@classytic/arc 2.16.0 → 2.17.0

package/dist/registry/index.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-CkW0flkU.mjs";
+import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-C1JSBan-.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 
@@ -20,7 +20,14 @@ interface AssertNoTenantDataOptions {
 interface TenantDataLeak {
   readonly resource: string;
   readonly tenantField: string;
-  readonly strategy: TenantPurgeStrategy["type"];
+  /**
+   * Full `TenantPurgeStrategy` discriminated union — not just `.type`.
+   * `anonymize` carries the field map; `custom` carries the handler
+   * descriptor; auditors get the actionable signal without re-resolving
+   * the resource definition. Narrow on `.strategy.type` for typed
+   * access.
+   */
+  readonly strategy: TenantPurgeStrategy;
   readonly expected: number;
   readonly actual: number;
   readonly reason?: string;
@@ -64,7 +71,14 @@ declare function assertNoTenantData(registry: ResourceRegistry, options: AssertN
 interface PurgeResourceOutcome {
   readonly resource: string;
   readonly tenantField: string;
-  readonly strategy: TenantPurgeStrategy["type"];
+  /**
+   * Full `TenantPurgeStrategy` discriminated union. Audit consumers
+   * narrow on `.strategy.type` for typed access — `skip` carries the
+   * mandatory `reason`, `anonymize` carries the field map, `custom`
+   * carries the handler descriptor. Pre-2.17 this was the `.type` tag
+   * only, which dropped the audit-critical `reason` field.
+   */
+  readonly strategy: TenantPurgeStrategy;
   readonly processed: number;
   readonly ok: boolean;
   readonly path: "purgeByField" | "legacy-deleteMany" | "skipped" | "unsupported";
@@ -92,11 +106,13 @@ interface CascadeResourceReport {
    */
   readonly deletedCount: number;
   /**
-   * Strategy that actually ran for this resource — `'hard'` / `'soft'` /
-   * `'anonymize'` / `'skip'`. Audit consumers branch on this to answer
-   * "did data physically leave the system?".
+   * Full `TenantPurgeStrategy` that ran for this resource. Branch on
+   * `.strategy.type` (`'hard'` / `'soft'` / `'anonymize'` / `'skip'` /
+   * `'custom'`) to answer "did data physically leave the system?". The
+   * `skip` variant carries the mandatory `reason`; `anonymize` carries
+   * the field map; `custom` carries the handler descriptor.
    */
-  readonly strategy?: TenantPurgeStrategy["type"];
+  readonly strategy?: TenantPurgeStrategy;
   /**
    * Where the strategy came from — `'declared'` (host wrote
    * `onTenantDelete`) or `'disabled'` (filtered out before reaching
@@ -221,11 +237,17 @@ declare function getCascadingResources(registry: ResourceRegistry): readonly str
  * cascading resource. Use for audit dashboards that answer "what
  * happens to this resource on org-delete?" without grepping the
  * source.
+ *
+ * **Returns the full `TenantPurgeStrategy` discriminated union**, not
+ * just its `type` tag. The `skip` variant carries a required `reason`
+ * field — auditors need it to sign off on every "we deliberately don't
+ * purge this" entry. Anonymize carries the field map. Custom carries
+ * the handler reference. Narrow on `.strategy.type` for typed access.
  */
 declare function getCascadingResourcesWithMetadata(registry: ResourceRegistry): readonly {
   name: string;
   tenantField: string;
-  strategy: TenantPurgeStrategy["type"];
+  strategy: TenantPurgeStrategy;
   source: ResolvedTenantPurge["source"];
   priority: number;
 }[];

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-BBE23CDj.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-f48hFk3m.mjs";
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-BrlHkrRS.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-CzSzVK1m.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-BBE23CDj.mjs → registry-BrlHkrRS.mjs}

@@ -59,7 +59,7 @@ async function assertNoTenantData(registry, options) {
 		if (actual !== expected) leaks.push({
 			resource: r.name,
 			tenantField,
-			strategy: strategy.type,
+			strategy,
 			expected,
 			actual
 		});
@@ -88,7 +88,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 	if (strategy.type === "skip") return {
 		resource: resourceName,
 		tenantField,
-		strategy: "skip",
+		strategy,
 		processed: 0,
 		ok: true,
 		path: "skipped",
@@ -103,7 +103,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 		return {
 			resource: resourceName,
 			tenantField,
-			strategy: result.strategy,
+			strategy,
 			processed: result.processed,
 			ok: result.ok,
 			path: "purgeByField",
@@ -114,7 +114,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 	if (strategy.type !== "hard") return {
 		resource: resourceName,
 		tenantField,
-		strategy: strategy.type,
+		strategy,
 		processed: 0,
 		ok: false,
 		path: "unsupported",
@@ -127,7 +127,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 	if (!op) return {
 		resource: resourceName,
 		tenantField,
-		strategy: "hard",
+		strategy,
 		processed: 0,
 		ok: false,
 		path: "unsupported",
@@ -142,7 +142,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 		return {
 			resource: resourceName,
 			tenantField,
-			strategy: "hard",
+			strategy,
 			processed: typeof result === "number" ? result : typeof result?.deletedCount === "number" ? result.deletedCount : typeof result?.count === "number" ? result.count : -1,
 			ok: true,
 			path: "legacy-deleteMany",
@@ -152,7 +152,7 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 		return {
 			resource: resourceName,
 			tenantField,
-			strategy: "hard",
+			strategy,
 			processed: 0,
 			ok: false,
 			path: "legacy-deleteMany",
@@ -178,6 +178,12 @@ function getCascadingResources(registry) {
 * cascading resource. Use for audit dashboards that answer "what
 * happens to this resource on org-delete?" without grepping the
 * source.
+*
+* **Returns the full `TenantPurgeStrategy` discriminated union**, not
+* just its `type` tag. The `skip` variant carries a required `reason`
+* field — auditors need it to sign off on every "we deliberately don't
+* purge this" entry. Anonymize carries the field map. Custom carries
+* the handler reference. Narrow on `.strategy.type` for typed access.
 */
 function getCascadingResourcesWithMetadata(registry) {
 	return registry.getAll().filter((r) => isResourceCascading(r)).map((r) => {
@@ -191,7 +197,7 @@ function getCascadingResourcesWithMetadata(registry) {
 		return {
 			name: r.name,
 			tenantField,
-			strategy: r0.strategy.type,
+			strategy: r0.strategy,
 			source: r0.source,
 			priority: r0.priority
 		};

package/dist/{routerShared-CZV5aabX.mjs → routerShared-nCyJGOKX.mjs}

@@ -1,10 +1,63 @@
-import { f as createError } from "./errors-j4aJm1Wg.mjs";
+import { h as SYSTEM_FIELDS } from "./constants-TrJVIJl0.mjs";
+import { f as createError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
 import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-Bi0r0vjG.mjs";
 import { t as requestContext } from "./requestContext-SSaaTgW8.mjs";
-import { I as evaluateAndApplyPermission, p as resolveEffectiveRoles, u as applyFieldReadPermissions } from "./permissions-CTxMrreC.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { I as evaluateAndApplyPermission, M as applyFieldWritePermissions, P as resolveEffectiveRoles, j as applyFieldReadPermissions } from "./permissions-B1Qy55fg.mjs";
+import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
 import { t as executePipeline } from "./pipe-DiCyvyPN.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
+//#region src/core/BodySanitizer.ts
+/**
+* BodySanitizer - Composable body sanitization logic extracted from BaseController.
+*
+* Strips readonly fields, system-managed fields, and applies field-level
+* write permissions from request bodies before create/update operations.
+*
+* Designed to be used standalone or composed into controllers.
+*/
+const DEFAULT_FIELD_WRITE_DENIAL_POLICY = "reject";
+var BodySanitizer = class {
+	schemaOptions;
+	onFieldWriteDenied;
+	constructor(config) {
+		this.schemaOptions = config.schemaOptions;
+		this.onFieldWriteDenied = config.onFieldWriteDenied ?? "reject";
+	}
+	/**
+	* Strip readonly and system-managed fields from request body.
+	* Prevents clients from overwriting _id, timestamps, __v, etc.
+	*
+	* Also applies field-level write permissions when the request has
+	* field permission metadata.
+	*/
+	sanitize(body, _operation, req, meta) {
+		let sanitized = { ...body };
+		for (const field of SYSTEM_FIELDS) delete sanitized[field];
+		const scopeForRules = req ? (meta ?? req.metadata)?._scope ?? PUBLIC_SCOPE : void 0;
+		const scopeIsElevated = scopeForRules ? isElevated(scopeForRules) : false;
+		const fieldRules = this.schemaOptions.fieldRules ?? {};
+		for (const [field, rules] of Object.entries(fieldRules)) {
+			const bypass = Boolean(rules.preserveForElevated) && scopeIsElevated;
+			if ((rules.systemManaged || rules.readonly) && !bypass) delete sanitized[field];
+			if (_operation === "update" && (rules.immutable || rules.immutableAfterCreate) && !bypass) delete sanitized[field];
+		}
+		if (req) {
+			const arcContext = meta ?? req.metadata;
+			const scope = arcContext?._scope ?? PUBLIC_SCOPE;
+			if (!isElevated(scope)) {
+				const fieldPerms = arcContext?.arc?.fields;
+				if (fieldPerms) {
+					const effectiveRoles = resolveEffectiveRoles(getUserRoles(req.user), isMember(scope) ? scope.orgRoles : []);
+					const { body: filtered, deniedFields } = applyFieldWritePermissions(sanitized, fieldPerms, effectiveRoles);
+					if (deniedFields.length > 0 && this.onFieldWriteDenied === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+					sanitized = filtered;
+				}
+			}
+		}
+		return sanitized;
+	}
+};
+//#endregion
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no
@@ -55,9 +108,13 @@ function applyFieldMask(data, fieldMask) {
 	return data;
 }
 /**
-* Create IRequestContext from Fastify request
-*
-* Extracts framework-agnostic context from Fastify-specific request object
+* Project `FastifyRequest` into the curated `IRequestContext` shape that
+* arc's controllers receive. This is a developer-facing facade, not a
+* portability boundary — arc is Fastify-only. The projection lifts the
+* fields tenant-scoped controllers reach for (`organizationId`,
+* `teamId`, `scope`, `context`, server accessor) onto a flat, typed
+* surface so handler code doesn't have to dig through Fastify's
+* decorator surface or `req.metadata._scope` internals.
 */
 function createRequestContext(req) {
 	const reqWithExtras = req;
@@ -145,12 +202,33 @@ function computeFieldCapabilities(fieldPerms, effectiveRoles) {
 	return caps;
 }
 /**
-* Send IControllerResponse via Fastify reply
+* Send a controller's `IControllerResponse` through Fastify's reply.
 *
-* Converts framework-agnostic response to Fastify response
-* Applies field masking if specified in request
+* The `IControllerResponse<T>` envelope is arc's internal pipeline
+* contract — it's how custom `status`, `meta`, `headers`, and field
+* permissions thread from a handler through interceptors to the wire
+* without each step having to touch `reply` directly. Not a portability
+* abstraction (arc is Fastify-only); a pipeline-internal one.
+*
+* **Auto-envelope of bare returns.** Custom route handlers are
+* expected to return the envelope shape so this function can apply
+* field permissions, attach `fieldCaps`, and flatten paginated lists.
+* A handler that returns raw `T` (array, plain object, primitive) used
+* to silently produce a broken response — `response.data` was
+* `undefined`, the body sent was `undefined`, and any declared
+* `fields:` permission map was bypassed (the leak shape mentora
+* flagged). 2.17 detects bare returns and wraps them into
+* `{ data: response, status: 200 }` before the field-permission
+* pipeline runs, so `fields:` applies to ALL custom routes whether the
+* handler envelopes its return value or not. The envelope shape is
+* still the canonical contract — auto-wrapping is a safety net, not
+* an invitation to drop the envelope.
 */
 function sendControllerResponse(reply, response, request) {
+	if (response === null || typeof response !== "object" || !Object.hasOwn(response, "data")) response = {
+		data: response,
+		status: 200
+	};
 	const reqWithExtras = request;
 	const fieldMaskConfig = reqWithExtras?.fieldMask;
 	const arcMeta = reqWithExtras?.arc;
@@ -207,18 +285,17 @@ function sendControllerResponse(reply, response, request) {
 	reply.code(status).send(filteredData);
 }
 /**
-* Create Fastify route handler from IController method
-*
-* Wraps framework-agnostic controller method in Fastify-specific handler
+* Bridge an `IController` method (`(ctx: IRequestContext) => Promise<IControllerResponse<T>>`)
+* into a Fastify route handler. Translates between arc's curated request
+* context surface and Fastify's request/reply, and routes the envelope
+* through `sendControllerResponse` so the pipeline applies field
+* permissions, status, and meta uniformly. Internal plumbing, not a
+* portability layer — arc is Fastify-only.
 *
 * @example
 * ```typescript
 * const controller = new BaseController(repository);
-*
-* // Create Fastify handler
 * const listHandler = createFastifyHandler(controller.list.bind(controller));
-*
-* // Register route
 * fastify.get('/products', listHandler);
 * ```
 */
@@ -573,5 +650,75 @@ function describeValue(v) {
 	if (Array.isArray(v)) return `an array of length ${v.length}`;
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
+/**
+* Build a preHandler that enforces field-write permissions on the request body.
+*
+* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
+* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
+* never went through that path — so a host that declared
+* `fields: { role: fields.writableBy(['admin']) }` and a custom
+* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
+*
+* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
+* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
+* bodies don't necessarily mirror the resource's adapter shape, and we'd
+* generate surprising 403s by enforcing rules tied to that shape.
+*
+* Returns `null` when the resource has no field permissions configured — the
+* caller should then skip wiring it into the preHandler chain.
+*/
+function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
+	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
+	return async (request, _reply) => {
+		const body = request.body;
+		if (!body || typeof body !== "object" || Array.isArray(body)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
+		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+		request.body = filtered;
+	};
+}
+/**
+* True for HTTP methods that carry a request body and should run the
+* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
+*/
+function methodCarriesBody(method) {
+	const m = method.toUpperCase();
+	return m === "POST" || m === "PUT" || m === "PATCH";
+}
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
 //#endregion
-export { getControllerContext as _, buildAuthMiddlewareForPermissions as a, buildRequestScopeProjection as b, buildPreHandlerChain as c, resolveRoutePreHandlers as d, resolveRouterPluginMw as f, createRequestContext as g, createFastifyHandler as h, buildAuthMiddleware as i, buildRateLimitConfig as l, createCrudHandlers as m, buildActionPipelineHandler as n, buildCrudPermissionMw as o, selectPluginMw as p, buildArcDecorator as r, buildPipelineHandler as s, buildActionPermissionMw as t, resolvePipelineSteps as u, getControllerScope as v, sendControllerResponse as y };
+export { buildRequestScopeProjection as C, sendControllerResponse as S, createCrudHandlers as _, buildAuthMiddlewareForPermissions as a, getControllerContext as b, buildPipelineHandler as c, methodCarriesBody as d, resolvePipelineSteps as f, tryRegisterRoute as g, selectPluginMw as h, buildAuthMiddleware as i, buildPreHandlerChain as l, resolveRouterPluginMw as m, buildActionPipelineHandler as n, buildCrudPermissionMw as o, resolveRoutePreHandlers as p, buildArcDecorator as r, buildFieldWritePreHandler as s, buildActionPermissionMw as t, buildRateLimitConfig as u, createFastifyHandler as v, BodySanitizer as w, getControllerScope as x, createRequestContext as y };

