@classytic/arc 2.18.3 → 2.18.5

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { c as McpAuthResult, l as McpPluginOptions } from "../../types-BWBcb88c.mjs";
+import { c as McpAuthResult, l as McpPluginOptions } from "../../types-D60PFwfG.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-CzKdt3B8.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-D1wuRD2c.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/streamline.mjs

@@ -1,4 +1,5 @@
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-j4aJm1Wg.mjs";
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-DkO8Nk6-.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-BQcW6_Kq.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**
@@ -293,7 +294,9 @@ const streamlinePluginImpl = async (fastify, options) => {
 				}, `Failed to bridge ${eventName}`);
 			});
 		});
-		if (enableStreaming && wf.container?.eventBus) fastify.get(`${routePrefix}/runs/:runId/stream`, { preHandler: authPreHandler }, async (request, reply) => {
+		if (enableStreaming && wf.container?.eventBus) fastify.get(`${routePrefix}/runs/:runId/stream`, { preHandler: [async (request) => {
+			promoteStreamTokenToHeader(request);
+		}, ...authPreHandler] }, async (request, reply) => {
 			if (!await checkPerm("get", request)) throw new ForbiddenError();
 			const { runId } = request.params;
 			await assertRunVisible(request, runId);
@@ -303,7 +306,8 @@ const streamlinePluginImpl = async (fastify, options) => {
 				"Content-Type": "text/event-stream",
 				"Cache-Control": "no-cache",
 				Connection: "keep-alive",
-				"X-Accel-Buffering": "no"
+				"X-Accel-Buffering": "no",
+				...forwardedStreamHeaders(reply)
 			});
 			reply.raw.flushHeaders();
 			const terminalEvents = new Set(STREAMLINE_TERMINAL_EVENTS);

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -1,4 +1,4 @@
-import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-Dqclzjy7.mjs";
+import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-DnCqL3aa.mjs";
 
 //#region src/integrations/websocket-pushref-redis.d.ts
 /**

package/dist/integrations/websocket-redis.d.mts

@@ -1,4 +1,4 @@
-import { f as WebSocketAdapter } from "../websocket-BFBT5rH-.mjs";
+import { f as WebSocketAdapter } from "../websocket-MlYlrYq0.mjs";
 
 //#region src/integrations/websocket-redis.d.ts
 interface RedisLike {

package/dist/integrations/websocket.d.mts

@@ -1,3 +1,3 @@
-import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-BFBT5rH-.mjs";
-import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore } from "../pushref-registry-Dqclzjy7.mjs";
-export { AuthResult, GeoPoint, GeoPublishOpts, GeoRoom, GeoRoomOptions, LocalWebSocketAdapter, MemoryPushRefStore, Principal, PushRefRegistry, PushRefRegistryOptions, PushRefStore, RoomManager, SerializedEntry, WebSocketAdapter, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, websocketPlugin };
+import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
+import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore } from "../pushref-registry-DnCqL3aa.mjs";
+export { type AuthResult, type GeoPoint, type GeoPublishOpts, GeoRoom, type GeoRoomOptions, LocalWebSocketAdapter, MemoryPushRefStore, type Principal, PushRefRegistry, type PushRefRegistryOptions, type PushRefStore, RoomManager, type SerializedEntry, type WebSocketAdapter, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, websocketPlugin };

package/dist/{loadResources-CwXt9MCh.mjs → loadResources-B8UmpITt.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-XHNeUWpu.mjs → loadResourcesFromEntry-BTlFEx05.mjs}

@@ -1,4 +1,4 @@
-import { t as ResourceRegistry } from "./ResourceRegistry-CWmOggxS.mjs";
+import { t as ResourceRegistry } from "./ResourceRegistry-5fKZwhK_.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/{mcpPlugin-CzKdt3B8.mjs → mcpPlugin-D1wuRD2c.mjs}

@@ -1,15 +1,14 @@
-import { p as isArcError, t as ArcError } from "./errors-j4aJm1Wg.mjs";
-import { t as BaseController } from "./BaseController-B-uXzf6I.mjs";
-import { N as normalizePermissionResult } from "./permissions-3uzwkbQt.mjs";
-import { t as executePipeline } from "./pipe-9Tl-OAus.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-D4sqiokR.mjs";
-import { n as validateAggregations } from "./validate-0__MuUsK.mjs";
-import { n as executeAggregation } from "./buildHandler-Cvrc2p7r.mjs";
-import { t as pluralize } from "./pluralize-BxdUl2P4.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CX9QIMTd.mjs";
-import { i as shouldRejectAdditionalProperties, r as schemaIRToZodShape, t as normalizeSchemaIR } from "./schemaIR-CE6USIRi.mjs";
-import { createHash, randomUUID } from "node:crypto";
+import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
+import { t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
+import { N as normalizePermissionResult } from "./permissions-BPB1xqGf.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
+import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
+import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
+import { i as shouldRejectAdditionalProperties, r as schemaIRToZodShape, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";
+import { n as validateAggregations } from "./validate-CRcaWzp2.mjs";
+import { n as executeAggregation } from "./buildHandler-B0qvAguf.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
+import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 import { z } from "zod";
 //#region src/integrations/mcp/createMcpServer.ts

