@classytic/arc 2.15.4 → 2.16.1

package/dist/{memory-UBydS5ku.mjs → memory-QOLe11D5.mjs}

@@ -108,6 +108,7 @@ var MemoryCacheStore = class {
 			const oldestKey = this.cache.keys().next().value;
 			if (!oldestKey) break;
 			const entry = this.cache.get(oldestKey);
+			if (!entry) break;
 			this.removeEntry(oldestKey, entry);
 			this._evictions++;
 		}
@@ -118,6 +119,7 @@ var MemoryCacheStore = class {
 			const oldestKey = this.cache.keys().next().value;
 			if (!oldestKey) break;
 			const entry = this.cache.get(oldestKey);
+			if (!entry) break;
 			this.removeEntry(oldestKey, entry);
 			this._evictions++;
 			if (this.currentBytes <= target) break;

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BswOSJCE.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DBDgy6Hw.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/middleware/index.mjs

@@ -1,4 +1,4 @@
-import { t as CRUD_OPERATIONS } from "../constants-Cxde4rpC.mjs";
+import { t as CRUD_OPERATIONS } from "../constants-TrJVIJl0.mjs";
 import { t as multipartBody } from "../multipartBody-BOvVSVCD.mjs";
 //#region src/middleware/middleware.ts
 /**

