpC.mjs";
-import { _ as hasOrgAccess, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, y as isElevated } from "../types-C_s5moIu.mjs";
+import "../constants-TrJVIJl0.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-Bi0r0vjG.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.
@@ -186,7 +186,8 @@ function multiTenantPreset(options = {}) {
 			create: [tenantInjection],
 			update: [getFilter("update"), tenantInjection],
 			delete: [getFilter("delete")],
-			aggregations: [strictTenantFilter]
+			aggregations: [strictTenantFilter],
+			tenantScope: [strictTenantFilter, tenantInjection]
 		}
 	};
 }

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { lt as RouteDefinition, nt as PresetResult, pt as ControllerHandler, ut as RouteMcpConfig } from "../index-BswOSJCE.mjs";
-import { c as PermissionCheck } from "../fields-COhcH3fk.mjs";
+import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-CkW0flkU.mjs";
+import { c as PermissionCheck } from "../fields-Anj0xdih.mjs";
 
 //#region src/presets/search.d.ts
 /**

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as allowPublic, D as requireAuth } from "../permissions-ohQyv50e.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-BbkjdPeH.mjs → presets-C9BE6WaZ.mjs}

@@ -1,5 +1,5 @@
-import { n as PUBLIC_SCOPE, y as isElevated } from "./types-C_s5moIu.mjs";
-import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-ohQyv50e.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
+import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-CTxMrreC.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{queryCachePlugin-m1XsgAIJ.mjs → queryCachePlugin-B4XMSSe7.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { t as MemoryCacheStore } from "./memory-UBydS5ku.mjs";
+import { t as MemoryCacheStore } from "./memory-QOLe11D5.mjs";
 import { t as hasEvents } from "./typeGuards-BzkXkvVv.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-CGcCbNyu.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-DopsCuyQ.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{queryCachePlugin-CqMdLI2-.d.mts → queryCachePlugin-Biqzfbi5.d.mts}

@@ -1,5 +1,5 @@
-import { r as CacheStore } from "./interface-beEtJyWM.mjs";
-import { i as QueryCache } from "./QueryCache-D41bfdBB.mjs";
+import { r as CacheStore } from "./interface-CH0OQudo.mjs";
+import { i as QueryCache } from "./QueryCache-SvmT_9ti.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/cache/queryCachePlugin.d.ts

package/dist/{redis-DiMkdHEl.d.mts → redis-Cyzrz6SX.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DfLGcus7.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-NwJ_qPlY.mjs";
 
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {

package/dist/{redis-stream-D6HzR1Z_.d.mts → redis-stream-DT-YjzrB.d.mts}

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-CT_52aWU.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-C-2oAHtw.mjs";
 
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {