@classytic/arc 2.18.1 → 2.18.3

package/dist/{index-C000faom.d.mts → index-QYma8mdC.d.mts}

@@ -1,7 +1,7 @@
-import { a as QueryCacheConfig } from "./QueryCache-8YmAQ-zW.mjs";
-import { i as RequestScope } from "./types-CfapW2t8.mjs";
-import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-DqZLp5d6.mjs";
-import { n as DomainEvent } from "./EventTransport-B1GFiYUy.mjs";
+import { a as QueryCacheConfig } from "./QueryCache-Dsyv2mLS.mjs";
+import { i as RequestScope } from "./types-BJwJN2Pg.mjs";
+import { c as PermissionCheck, d as UserBase, n as FieldPermissionMap } from "./fields-CKLrhyOb.mjs";
+import { n as DomainEvent } from "./EventTransport-CaaXM5Y1.mjs";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 import * as _$_classytic_repo_core_adapter0 from "@classytic/repo-core/adapter";
@@ -10,6 +10,183 @@ import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantP
 import { LookupSpec } from "@classytic/repo-core/lookup";
 import { FieldRule, SchemaBuilderOptions } from "@classytic/repo-core/schema";
 
+//#region src/core/BodySanitizer.d.ts
+/**
+ * Policy for handling fields the caller lacks write permission for.
+ *
+ * - `'reject'` (default, secure): throw 403 listing the denied fields so
+ *   misconfigurations and attacks surface instead of silently disappearing.
+ * - `'strip'` (legacy): silently drop the field and continue. Preserved for
+ *   apps that relied on the pre-2.9 behaviour — new code should not use it.
+ */
+type FieldWriteDenialPolicy = "reject" | "strip";
+interface BodySanitizerConfig {
+  /** Schema options for field sanitization */
+  schemaOptions: RouteSchemaOptions;
+  /**
+   * What to do when a request contains fields the caller can't write.
+   * Default: `'reject'` — surface the misconfiguration as a 403.
+   */
+  onFieldWriteDenied?: FieldWriteDenialPolicy;
+}
+declare class BodySanitizer {
+  private schemaOptions;
+  private onFieldWriteDenied;
+  constructor(config: BodySanitizerConfig);
+  /**
+   * Strip readonly and system-managed fields from request body.
+   * Prevents clients from overwriting _id, timestamps, __v, etc.
+   *
+   * Also applies field-level write permissions when the request has
+   * field permission metadata.
+   */
+  sanitize(body: AnyRecord, _operation: "create" | "update", req?: IRequestContext, meta?: ArcInternalMetadata): AnyRecord;
+}
+//#endregion
+//#region src/core/controllerTypes.d.ts
+/**
+ * Union of every return shape repo-core's `MinimalRepo.getAll()` is
+ * contractually allowed to produce. See repo-core's `MinimalRepo.getAll`
+ * docstring for the three-way split:
+ *
+ * - `OffsetPaginationResult<TDoc>` — `page` param drives pagination.
+ * - `KeysetPaginationResult<TDoc>` — `sort` + optional `after` drives pagination.
+ * - `TDoc[]` — raw array when neither drives pagination.
+ *
+ * Arc passes the kit's response verbatim; consumers narrow on shape.
+ */
+type ListResult<TDoc> = OffsetPaginationResult<TDoc> | KeysetPaginationResult<TDoc> | TDoc[];
+/**
+ * Discrete cache states reported via the `x-cache` response header.
+ *
+ * - `'HIT'`   — fresh cache entry served, no upstream call made.
+ * - `'STALE'` — stale entry served, upstream refresh scheduled in the background.
+ * - `'MISS'`  — no cache entry; upstream call ran and the result was cached.
+ *
+ * Exported as a literal union so test code and downstream clients can
+ * import + narrow without restating the literal triple.
+ */
+type CacheStatus = "HIT" | "STALE" | "MISS";
+/**
+ * Controller-shape surface that the `Arc*Result` utilities read return
+ * types from. Internal — exported so the utility types can reference
+ * the minimal shape without a circular dependency on the full
+ * `BaseCrudController` / `BaseController` declarations.
+ */
+type ArcControllerLike = {
+  list: (...args: never[]) => unknown;
+  get: (...args: never[]) => unknown;
+  create: (...args: never[]) => unknown;
+  update: (...args: never[]) => unknown;
+  delete: (...args: never[]) => unknown;
+};
+/**
+ * Return type of the controller's `list` method.
+ *
+ * @example
+ * ```ts
+ * class ProductController extends BaseController<Product> {
+ *   async list(ctx: IRequestContext): ArcListResult<this> {
+ *     // return shape inferred from BaseController.list — no need to
+ *     // restate `Promise<IControllerResponse<ListResult<Product>>>`
+ *     return super.list(ctx);
+ *   }
+ * }
+ * ```
+ */
+type ArcListResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["list"]>;
+/** Return type of the controller's `get` method. See {@link ArcListResult}. */
+type ArcGetResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["get"]>;
+/** Return type of the controller's `create` method. See {@link ArcListResult}. */
+type ArcCreateResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["create"]>;
+/** Return type of the controller's `update` method. See {@link ArcListResult}. */
+type ArcUpdateResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["update"]>;
+/** Return type of the controller's `delete` method. See {@link ArcListResult}. */
+type ArcDeleteResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["delete"]>;
+/**
+ * Construction-only options — fields that participate in the
+ * controller's mixin composition / hook identity and **cannot** be
+ * re-tuned post-construction via `configure()`. Pass these once at
+ * construction; if they need to change, build a new controller.
+ *
+ * Layer split (2.15.0): keeping this distinct from the configurable
+ * surface makes the layer explicit at compile time — `configure()`
+ * can't accept these, so accidental "I'll re-name the resource at
+ * runtime" calls fail to typecheck.
+ */
+interface ControllerConstructionOptions {
+  /** Resource name for hook execution (e.g., 'product' → 'product.created'). */
+  resourceName?: string;
+}
+/**
+ * Configurable options — fields arc can forward post-construction via
+ * `BaseController.configure(opts)`. `defineResource()` calls
+ * `configure()` automatically when a user-supplied controller exposes
+ * the method, so resource-level options reach the controller without a
+ * `super(repo, { ... })` dance. Everything except `resourceName` /
+ * `repository` lives here.
+ *
+ * Each field maps 1:1 to a resource-level option on `defineResource()`:
+ * the resource is the public-API source of truth, this interface is
+ * the controller-internal surface arc forwards into.
+ */
+interface ControllerConfigurableOptions {
+  /** Schema options for field sanitization. */
+  schemaOptions?: RouteSchemaOptions;
+  /**
+   * Query parser instance.
+   * Default: Arc built-in query parser (adapter-agnostic).
+   * Swap in MongoKit QueryParser, pgkit parser, etc.
+   */
+  queryParser?: QueryParserInterface;
+  /** Maximum limit for pagination (default: 100). */
+  maxLimit?: number;
+  /** Default limit for pagination (default: 20). */
+  defaultLimit?: number;
+  /**
+   * Default sort applied when the request doesn't specify one.
+   *   - `string` (default: `'-createdAt'`) — Mongo `-field` DESC convention.
+   *   - `false` — disable the default sort entirely (SQL/Drizzle resources
+   *     without a `createdAt` column).
+   */
+  defaultSort?: string | false;
+  /**
+   * Field name used for multi-tenant scoping (default: 'organizationId').
+   * Override to match your schema: 'workspaceId', 'tenantId', 'teamId', etc.
+   * Set to `false` to disable org filtering for platform-universal resources.
+   */
+  tenantField?: string | false;
+  /**
+   * Primary key field name (default: '_id'). Auto-derives from the repo's
+   * own `idField` when unset.
+   */
+  idField?: string;
+  /**
+   * Custom filter matching for policy enforcement.
+   * Provided by the DataAdapter for non-MongoDB databases (SQL, etc.).
+   */
+  matchesFilter?: (item: unknown, filters: Record<string, unknown>) => boolean;
+  /** Cache configuration for the resource. */
+  cache?: ResourceCacheConfig;
+  /** Internal preset fields map (slug, tree, etc.). */
+  presetFields?: {
+    slugField?: string;
+    parentField?: string;
+  };
+  /**
+   * Policy for requests that include fields the caller can't write.
+   * - `'reject'` (default): 403 with denied field names.
+   * - `'strip'`: legacy silent-drop.
+   */
+  onFieldWriteDenied?: FieldWriteDenialPolicy;
+}
+/**
+ * Full constructor options — union of construction-only + configurable.
+ * The constructor accepts everything; `configure()` accepts only
+ * `ControllerConfigurableOptions`.
+ */
+interface BaseControllerOptions extends ControllerConstructionOptions, ControllerConfigurableOptions {}
+//#endregion
 //#region src/hooks/HookSystem.d.ts
 type HookPhase = "before" | "around" | "after";
 type HookOperation = "create" | "update" | "delete" | "restore" | "read" | "list";
@@ -389,100 +566,6 @@ declare class AccessControl {
   private _meta;
 }
 //#endregion
-//#region src/core/BodySanitizer.d.ts
-/**
- * Policy for handling fields the caller lacks write permission for.
- *
- * - `'reject'` (default, secure): throw 403 listing the denied fields so
- *   misconfigurations and attacks surface instead of silently disappearing.
- * - `'strip'` (legacy): silently drop the field and continue. Preserved for
- *   apps that relied on the pre-2.9 behaviour — new code should not use it.
- */
-type FieldWriteDenialPolicy = "reject" | "strip";
-interface BodySanitizerConfig {
-  /** Schema options for field sanitization */
-  schemaOptions: RouteSchemaOptions;
-  /**
-   * What to do when a request contains fields the caller can't write.
-   * Default: `'reject'` — surface the misconfiguration as a 403.
-   */
-  onFieldWriteDenied?: FieldWriteDenialPolicy;
-}
-declare class BodySanitizer {
-  private schemaOptions;
-  private onFieldWriteDenied;
-  constructor(config: BodySanitizerConfig);
-  /**
-   * Strip readonly and system-managed fields from request body.
-   * Prevents clients from overwriting _id, timestamps, __v, etc.
-   *
-   * Also applies field-level write permissions when the request has
-   * field permission metadata.
-   */
-  sanitize(body: AnyRecord, _operation: "create" | "update", req?: IRequestContext, meta?: ArcInternalMetadata): AnyRecord;
-}
-//#endregion
-//#region src/core/controllerTypes.d.ts
-/**
- * Union of every return shape repo-core's `MinimalRepo.getAll()` is
- * contractually allowed to produce. See repo-core's `MinimalRepo.getAll`
- * docstring for the three-way split:
- *
- * - `OffsetPaginationResult<TDoc>` — `page` param drives pagination.
- * - `KeysetPaginationResult<TDoc>` — `sort` + optional `after` drives pagination.
- * - `TDoc[]` — raw array when neither drives pagination.
- *
- * Arc passes the kit's response verbatim; consumers narrow on shape.
- */
-type ListResult<TDoc> = OffsetPaginationResult<TDoc> | KeysetPaginationResult<TDoc> | TDoc[];
-/**
- * Discrete cache states reported via the `x-cache` response header.
- *
- * - `'HIT'`   — fresh cache entry served, no upstream call made.
- * - `'STALE'` — stale entry served, upstream refresh scheduled in the background.
- * - `'MISS'`  — no cache entry; upstream call ran and the result was cached.
- *
- * Exported as a literal union so test code and downstream clients can
- * import + narrow without restating the literal triple.
- */
-type CacheStatus = "HIT" | "STALE" | "MISS";
-/**
- * Controller-shape surface that the `Arc*Result` utilities read return
- * types from. Internal — exported so the utility types can reference
- * the minimal shape without a circular dependency on the full
- * `BaseCrudController` / `BaseController` declarations.
- */
-type ArcControllerLike = {
-  list: (...args: never[]) => unknown;
-  get: (...args: never[]) => unknown;
-  create: (...args: never[]) => unknown;
-  update: (...args: never[]) => unknown;
-  delete: (...args: never[]) => unknown;
-};
-/**
- * Return type of the controller's `list` method.
- *
- * @example
- * ```ts
- * class ProductController extends BaseController<Product> {
- *   async list(ctx: IRequestContext): ArcListResult<this> {
- *     // return shape inferred from BaseController.list — no need to
- *     // restate `Promise<IControllerResponse<ListResult<Product>>>`
- *     return super.list(ctx);
- *   }
- * }
- * ```
- */
-type ArcListResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["list"]>;
-/** Return type of the controller's `get` method. See {@link ArcListResult}. */
-type ArcGetResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["get"]>;
-/** Return type of the controller's `create` method. See {@link ArcListResult}. */
-type ArcCreateResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["create"]>;
-/** Return type of the controller's `update` method. See {@link ArcListResult}. */
-type ArcUpdateResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["update"]>;
-/** Return type of the controller's `delete` method. See {@link ArcListResult}. */
-type ArcDeleteResult<TCtrl extends ArcControllerLike> = ReturnType<TCtrl["delete"]>;
-//#endregion
 //#region src/core/QueryResolver.d.ts
 interface QueryResolverConfig {
   /** Query parser instance (default: Arc built-in parser) */
@@ -551,89 +634,6 @@ declare class QueryResolver {
 }
 //#endregion
 //#region src/core/BaseCrudController.d.ts
-/**
- * Construction-only options — fields that participate in the
- * controller's mixin composition / hook identity and **cannot** be
- * re-tuned post-construction via `configure()`. Pass these once at
- * construction; if they need to change, build a new controller.
- *
- * Layer split (2.15.0): keeping this distinct from the configurable
- * surface makes the layer explicit at compile time — `configure()`
- * can't accept these, so accidental "I'll re-name the resource at
- * runtime" calls fail to typecheck.
- */
-interface ControllerConstructionOptions {
-  /** Resource name for hook execution (e.g., 'product' → 'product.created'). */
-  resourceName?: string;
-}
-/**
- * Configurable options — fields arc can forward post-construction via
- * `BaseController.configure(opts)`. `defineResource()` calls
- * `configure()` automatically when a user-supplied controller exposes
- * the method, so resource-level options reach the controller without a
- * `super(repo, { ... })` dance. Everything except `resourceName` /
- * `repository` lives here.
- *
- * Each field maps 1:1 to a resource-level option on `defineResource()`:
- * the resource is the public-API source of truth, this interface is
- * the controller-internal surface arc forwards into.