package/dist/scope/index.d.mts

@@ -1,5 +1,5 @@
-import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-DVfpSfx2.mjs";
-import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-0YBpa663.mjs";
+import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-CfapW2t8.mjs";
+import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-DvwtjDwu.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 
 //#region src/scope/rateLimitKey.d.ts

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
 import { C as isService, D as requireUserId, E as requireTeamId, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-Bi0r0vjG.mjs";
-import { n as normalizeRoles } from "../types-D57iXYb8.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-Dci0AYLT.mjs";
+import { n as normalizeRoles } from "../types-DV9WDfeg.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-6mfTLBC-.mjs";
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/testing/index.d.mts

@@ -1,5 +1,5 @@
-import { Kt as AnyRecord, V as ResourceDefinition } from "../index-CkW0flkU.mjs";
-import { d as ResourceLike, r as CreateAppOptions } from "../types-D-fYtKjb.mjs";
+import { Kt as AnyRecord, V as ResourceDefinition } from "../index-C1JSBan-.mjs";
+import { d as preloadResourcesAsync, r as CreateAppOptions, u as preloadResources } from "../types-BRmS8TNa.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";
@@ -464,29 +464,6 @@ declare function createTestTimer(): {
   reset: () => void;
 };
 //#endregion
-//#region src/testing/preloadResources.d.ts
-/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
-type EagerGlobResult = Record<string, unknown>;
-/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
-type LazyGlobResult = Record<string, () => Promise<unknown>>;
-/**
- * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
- *
- * Accepts either:
- * - `{ import: 'default' }` form: values are the resource directly
- * - default form: values are the full module — picks first export with `toPlugin()`
- *
- * Throws if any module doesn't yield a valid `ResourceLike`.
- */
-declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
-/**
- * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
- *
- * Use this when resources depend on prior bootstrap (e.g., engine init) and
- * cannot be evaluated at import time of the preload file.
- */
-declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
-//#endregion
 //#region src/testing/testApp.d.ts
 type DbMode = "in-memory" | {
   uri: string;

package/dist/testing/index.mjs

@@ -1,4 +1,5 @@
 import { t as CRUD_OPERATIONS } from "../constants-TrJVIJl0.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BOXzPhKU.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -970,50 +971,6 @@ function createTestTimer() {
 	};
 }
 //#endregion
-//#region src/testing/preloadResources.ts
-/**
-* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
-*
-* Accepts either:
-* - `{ import: 'default' }` form: values are the resource directly
-* - default form: values are the full module — picks first export with `toPlugin()`
-*
-* Throws if any module doesn't yield a valid `ResourceLike`.
-*/
-function preloadResources(globResult) {
-	const resources = [];
-	for (const [path, value] of Object.entries(globResult)) {
-		const resource = pickResource(value);
-		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		resources.push(resource);
-	}
-	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-/**
-* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
-*
-* Use this when resources depend on prior bootstrap (e.g., engine init) and
-* cannot be evaluated at import time of the preload file.
-*/
-async function preloadResourcesAsync(globResult) {
-	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
-		const resource = pickResource(await loader());
-		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		return resource;
-	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-function pickResource(value) {
-	if (!value || typeof value !== "object") return void 0;
-	if (typeof value.toPlugin === "function") return value;
-	const mod = value;
-	const candidates = [
-		mod.default,
-		mod.resource,
-		...Object.values(mod)
-	];
-	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
-}
-//#endregion
 //#region src/testing/testApp.ts
 /**
 * createTestApp — test app factory for arc
@@ -1079,7 +1036,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-DNccuhyI.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-CzCEEsEm.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;

package/dist/testing/storageContract.d.mts

@@ -1,4 +1,4 @@
-import { t as Storage } from "../storage-D2KZJAmn.mjs";
+import { t as Storage } from "../storage-HcAgP5Ni.mjs";
 
 //#region src/testing/storageContract.d.ts
 interface StorageContractSetupResult {