package/dist/{openapi-BHXhoX8O.mjs → openapi-BRnd3pT7.mjs}

@@ -1,7 +1,8 @@
 import { t as getUserRoles } from "./types-D57iXYb8.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-De34B1ZG.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CyUkQu6O.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-S3MLVYot.mjs";
+import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-eiOFtnC3.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**
@@ -383,9 +384,11 @@ function createOperation(resource, operation, summary, extras, requiresAuthOverr
 		if (!s.operations) return true;
 		return s.operations.includes(operation);
 	});
+	const summaryNoun = (resource.displayName || resource.name).toLowerCase();
+	const finalNoun = operation === "list" ? pluralize(summaryNoun) : summaryNoun;
 	const op = {
 		tags: [resource.tag || "Resource"],
-		summary: `${summary} ${(resource.displayName || resource.name).toLowerCase()}`,
+		summary: `${summary} ${finalNoun}`,
 		operationId: `${resource.name}_${operation}`,
 		...descParts.length > 0 && { description: descParts.join("\n\n") },
 		...requiresAuth && { security: [{ bearerAuth: [] }, ...additionalSecurity] },
@@ -509,49 +512,59 @@ function extractPathParams(path) {
 //#endregion
 //#region src/docs/openapi/action-paths.ts
 /**
-* Action endpoint emitter — `POST /:resource/:id/action`.
+* Action endpoint emitter — `POST /:resource/:id/action` and/or
+* `POST /:resource/action`.
 *
-* Generates a single dispatch endpoint per resource that lists every
-* declared action via the `action` discriminant. Body schema is built
-* via the SAME `buildActionBodySchema` runtime uses, so docs and
-* validation stay in sync (one source of truth for the action envelope
-* shape).
+* Generates a dispatch endpoint per mount point. Each mount has its own
+* `oneOf` body schema containing only the actions that live at that
+* mount — id-bound actions under `/:id/action`, id-less actions
+* (`id: false`) under `/action`. Body schemas come from the SAME
+* `buildActionBodySchema` the runtime uses, so docs and validation stay
+* in sync.
 *
 * NOTE: action **response** shape varies per action — the dispatcher
 * returns whatever the handler returned. We can't statically type the
-* response without the handler exposing its return type, and most
-* handlers return either the mutated resource document or a kit-defined
-* envelope. We declare the `200` body schema as an empty object (`{}`)
-* which `@hey-api/openapi-ts` and friends compile to `unknown` — that's
-* the most accurate thing we can say without lying to consumers about
-* shape. Per-action shape is documented in the `description` field;
-* future work could let resource authors declare a per-action
-* `responseSchema`.
+* response without the handler exposing its return type, so the `200`
+* body schema is `{}` (codegen → `unknown`). Per-action shape lives in
+* the operation `description`.
 */
 /**
-* Append the action-dispatch path (`POST /:basePath/:id/action`) when
-* the resource declares any `actions`.
+* Append action-dispatch paths to `paths` for the resource. Emits one
+* path per non-empty mount point — id-bound and/or id-less.
 */
 function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 	if (!resource.actions || resource.actions.length === 0) return;
-	const actionPath = toOpenApiPath(`${basePath}/:id/action`);
-	const actionEnum = resource.actions.map((a) => a.name);
+	const idBound = [];
+	const idLess = [];
+	for (const a of resource.actions) (a.id === false ? idLess : idBound).push(a);
+	if (idBound.length > 0) emitMount(paths, resource, basePath, additionalSecurity, idBound, true);
+	if (idLess.length > 0) emitMount(paths, resource, basePath, additionalSecurity, idLess, false);
+}
+/**
+* Emit one OpenAPI path for a single mount point's action subset.
+* Centralises the shared rendering (body schema, description list,
+* auth detection, response wiring) so id-bound and id-less mounts can't
+* drift in shape.
+*/
+function emitMount(paths, resource, basePath, additionalSecurity, subsetActions, hasId) {
+	const actionPath = toOpenApiPath(`${basePath}${hasId ? "/:id/action" : "/action"}`);
+	const actionEnum = subsetActions.map((a) => a.name);
 	const actionSchemas = {};
-	for (const a of resource.actions) if (a.schema) actionSchemas[a.name] = a.schema;
+	for (const a of subsetActions) if (a.schema) actionSchemas[a.name] = a.schema;
 	const bodySchema = buildActionBodySchema(actionEnum, actionSchemas);
 	const descLines = [
-		"Unified action endpoint for state transitions.",
+		hasId ? "Unified action endpoint for state transitions on an existing entity." : "Resource-root action endpoint (no `:id` — operates on the collection or creates new entities).",
 		"",
 		"**Available actions:**"
 	];
-	for (const a of resource.actions) {
+	for (const a of subsetActions) {