package/dist/{memory-TdTHCS9-.mjs → memory-CLXA2VeJ.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-Da2EUPi9.mjs → metrics-fdxI5mn_.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-QYma8mdC.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CHNQIhcb.mjs";
 import { RouteHandlerMethod } from "fastify";
 
 //#region src/middleware/middleware.d.ts

package/dist/middleware/index.mjs

@@ -1,5 +1,5 @@
-import { t as CRUD_OPERATIONS } from "../constants-TrJVIJl0.mjs";
-import { t as multipartBody } from "../multipartBody-709YcXi1.mjs";
+import { t as CRUD_OPERATIONS } from "../constants-gaEeMlz-.mjs";
+import { t as multipartBody } from "../multipartBody-CHEQSZ6G.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/{openapi-ButnRyOM.mjs → openapi-xVJibapr.mjs}

@@ -1,8 +1,8 @@
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-DatAaVNj.mjs";
-import { t as pluralize } from "./pluralize-BxdUl2P4.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CX9QIMTd.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-DGCCp-kP.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-U0MnO9vd.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
+import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-CagItpxI.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/permissions/index.d.mts

@@ -1,3 +1,3 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-CKLrhyOb.mjs";
-import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-vcWUGkwf.mjs";
-export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RequireAgentScopeOptions, RequireMandateOptions, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-C7ahdGYf.mjs";
+import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-CRKiiP5o.mjs";
+export { type ConnectEventsOptions, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, type PermissionCheck, type PermissionContext, type PermissionEventBus, type PermissionResult, type RequireAgentScopeOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/permissions/index.mjs

@@ -1,3 +1,3 @@
-import { A as requireMandate, C as requireAuth, D as when, E as roles, F as applyFieldWritePermissions, I as fields, L as resolveEffectiveRoles, N as normalizePermissionResult, O as requireAgentScope, P as applyFieldReadPermissions, S as not, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyPermissionResult, k as requireDPoP, l as createRoleHierarchy, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "../permissions-3uzwkbQt.mjs";
-import { n as normalizeRoles, t as getUserRoles } from "../types-D57iXYb8.mjs";
+import { A as requireMandate, C as requireAuth, D as when, E as roles, F as applyFieldWritePermissions, I as fields, L as resolveEffectiveRoles, N as normalizePermissionResult, O as requireAgentScope, P as applyFieldReadPermissions, S as not, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyPermissionResult, k as requireDPoP, l as createRoleHierarchy, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "../permissions-BPB1xqGf.mjs";
+import { n as normalizeRoles, t as getUserRoles } from "../types-XTApa8b6.mjs";
 export { adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/{permissions-3uzwkbQt.mjs → permissions-BPB1xqGf.mjs}

@@ -1,7 +1,7 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Bi0r0vjG.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { t as MemoryCacheStore } from "./memory-TdTHCS9-.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-bHblZ9YN.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { t as MemoryCacheStore } from "./memory-CLXA2VeJ.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/fields.ts
 /**

package/dist/{pipe-9Tl-OAus.mjs → pipe-BOLmGIxa.mjs}

@@ -1,4 +1,4 @@
-import { r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
+import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-QYma8mdC.mjs";
+import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-CHNQIhcb.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/pipeline/index.mjs

@@ -1,4 +1,4 @@
-import { n as pipe, t as executePipeline } from "../pipe-9Tl-OAus.mjs";
+import { n as pipe, t as executePipeline } from "../pipe-BOLmGIxa.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,9 +1,8 @@
-import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-QYma8mdC.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-BdCl_eNo.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-BSEDGXKC.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-_Lp2k9M3.mjs";
-import { t as TracingOptions } from "../tracing-Bnb1-YVd.mjs";
-import * as _$node_stream0 from "node:stream";
+import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-CHNQIhcb.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-Cxb0ROIw.mjs";
+import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-D_eBCfNr.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-BtUUDPEa.mjs";
+import { t as TracingOptions } from "../tracing-D8jlGXP7.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 
@@ -103,7 +102,7 @@ declare module "fastify" {
      * @example
      * return reply.stream(csvReadable, { contentType: 'text/csv', filename: 'export.csv' });
      */
-    stream(source: _$node_stream0.Readable | Buffer | AsyncIterable<unknown>, options: {
+    stream(source: import("node:stream").Readable | Buffer | AsyncIterable<unknown>, options: {
       contentType: string;
       filename?: string;
       statusCode?: number;

