@classytic/arc 2.16.0 → 2.16.1

package/dist/{index-B-ulKx5P.d.mts → index-CC_pgZjY.d.mts}

@@ -1,6 +1,6 @@
-import { C as RequestContext, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, bt as IRequestContext, ft as RouteMcpConfig, mt as RouteSchemaOptions, q as CrudController, st as ResourceConfig, vt as IController, yt as IControllerResponse } from "./index-CkW0flkU.mjs";
-import { i as RequestScope } from "./types-DVfpSfx2.mjs";
-import { c as PermissionCheck } from "./fields-Anj0xdih.mjs";
+import { C as RequestContext, F as FastifyWithDecorators, H as ActionDefinition, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, bt as IRequestContext, ft as RouteMcpConfig, mt as RouteSchemaOptions, q as CrudController, st as ResourceConfig, vt as IController, yt as IControllerResponse } from "./index-DBDgy6Hw.mjs";
+import { i as RequestScope } from "./types-CfapW2t8.mjs";
+import { c as PermissionCheck } from "./fields-DqZLp5d6.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
@@ -240,9 +240,13 @@ declare function getEntityQuery(req: RequestWithExtras): Record<string, string>;
 //#endregion
 //#region src/core/fastifyAdapter.d.ts
 /**
- * Create IRequestContext from Fastify request
- *
- * Extracts framework-agnostic context from Fastify-specific request object
+ * Project `FastifyRequest` into the curated `IRequestContext` shape that
+ * arc's controllers receive. This is a developer-facing facade, not a
+ * portability boundary — arc is Fastify-only. The projection lifts the
+ * fields tenant-scoped controllers reach for (`organizationId`,
+ * `teamId`, `scope`, `context`, server accessor) onto a flat, typed
+ * surface so handler code doesn't have to dig through Fastify's
+ * decorator surface or `req.metadata._scope` internals.
  */
 declare function createRequestContext(req: FastifyRequest): IRequestContext;
 /**
@@ -258,25 +262,41 @@ declare function getControllerContext(req: IRequestContext): RequestContext;
  */
 declare function getControllerScope(req: IRequestContext): RequestScope;
 /**
- * Send IControllerResponse via Fastify reply
+ * Send a controller's `IControllerResponse` through Fastify's reply.
+ *
+ * The `IControllerResponse<T>` envelope is arc's internal pipeline
+ * contract — it's how custom `status`, `meta`, `headers`, and field
+ * permissions thread from a handler through interceptors to the wire
+ * without each step having to touch `reply` directly. Not a portability
+ * abstraction (arc is Fastify-only); a pipeline-internal one.
  *
- * Converts framework-agnostic response to Fastify response
- * Applies field masking if specified in request
+ * **Auto-envelope of bare returns.** Custom route handlers are
+ * expected to return the envelope shape so this function can apply
+ * field permissions, attach `fieldCaps`, and flatten paginated lists.
+ * A handler that returns raw `T` (array, plain object, primitive) used
+ * to silently produce a broken response — `response.data` was
+ * `undefined`, the body sent was `undefined`, and any declared
+ * `fields:` permission map was bypassed (the leak shape mentora
+ * flagged). 2.17 detects bare returns and wraps them into
+ * `{ data: response, status: 200 }` before the field-permission
+ * pipeline runs, so `fields:` applies to ALL custom routes whether the
+ * handler envelopes its return value or not. The envelope shape is
+ * still the canonical contract — auto-wrapping is a safety net, not
+ * an invitation to drop the envelope.
  */
 declare function sendControllerResponse<T>(reply: FastifyReply, response: IControllerResponse<T>, request?: FastifyRequest): void;
 /**
- * Create Fastify route handler from IController method
- *
- * Wraps framework-agnostic controller method in Fastify-specific handler
+ * Bridge an `IController` method (`(ctx: IRequestContext) => Promise<IControllerResponse<T>>`)
+ * into a Fastify route handler. Translates between arc's curated request
+ * context surface and Fastify's request/reply, and routes the envelope
+ * through `sendControllerResponse` so the pipeline applies field
+ * permissions, status, and meta uniformly. Internal plumbing, not a
+ * portability layer — arc is Fastify-only.
  *
  * @example
  * ```typescript
  * const controller = new BaseController(repository);
- *
- * // Create Fastify handler
  * const listHandler = createFastifyHandler(controller.list.bind(controller));
- *
- * // Register route
  * fastify.get('/products', listHandler);
  * ```
  */