 		const roles = a.permissions?._roles;
 		const roleStr = roles?.length ? ` — requires: ${roles.join(" or ")}` : "";
 		const descStr = a.description ? ` — ${a.description}` : "";
 		descLines.push(`- \`${a.name}\`${roleStr}${descStr}`);
 	}
 	descLines.push("", "Response shape depends on the action handler — typically the mutated resource document or a kit-defined result envelope. See the per-action description above.");
-	const anyAuthRequired = resource.actions.some((a) => {
+	const anyAuthRequired = subsetActions.some((a) => {
 		const effective = resolveActionPermission({
 			action: { permissions: a.permissions },
 			resourcePermissions: resource.permissions,
@@ -561,13 +574,13 @@ function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 	});
 	if (!paths[actionPath]) paths[actionPath] = {};
 	paths[actionPath].post = createOperation(resource, "action", `Perform action (${actionEnum.join(" / ")})`, {
-		parameters: [{
+		...hasId ? { parameters: [{
 			name: "id",
 			in: "path",
 			required: true,
 			schema: { type: "string" },
 			description: "Resource ID"
-		}],
+		}] } : {},
 		description: descLines.join("\n"),
 		requestBody: {
 			required: true,
@@ -579,7 +592,7 @@ function appendActionPaths(paths, resource, basePath, additionalSecurity) {
 				content: { "application/json": { schema: {} } }
 			},
 			"400": errorResponse("Invalid action or missing required fields"),
-			"404": errorResponse("Resource not found")
+			...hasId ? { "404": errorResponse("Resource not found") } : {}
 		}
 	}, anyAuthRequired, additionalSecurity);
 }
@@ -634,13 +647,7 @@ function appendAggregationPaths(paths, resource, basePath, additionalSecurity) {
 		if (!paths[path]) paths[path] = {};
 		paths[path].get = createOperation(resource, `aggregation.${agg.name}`, agg.summary ?? `Aggregation: ${agg.name}`, {
 			description: descLines.join("\n"),
-			parameters: [{
-				name: "querystring",
-				in: "query",
-				required: false,
-				schema: querystring,
-				description: "Filter narrowing — composes with base filter + tenant scope."
-			}],
+			parameters: buildAggregationParameters(agg, querystring),
 			responses: {
 				"200": {
 					description: "Aggregation result",
@@ -688,6 +695,37 @@ function normalizeGroupByForOpenApi(groupBy) {
 	if (!groupBy) return [];
 	return typeof groupBy === "string" ? [groupBy] : groupBy;
 }
+/**
+* Build the OpenAPI `parameters` array for an aggregation route.
+*
+* Always includes the filter-narrowing `querystring` slot. When the
+* aggregation declares URL-driven paging (`defaultLimit`), adds an
+* explicit `?limit` integer parameter with the declared default +
+* maximum. Auto-generated FE clients pick the constraint up; humans
+* reading the docs see the cap without reading source.
+*/
+function buildAggregationParameters(agg, querystring) {
+	const params = [{
+		name: "querystring",
+		in: "query",
+		required: false,
+		schema: querystring,
+		description: "Filter narrowing — composes with base filter + tenant scope."
+	}];
+	if (agg.defaultLimit !== void 0) params.push({
+		name: "limit",
+		in: "query",
+		required: false,
+		schema: {
+			type: "integer",
+			minimum: 1,
+			default: agg.defaultLimit,
+			maximum: agg.maxLimit ?? 1e3
+		},
+		description: `Result row cap. Default ${agg.defaultLimit}; values above ${agg.maxLimit ?? 1e3} are capped silently. Invalid values fall back to the default.`
+	});
+	return params;
+}
 function setNestedSchemaProp(target, path, leaf) {
 	if (path.length === 1) {
 		target[path[0]] = leaf;
@@ -837,7 +875,9 @@ function appendCustomRoutePaths(paths, resource, basePath, additionalSecurity) {
 		}
 		if (routeSchema?.response) {
 			const responseSchemas = routeSchema.response;
-			for (const [statusCode, schema] of Object.entries(responseSchemas)) extras.responses[statusCode] = {
+			const responses = extras.responses ?? {};
+			extras.responses = responses;
+			for (const [statusCode, schema] of Object.entries(responseSchemas)) responses[statusCode] = {
 				description: schema.description || `Response ${statusCode}`,
 				content: { "application/json": { schema } }
 			};
@@ -921,14 +961,12 @@ function buildOpenApiSpec(resources, options = {}, externalPaths) {
 			for (const tag of ext.tags) if (!tags.find((t) => t.name === tag.name)) tags.push(tag);
 		}
 	}
-	const externalSecuritySchemes = externalPaths?.reduce((acc, ext) => ({
-		...acc,
-		...ext.securitySchemes
-	}), {}) ?? {};
-	const externalSchemas = externalPaths?.reduce((acc, ext) => ({
-		...acc,
-		...ext.schemas
-	}), {}) ?? {};
+	const externalSecuritySchemes = {};
+	const externalSchemas = {};
+	for (const ext of externalPaths ?? []) {
+		if (ext.securitySchemes) Object.assign(externalSecuritySchemes, ext.securitySchemes);
+		if (ext.schemas) Object.assign(externalSchemas, ext.schemas);
+	}
 	return {
 		openapi: "3.0.3",
 		info: {