package/dist/types/index.d.mts

@@ -1,5 +1,5 @@
-import { $ as OnTenantDeleteConfig, A as RequestIdOptions, Bt as AuthHelpers, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, G as ActionsMap, Gt as TokenPair, H as ActionDefinition, Ht as Authenticator, I as MiddlewareHandler, J as CrudRouteKey, Jt as ArcRequest, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, M as EventsDecorator, N as FastifyRequestExtras, O as HealthOptions, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, T as CrudRouterOptions, U as ActionEntry, Ut as AuthenticatorContext, Vt as AuthPluginOptions, W as ActionHandlerFn, Wt as JwtContext, X as EventDefinition, Xt as ObjectId, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, Zt as UserLike, _ as ControllerQueryOptions, _t as FastifyHandler, a as InferAdapterDoc, at as ResolvedTenantPurge, b as ParsedQuery, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, ct as ResourceHookContext, d as PaginationResult, dt as RouteDefinition, et as OpenApiSchemas, f as IntrospectionData, ft as RouteMcpConfig, g as ArcInternalMetadata, gt as ControllerLike, h as ResourceMetadata, ht as ControllerHandler, i as ValidationResult, it as RateLimitConfig, j as ArcDecorator, k as IntrospectionPluginOptions, l as TypedRepository, lt as ResourceHooks, m as RegistryStats, mt as RouteSchemaOptions, n as ConfigError, nt as PresetHook, o as InferDocType, ot as ResourceCacheConfig, p as RegistryEntry, pt as RouteMethod, q as CrudController, qt as ApiResponse, r as ValidateOptions, rt as PresetResult, s as InferResourceDoc, st as ResourceConfig, t as RouteHandlerMethod, tt as PresetFunction, u as TypedResourceConfig, ut as ResourcePermissions, v as LookupOption, vt as IController, w as ServiceContext, x as PopulateOption, xt as RouteHandler, y as OwnershipCheck, yt as IControllerResponse } from "../index-CkW0flkU.mjs";
-import { i as RequestScope } from "../types-DVfpSfx2.mjs";
-import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-Anj0xdih.mjs";
-import { n as ElevationOptions, t as ElevationEvent } from "../elevation-0YBpa663.mjs";
+import { $ as OnTenantDeleteConfig, A as RequestIdOptions, Bt as AuthHelpers, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, G as ActionsMap, Gt as TokenPair, H as ActionDefinition, Ht as Authenticator, I as MiddlewareHandler, J as CrudRouteKey, Jt as ArcRequest, K as ArcFieldRule, Kt as AnyRecord, L as RequestWithExtras, M as EventsDecorator, N as FastifyRequestExtras, O as HealthOptions, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, T as CrudRouterOptions, U as ActionEntry, Ut as AuthenticatorContext, Vt as AuthPluginOptions, W as ActionHandlerFn, Wt as JwtContext, X as EventDefinition, Xt as ObjectId, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, Zt as UserLike, _ as ControllerQueryOptions, _t as FastifyHandler, a as InferAdapterDoc, at as ResolvedTenantPurge, b as ParsedQuery, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, ct as ResourceHookContext, d as PaginationResult, dt as RouteDefinition, et as OpenApiSchemas, f as IntrospectionData, ft as RouteMcpConfig, g as ArcInternalMetadata, gt as ControllerLike, h as ResourceMetadata, ht as ControllerHandler, i as ValidationResult, it as RateLimitConfig, j as ArcDecorator, k as IntrospectionPluginOptions, l as TypedRepository, lt as ResourceHooks, m as RegistryStats, mt as RouteSchemaOptions, n as ConfigError, nt as PresetHook, o as InferDocType, ot as ResourceCacheConfig, p as RegistryEntry, pt as RouteMethod, q as CrudController, qt as ApiResponse, r as ValidateOptions, rt as PresetResult, s as InferResourceDoc, st as ResourceConfig, t as RouteHandlerMethod, tt as PresetFunction, u as TypedResourceConfig, ut as ResourcePermissions, v as LookupOption, vt as IController, w as ServiceContext, x as PopulateOption, xt as RouteHandler, y as OwnershipCheck, yt as IControllerResponse } from "../index-C1JSBan-.mjs";
+import { i as RequestScope } from "../types-CfapW2t8.mjs";
+import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-DqZLp5d6.mjs";
+import { n as ElevationOptions, t as ElevationEvent } from "../elevation-DvwtjDwu.mjs";
 export { ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ApiResponse, ArcDecorator, ArcFieldRule, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OnTenantDeleteConfig, OpenApiSchemas, OwnershipCheck, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResolvedTenantPurge, ResourceCacheConfig, ResourceConfig, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult };

package/dist/types/storage.d.mts

@@ -1,2 +1,2 @@
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-D2KZJAmn.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-HcAgP5Ni.mjs";
 export { Storage, StorageContext, StorageFile, StorageReadRange, StorageReadResult, StorageUploadInput };