- */
-interface ControllerConfigurableOptions {
-  /** Schema options for field sanitization. */
-  schemaOptions?: RouteSchemaOptions;
-  /**
-   * Query parser instance.
-   * Default: Arc built-in query parser (adapter-agnostic).
-   * Swap in MongoKit QueryParser, pgkit parser, etc.
-   */
-  queryParser?: QueryParserInterface;
-  /** Maximum limit for pagination (default: 100). */
-  maxLimit?: number;
-  /** Default limit for pagination (default: 20). */
-  defaultLimit?: number;
-  /**
-   * Default sort applied when the request doesn't specify one.
-   *   - `string` (default: `'-createdAt'`) — Mongo `-field` DESC convention.
-   *   - `false` — disable the default sort entirely (SQL/Drizzle resources
-   *     without a `createdAt` column).
-   */
-  defaultSort?: string | false;
-  /**
-   * Field name used for multi-tenant scoping (default: 'organizationId').
-   * Override to match your schema: 'workspaceId', 'tenantId', 'teamId', etc.
-   * Set to `false` to disable org filtering for platform-universal resources.
-   */
-  tenantField?: string | false;
-  /**
-   * Primary key field name (default: '_id'). Auto-derives from the repo's
-   * own `idField` when unset.
-   */
-  idField?: string;
-  /**
-   * Custom filter matching for policy enforcement.
-   * Provided by the DataAdapter for non-MongoDB databases (SQL, etc.).
-   */
-  matchesFilter?: (item: unknown, filters: Record<string, unknown>) => boolean;
-  /** Cache configuration for the resource. */
-  cache?: ResourceCacheConfig;
-  /** Internal preset fields map (slug, tree, etc.). */
-  presetFields?: {
-    slugField?: string;
-    parentField?: string;
-  };
-  /**
-   * Policy for requests that include fields the caller can't write.
-   * - `'reject'` (default): 403 with denied field names.
-   * - `'strip'`: legacy silent-drop.
-   */
-  onFieldWriteDenied?: FieldWriteDenialPolicy;
-}
-/**
- * Full constructor options — union of construction-only + configurable.
- * The constructor accepts everything; `configure()` accepts only
- * `ControllerConfigurableOptions`.
- */
-interface BaseControllerOptions extends ControllerConstructionOptions, ControllerConfigurableOptions {}
 /**
  * Framework-agnostic CRUD controller implementing IController.
  *
@@ -683,6 +683,15 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     parentField?: string;
   };
   protected _cacheConfig?: ResourceCacheConfig;
+  /**
+   * Retained construction-time values so partial `configure()` rebuilds
+   * (e.g. `configure({ schemaOptions })`) reuse them instead of silently
+   * falling back to the sub-component defaults (`-createdAt` sort,
+   * `reject` write-denial) — `defaultSort: false` matters for kits
+   * without a `createdAt` column, `strip` for legacy write semantics.
+   */
+  protected _defaultSort?: string | false;
+  protected _onFieldWriteDenied?: FieldWriteDenialPolicy;
   constructor(repository: TRepository, options?: BaseControllerOptions);
   /**
    * Swap the controller's query parser. Mutates the existing `QueryResolver`
@@ -730,38 +739,16 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    */
   protected getTenantField(): string | undefined;
   /**
-   * Build the canonical repo-options bag from the Fastify request.
-   *
-   * Forwards the cross-kit canonical set (see repo-core's
-   * `STANDARD_REPO_OPTION_KEYS`) into every CRUD repo call so kit
-   * plugins (multi-tenant, audit, audit-trail, observability) get
-   * what they need without per-resource wiring:
-   *
-   * - **Tenant scope** — `[tenantField]: orgId` from `RequestScope`.
-   *   Plugin-scoped repos (mongokit's `multiTenantPlugin`) read tenant
-   *   scope from the TOP of the options bag, not `data.organizationId`.
-   *   Without this stamping, a tenant-scoped repo throws "Missing
-   *   'organizationId' in context" even when arc has injected the
-   *   tenant into the request body.
-   *   Multi-field tenancy from `_tenantFields` (populated by
-   *   `multiTenantPreset`) is merged in.
-   *
-   * - **Audit attribution** — `userId` + `user` from the authenticated
-   *   actor. Mongokit's audit-log / audit-trail plugins read these
-   *   into the `who` column; sqlitekit's audit plugin reads the same
-   *   names. No host-side forwarding needed.
-   *
-   * - **Trace correlation** — `requestId` from Fastify's request id
-   *   for stitching logs / events / downstream calls.
-   *
-   * - **`session` is intentionally NOT auto-set.** Sessions are tied
-   *   to explicit transaction scopes the controller doesn't manage;
-   *   pass `session` inline at the call site when running inside a
-   *   `withTransaction` helper.
+   * Build the canonical repo-options bag (tenant scope, audit
+   * attribution, trace correlation) from the Fastify request. Full
+   * contract + rationale on `buildTenantRepoOptions` in
+   * `crud/requestPipeline.ts` — this delegate exists so host overrides
+   * and duck-typed consumers (aggregation router, MCP bridge) keep the
+   * same `protected` entry point.
    *
    * Method kept named `tenantRepoOptions` for back-compat with hosts
    * that spread `...this.tenantRepoOptions(req)` (10+ call sites in
-   * arc, plus host overrides). The bag has always grown over time —
+   * arc, plus host overrides). The bag has always grown over time —
    * hosts that don't want audit forwarding never read those keys.
    */
   protected tenantRepoOptions(req: IRequestContext): AnyRecord;
@@ -770,15 +757,10 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /** Get hook system from request context (instance-scoped) */
   protected getHooks(req: IRequestContext): HookSystem | null;
   /**
-   * Resolve the repository primary key for mutation calls.
-   *
-   * When the resource declares a custom `idField` (slug, jobId, UUID), the
-   * default behavior is to translate the route id → the fetched doc's `_id`
-   * because most Mongo repositories key mutation methods off `_id`.
-   *
-   * Exception: if the repo exposes a matching `idField` property (e.g.
-   * MongoKit's `new Repository(Model, [], {}, { idField: 'id' })`), the
-   * repo handles lookup itself — pass the route id through unchanged.
+   * Resolve the repository primary key for mutation calls. Translates a
+   * custom route `idField` (slug, jobId, UUID) to the fetched doc's `_id`
+   * unless the repo declares a matching `idField` of its own — see
+   * `resolveMutationRepoId` in `crud/requestPipeline.ts`.
    */
   protected resolveRepoId(id: string, existing: AnyRecord | null): string;
   /**
@@ -828,23 +810,14 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    * or `null` — every truthy non-null shape collapses to `true`.
    */
   protected isExistsTruthy(result: unknown): boolean;
+  /** Assemble the per-request hook context from the protected accessors. */
+  private hookOpContext;
   /**
    * Run `executeBefore` then `executeAround` (or just the executor if no
    * hooks are wired). Returns the around-phase result directly. Throws an
    * `ArcError` (status 400, code `BEFORE_<OP>_HOOK_ERROR`) when the
-   * before-hook fails — the global error handler emits the canonical
-   * `ErrorContract` shape.
-   *
-   * The caller runs `executeAfter` separately via `runAfterHook` — typically
-   * after success-checking the result (delete checks `isDeleteSuccess`,
-   * update checks `if (!item)`).
-   *
-   * **Knobs:**
-   *   - `meta` — passed verbatim into `executeBefore` / `executeAround` opts.
-   *   - `pipeProcessedData` (default `true`) — whether `executeBefore`'s
-   *     return value flows into `executeAround` as the data parameter.
-   *     Set `false` for delete (current behaviour: discards before's
-   *     return, passes original input to around).
+   * before-hook fails. Full contract on `executeHookedOp` in
+   * `crud/requestPipeline.ts`.
    */
   protected runHookedOpUntilResult<TInput, TResult>(req: IRequestContext, args: {
     op: "create" | "update" | "delete";
@@ -868,26 +841,27 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    * Resource-dispatch verbs router. Returns `null` when the request is
    * a regular list query, otherwise returns the dispatch promise.
    *
-   * Verbs (mutually exclusive — first match wins):
-   *   - `?_count=true` → `{ count: number }` via `repo.count()`
-   *   - `?_distinct=field` → `unknown[]` via `repo.distinct(field)`
-   *   - `?_exists=true` → `{ exists: boolean }` via `repo.exists()`
+   * Verbs (mutually exclusive — first match wins):
+   *   - `?_count=true` → `{ count: number }` via `repo.count()`
+   *   - `?_distinct=field` → `unknown[]` via `repo.distinct(field)`
+   *   - `?_exists=true` → `{ exists: boolean }` via `repo.exists()`
    *
    * All verbs share the resolved filter (parsed query + policy filters
    * + tenant scope). Adapters that don't ship the underlying repo
    * method get a `501` so failures surface loudly instead of falling
-   * back to a full table scan.
+   * back to a full table scan. Matching + repo invocation live in
+   * `crud/resourceVerbs.ts`.