package/dist/{index-CkW0flkU.d.mts → index-DBDgy6Hw.d.mts}

@@ -1,7 +1,7 @@
-import { a as QueryCacheConfig } from "./QueryCache-SvmT_9ti.mjs";
-import { i as RequestScope } from "./types-DVfpSfx2.mjs";
-import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-Anj0xdih.mjs";
-import { n as DomainEvent } from "./EventTransport-C-2oAHtw.mjs";
+import { a as QueryCacheConfig } from "./QueryCache-8YmAQ-zW.mjs";
+import { i as RequestScope } from "./types-CfapW2t8.mjs";
+import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-DqZLp5d6.mjs";
+import { n as DomainEvent } from "./EventTransport-B1GFiYUy.mjs";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 import * as _$_classytic_repo_core_adapter0 from "@classytic/repo-core/adapter";
@@ -1569,8 +1569,39 @@ interface AggregationConfig {
   having?: AnyRecord;
   /** Order grouped rows by groupBy field, measure alias, or joined-alias path. */
   sort?: Record<string, 1 | -1>;
-  /** Hard cap on result rows. Applied at the IR level (LIMIT / `$limit`). */
+  /**
+   * Static hard cap on result rows. Always applied at the IR level
+   * (LIMIT / `$limit`), regardless of URL params. Use when the
+   * aggregation has a fixed-size shape ("top 10 categories"). Mutually
+   * exclusive with `defaultLimit` / `maxLimit` — pick the static form
+   * OR the URL-driven form, not both.
+   */
   limit?: number;
+  /**
+   * URL-driven row limit — applied when the caller passes `?limit=N`.
+   * When set, the auto-route reads `query.limit`, parses it as a
+   * positive integer, caps it at `maxLimit` (or the framework default
+   * if `maxLimit` is unset), and writes the result into `AggRequest.limit`.
+   * When the caller omits `?limit`, this default applies.
+   *
+   * **DoS defense.** Auto-generated `/aggregations/:name` routes today
+   * have no upper bound on response size. A `groupBy: 'userId'` on a
+   * 10M-user table without `defaultLimit` returns a 10M-row JSON. Setting
+   * `defaultLimit: 100, maxLimit: 1000` bounds the response shape while
+   * letting power users request up to 1000 rows when they need them.
+   *
+   * Mutually exclusive with the static `limit` — boot error if both set.
+   * Setting `defaultLimit` without `maxLimit` uses the framework
+   * default cap (`AGG_FRAMEWORK_MAX_LIMIT = 1000`) — explicit is better.
+   */
+  defaultLimit?: number;
+  /**
+   * Hard ceiling for URL-driven `?limit=N`. Only meaningful when
+   * `defaultLimit` is set; ignored otherwise. Defaults to
+   * `AGG_FRAMEWORK_MAX_LIMIT` (1000) when omitted but `defaultLimit` is
+   * present. Boot validation: must be ≥ `defaultLimit`.
+   */
+  maxLimit?: number;
   /**
    * Top-N-per-group filter. Keeps only the top `limit` rows per
    * partition, ranked by `sortBy`. The classic "top 3 products per
@@ -2707,13 +2738,37 @@ interface ResourceConfig<TDoc = AnyRecord> {
   /**
    * Custom routes beyond CRUD. Presets also merge their routes here.
    *
-   * @example
+   * **Route handlers return `IControllerResponse<T>` shape** —
+   * `{ data, status?, meta?, headers? }`. Returning a bare value (array,
+   * object, primitive) is supported via auto-envelope (2.17+) but the
+   * explicit envelope is the canonical contract — declared `fields:`
+   * permissions, custom `status`, `meta`, and `headers` only work when
+   * you return the envelope. Set `raw: true` on a route to opt out of
+   * arc's pipeline entirely (custom streaming, SSE, manual `reply.send()`).
+   *
+   * **Path collisions with auto-CRUD are detected at `defineResource()` time.**
+   * If you declare a route that shares method+path with an auto-CRUD op
+   * (e.g. `POST /` collides with `create`), validation throws with the
+   * exact `disabledRoutes` line to add. Use one of:
+   *   - `disabledRoutes: ['create']` — suppress the auto-CRUD op
+   *   - `crud: { list: true, get: true }` — opt-in allow-list (preferred)
+   *   - `disableDefaultRoutes: true` — turn off all auto-CRUD on this resource
+   *
+   * @example Custom route alongside default CRUD:
    * ```typescript
    * routes: [
    *   { method: 'GET', path: '/stats', handler: 'getStats', permissions: auth() },
    *   { method: 'POST', path: '/webhook', handler: webhookFn, raw: true, permissions: auth() },
    * ]
    * ```
+   *
+   * @example Custom POST replacing the auto-CRUD `create`:
+   * ```typescript
+   * disabledRoutes: ['create'],
+   * routes: [
+   *   { method: 'POST', path: '/', handler: customCreate, permissions: requireAuth() },
+   * ]
+   * ```
    */
   routes?: RouteDefinition[];
   /**
@@ -3713,7 +3768,24 @@ interface RegistryEntry extends ResourceMetadata {
       field: string;
       maxRangeDays?: number;
     }; /** Whether the aggregation requires named filters — surfaced in docs. */
-    readonly requireFilters?: readonly string[]; /** MCP tool generation flag — `false` to skip, object for overrides. */
+    readonly requireFilters?: readonly string[];
+    /**
+     * Static result-row cap (no URL override). Mutually exclusive with
+     * `defaultLimit` / `maxLimit`. Surfaced so OpenAPI docs can mention
+     * the fixed cap in the description.
+     */
+    readonly limit?: number;
+    /**
+     * URL-driven default limit (caller may pass `?limit=N`). When set,
+     * OpenAPI docs render `?limit` as a query parameter with this
+     * default and `maxLimit` as the maximum.
+     */
+    readonly defaultLimit?: number;
+    /**
+     * URL-driven limit ceiling (only meaningful with `defaultLimit`).
+     * OpenAPI docs render this as the `maximum` constraint on `?limit`.
+     */
+    readonly maxLimit?: number; /** MCP tool generation flag — `false` to skip, object for overrides. */
     readonly mcp?: boolean | {
       readonly description?: string;
       readonly annotations?: Record<string, unknown>;

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $t as BaseController, A as RequestIdOptions, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, N as FastifyRequestExtras, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, _n as ArcListResult, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, d as PaginationResult, dn as ControllerConstructionOptions, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gn as ArcGetResult, gt as ControllerLike, h as ResourceMetadata, hn as ArcDeleteResult, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jt as AggregationsMap, k as IntrospectionPluginOptions, kt as AggregationMaterializedResult, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, mn as ArcCreateResult, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, un as ControllerConfigurableOptions, vn as ArcUpdateResult, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yn as ListResult, yt as IControllerResponse } from "./index-CkW0flkU.mjs";
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-Anj0xdih.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-B-ulKx5P.mjs";
-import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-3oIimXQn.mjs";
-import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-C1lX_jlm.mjs";
+import { $t as BaseController, A as RequestIdOptions, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, N as FastifyRequestExtras, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, _n as ArcListResult, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, d as PaginationResult, dn as ControllerConstructionOptions, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gn as ArcGetResult, gt as ControllerLike, h as ResourceMetadata, hn as ArcDeleteResult, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jt as AggregationsMap, k as IntrospectionPluginOptions, kt as AggregationMaterializedResult, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, mn as ArcCreateResult, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, un as ControllerConfigurableOptions, vn as ArcUpdateResult, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yn as ListResult, yt as IControllerResponse } from "./index-DBDgy6Hw.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-DqZLp5d6.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-CC_pgZjY.mjs";
+import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-3L-adFJO.mjs";
+import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-4ZloYFvm.mjs";
 