package/dist/{types-D-fYtKjb.d.mts → types-BRmS8TNa.d.mts}

@@ -1,13 +1,13 @@
-import { r as CacheStore } from "./interface-CH0OQudo.mjs";
-import { Ht as Authenticator } from "./index-CkW0flkU.mjs";
-import { n as ElevationOptions } from "./elevation-0YBpa663.mjs";
-import { a as EventTransport } from "./EventTransport-C-2oAHtw.mjs";
-import { t as ExternalOpenApiPaths } from "./externalPaths-DFg-2KTp.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-Biqzfbi5.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-CtHC_av1.mjs";
-import { _ as HealthOptions, f as CachingOptions, l as SSEOptions, o as MetricsOptions, t as VersioningOptions } from "./versioning-ZwX9tmbS.mjs";
-import { t as ErrorHandlerOptions } from "./errorHandler-mHuyWzZE.mjs";
-import { r as IdempotencyStore } from "./interface-NwJ_qPlY.mjs";
+import { r as CacheStore } from "./interface-BVkZsvEe.mjs";
+import { Ht as Authenticator } from "./index-C1JSBan-.mjs";
+import { n as ElevationOptions } from "./elevation-DvwtjDwu.mjs";
+import { a as EventTransport } from "./EventTransport-B1GFiYUy.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-ClykOQqa.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-Do4P_WBC.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-DjEx_J3j.mjs";
+import { _ as HealthOptions, f as CachingOptions, l as SSEOptions, o as MetricsOptions, t as VersioningOptions } from "./versioning-5H4930tj.mjs";
+import { t as ErrorHandlerOptions } from "./errorHandler-DuqTqeqn.mjs";
+import { r as IdempotencyStore } from "./interface-DoE6UoC2.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
 
 //#region src/factory/loadResources.d.ts
@@ -203,6 +203,29 @@ interface LoadResourcesOptions<TContext = unknown> {
  */
 declare function loadResources<TContext = unknown>(dir: string, options?: LoadResourcesOptions<TContext>): Promise<ResourceLike[]>;
 //#endregion
+//#region src/testing/preloadResources.d.ts
+/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
+type EagerGlobResult = Record<string, unknown>;
+/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
+type LazyGlobResult = Record<string, () => Promise<unknown>>;
+/**
+ * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+ *
+ * Accepts either:
+ * - `{ import: 'default' }` form: values are the resource directly
+ * - default form: values are the full module — picks first export with `toPlugin()`
+ *
+ * Throws if any module doesn't yield a valid `ResourceLike`.
+ */
+declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
+/**
+ * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+ *
+ * Use this when resources depend on prior bootstrap (e.g., engine init) and
+ * cannot be evaluated at import time of the preload file.
+ */
+declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
+//#endregion
 //#region src/factory/types.d.ts
 type CorsOptions = Record<string, unknown> & {
   origin?: unknown;
@@ -1041,4 +1064,4 @@ interface RawBodyOptions {
   runFirst?: boolean;
 }
 //#endregion
-export { CustomPluginAuthOption as a, RawBodyOptions as c, ResourceLike as d, ResourceModule as f, CustomAuthenticatorOption as i, UnderPressureOptions as l, BetterAuthOption as n, JwtAuthOption as o, loadResources as p, CreateAppOptions as r, MultipartOptions as s, AuthOption as t, LoadResourcesOptions as u };
+export { CustomPluginAuthOption as a, RawBodyOptions as c, preloadResourcesAsync as d, LoadResourcesOptions as f, loadResources as h, CustomAuthenticatorOption as i, UnderPressureOptions as l, ResourceModule as m, BetterAuthOption as n, JwtAuthOption as o, ResourceLike as p, CreateAppOptions as r, MultipartOptions as s, AuthOption as t, preloadResources as u };

package/dist/{types-BsJMEQ4D.d.mts → types-CoMjNmkF.d.mts}

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition } from "./index-CkW0flkU.mjs";
+import { V as ResourceDefinition } from "./index-C1JSBan-.mjs";
 import { z } from "zod";
 
 //#region src/integrations/mcp/types.d.ts
@@ -93,6 +93,17 @@ interface ToolDefinition<TSession = McpAuthResult> {
   outputSchema?: Record<string, z.ZodTypeAny>;
   annotations?: ToolAnnotations;
   handler: (input: Record<string, unknown>, ctx: ToolContext<TSession>) => Promise<CallToolResult>;
+  /**
+   * Origin label used by collision diagnostics — names BOTH the resource
+   * and the surface that produced this tool (`'crud:post:list'`,
+   * `'action:post:approve'`, `'route:post:GET /export'`,
+   * `'preset:softDelete:post:restore'`). When two tools share a name,
+   * `createMcpServer()` prints both labels so the host can see which
+   * surfaces collided without spelunking through the MCP SDK's stack
+   * trace. Optional — hand-written tools without a `source` simply
+   * appear as `'(unknown)'` in collision messages.
+   */
+  source?: string;
 }
 /** Output of definePrompt() — plain data, not yet registered */
 interface PromptDefinition {