    */
   protected dispatchResourceVerb(req: IRequestContext): Promise<IControllerResponse<unknown>> | null;
   /** Resolve filter + tenant/audit options for a dispatch verb. */
   private resolveDispatchScope;
-  /** `?_count=true` → `repo.count(filter)` */
+  /** `?_count=true` → `repo.count(filter)` */
   protected dispatchCount(req: IRequestContext): Promise<IControllerResponse<{
     count: number;
   }>>;
-  /** `?_distinct=field` → `repo.distinct(field, filter)` */
+  /** `?_distinct=field` → `repo.distinct(field, filter)` */
   protected dispatchDistinct(req: IRequestContext, field: string): Promise<IControllerResponse<unknown[]>>;
-  /** `?_exists=true` → `repo.exists(filter)` */
+  /** `?_exists=true` → `repo.exists(filter)` */
   protected dispatchExists(req: IRequestContext): Promise<IControllerResponse<{
     exists: boolean;
   }>>;
@@ -4059,4 +4033,4 @@ interface ValidateOptions {
   strict?: boolean;
 }
 //#endregion
-export { OnTenantDeleteConfig as $, BaseController as $t, RequestIdOptions as A, HookSystem as An, AggregationRateLimit as At, defineResource as B, AuthHelpers as Bt, RequestContext as C, AccessControlConfig as Cn, AggMeasureShorthand as Ct, HealthCheck as D, HookOperation as Dn, AggregationIndexHint as Dt, GracefulShutdownOptions as E, HookHandler as En, AggregationDateRangeRequirement as Et, FastifyWithDecorators as F, beforeCreate as Fn, OperationFilter as Ft, ActionsMap as G, TokenPair as Gt, ActionDefinition as H, Authenticator as Ht, MiddlewareHandler as I, beforeDelete as In, PipelineConfig as It, CrudRouteKey as J, ArcRequest as Jt, ArcFieldRule as K, AnyRecord as Kt, RequestWithExtras as L, beforeUpdate as Ln, PipelineContext as Lt, EventsDecorator as M, afterCreate as Mn, Guard as Mt, FastifyRequestExtras as N, afterDelete as Nn, Interceptor as Nt, HealthOptions as O, HookPhase as On, AggregationMaterializedContext as Ot, FastifyWithAuth as P, afterUpdate as Pn, NextFunction as Pt, MiddlewareConfig as Q, UserOrganization as Qt, RegisterOptions as R, createHookSystem as Rn, PipelineStep as Rt, QueryParserInterface as S, AccessControl as Sn, AggMeasureInput as St, CrudRouterOptions as T, HookContext as Tn, AggregationConfig as Tt, ActionEntry as U, AuthenticatorContext as Ut, ResourceDefinition as V, AuthPluginOptions as Vt, ActionHandlerFn as W, JwtContext as Wt, EventDefinition as X, ObjectId as Xt, CrudSchemas as Y, JWTPayload as Yt, FieldRule$1 as Z, UserLike as Zt, ControllerQueryOptions as _, ArcListResult as _n, FastifyHandler as _t, InferAdapterDoc as a, SlugMixin as an, ResolvedTenantPurge as at, ParsedQuery as b, BodySanitizer as bn, IRequestContext as bt, TypedController as c, BaseControllerOptions as cn, ResourceHookContext as ct, PaginationResult as d, ControllerConstructionOptions as dn, RouteDefinition as dt, SoftDeleteExt as en, OpenApiSchemas as et, IntrospectionData as f, QueryResolver as fn, RouteMcpConfig as ft, ArcInternalMetadata as g, ArcGetResult as gn, ControllerLike as gt, ResourceMetadata as h, ArcDeleteResult as hn, ControllerHandler as ht, ValidationResult as i, SlugExt as in, RateLimitConfig as it, ArcDecorator as j, HookSystemOptions as jn, AggregationsMap as jt, IntrospectionPluginOptions as k, HookRegistration as kn, AggregationMaterializedResult as kt, TypedRepository as l, BaseCrudController as ln, ResourceHooks as lt, RegistryStats as m, ArcCreateResult as mn, RouteSchemaOptions as mt, ConfigError as n, TreeExt as nn, PresetHook as nt, InferDocType as o, BulkExt as on, ResourceCacheConfig as ot, RegistryEntry as p, QueryResolverConfig as pn, RouteMethod as pt, CrudController as q, ApiResponse as qt, ValidateOptions as r, TreeMixin as rn, PresetResult as rt, InferResourceDoc as s, BulkMixin as sn, ResourceConfig as st, RouteHandlerMethod$1 as t, SoftDeleteMixin as tn, PresetFunction as tt, TypedResourceConfig as u, ControllerConfigurableOptions as un, ResourcePermissions as ut, LookupOption as v, ArcUpdateResult as vn, IController as vt, ServiceContext as w, DefineHookOptions as wn, AggregationCacheConfig as wt, PopulateOption as x, BodySanitizerConfig as xn, RouteHandler as xt, OwnershipCheck as y, ListResult as yn, IControllerResponse as yt, ResourceRegistry as z, defineHook as zn, Transform as zt };