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-TrJVIJl0.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-j4aJm1Wg.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DlCCTIxJ.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-Vk8I7C0x.mjs";
 import { C as allowPublic, D as requireAuth, O as requireOwnership, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "./permissions-CTxMrreC.mjs";
-import { v as getControllerScope } from "./routerShared-CZV5aabX.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-DBJ_j6rX.mjs";
+import { v as getControllerScope } from "./routerShared-ClV4cCaa.mjs";
+import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-wKeGXn38.mjs";
 //#region src/index.ts
-const version = "2.16.0";
+const version = "2.16.1";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
-import { n as DomainEvent } from "../EventTransport-C-2oAHtw.mjs";
-import { a as WebSocketMessage, i as WebSocketClient } from "../websocket-BkjeGZRn.mjs";
+import { n as DomainEvent } from "../EventTransport-B1GFiYUy.mjs";
+import { a as WebSocketMessage, i as WebSocketClient } from "../websocket-BJ0w-3Dt.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/event-gateway.mjs

@@ -4,7 +4,7 @@ const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-BY6sTy4P.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-jh5OqFjR.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
-import { a as WebSocketMessage, i as WebSocketClient, o as WebSocketPluginOptions } from "../websocket-BkjeGZRn.mjs";
+import { a as WebSocketMessage, i as WebSocketClient, o as WebSocketPluginOptions } from "../websocket-BJ0w-3Dt.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-BsJMEQ4D.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-BD0BCdf6.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export { type BetterAuthHandler, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type EventGatewayOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobsPluginOptions, type McpAuthResult, type McpPluginOptions, type McpResourceConfig, type PromptDefinition, type QueueStats, type StreamlinePluginOptions, type ToolAnnotations, type ToolContext, type ToolDefinition, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, type WebhookDeliveryRecord, type WebhookManager, type WebhookPluginOptions, type WebhookStore, type WebhookSubscription, type WorkflowLike, type WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,7 +1,7 @@
-import { V as ResourceDefinition, bt as IRequestContext, yt as IControllerResponse } from "../../index-CkW0flkU.mjs";
-import { i as RequestScope } from "../../types-DVfpSfx2.mjs";
-import { c as PermissionCheck } from "../../fields-Anj0xdih.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-BsJMEQ4D.mjs";
+import { V as ResourceDefinition, bt as IRequestContext, yt as IControllerResponse } from "../../index-DBDgy6Hw.mjs";
+import { i as RequestScope } from "../../types-CfapW2t8.mjs";
+import { c as PermissionCheck } from "../../fields-DqZLp5d6.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-BD0BCdf6.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-7vGV51ED.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-Dbgz9_Rj.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { c as McpAuthResult, l as McpPluginOptions } from "../../types-BsJMEQ4D.mjs";
+import { c as McpAuthResult, l as McpPluginOptions } from "../../types-BD0BCdf6.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-7vGV51ED.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-Dbgz9_Rj.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/websocket-redis.d.mts

@@ -1,4 +1,4 @@
-import { c as WebSocketAdapter } from "../websocket-BkjeGZRn.mjs";
+import { c as WebSocketAdapter } from "../websocket-BJ0w-3Dt.mjs";
 
 //#region src/integrations/websocket-redis.d.ts
 interface RedisLike {

package/dist/integrations/websocket.d.mts

@@ -1,2 +1,2 @@
-import { a as WebSocketMessage, c as WebSocketAdapter, i as WebSocketClient, n as websocketPlugin, o as WebSocketPluginOptions, r as AuthResult, s as LocalWebSocketAdapter, t as RoomManager } from "../websocket-BkjeGZRn.mjs";
+import { a as WebSocketMessage, c as WebSocketAdapter, i as WebSocketClient, n as websocketPlugin, o as WebSocketPluginOptions, r as AuthResult, s as LocalWebSocketAdapter, t as RoomManager } from "../websocket-BJ0w-3Dt.mjs";
 export { AuthResult, LocalWebSocketAdapter, RoomManager, WebSocketAdapter, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, websocketPlugin };

package/dist/{loadResourcesFromEntry-BLMEI2Xa.mjs → loadResourcesFromEntry-DCjYMgfC.mjs}

@@ -1,4 +1,4 @@
-import { t as ResourceRegistry } from "./ResourceRegistry-f48hFk3m.mjs";
+import { t as ResourceRegistry } from "./ResourceRegistry-CzSzVK1m.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/{mcpPlugin-7vGV51ED.mjs → mcpPlugin-Dbgz9_Rj.mjs}