package/dist/permissions/index.d.mts

@@ -1,3 +1,3 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-COhcH3fk.mjs";
-import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-BTqLEvhu.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-DqZLp5d6.mjs";
+import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-3L-adFJO.mjs";
 export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RequireAgentScopeOptions, RequireMandateOptions, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/permissions/index.mjs

@@ -1,3 +1,3 @@
-import { A as roles, C as allowPublic, D as requireAuth, E as not, F as applyPermissionResult, L as normalizePermissionResult, M as requireAgentScope, N as requireDPoP, O as requireOwnership, P as requireMandate, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as createRoleHierarchy, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, p as resolveEffectiveRoles, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "../permissions-ohQyv50e.mjs";
+import { A as roles, C as allowPublic, D as requireAuth, E as not, F as applyPermissionResult, L as normalizePermissionResult, M as requireAgentScope, N as requireDPoP, O as requireOwnership, P as requireMandate, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as createRoleHierarchy, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, p as resolveEffectiveRoles, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "../permissions-CTxMrreC.mjs";
 import { n as normalizeRoles, t as getUserRoles } from "../types-D57iXYb8.mjs";
 export { adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/{permissions-ohQyv50e.mjs → permissions-CTxMrreC.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { S as isService, _ as hasOrgAccess, a as getDPoPJkt, b as isMember, d as getScopeContext, f as getScopeContextMap, h as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, x as isOrgInScope, y as isElevated } from "./types-C_s5moIu.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Bi0r0vjG.mjs";
 import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { t as MemoryCacheStore } from "./memory-UBydS5ku.mjs";
+import { t as MemoryCacheStore } from "./memory-QOLe11D5.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/applyPermissionResult.ts
 /**

package/dist/{pipe-Zr0KXjQe.mjs → pipe-DiCyvyPN.mjs}

@@ -53,6 +53,7 @@ async function executePipeline(steps, ctx, handler, operation) {
 	let chain = () => handler(currentCtx);
 	for (let i = interceptors.length - 1; i >= 0; i--) {
 		const interceptor = interceptors[i];
+		if (!interceptor) continue;
 		const next = chain;
 		chain = () => interceptor.handler(currentCtx, next);
 	}

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { At as Guard, Ft as PipelineContext, It as PipelineStep, Lt as Transform, Mt as NextFunction, Nt as OperationFilter, Pt as PipelineConfig, _t as IControllerResponse, jt as Interceptor } from "../index-BswOSJCE.mjs";
+import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-DBDgy6Hw.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/pipeline/index.mjs

@@ -1,4 +1,4 @@
-import { n as pipe, t as executePipeline } from "../pipe-Zr0KXjQe.mjs";
+import { n as pipe, t as executePipeline } from "../pipe-DiCyvyPN.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,66 +1,12 @@
-import { On as HookSystem, Q as MiddlewareConfig, Wt as AnyRecord, ft as RouteSchemaOptions, lt as RouteDefinition, tt as PresetHook, z as ResourceRegistry } from "../index-BswOSJCE.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BD5nw6St.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-hmkPcDlX.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DFr45ZG4.mjs";
-import { t as TracingOptions } from "../tracing-QJVprktp.mjs";
+import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-DBDgy6Hw.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-CJm0vh-l.mjs";
+import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-5H4930tj.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DuqTqeqn.mjs";
+import { t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 
-//#region src/core/arcCorePlugin.d.ts
-interface ArcCorePluginOptions {
-  /** Enable event emission for CRUD operations (requires eventPlugin) */
-  emitEvents?: boolean;
-  /** Hook system instance (for testing/custom setup) */
-  hookSystem?: HookSystem;
-  /** Resource registry instance (for testing/custom setup) */
-  registry?: ResourceRegistry;
-}
-interface PluginMeta {
-  name: string;
-  version?: string;
-  options?: Record<string, unknown>;
-  registeredAt: string;
-}
-interface ArcCore {
-  /** Instance-scoped hook system */
-  hooks: HookSystem;
-  /** Instance-scoped resource registry */
-  registry: ResourceRegistry;
-  /** Whether event emission is enabled */
-  emitEvents: boolean;
-  /** External OpenAPI paths contributed by auth adapters or third-party integrations */
-  externalOpenApiPaths: ExternalOpenApiPaths[];
-  /** Registered plugins for introspection */
-  plugins: Map<string, PluginMeta>;
-}
-declare module "fastify" {
-  interface FastifyInstance {
-    /**
-     * Arc core decorator. Optional because:
-     *
-     * 1. Consumers who import any `@classytic/arc/*` subpath get this module
-     *    augmentation merged into every `FastifyInstance` they see — even
-     *    instances on apps that never register {@link arcCorePlugin}. Making
-     *    it required would force those apps to assert or guard every
-     *    property access.
-     * 2. Hosts that extend `FastifyInstance` to narrow `arc` to their own
-     *    type (`interface X extends FastifyInstance { arc?: MyArc }`) were
-     *    previously blocked because non-optional `arc: ArcCore` conflicts
-     *    with the re-declaration. An optional field lets hosts re-declare
-     *    with a compatible subtype without fighting TS.
-     *
-     * Inside Arc's own code, any call site that runs *after* `arcCorePlugin`
-     * has registered treats this as non-null — see the call sites in
-     * `factory/registerAuth.ts` and `factory/createApp.ts` which assert
-     * with `fastify.arc!` or narrow explicitly.
-     */
-    arc?: ArcCore;
-  }
-}
-declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
-declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
-//#endregion
 //#region src/plugins/createPlugin.d.ts
 interface PluginResourceResult {
   /** Additional routes to add to the resource (v2.8 `RouteDefinition` shape) */