+export { OnTenantDeleteConfig as $, BaseController as $t, RequestIdOptions as A, ArcDeleteResult as An, AggregationRateLimit as At, defineResource as B, AuthHelpers as Bt, RequestContext as C, afterUpdate as Cn, AggMeasureShorthand as Ct, HealthCheck as D, createHookSystem as Dn, AggregationIndexHint as Dt, GracefulShutdownOptions as E, beforeUpdate as En, AggregationDateRangeRequirement as Et, FastifyWithDecorators as F, ControllerConfigurableOptions as Fn, OperationFilter as Ft, ActionsMap as G, TokenPair as Gt, ActionDefinition as H, Authenticator as Ht, MiddlewareHandler as I, ControllerConstructionOptions as In, PipelineConfig as It, CrudRouteKey as J, ArcRequest as Jt, ArcFieldRule as K, AnyRecord as Kt, RequestWithExtras as L, ListResult as Ln, PipelineContext as Lt, EventsDecorator as M, ArcListResult as Mn, Guard as Mt, FastifyRequestExtras as N, ArcUpdateResult as Nn, Interceptor as Nt, HealthOptions as O, defineHook as On, AggregationMaterializedContext as Ot, FastifyWithAuth as P, BaseControllerOptions as Pn, NextFunction as Pt, MiddlewareConfig as Q, UserOrganization as Qt, RegisterOptions as R, BodySanitizer as Rn, PipelineStep as Rt, QueryParserInterface as S, afterDelete as Sn, AggMeasureInput as St, CrudRouterOptions as T, beforeDelete as Tn, AggregationConfig as Tt, ActionEntry as U, AuthenticatorContext as Ut, ResourceDefinition as V, AuthPluginOptions as Vt, ActionHandlerFn as W, JwtContext as Wt, EventDefinition as X, ObjectId as Xt, CrudSchemas as Y, JWTPayload as Yt, FieldRule$1 as Z, UserLike as Zt, ControllerQueryOptions as _, HookPhase as _n, FastifyHandler as _t, InferAdapterDoc as a, SlugMixin as an, ResolvedTenantPurge as at, ParsedQuery as b, HookSystemOptions as bn, IRequestContext as bt, TypedController as c, BaseCrudController as cn, ResourceHookContext as ct, PaginationResult as d, AccessControl as dn, RouteDefinition as dt, SoftDeleteExt as en, OpenApiSchemas as et, IntrospectionData as f, AccessControlConfig as fn, RouteMcpConfig as ft, ArcInternalMetadata as g, HookOperation as gn, ControllerLike as gt, ResourceMetadata as h, HookHandler as hn, ControllerHandler as ht, ValidationResult as i, SlugExt as in, RateLimitConfig as it, ArcDecorator as j, ArcGetResult as jn, AggregationsMap as jt, IntrospectionPluginOptions as k, ArcCreateResult as kn, AggregationMaterializedResult as kt, TypedRepository as l, QueryResolver as ln, ResourceHooks as lt, RegistryStats as m, HookContext as mn, RouteSchemaOptions as mt, ConfigError as n, TreeExt as nn, PresetHook as nt, InferDocType as o, BulkExt as on, ResourceCacheConfig as ot, RegistryEntry as p, DefineHookOptions as pn, RouteMethod as pt, CrudController as q, ApiResponse as qt, ValidateOptions as r, TreeMixin as rn, PresetResult as rt, InferResourceDoc as s, BulkMixin as sn, ResourceConfig as st, RouteHandlerMethod$1 as t, SoftDeleteMixin as tn, PresetFunction as tt, TypedResourceConfig as u, QueryResolverConfig as un, ResourcePermissions as ut, LookupOption as v, HookRegistration as vn, IController as vt, ServiceContext as w, beforeCreate as wn, AggregationCacheConfig as wt, PopulateOption as x, afterCreate as xn, RouteHandler as xt, OwnershipCheck as y, HookSystem as yn, IControllerResponse as yt, ResourceRegistry as z, BodySanitizerConfig as zn, Transform as zt };

package/dist/{index-3L-adFJO.d.mts → index-vcWUGkwf.d.mts}

@@ -1,6 +1,6 @@
-import { r as CacheStore, t as CacheLogger } from "./interface-BVkZsvEe.mjs";
-import { i as RequestScope, n as Mandate } from "./types-CfapW2t8.mjs";
-import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-DqZLp5d6.mjs";
+import { r as CacheStore, t as CacheLogger } from "./interface-DL7LlWS5.mjs";
+import { i as RequestScope, n as Mandate } from "./types-BJwJN2Pg.mjs";
+import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-CKLrhyOb.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 
 //#region src/permissions/agent.d.ts

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $t as BaseController, A as RequestIdOptions, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, N as FastifyRequestExtras, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, _n as ArcListResult, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseControllerOptions, d as PaginationResult, dn as ControllerConstructionOptions, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gn as ArcGetResult, gt as ControllerLike, h as ResourceMetadata, hn as ArcDeleteResult, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jt as AggregationsMap, k as IntrospectionPluginOptions, kt as AggregationMaterializedResult, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, mn as ArcCreateResult, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, un as ControllerConfigurableOptions, vn as ArcUpdateResult, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yn as ListResult, yt as IControllerResponse } from "./index-C000faom.mjs";
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-DqZLp5d6.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-CNiryUMN.mjs";
-import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-3L-adFJO.mjs";
-import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-4ZloYFvm.mjs";
