@classytic/arc 2.15.4 → 2.16.1

package/dist/{buildHandler-CcFOpJLh.mjs → validate-DFIP2VrM.mjs}

@@ -1,9 +1,23 @@
+import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 //#region src/core/aggregation/validate.ts
+var validate_exports = /* @__PURE__ */ __exportAll({
+	ArcAggregationConfigError: () => ArcAggregationConfigError,
+	adapterSupportsAggregate: () => adapterSupportsAggregate,
+	compileAggRequest: () => compileAggRequest,
+	validateAggregations: () => validateAggregations
+});
 /** Thrown on aggregation misconfig at boot time. */
 var ArcAggregationConfigError = class extends Error {
 	name = "ArcAggregationConfigError";
 };
 /**
+* Framework cap on URL-driven aggregation limits when the host opts
+* in to `defaultLimit` without explicit `maxLimit`. Set to the same
+* order of magnitude as a "large dashboard page" — bigger than every
+* realistic grouped tile, smaller than "we returned the whole table."
+*/
+const AGG_FRAMEWORK_MAX_LIMIT = 1e3;
+/**
 * Validate + normalize all aggregations on a resource. Throws on first
 * misconfig with the offending aggregation name in the message — hosts
 * see exactly which entry needs fixing.
@@ -46,6 +60,8 @@ function validateAggregations(resourceName, aggregations, schemaOptions) {
 			bucketAliases
 		});
 		if (config.topN) validateTopNConfig(resourceName, name, config.topN, groupBy, measures, bucketAliases);
+		validateLimitConfig(resourceName, name, config);
+		const limitPolicy = resolveLimitPolicy(config);
 		out.push({
 			name,
 			base: config,
@@ -58,13 +74,47 @@ function validateAggregations(resourceName, aggregations, schemaOptions) {
 				having: config.having,
 				sort: config.sort,
 				limit: config.limit,
-				topN: config.topN
+				topN: config.topN,
+				...limitPolicy ? { limitPolicy } : {}
 			}
 		});
 	}
 	return out;
 }
 /**
+* Validate `limit` / `defaultLimit` / `maxLimit` triad. Throws on
+* misconfig at boot — boundary value, hosts see exactly what to fix.
+*/
+function validateLimitConfig(resourceName, aggName, config) {
+	const hasStatic = config.limit !== void 0;
+	const hasDynamic = config.defaultLimit !== void 0;
+	if (hasStatic && hasDynamic) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" sets both \`limit\` (static cap) and \`defaultLimit\` (URL-driven cap). Pick one — static \`limit\` ignores the URL; \`defaultLimit\` reads \`?limit=N\` and caps it at \`maxLimit\`.`);
+	if (config.maxLimit !== void 0 && !hasDynamic) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" sets \`maxLimit\` without \`defaultLimit\`. \`maxLimit\` only applies to URL-driven limits — set \`defaultLimit\` or remove \`maxLimit\`.`);
+	if (hasStatic) {
+		if (!Number.isInteger(config.limit) || config.limit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`limit\` must be a positive integer — got ${String(config.limit)}.`);
+	}
+	if (hasDynamic) {
+		if (!Number.isInteger(config.defaultLimit) || config.defaultLimit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`defaultLimit\` must be a positive integer — got ${String(config.defaultLimit)}.`);
+		if (config.maxLimit !== void 0) {
+			if (!Number.isInteger(config.maxLimit) || config.maxLimit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`maxLimit\` must be a positive integer — got ${String(config.maxLimit)}.`);
+			if (config.maxLimit < config.defaultLimit) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`maxLimit\` (${config.maxLimit}) is less than \`defaultLimit\` (${config.defaultLimit}). The ceiling must be ≥ the default.`);
+		}
+	}
+}
+/**
+* Resolve the URL-driven limit policy into a concrete `{ default, max }`
+* pair. Returns `undefined` when the host uses the static `limit` form
+* (or no limit at all) — the request handler reads the absence to know
+* "do not parse `?limit=N` from the URL."