package/dist/plugins/index.mjs

@@ -1,15 +1,15 @@
-import { p as MUTATION_OPERATIONS } from "../constants-TrJVIJl0.mjs";
-import { c as getOrgId } from "../types-Bi0r0vjG.mjs";
-import { n as requestContext } from "../requestContext-DDLS3NVU.mjs";
-import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
-import { t as HookSystem } from "../HookSystem-BfCpWbwM.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CWmOggxS.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-C0DdKiYB.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bua97SEt.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-Da2EUPi9.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-DXHVxrrj.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-Xq8UtuQx.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-C0K8KQLx.mjs";
+import { p as MUTATION_OPERATIONS } from "../constants-gaEeMlz-.mjs";
+import { c as getOrgId } from "../types-bHblZ9YN.mjs";
+import { n as requestContext } from "../requestContext-BZKOr13H.mjs";
+import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
+import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-5fKZwhK_.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Dxf6P_kV.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-CfUjwjDk.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-Dk-71iIz.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.mjs

@@ -1,4 +1,4 @@
-import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
+import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Bnb1-YVd.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-D8jlGXP7.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.18.3";
+	const resolvedVersion = serviceVersion ?? "2.18.5";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
-import { rt as PresetResult } from "../index-QYma8mdC.mjs";
-import { i as RequestScope } from "../types-BJwJN2Pg.mjs";
-import { c as PermissionCheck } from "../fields-CKLrhyOb.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-C5q8fuEt.mjs";
+import { rt as PresetResult } from "../index-CHNQIhcb.mjs";
+import { i as RequestScope } from "../types-LNebCoJx.mjs";
+import { c as PermissionCheck } from "../fields-C7ahdGYf.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Co_PQpeQ.mjs";
 
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,7 @@
-import { i as NotFoundError, u as ValidationError } from "../errors-j4aJm1Wg.mjs";
-import { c as getOrgId, g as getUserId } from "../types-Bi0r0vjG.mjs";
-import { C as requireAuth, y as allowPublic } from "../permissions-3uzwkbQt.mjs";
-import { t as multipartBody } from "../multipartBody-709YcXi1.mjs";
+import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
+import { c as getOrgId, g as getUserId } from "../types-bHblZ9YN.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-BPB1xqGf.mjs";
+import { t as multipartBody } from "../multipartBody-CHEQSZ6G.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-QYma8mdC.mjs";
+import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-CHNQIhcb.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CF79RHEo.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BtyFwTO4.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, rt as PresetResult } from "../index-QYma8mdC.mjs";
+import { J as CrudRouteKey, rt as PresetResult } from "../index-CHNQIhcb.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,5 @@
-import "../constants-TrJVIJl0.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-Bi0r0vjG.mjs";
+import "../constants-gaEeMlz-.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-bHblZ9YN.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-QYma8mdC.mjs";
-import { c as PermissionCheck } from "../fields-CKLrhyOb.mjs";
+import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-CHNQIhcb.mjs";
+import { c as PermissionCheck } from "../fields-C7ahdGYf.mjs";
 
 //#region src/presets/search.d.ts
 /**

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as requireAuth, y as allowPublic } from "../permissions-3uzwkbQt.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-BPB1xqGf.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-CF79RHEo.mjs → presets-BtyFwTO4.mjs}

@@ -1,5 +1,5 @@
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
-import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-3uzwkbQt.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
+import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-BPB1xqGf.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{queryCachePlugin-CnAeFqju.mjs → queryCachePlugin-emHb0CuX.mjs}

@@ -1,7 +1,7 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { t as MemoryCacheStore } from "./memory-TdTHCS9-.mjs";
-import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-B3yyBEyH.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-Cd316u_y.mjs";
+import { t as MemoryCacheStore } from "./memory-CLXA2VeJ.mjs";
+import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{queryCachePlugin-Bd2tYgh5.d.mts → queryCachePlugin-xzFyKAjT.d.mts}

@@ -1,5 +1,5 @@
-import { r as CacheStore } from "./interface-DL7LlWS5.mjs";
-import { i as QueryCache } from "./QueryCache-Dsyv2mLS.mjs";
+import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
+import { i as QueryCache } from "./QueryCache-TRfXau3W.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/cache/queryCachePlugin.d.ts

package/dist/{redis-3hqH_Qk_.d.mts → redis-C3W0qbz8.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-CsrGR8LF.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
 