+import { $t as BaseController, A as RequestIdOptions, An as ArcDeleteResult, At as AggregationRateLimit, B as defineResource, C as RequestContext, Ct as AggMeasureShorthand, D as HealthCheck, Dt as AggregationIndexHint, E as GracefulShutdownOptions, Et as AggregationDateRangeRequirement, F as FastifyWithDecorators, Fn as ControllerConfigurableOptions, In as ControllerConstructionOptions, J as CrudRouteKey, Jt as ArcRequest, Kt as AnyRecord, L as RequestWithExtras, Ln as ListResult, Mn as ArcListResult, N as FastifyRequestExtras, Nn as ArcUpdateResult, O as HealthOptions, Ot as AggregationMaterializedContext, P as FastifyWithAuth, Pn as BaseControllerOptions, Q as MiddlewareConfig, Qt as UserOrganization, S as QueryParserInterface, St as AggMeasureInput, T as CrudRouterOptions, Tt as AggregationConfig, V as ResourceDefinition, Vt as AuthPluginOptions, X as EventDefinition, Y as CrudSchemas, Yt as JWTPayload, Z as FieldRule, a as InferAdapterDoc, an as SlugMixin, bt as IRequestContext, c as TypedController, cn as BaseCrudController, d as PaginationResult, en as SoftDeleteExt, f as IntrospectionData, g as ArcInternalMetadata, gt as ControllerLike, h as ResourceMetadata, i as ValidationResult, in as SlugExt, it as RateLimitConfig, jn as ArcGetResult, jt as AggregationsMap, k as IntrospectionPluginOptions, kn as ArcCreateResult, kt as AggregationMaterializedResult, l as TypedRepository, m as RegistryStats, mt as RouteSchemaOptions, n as ConfigError, nn as TreeExt, o as InferDocType, on as BulkExt, p as RegistryEntry, q as CrudController, qt as ApiResponse, r as ValidateOptions, rn as TreeMixin, rt as PresetResult, s as InferResourceDoc, sn as BulkMixin, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteMixin, tt as PresetFunction, u as TypedResourceConfig, vt as IController, w as ServiceContext, wt as AggregationCacheConfig, xt as RouteHandler, y as OwnershipCheck, yt as IControllerResponse } from "./index-QYma8mdC.mjs";
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-CKLrhyOb.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, b as DEFAULT_ID_FIELD, f as defineResourceVariants, j as MAX_REGEX_LENGTH, k as HookPhase, m as defineAction, s as getControllerScope, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "./index-Cvo1u9n6.mjs";
+import { A as requireRoles, C as allOf, E as denyAll, M as when, O as requireAuth, S as createOrgPermissions, T as anyOf, a as presets_d_exports, c as readOnly, d as requireOrgRole, f as requireScopeContext, i as ownerWithAdminBypass, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "./index-vcWUGkwf.mjs";
+import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DZOemeGa.mjs";
 
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-TrJVIJl0.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-j4aJm1Wg.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DPwe89qs.mjs";
-import { C as requireAuth, D as when, M as applyFieldWritePermissions, N as fields, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyFieldReadPermissions, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-B1Qy55fg.mjs";
-import { x as getControllerScope } from "./routerShared-Dl0A77Ba.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-B41eZxyM.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B-uXzf6I.mjs";
+import { C as requireAuth, D as when, F as applyFieldWritePermissions, I as fields, P as applyFieldReadPermissions, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-3uzwkbQt.mjs";
+import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-C88uIwd3.mjs";
+import { c as getControllerScope } from "./pipeline-D4sqiokR.mjs";
 //#region src/index.ts
-const version = "2.18.1";
+const version = "2.18.3";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-DQ_rY1J7.mjs → init-DSsdRfk9.mjs}

@@ -917,9 +917,9 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 //#region src/cli/commands/init/dependency-plan.ts
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
-		"@classytic/arc": "^2.17.2",
+		"@classytic/arc": "^2.18.3",
 		"@classytic/primitives": "^0.6.0",
-		"@classytic/repo-core": "^0.5.0",
+		"@classytic/repo-core": "^0.6.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -938,7 +938,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	},
 	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.11" },
 	adapterMongokit: {
-		"@classytic/mongokit": "^3.14.0",
+		"@classytic/mongokit": "^3.16.0",
 		mongoose: "^9.6.2"
 	},
 	devCommon: {

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
-import { n as DomainEvent } from "../EventTransport-B1GFiYUy.mjs";
-import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BZMUP7Gr.mjs";
+import { n as DomainEvent } from "../EventTransport-CaaXM5Y1.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BFBT5rH-.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/event-gateway.mjs

@@ -4,7 +4,7 @@ const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-jh5OqFjR.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-Xq8UtuQx.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,