+*/
+function resolveLimitPolicy(config) {
+	if (config.defaultLimit === void 0) return void 0;
+	return {
+		defaultLimit: config.defaultLimit,
+		maxLimit: config.maxLimit ?? AGG_FRAMEWORK_MAX_LIMIT
+	};
+}
+/**
 * Adapter feature-detect for `aggregate()`. Called at boot when the
 * repository instance is available. Returns `true` when the kit ships
 * `aggregate`; `false` when missing.
@@ -76,14 +126,33 @@ function adapterSupportsAggregate(repo) {
 	if (!repo || typeof repo !== "object") return false;
 	return typeof repo.aggregate === "function";
 }
+/**
+* Resolve the effective per-request `limit` — three cases:
+*
+*   1. Host declared static `limit` → URL `?limit` ignored, static wins.
+*   2. Host declared `defaultLimit` → parse `?limit=N`, cap at
+*      `maxLimit`, fall back to default on absent / invalid input.
+*   3. Host declared neither → returns `undefined` (no limit applied,
+*      preserves pre-2.16.1 behavior).
+*/
+function resolveAggRequestLimit(normalized, query) {
+	const policy = normalized.compiled.limitPolicy;
+	if (!policy) return normalized.compiled.limit;
+	const raw = query["limit"];
+	if (raw === void 0 || raw === "") return policy.defaultLimit;
+	const parsed = typeof raw === "number" ? raw : Number.parseInt(String(raw), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return policy.defaultLimit;
+	return Math.min(Math.floor(parsed), policy.maxLimit);
+}
 /** Compile to canonical `AggRequest` for `repo.aggregate()` at request time. */
-function compileAggRequest(normalized, callerFilter, tenantOptions) {
+function compileAggRequest(normalized, callerFilter, tenantOptions, query) {
 	const filter = {
 		...normalized.compiled.filter ?? {},
 		...callerFilter
 	};
 	const executionHints = buildExecutionHints(normalized.base);
 	const cache = buildCacheOptions(normalized.base);
+	const limit = query ? resolveAggRequestLimit(normalized, query) : normalized.compiled.limit;
 	return {
 		measures: normalized.compiled.measures,
 		...Object.keys(filter).length > 0 ? { filter } : {},
@@ -92,7 +161,7 @@ function compileAggRequest(normalized, callerFilter, tenantOptions) {
 		...normalized.compiled.dateBuckets ? { dateBuckets: normalized.compiled.dateBuckets } : {},
 		...normalized.compiled.having ? { having: normalized.compiled.having } : {},
 		...normalized.compiled.sort ? { sort: normalized.compiled.sort } : {},
-		...normalized.compiled.limit !== void 0 ? { limit: normalized.compiled.limit } : {},
+		...limit !== void 0 ? { limit } : {},
 		...normalized.compiled.topN ? { topN: normalized.compiled.topN } : {},
 		...executionHints ? { executionHints } : {},
 		...cache ? { cache } : {}
@@ -373,302 +442,4 @@ function assertFieldAllowed(context, ref, input) {
 	if (blockedFields.has(ref)) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggregationName}" references field "${ref}" in ${context}, but the field is blocked from aggregation (\`hidden: true\` or \`aggregable: false\` in schemaOptions.fieldRules). Aggregating hidden fields would leak cardinality information.`);
 }
 //#endregion
-//#region src/core/aggregation/buildHandler.ts
-/**
-* Framework-agnostic aggregation execution. Runs safety guards,
-* compiles the AggRequest, dispatches to the materialized hook or
-* `repo.aggregate()`, and applies the post-execution `maxGroups` cap.
-*
-* Returns an envelope describing the response — Fastify wrappers
-* apply it to a reply, MCP wrappers convert it to a tool-call result.
-*
-* **Does NOT run the per-aggregation permission check.** Auth runs
-* upstream (Fastify preHandler chain or MCP `evaluatePermission`)
-* because the permission shape differs by surface (FastifyRequest vs
-* MCP session). Both surfaces fail-closed BEFORE reaching this
-* function; this is purely the runtime executor.