@@ -1,13 +1,13 @@
 import { p as isArcError } from "./errors-j4aJm1Wg.mjs";
-import { t as BaseController } from "./BaseController-DlCCTIxJ.mjs";
+import { t as BaseController } from "./BaseController-Vk8I7C0x.mjs";
 import { L as normalizePermissionResult } from "./permissions-CTxMrreC.mjs";
 import { t as executePipeline } from "./pipe-DiCyvyPN.mjs";
-import { u as resolvePipelineSteps } from "./routerShared-CZV5aabX.mjs";
-import { r as validateAggregations } from "./validate-By96rH0r.mjs";
-import { n as executeAggregation } from "./buildHandler-BZX6zzDM.mjs";
+import { u as resolvePipelineSteps } from "./routerShared-ClV4cCaa.mjs";
+import { r as validateAggregations } from "./validate-DFIP2VrM.mjs";
+import { n as executeAggregation } from "./buildHandler-C_SkBNF3.mjs";
 import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
-import { i as shouldRejectAdditionalProperties, r as schemaIRToZodShape, t as normalizeSchemaIR } from "./schemaIR-Ctc89DSn.mjs";
+import { i as shouldRejectAdditionalProperties, r as schemaIRToZodShape, t as normalizeSchemaIR } from "./schemaIR-DAOvBWgT.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CkW0flkU.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DBDgy6Hw.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/{openapi-34T9yNwd.mjs → openapi-BRnd3pT7.mjs}

@@ -2,7 +2,7 @@ import { t as getUserRoles } from "./types-D57iXYb8.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-De34B1ZG.mjs";
 import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-DUpN3Dd1.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-eiOFtnC3.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**
@@ -647,13 +647,7 @@ function appendAggregationPaths(paths, resource, basePath, additionalSecurity) {
 		if (!paths[path]) paths[path] = {};
 		paths[path].get = createOperation(resource, `aggregation.${agg.name}`, agg.summary ?? `Aggregation: ${agg.name}`, {
 			description: descLines.join("\n"),
-			parameters: [{
-				name: "querystring",
-				in: "query",
-				required: false,
-				schema: querystring,
-				description: "Filter narrowing — composes with base filter + tenant scope."
-			}],
+			parameters: buildAggregationParameters(agg, querystring),
 			responses: {
 				"200": {
 					description: "Aggregation result",
@@ -701,6 +695,37 @@ function normalizeGroupByForOpenApi(groupBy) {
 	if (!groupBy) return [];
 	return typeof groupBy === "string" ? [groupBy] : groupBy;
 }
+/**
+* Build the OpenAPI `parameters` array for an aggregation route.
+*
+* Always includes the filter-narrowing `querystring` slot. When the
+* aggregation declares URL-driven paging (`defaultLimit`), adds an
+* explicit `?limit` integer parameter with the declared default +
+* maximum. Auto-generated FE clients pick the constraint up; humans
+* reading the docs see the cap without reading source.
+*/
+function buildAggregationParameters(agg, querystring) {
+	const params = [{
+		name: "querystring",
+		in: "query",
+		required: false,
+		schema: querystring,
+		description: "Filter narrowing — composes with base filter + tenant scope."
+	}];
+	if (agg.defaultLimit !== void 0) params.push({
+		name: "limit",
+		in: "query",
+		required: false,
+		schema: {
+			type: "integer",
+			minimum: 1,
+			default: agg.defaultLimit,
+			maximum: agg.maxLimit ?? 1e3
+		},
+		description: `Result row cap. Default ${agg.defaultLimit}; values above ${agg.maxLimit ?? 1e3} are capped silently. Invalid values fall back to the default.`
+	});
+	return params;
+}
 function setNestedSchemaProp(target, path, leaf) {
 	if (path.length === 1) {
 		target[path[0]] = leaf;
@@ -850,7 +875,9 @@ function appendCustomRoutePaths(paths, resource, basePath, additionalSecurity) {
 		}
 		if (routeSchema?.response) {
 			const responseSchemas = routeSchema.response;
-			for (const [statusCode, schema] of Object.entries(responseSchemas)) extras.responses[statusCode] = {
+			const responses = extras.responses ?? {};
+			extras.responses = responses;
+			for (const [statusCode, schema] of Object.entries(responseSchemas)) responses[statusCode] = {
 				description: schema.description || `Response ${statusCode}`,
 				content: { "application/json": { schema } }
 			};

package/dist/permissions/index.d.mts

@@ -1,3 +1,3 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-Anj0xdih.mjs";
-import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-3oIimXQn.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-DqZLp5d6.mjs";
+import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-3L-adFJO.mjs";
 export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RequireAgentScopeOptions, RequireMandateOptions, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-CkW0flkU.mjs";
+import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-DBDgy6Hw.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/plugins/index.d.mts

@@ -1,66 +1,12 @@
-import { An as HookSystem, Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook, z as ResourceRegistry } from "../index-CkW0flkU.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-DFg-2KTp.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-ZwX9tmbS.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-mHuyWzZE.mjs";
-import { t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
+import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-DBDgy6Hw.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-CJm0vh-l.mjs";
+import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-5H4930tj.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DuqTqeqn.mjs";
+import { t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 
-//#region src/core/arcCorePlugin.d.ts
-interface ArcCorePluginOptions {
-  /** Enable event emission for CRUD operations (requires eventPlugin) */
-  emitEvents?: boolean;
-  /** Hook system instance (for testing/custom setup) */
-  hookSystem?: HookSystem;
-  /** Resource registry instance (for testing/custom setup) */
-  registry?: ResourceRegistry;
-}
-interface PluginMeta {
-  name: string;
-  version?: string;
-  options?: Record<string, unknown>;
-  registeredAt: string;
-}
-interface ArcCore {
-  /** Instance-scoped hook system */
-  hooks: HookSystem;
-  /** Instance-scoped resource registry */
-  registry: ResourceRegistry;
-  /** Whether event emission is enabled */
-  emitEvents: boolean;
-  /** External OpenAPI paths contributed by auth adapters or third-party integrations */
-  externalOpenApiPaths: ExternalOpenApiPaths[];
-  /** Registered plugins for introspection */
-  plugins: Map<string, PluginMeta>;
-}
-declare module "fastify" {
-  interface FastifyInstance {
-    /**
-     * Arc core decorator. Optional because:
-     *
-     * 1. Consumers who import any `@classytic/arc/*` subpath get this module
-     *    augmentation merged into every `FastifyInstance` they see — even
-     *    instances on apps that never register {@link arcCorePlugin}. Making
-     *    it required would force those apps to assert or guard every
-     *    property access.
-     * 2. Hosts that extend `FastifyInstance` to narrow `arc` to their own
-     *    type (`interface X extends FastifyInstance { arc?: MyArc }`) were
-     *    previously blocked because non-optional `arc: ArcCore` conflicts
-     *    with the re-declaration. An optional field lets hosts re-declare
-     *    with a compatible subtype without fighting TS.
-     *
-     * Inside Arc's own code, any call site that runs *after* `arcCorePlugin`
-     * has registered treats this as non-null — see the call sites in
-     * `factory/registerAuth.ts` and `factory/createApp.ts` which assert
-     * with `fastify.arc!` or narrow explicitly.
-     */
-    arc?: ArcCore;
-  }
-}
-declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
-declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
-//#endregion
 //#region src/plugins/createPlugin.d.ts
 interface PluginResourceResult {
   /** Additional routes to add to the resource (v2.8 `RouteDefinition` shape) */

package/dist/plugins/index.mjs

@@ -3,13 +3,13 @@ import { c as getOrgId } from "../types-Bi0r0vjG.mjs";
 import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
 import { t as hasEvents } from "../typeGuards-BzkXkvVv.mjs";
 import { t as HookSystem } from "../HookSystem-Cmf7-Etp.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-f48hFk3m.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-TeHE8G-v.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DpoXQHZ9.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-TuOmguhi.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-C-gD32oF.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-BY6sTy4P.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-B6mimogM.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-CzSzVK1m.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-8MfrrUYU.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DNPzqaTT.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-B-PU4-Yu.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-boS5Rx26.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-jh5OqFjR.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CuIwUQZ2.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.16.0";
+	const resolvedVersion = serviceVersion ?? "2.16.1";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/preloadResources-BOXzPhKU.mjs

@@ -0,0 +1,45 @@
+//#region src/testing/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { preloadResourcesAsync as n, preloadResources as t };