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {

package/dist/{redis-stream-BtEUtjxZ.d.mts → redis-stream-DsP1vqZB.d.mts}

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-CaaXM5Y1.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-IEn7Tn-Q.mjs";
 
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {

package/dist/{rateLimit-yKvxWAky.mjs → registerRoute-CPmdkZGu.mjs}

@@ -1,4 +1,6 @@
-import { n as requestContext } from "./requestContext-DDLS3NVU.mjs";
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { M as evaluateAndApplyPermission } from "./permissions-BPB1xqGf.mjs";
+import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -157,6 +159,76 @@ function describeValue(v) {
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
 //#endregion
+//#region src/core/middlewares/permissions.ts
+/**
+* Build a PermissionContext from a Fastify request. Extracted so the CRUD
+* permission middleware and the dynamic action-permission check use the same
+* field layout — divergence here silently broke policy filters for actions.
+*/
+function buildPermissionContext(req, opts) {
+	const reqWithExtras = req;
+	const params = req.params;
+	return {
+		user: reqWithExtras.user ?? null,
+		request: req,
+		resource: opts.resource,
+		action: opts.action,
+		resourceId: opts.resourceId ?? params?.id,
+		params,
+		data: opts.data ?? req.body
+	};
+}
+/**
+* Static per-route CRUD permission gate. The permission and action are known
+* at route-registration time, so the gate is a plain preHandler.
+*
+* Actions use the dynamic counterpart `buildActionPermissionMw` — their
+* permission is resolved from `body.action` at request time.
+*/
+function buildCrudPermissionMw(permissionCheck, resourceName, action) {
+	if (!permissionCheck) return null;
+	return async (req, reply) => {
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action
+		}), req, reply);
+	};
+}
+/**
+* Dynamic per-action permission gate for the action router.
+*
+* Resolves the permission from `body.action` at request time and runs
+* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
+* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
+* (idempotency) and `routeGuards` run. Previously this check lived inside
+* the main action handler, which meant idempotency recorded unauthorized
+* requests and route guards saw unfiltered scope — the very divergence
+* routerShared exists to prevent.
+*
+* Also acts as a defensive fallback for invalid action names — the
+* `oneOf` body schema normally rejects these at AJV validation, but
+* hosts that disable schema validation still get a 400 here.
+*/
+function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
+	const enumSet = new Set(actionEnum);
+	const validActions = [...actionEnum];
+	return async (req, reply) => {
+		const body = req.body ?? {};
+		const action = body.action;
+		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
+		const permissionCheck = actionPermissions[action] ?? globalAuth;
+		if (!permissionCheck) return;
+		const { action: _discard, ...data } = body;
+		const params = req.params;
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action,
+			resourceId: params?.id,
+			data
+		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+	};
+}
+//#endregion
 //#region src/core/middlewares/pluginMw.ts
 /**
 * Pick the request-lifecycle plugin middleware for an HTTP method:
@@ -204,4 +276,39 @@ function buildRateLimitConfig(rateLimit) {
 	} };
 }
 //#endregion
-export { resolveRoutePreHandlers as a, buildArcDecorator as c, buildPreHandlerChain as i, resolveRouterPluginMw as n, buildAuthMiddleware as o, selectPluginMw as r, buildAuthMiddlewareForPermissions as s, buildRateLimitConfig as t };
+//#region src/core/middlewares/registerRoute.ts
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
+//#endregion
+export { buildActionPermissionMw as a, resolveRoutePreHandlers as c, buildArcDecorator as d, selectPluginMw as i, buildAuthMiddleware as l, buildRateLimitConfig as n, buildCrudPermissionMw as o, resolveRouterPluginMw as r, buildPreHandlerChain as s, tryRegisterRoute as t, buildAuthMiddlewareForPermissions as u };

package/dist/registry/index.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-QYma8mdC.mjs";
+import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-CHNQIhcb.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-Br15xdGM.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-CWmOggxS.mjs";
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-Bm9LjWKs.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-5fKZwhK_.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-Br15xdGM.mjs → registry-Bm9LjWKs.mjs}

@@ -1,4 +1,4 @@
-import { t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
+import { t as CRUD_OPERATIONS } from "./constants-gaEeMlz-.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**

package/dist/{replyHelpers-DXHVxrrj.mjs → replyHelpers-67tRawQZ.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{schemaIR-CE6USIRi.mjs → schemaIR-D1MJwqmp.mjs}

@@ -1,4 +1,4 @@
-import { a as toJsonSchema } from "./schemaConverter-DatAaVNj.mjs";
+import { a as toJsonSchema } from "./schemaConverter-U0MnO9vd.mjs";
 import { z } from "zod";
 //#region src/core/schemaIR.ts
 /**