-*/
-async function executeAggregation(normalized, deps, ctx) {
-	const { repo } = deps;
-	const config = normalized.base;
-	const aggregationName = normalized.name;
-	const { query, tenantOptions } = ctx;
-	const guardError = checkRequestGuards(query, config);
-	if (guardError) return {
-		status: 400,
-		body: guardError
-	};
-	const aggReq = compileAggRequest(normalized, extractCallerFilter(query), tenantOptions);
-	if (config.materialized) {
-		const matCtx = {
-			filter: aggReq.filter,
-			orgId: pickString(tenantOptions.organizationId),
-			userId: pickString(tenantOptions.userId),
-			requestId: pickString(tenantOptions.requestId),
-			query
-		};
-		return {
-			status: 200,
-			headers: { "x-aggregation-source": "materialized" },
-			body: { rows: (await config.materialized(matCtx)).rows }
-		};
-	}
-	if (!adapterSupportsAggregate(repo)) return {
-		status: 501,
-		body: {
-			code: "arc.adapter.capability_required",
-			message: `Aggregation "${aggregationName}" is not supported: the resource's storage adapter does not implement repo.aggregate(). Use a kit that ships StandardRepo.aggregate (mongokit / sqlitekit), or remove the aggregations entry.`,
-			status: 501,
-			meta: {
-				capability: "aggregate",
-				aggregation: aggregationName
-			}
-		}
-	};
-	let result;
-	try {
-		result = await repo.aggregate(aggReq, tenantOptions);
-	} catch (err) {
-		return mapAggregateError(err, aggregationName);
-	}
-	if (config.maxGroups !== void 0 && result.rows.length > config.maxGroups) return {
-		status: 422,
-		body: {
-			code: "arc.aggregation.max_groups_exceeded",
-			message: `Aggregation "${aggregationName}" produced ${result.rows.length} groups, exceeding maxGroups (${config.maxGroups}). Narrow the filter or raise the cap.`,
-			status: 422,
-			meta: {
-				aggregation: aggregationName,
-				produced: result.rows.length,
-				maxGroups: config.maxGroups
-			}
-		}
-	};
-	return {
-		status: 200,
-		body: { rows: result.rows }
-	};
-}
-/**
-* Build the Fastify handler for a single aggregation.
-*
-* The returned function calls the repo (or materialized hook), shapes
-* the response envelope, and writes status/headers via Fastify's
-* `reply` API. Errors throw — the router's error handler converts to
-* the standard arc response shape.
-*/
-/**
-* Build the Fastify handler for a single aggregation.
-*
-* Caching lives in the kit's repo-core `cachePlugin` — when the host
-* declares `cache:` on the aggregation, `compileAggRequest` translates
-* to `aggReq.cache: CacheOptions` and the kit handles SWR + tag
-* invalidation + version-bump on writes. Arc passes the request
-* through; no duplicate cache layer at the HTTP handler.
-*/
-function buildAggregationHandler(normalized, deps) {
-	const { buildOptions } = deps;
-	return async (request, reply) => {
-		const result = await executeAggregation(normalized, deps, {
-			query: request.query ?? {},
-			tenantOptions: buildOptions(request)
-		});
-		reply.status(result.status);
-		if (result.headers) for (const [k, v] of Object.entries(result.headers)) reply.header(k, v);
-		return result.body;
-	};
-}
-function pickString(value) {
-	return typeof value === "string" ? value : void 0;
-}
-function checkRequestGuards(query, config) {
-	if (config.requireFilters) {
-		for (const field of config.requireFilters) if (!hasFilterOnField(query, field)) return {
-			code: "arc.aggregation.required_filter_missing",
-			message: `Aggregation requires filter on "${field}" — supply ?${field}=... or ?${field}[op]=... in the query string.`,
-			status: 400,
-			meta: { field }
-		};
-	}
-	if (config.requireDateRange) {
-		const { field, maxRangeDays } = config.requireDateRange;
-		const range = parseDateRange(query, field);
-		if (!range) return {
-			code: "arc.aggregation.required_date_range_missing",
-			message: `Aggregation requires a bounded date range on "${field}" — supply ?${field}[gte]=... and ?${field}[lt]=... (or ?${field}[lte]=...).`,
-			status: 400,
-			meta: { field }
-		};
-		if (maxRangeDays !== void 0) {
-			const days = (range.upper.getTime() - range.lower.getTime()) / 864e5;
-			if (days > maxRangeDays) return {
-				code: "arc.aggregation.date_range_exceeded",
-				message: `Aggregation date range on "${field}" exceeds the cap (${maxRangeDays} days). Requested range: ${days.toFixed(1)} days. Narrow the range and retry.`,
-				status: 400,
-				meta: {
-					field,
-					maxRangeDays,
-					requestedDays: days
-				}
-			};
-		}
-	}
-	return null;
-}
-function hasFilterOnField(query, field) {
-	const direct = query[field];
-	if (direct !== void 0 && direct !== "") return true;
-	for (const key of Object.keys(query)) if (key.startsWith(`${field}[`)) return true;
-	return false;
-}
-function parseDateRange(query, field) {
-	let gte;
-	let lte;
-	const nested = query[field];
-	if (nested && typeof nested === "object" && !Array.isArray(nested)) {
-		const ops = nested;
-		gte = pickString(ops.gte) ?? pickString(ops.gt);
-		lte = pickString(ops.lte) ?? pickString(ops.lt);
-	}
-	if (!gte) gte = pickString(query[`${field}[gte]`]) ?? pickString(query[`${field}[gt]`]);
-	if (!lte) lte = pickString(query[`${field}[lte]`]) ?? pickString(query[`${field}[lt]`]);
-	if (!gte || !lte) return null;
-	const lower = new Date(gte);
-	const upper = new Date(lte);
-	if (Number.isNaN(lower.getTime()) || Number.isNaN(upper.getTime())) return null;
-	if (upper <= lower) return null;
-	return {
-		lower,
-		upper
-	};
-}
-/**
-* Bracket-syntax operator shorthand → canonical Mongo operator. Mirrors
-* the `operators` map in `ArcQueryParser` so the aggregation route emits
-* the same shape the CRUD list route produces. Aggregations don't run
-* through the resource-level QueryParser (they have their own URL→IR
-* compile path), so this translation has to happen in arc itself —
-* downstream kits' filter compilers expect canonical `$gte/$lte/$in/...`
-* keys, not bare `gte/lte/in/...` shorthand.
-*/
-const OPERATOR_SHORTHAND = {
-	eq: "$eq",
-	ne: "$ne",
-	gt: "$gt",
-	gte: "$gte",
-	lt: "$lt",
-	lte: "$lte",
-	in: "$in",
-	nin: "$nin",
-	like: "$regex",
-	contains: "$regex",
-	regex: "$regex",
-	exists: "$exists",
-	size: "$size",
-	type: "$type"
-};
-const SHORTHAND_RANGE_OPS = new Set([
-	"gt",
-	"gte",
-	"lt",
-	"lte"
-]);
-const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
-function tryCoerceDate(v) {
-	if (typeof v !== "string" || !ISO_DATE_RE.test(v)) return v;
-	const d = new Date(v);
-	return Number.isNaN(d.getTime()) ? v : d;
-}
-/**
-* Translate a qs-parsed nested-operator object (`{ field: { gte, lte } }`)
-* into Mongo-shape (`{ field: { $gte: Date, $lte: Date } }`). Only fires
-* when EVERY key is a known shorthand operator — leaves user-data
-* objects untouched so callers can still equality-match on a stored
-* sub-document.
-*/
-function expandShorthandOperators(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return value;
-	const nested = value;
-	const keys = Object.keys(nested);
-	if (keys.length === 0) return value;
-	if (!keys.every((k) => !k.startsWith("$") && OPERATOR_SHORTHAND[k] !== void 0)) return value;
-	const expanded = {};
-	for (const [op, opVal] of Object.entries(nested)) {
-		const mongoOp = OPERATOR_SHORTHAND[op];
-		if (!mongoOp) continue;
-		expanded[mongoOp] = SHORTHAND_RANGE_OPS.has(op) ? tryCoerceDate(opVal) : opVal;
-	}
-	return expanded;
-}
-/**
-* Strip control params (page/limit/sort/select/...) and the resource-
-* dispatch verbs from the query, leaving only filter predicates the
-* caller used to narrow the aggregation. Bracket-syntax operator
-* shorthand (`createdAt[gte]=...`) gets translated to canonical Mongo-
-* shape here so kits don't have to reimplement the URL grammar — same
-* contract `ArcQueryParser` enforces for the CRUD list route.
-*
-* The resulting record is shallow-merged into the AggRequest filter
-* via `compileAggRequest`.
-*/
-function extractCallerFilter(query) {
-	const out = {};
-	const reserved = new Set([
-		"page",
-		"limit",
-		"after",
-		"sort",
-		"select",
-		"populate",
-		"search",
-		"_count",
-		"_distinct",
-		"_exists"
-	]);
-	for (const [key, value] of Object.entries(query)) {
-		if (reserved.has(key)) continue;
-		if (value === void 0 || value === "") continue;
-		out[key] = expandShorthandOperators(value);
-	}
-	return out;
-}
-/**
-* Map a kit-thrown error to the framework-agnostic execute response.
-* Detects two well-known signals:
-*   - "unsupported" / "not implemented" → 501 with upgrade hint
-*   - timeout markers → 504
-*   - everything else → 500
-*/
-function mapAggregateError(err, aggregationName) {
-	const message = err instanceof Error ? err.message : String(err);
-	const lower = message.toLowerCase();
-	if (lower.includes("unsupported") || lower.includes("not implemented")) return {
-		status: 501,
-		body: {
-			code: "arc.adapter.capability_required",
-			message: `Aggregation "${aggregationName}" failed: ${message}. The kit may not yet support this feature (e.g. lookups in aggregate). Upgrade the kit or remove the unsupported field.`,
-			status: 501,
-			meta: { aggregation: aggregationName }
-		}
-	};
-	if (lower.includes("maxtimems") || lower.includes("timeout") || lower.includes("timed out")) return {
-		status: 504,
-		body: {
-			code: "arc.gateway_timeout",
-			message: `Aggregation "${aggregationName}" timed out: ${message}. Narrow the filter or raise the timeout.`,
-			status: 504,
-			meta: { aggregation: aggregationName }
-		}
-	};
-	return {
-		status: 500,
-		body: {
-			code: "arc.internal_error",
-			message: `Aggregation "${aggregationName}" failed: ${message}`,
-			status: 500,
-			meta: { aggregation: aggregationName }
-		}
-	};
-}
-//#endregion
-export { executeAggregation as n, validateAggregations as r, buildAggregationHandler as t };
+export { validate_exports as i, compileAggRequest as n, validateAggregations as r, adapterSupportsAggregate as t };

package/dist/{versioning-hmkPcDlX.d.mts → versioning-5H4930tj.d.mts}

@@ -1,4 +1,4 @@
-import { n as DomainEvent } from "./EventTransport-CT_52aWU.mjs";
+import { n as DomainEvent } from "./EventTransport-B1GFiYUy.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/plugins/health.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.15.4",
+  "version": "2.16.1",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -48,14 +48,6 @@
       "types": "./dist/auth/index.d.mts",
       "default": "./dist/auth/index.mjs"
     },
-    "./org": {
-      "types": "./dist/org/index.d.mts",
-      "default": "./dist/org/index.mjs"
-    },
-    "./org/types": {
-      "types": "./dist/org/types.d.mts",
-      "default": "./dist/org/types.mjs"
-    },
     "./hooks": {
       "types": "./dist/hooks/index.d.mts",
       "default": "./dist/hooks/index.mjs"
@@ -227,8 +219,8 @@
     "lint:fix": "biome check --fix src/",
     "lint:all": "biome check src/ tests/",
     "test": "vitest run",
-    "test:main": "vitest run",
-    "test:perf": "node --expose-gc ./node_modules/vitest/vitest.mjs run --config vitest.perf.config.ts",
+    "test:main": "vitest run --no-file-parallelism",
+    "test:perf": "node --expose-gc ./node_modules/vitest/vitest.mjs run --config vitest.perf.config.ts --no-file-parallelism",
     "test:ci": "npm run test:main && npm run test:perf",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
@@ -239,14 +231,14 @@
     "push": "classytic-push",
     "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
     "release": "npm run push -- main && npm run release:tag && npm publish",
-    "prepublishOnly": "npm run typecheck && npm run lint && npm run build && npm run test:ci && npm run smoke"
+    "prepublishOnly": "npm run typecheck && npm run lint && npm run build && npm run test:main && npm run smoke"
   },
   "engines": {
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.5.0",
-    "@classytic/repo-core": ">=0.4.1",
+    "@classytic/primitives": ">=0.6.0",
+    "@classytic/repo-core": ">=0.5.0",
     "@classytic/streamline": ">=2.3.3",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
@@ -349,18 +341,18 @@
   },
   "dependencies": {
     "fastify-plugin": "^5.0.1",
-    "qs": "^6.15.1",
+    "qs": "^6.15.2",
     "secure-json-parse": "^4.1.0"
   },
   "devDependencies": {
     "@better-auth/drizzle-adapter": "^1.6.9",
     "@better-auth/mongo-adapter": "^1.6.9",
-    "@biomejs/biome": "^2.4.11",
+    "@biomejs/biome": "^2.4.15",
     "@classytic/dev-tools": "^0.2.0",
-    "@classytic/mongokit": "^3.13.2",
-    "@classytic/primitives": "^0.4.0",
-    "@classytic/repo-core": "^0.4.1",
-    "@classytic/sqlitekit": "^0.3.1",
+    "@classytic/mongokit": "^3.14.0",
+    "@classytic/primitives": "^0.6.0",
+    "@classytic/repo-core": "^0.5.0",
+    "@classytic/sqlitekit": "^0.5.0",
     "@classytic/streamline": "^2.3.3",
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",
@@ -374,27 +366,28 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.1",
     "@sinclair/typebox": "^0.34.0",
-    "@types/node": "^22.10.0",
-    "@types/qs": "^6.14.0",
+    "@types/node": "^22.19.19",
+    "@types/qs": "^6.15.1",
     "@vitest/coverage-v8": "^3.2.4",
     "ajv": "^8.18.0",
     "better-auth": "^1.6.9",
-    "better-sqlite3": "^12.9.0",
-    "bullmq": "^5.73.5",
+    "better-sqlite3": "^12.10.0",
+    "bullmq": "^5.76.9",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
-    "fast-check": "^4.6.0",
+    "fast-check": "^4.8.0",
+    "fastify": "^5.8.5",
     "fastify-raw-body": "^5.0.0",
     "ioredis": "^5.10.1",
     "jsonwebtoken": "^9.0.0",
-    "knip": "^6.4.1",
+    "knip": "^6.14.1",
     "mongodb": "^7.1.0",
     "mongodb-memory-server": "^11.0.1",
-    "mongoose": ">=9.4.1",
+    "mongoose": "^9.6.2",
     "tsdown": "^0.21.7",
     "typescript": "^6.0.2",
     "vitest": "^3.0.0",
-    "ws": "^8.0.0",
+    "ws": "^8.20.1",
     "zod": "^4.3.6"
   },
   "keywords": [
@@ -420,4 +413,4 @@
     "type": "git",
     "url": "https://github.com/classytic/arc.git"
   }
-}
+}