package/dist/plugins/index.mjs

@@ -1,15 +1,15 @@
-import { p as MUTATION_OPERATIONS } from "../constants-Cxde4rpC.mjs";
-import { c as getOrgId } from "../types-C_s5moIu.mjs";
+import { p as MUTATION_OPERATIONS } from "../constants-TrJVIJl0.mjs";
+import { c as getOrgId } from "../types-Bi0r0vjG.mjs";
 import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
 import { t as hasEvents } from "../typeGuards-BzkXkvVv.mjs";
-import { t as HookSystem } from "../HookSystem-Iiebom92.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CTERg_2x.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-SM8gghN6.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bk-AGhkU.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-Qnvwc-LQ.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-CK-FNO8E.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-Bz-5ZeTt.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-BUrT5aP4.mjs";
+import { t as HookSystem } from "../HookSystem-Cmf7-Etp.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-CzSzVK1m.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-8MfrrUYU.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DNPzqaTT.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-B-PU4-Yu.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-boS5Rx26.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-jh5OqFjR.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CuIwUQZ2.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.mjs

@@ -48,7 +48,7 @@ var LRUCache = class {
 		let count = 0;
 		for (const key of this.cache.keys()) {
 			const colonIdx = key.indexOf(":");
-			if ((colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0].startsWith(prefix)) {
+			if (((colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0] ?? "").startsWith(prefix)) {
 				this.cache.delete(key);
 				count++;
 			}
@@ -60,7 +60,7 @@ var LRUCache = class {
 	isPrefixLocked(key) {
 		if (this.invalidatedPrefixes.size === 0) return false;
 		const colonIdx = key.indexOf(":");
-		const pathOnly = (colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0];
+		const pathOnly = (colonIdx >= 0 ? key.slice(colonIdx + 1) : key).split("?")[0] ?? "";
 		const now = Date.now();
 		for (const [prefix, expiresAt] of this.invalidatedPrefixes.entries()) if (now > expiresAt) this.invalidatedPrefixes.delete(prefix);
 		else if (pathOnly.startsWith(prefix)) return true;
@@ -96,7 +96,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 	const invalidateMethods = new Set(invalidateOn.map((m) => m.toUpperCase()));
 	/** Find TTL for a given URL path (seconds) */
 	function getTTL(url) {
-		const path = url.split("?")[0];
+		const path = url.split("?")[0] ?? url;
 		for (const rule of rules) if (path.startsWith(rule.match)) return rule.ttl;
 		return defaultTTL;
 	}
@@ -123,7 +123,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 		if (!invalidateMethods.has(request.method.toUpperCase())) return;
 		const statusCode = reply.statusCode;
 		if (statusCode < 200 || statusCode >= 300) return;
-		const path = request.url.split("?")[0];
+		const path = request.url.split("?")[0] ?? request.url;
 		const segments = path.split("/").filter(Boolean);
 		const lastSegment = segments[segments.length - 1];
 		if (segments.length >= 2 && lastSegment != null && /^[0-9a-f]{8,}$|^\d+$/.test(lastSegment)) {
@@ -189,7 +189,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 			const parts = event.type.split(".");
 			if (parts.length !== 2) return;
 			const [resource, action] = parts;
-			if (!resource || ![
+			if (!resource || !action || ![
 				"created",
 				"updated",
 				"deleted"

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-QJVprktp.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.15.4";
+	const resolvedVersion = serviceVersion ?? "2.16.1";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-DQgqgifU.mjs → pluralize-B9M8xvy-.mjs}

@@ -58,7 +58,8 @@ function pluralize(word) {
 	if (UNCOUNTABLES.has(lower)) return word;
 	if (IRREGULARS[lower]) {
 		const plural = IRREGULARS[lower];
-		return word[0] === word[0]?.toUpperCase() ? plural.charAt(0).toUpperCase() + plural.slice(1) : plural;
+		const firstChar = word.charAt(0);
+		return firstChar === firstChar.toUpperCase() ? plural.charAt(0).toUpperCase() + plural.slice(1) : plural;
 	}
 	if (lower.endsWith("fe")) return `${word.slice(0, -2)}ves`;
 	if (lower.endsWith("f") && !lower.endsWith("ff") && !lower.endsWith("roof") && !lower.endsWith("chief") && !lower.endsWith("belief")) return `${word.slice(0, -1)}ves`;

package/dist/preloadResources-BOXzPhKU.mjs

@@ -0,0 +1,45 @@
+//#region src/testing/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { preloadResourcesAsync as n, preloadResources as t };

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
-import { nt as PresetResult } from "../index-BswOSJCE.mjs";
-import { i as RequestScope } from "../types-CTYvcwHe.mjs";
-import { c as PermissionCheck } from "../fields-COhcH3fk.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Dfzt4VTl.mjs";
+import { rt as PresetResult } from "../index-DBDgy6Hw.mjs";
+import { i as RequestScope } from "../types-CfapW2t8.mjs";
+import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-HcAgP5Ni.mjs";
 
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,6 +1,6 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-j4aJm1Wg.mjs";
-import { c as getOrgId, h as getUserId } from "../types-C_s5moIu.mjs";
-import { C as allowPublic, D as requireAuth } from "../permissions-ohQyv50e.mjs";
+import { c as getOrgId, g as getUserId } from "../types-Bi0r0vjG.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
 import { t as multipartBody } from "../multipartBody-BOvVSVCD.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Wt as AnyRecord, _t as IControllerResponse, at as ResourceConfig, d as PaginationResult, nt as PresetResult, vt as IRequestContext } from "../index-BswOSJCE.mjs";
+import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-DBDgy6Hw.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BbkjdPeH.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C9BE6WaZ.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, nt as PresetResult } from "../index-BswOSJCE.mjs";
+import { J as CrudRouteKey, rt as PresetResult } from "../index-DBDgy6Hw.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,5 @@
-import "../constants-Cxde4rpC.mjs";
-import { _ as hasOrgAccess, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, y as isElevated } from "../types-C_s5moIu.mjs";
+import "../constants-TrJVIJl0.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-Bi0r0vjG.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.
@@ -186,7 +186,8 @@ function multiTenantPreset(options = {}) {
 			create: [tenantInjection],
 			update: [getFilter("update"), tenantInjection],
 			delete: [getFilter("delete")],
-			aggregations: [strictTenantFilter]
+			aggregations: [strictTenantFilter],
+			tenantScope: [strictTenantFilter, tenantInjection]
 		}
 	};
 }

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { lt as RouteDefinition, nt as PresetResult, pt as ControllerHandler, ut as RouteMcpConfig } from "../index-BswOSJCE.mjs";
-import { c as PermissionCheck } from "../fields-COhcH3fk.mjs";
+import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-DBDgy6Hw.mjs";
+import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
 
 //#region src/presets/search.d.ts
 /**

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as allowPublic, D as requireAuth } from "../permissions-ohQyv50e.mjs";
+import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-BbkjdPeH.mjs → presets-C9BE6WaZ.mjs}

@@ -1,5 +1,5 @@
-import { n as PUBLIC_SCOPE, y as isElevated } from "./types-C_s5moIu.mjs";
-import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-ohQyv50e.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
+import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-CTxMrreC.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{queryCachePlugin-m1XsgAIJ.mjs → queryCachePlugin-B4XMSSe7.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { t as MemoryCacheStore } from "./memory-UBydS5ku.mjs";
+import { t as MemoryCacheStore } from "./memory-QOLe11D5.mjs";
 import { t as hasEvents } from "./typeGuards-BzkXkvVv.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-CGcCbNyu.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-DopsCuyQ.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {