@classytic/arc 2.18.4 → 2.19.0

package/dist/{core-C88uIwd3.mjs → core-Ba-6Sue6.mjs}

@@ -1,58 +1,18 @@
-import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
+import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-gaEeMlz-.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Bi0r0vjG.mjs";
-import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-xAQeDyU_.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B-uXzf6I.mjs";
-import { a as resolveRoutePreHandlers, c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-3uzwkbQt.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
-import { t as applyPresets } from "./presets-CF79RHEo.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-DatAaVNj.mjs";
-import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-D4sqiokR.mjs";
-import { t as pluralize } from "./pluralize-BxdUl2P4.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CX9QIMTd.mjs";
-//#region src/core/middlewares/fieldWrite.ts
-/**
-* Build a preHandler that enforces field-write permissions on the request body.
-*
-* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
-* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
-* never went through that path — so a host that declared
-* `fields: { role: fields.writableBy(['admin']) }` and a custom
-* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
-*
-* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
-* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
-* bodies don't necessarily mirror the resource's adapter shape, and we'd
-* generate surprising 403s by enforcing rules tied to that shape.
-*
-* Returns `null` when the resource has no field permissions configured — the
-* caller should then skip wiring it into the preHandler chain.
-*/
-function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
-	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
-	return async (request, _reply) => {
-		const body = request.body;
-		if (!body || typeof body !== "object" || Array.isArray(body)) return;
-		const scope = request.scope ?? PUBLIC_SCOPE;
-		if (isElevated(scope)) return;
-		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
-		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
-		request.body = filtered;
-	};
-}
-/**
-* True for HTTP methods that carry a request body and should run the
-* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
-*/
-function methodCarriesBody(method) {
-	const m = method.toUpperCase();
-	return m === "POST" || m === "PUT" || m === "PATCH";
-}
-//#endregion
+import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
+import { p as assertValidConfig, x as getDefaultCrudSchemas } from "./utils-C6QQ9-hd.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
+import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-BPB1xqGf.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
+import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-D7NGwcAR.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-BdV8DDwU.mjs";
+import { t as applyPresets } from "./presets-BtyFwTO4.mjs";
+import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
+import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
 //#region src/core/aggregation/defineAggregation.ts
 /**
 * Declare a single resource aggregation. Exported configs flow into
@@ -99,13 +59,52 @@ function defineAggregation(config) {
 	return config;
 }
 //#endregion
+//#region src/core/middlewares/fieldWrite.ts
+/**
+* Build a preHandler that enforces field-write permissions on the request body.
+*
+* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
+* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
+* never went through that path — so a host that declared
+* `fields: { role: fields.writableBy(['admin']) }` and a custom
+* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
+*
+* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
+* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
+* bodies don't necessarily mirror the resource's adapter shape, and we'd
+* generate surprising 403s by enforcing rules tied to that shape.
+*
+* Returns `null` when the resource has no field permissions configured — the
+* caller should then skip wiring it into the preHandler chain.
+*/
+function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
+	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
+	return async (request, _reply) => {
+		const body = request.body;
+		if (!body || typeof body !== "object" || Array.isArray(body)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
+		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+		request.body = filtered;
+	};
+}
+/**
+* True for HTTP methods that carry a request body and should run the
+* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
+*/
+function methodCarriesBody(method) {
+	const m = method.toUpperCase();
+	return m === "POST" || m === "PUT" || m === "PATCH";
+}
+//#endregion
 //#region src/core/createCrudRouter.ts
 /**
 * Mount custom routes (from presets or user-defined `routes`) on Fastify.
 * `wrapHandler` is derived inline from `!route.raw`.
 */
 function createCustomRoutes(fastify, routes, controller, options) {
-	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied } = options;
+	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied, extensions } = options;
 	for (const route of routes) {
 		const routeWithRefs = route;
 		const hasHandler = route.handler !== void 0;
@@ -178,7 +177,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 				}
 				return result;
 			} : handler,
-			...rateLimitConfig ? { config: rateLimitConfig } : {}
+			...buildRouteConfig(rateLimitConfig, extensions)
 		}, {
 			resourceName,
 			op: opName
@@ -195,7 +194,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 * @param options    - Router configuration
 */
 function createCrudRouter(fastify, controller, options = {}) {
-	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField } = options;
+	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField, extensions } = options;
 	const rateLimitConfig = buildRateLimitConfig(rateLimit);
 	const resourceHasQueryCache = fastify.hasDecorator("queryCache") && controller && typeof controller._cacheConfig !== "undefined" && controller._cacheConfig !== void 0;
 	const pluginMw = resolveRouterPluginMw(fastify, Boolean(resourceHasQueryCache));
@@ -296,7 +295,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 					}, defaultSchemas[spec.op], schemas[spec.op]),
 					preHandler: preHandler.length > 0 ? preHandler : void 0,
 					handler: handlers[spec.op],
-					...rateLimitConfig ? { config: rateLimitConfig } : {}
+					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
 					resourceName,
 					op: spec.op
@@ -314,7 +313,8 @@ function createCrudRouter(fastify, controller, options = {}) {
 		routeGuards,
 		tenantScopeMw,
 		fieldPermissions,
-		onFieldWriteDenied
+		onFieldWriteDenied,
+		extensions
 	});
 }
 function buildCrudHandlers(ctrl, pipeline, resourceName) {
@@ -1243,10 +1243,11 @@ function buildResourcePlugin(resource) {
 				pipe: resource.pipe,
 				fields: resource.fields,
 				onFieldWriteDenied: resource.onFieldWriteDenied,
-				idField: resource.idField
+				idField: resource.idField,
+				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-DGCCp-kP.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-B_WzBFyf.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1256,11 +1257,12 @@ function buildResourcePlugin(resource) {
 					permissions: resource.permissions,
 					routeGuards: resource.routeGuards,
 					pipeline: resource.pipe,
-					rateLimit: resource.rateLimit
+					rateLimit: resource.rateLimit,
+					extensions: resource.extensions
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-Ca77b8iK.mjs"), import("./validate-0__MuUsK.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B_G_nIjm.mjs"), import("./validate-CRcaWzp2.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1333,6 +1335,7 @@ var ResourceDefinition = class {
 	*/
 	onFieldWriteDenied;
 	cache;
+	extensions;
 	referenceData;
 	/**
 	* Per-resource MCP opt-out. `false` keeps the resource out of every
@@ -1430,6 +1433,7 @@ var ResourceDefinition = class {
 		this.fields = config.fields;
 		this.onFieldWriteDenied = config.onFieldWriteDenied;
 		this.cache = config.cache;
+		this.extensions = config.extensions ? Object.freeze({ ...config.extensions }) : void 0;
 		this.mcp = config.mcp !== false;
 		this.referenceData = config.referenceData === true;
 		this.tenantField = config.tenantField;

package/dist/{createActionRouter-DGCCp-kP.mjs → createActionRouter-B_WzBFyf.mjs}

@@ -1,10 +1,9 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import "./constants-TrJVIJl0.mjs";
-import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, r as selectPluginMw, s as buildAuthMiddlewareForPermissions, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-BEYn0ylk.mjs";
-import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-D4sqiokR.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CE6USIRi.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import "./constants-gaEeMlz-.mjs";
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-D7NGwcAR.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-BdV8DDwU.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -19,7 +18,7 @@ var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 * (keyed by `body.action` at request time).
 */
 function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [] } = config;
+	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [], extensions } = config;
 	const allActionNames = Object.keys(actions);
 	if (allActionNames.length === 0) {
 		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
@@ -122,7 +121,7 @@ function createActionRouter(fastify, config) {
 			schema: routeSchema,
 			attachValidation: true,
 			preHandler: preHandler.length > 0 ? preHandler : void 0,
-			...rateLimitConfig ? { config: rateLimitConfig } : {},
+			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;
 				const id = hasId ? req.params.id : "";
@@ -136,7 +135,8 @@ function createActionRouter(fastify, config) {
 				const handler = wrappedHandlers.get(action);
 				if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionSubset.join(", ")}`, { validActions: actionSubset });
 				try {
-					return sendControllerResponse(reply, await handler(id, data, req), req);
+					sendControllerResponse(reply, await handler(id, data, req), req);
+					return reply;
 				} catch (error) {
 					if (onError) {
 						const { statusCode, error: errorMsg, code } = onError(error, action, id);

package/dist/{createAggregationRouter-Ca77b8iK.mjs → createAggregationRouter-B_G_nIjm.mjs}

@@ -1,7 +1,7 @@
-import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { c as buildArcDecorator, i as buildPreHandlerChain, n as resolveRouterPluginMw, o as buildAuthMiddleware, r as selectPluginMw, t as buildRateLimitConfig } from "./rateLimit-yKvxWAky.mjs";
-import { n as validateAggregations } from "./validate-0__MuUsK.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-Cvrc2p7r.mjs";
+import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-BdV8DDwU.mjs";
+import { n as validateAggregations } from "./validate-CRcaWzp2.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-B0qvAguf.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is

package/dist/{createApp-J1iPXY9p.mjs → createApp--703hQE1.mjs}

@@ -1,6 +1,6 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
+import { n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
 import Fastify from "fastify";
 import qs from "qs";
 //#region src/factory/presets.ts
@@ -74,7 +74,7 @@ const productionPreset = {
 */
 function devLoggerConfig() {
 	try {
-		if (typeof import.meta?.resolve === "function") {
+		if (typeof import.meta.resolve === "function") {
 			import.meta.resolve("pino-pretty");
 			return {
 				level: "debug",
@@ -202,7 +202,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Bw4bUDEO.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-DJG2D7sy.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -239,15 +239,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-C0DdKiYB.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-_NJeDd1_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-CnAeFqju.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-emHb0CuX.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-TdTHCS9-.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-CLXA2VeJ.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -256,19 +256,19 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-BrY1W6U8.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-CfUjwjDk.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-Da2EUPi9.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-fdxI5mn_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-C0K8KQLx.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-Dk-71iIz.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -337,7 +337,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-BzhyVWfn.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-COpYKt2h.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -347,7 +347,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-Bua97SEt.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-Dxf6P_kV.mjs").then((n) => n.r);
 	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
@@ -448,7 +448,7 @@ async function registerResources(fastify, config) {
 	let discoveryPath;
 	let discoveryYieldedZero = false;
 	if (resolvedResources === void 0 && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-CwXt9MCh.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-B8UmpITt.mjs").then((n) => n.n);
 		const { resolve, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const rawDir = config.resourceDir;
@@ -896,7 +896,7 @@ async function createApp(options) {
 	await registerErrorHandler(fastify, config, trackPlugin);
 	await registerResources(fastify, config);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-DXHVxrrj.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-67tRawQZ.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {

package/dist/docs/index.d.mts

@@ -1,5 +1,5 @@
-import { p as RegistryEntry } from "../index-QYma8mdC.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-DLle0R07.mjs";
+import { p as RegistryEntry } from "../index-CUTG2Cuo.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
-import { t as getUserRoles } from "../types-D57iXYb8.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-ButnRyOM.mjs";
+import { t as getUserRoles } from "../types-XTApa8b6.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-DZ-5a5Op.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-BzhyVWfn.mjs → elevation-COpYKt2h.mjs}

@@ -1,6 +1,6 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import fp from "fastify-plugin";
 //#region src/scope/elevation.ts
 var elevation_exports = /* @__PURE__ */ __exportAll({

package/dist/encryption/index.d.mts

@@ -0,0 +1,222 @@
+import { FastifyPluginAsync, FastifyRequest } from "fastify";
+
+//#region src/encryption/types.d.ts
+/** JWE key-management algorithm — the protected-header `alg`. */
+type JweAlg = "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512" | "ECDH-ES" | "ECDH-ES+A256KW" | "A256GCMKW" | "dir";
+/** JWE content-encryption algorithm — the protected-header `enc`. AEAD only. */
+type JweEnc = "A128GCM" | "A192GCM" | "A256GCM";
+/** Encryption strategy for a route's response. */
+type EncryptionMode = "jwe" | "fields";
+/**
+ * Opaque key material. For `jwe` mode this is a `jose` `KeyLike` /
+ * `CryptoKey` / `Uint8Array`; for `fields` mode a 32-byte secret
+ * (`Buffer` / `Uint8Array`). Kept `unknown` at the contract layer so the
+ * `KeyProvider` interface carries no hard `jose` type dependency — hosts
+ * without `jose` installed can still implement field-mode providers.
+ */
+type KeyMaterial = unknown;
+/** A key paired with its identifier — what encrypt operations consume. */
+interface ActiveKey {
+  /** Key id, stamped into the JWE `kid` header / field envelope for rotation. */
+  readonly kid: string;
+  /** The key material (public key for JWE, 32-byte secret for fields). */
+  readonly key: KeyMaterial;
+  /** Optional per-key `alg` override (else the plugin default applies). */
+  readonly alg?: JweAlg;
+}
+/** Context handed to the key provider so resolution can be request-scoped. */
+interface KeyContext {
+  readonly request: FastifyRequest;
+}
+type MaybePromise<T> = T | Promise<T>;
+/**
+ * Pluggable key resolution. Arc owns the request-time plumbing — `kid` →
+ * key, algorithm allowlist enforcement; the host owns the trust store —
+ * which keys are valid and where they live (file / env / AWS KMS / GCP KMS
+ * / Vault). Encryption and decryption are deliberately separate operations
+ * because they often use DIFFERENT keys (JWE: a public key encrypts the
+ * outbound response, a private key by `kid` decrypts the inbound request —
+ * exactly Visa's two-key-pair model).
+ *
+ * Rotation mirrors `@fastify/secure-session`: the active key encrypts; any
+ * key resolvable by `kid` can decrypt, so you can roll keys without dropping
+ * in-flight traffic.
+ */
+interface KeyProvider {
+  /** Active key for encrypting OUTBOUND responses. */
+  encryptionKey(ctx: KeyContext): MaybePromise<ActiveKey>;
+  /** Resolve a DECRYPTION key by the inbound message's `kid`. */
+  decryptionKey(kid: string, ctx: KeyContext): MaybePromise<KeyMaterial | undefined>;
+}
+/**
+ * Per-resource encryption directive — the typed slice plugins register on
+ * `ResourceExtensions`. Declared on a resource via
+ * `defineResource({ extensions: { encryption: { … } } })`; arc threads it
+ * to request time on `request.routeOptions.config.arcExtensions.encryption`.
+ */
+interface EncryptionDirective {
+  /** Strategy. Defaults to the plugin-level `mode` (default `'jwe'`). */
+  readonly mode?: EncryptionMode;
+  /**
+   * For `mode: 'fields'` — dot-paths of fields to encrypt, resolved against
+   * the serialized response body (e.g. `'cardNumber'`, `'account.iban'`).
+   * Ignored for `mode: 'jwe'` (the whole body is encrypted).
+   */
+  readonly fields?: readonly string[];
+  /**
+   * Explicit opt-out — set `false` to disable encryption for this resource
+   * even when a plugin-level default (`routes`) would otherwise apply.
+   */
+  readonly enabled?: boolean;
+}
+/**
+ * Plugin-level options. `keyProvider` is the only required field; everything
+ * else has a secure default.
+ */
+interface EncryptionOptions {
+  /**
+   * Master on/off. Default `true`. Set `false` to register the plugin as a
+   * typed no-op (config-gated environments) — same pattern as
+   * `idempotencyPlugin`.
+   */
+  readonly enabled?: boolean;
+  /** Key provider — resolves `kid` → key for encrypt/decrypt. Required. */
+  readonly keyProvider: KeyProvider;
+  /** Default mode when a route opts in without naming one. Default `'jwe'`. */
+  readonly mode?: EncryptionMode;
+  /** JWE key-management algorithm. Default `'RSA-OAEP-256'`. */
+  readonly alg?: JweAlg;
+  /** JWE content-encryption algorithm. Default `'A256GCM'`. */
+  readonly enc?: JweEnc;
+  /**
+   * Inbound-decryption algorithm allowlists — block algorithm-substitution
+   * downgrade attacks. Default `[alg]` / `[enc]`. Set explicitly only when a
+   * client legitimately uses more than one algorithm.
+   */
+  readonly allowedAlgs?: readonly JweAlg[];
+  readonly allowedEncs?: readonly JweEnc[];
+  /**
+   * Fallback opt-in for routes that don't declare
+   * `extensions.encryption`. Return a directive (or `true` for the default
+   * mode) to encrypt, `false`/`undefined` to skip. The per-resource
+   * `extensions.encryption` ALWAYS wins when present. Use this to scope ALE
+   * to sensitive prefixes without touching every resource.
+   *
+   * @example confine ALE to `/payments` and `/accounts`
+   * ```ts
+   * routes: (req) => /^\/(payments|accounts)\b/.test(req.url)
+   * ```
+   */
+  readonly routes?: (request: FastifyRequest) => EncryptionDirective | boolean | undefined;
+  /** Decrypt inbound `application/jose` request bodies. Default `true`. */
+  readonly decryptRequests?: boolean;
+  /** Media type that signals an encrypted REQUEST body. Default `'application/jose'`. */
+  readonly contentType?: string;
+  /** Content-Type set on full-body JWE RESPONSES. Default `'application/jose'`. */
+  readonly responseContentType?: string;
+  /**
+   * Response header advertising that the body is encrypted, so generic
+   * client SDKs know to decrypt. Default `'x-encrypted'`; set `false` to omit.
+   */
+  readonly flagHeader?: string | false;
+}
+/** Request decorations added by the plugin. */
+declare module "fastify" {
+  interface FastifyRequest {
+    /** `true` when the inbound body was decrypted from a JWE by this plugin. */
+    requestDecrypted?: boolean;
+    /** `true` when the outbound body was encrypted by this plugin. */
+    responseEncrypted?: boolean;
+  }
+}
+//#endregion
+//#region src/encryption/encryptionPlugin.d.ts
+declare const encryptionPlugin: FastifyPluginAsync<EncryptionOptions>;
+declare const _default: FastifyPluginAsync<EncryptionOptions>;
+//#endregion
+//#region src/encryption/fieldCipher.d.ts
+/**
+ * Field-level cipher — `node:crypto` AES-256-GCM, zero external deps.
+ *
+ * Used by `mode: 'fields'` to encrypt individual field values in place while
+ * leaving the JSON structure intact. The envelope is an authenticated,
+ * versioned, `kid`-tagged token:
+ *
+ *   arc.v1.<b64url(kid)>.<b64url(iv)>.<b64url(ciphertext)>.<b64url(tag)>
+ *
+ * This is NOT a hand-rolled cipher — it's the correct use of a vetted AEAD
+ * primitive (AES-256-GCM): a fresh random 96-bit IV per operation (never
+ * caller-supplied — IV reuse under GCM is catastrophic), authentication via
+ * the GCM tag, and a version prefix so the format can evolve. Same shape, in
+ * spirit, as MongoDB CSFLE's BSON-binary subtype-6 envelope. For
+ * cross-vendor interop or asymmetric keys use `mode: 'jwe'` (RFC 7516)
+ * instead.
+ */
+/** Encrypt a UTF-8 string into the `arc.v1` field envelope. */
+declare function encryptField(plaintext: string, kid: string, key: unknown): string;
+/** Parsed envelope header — exposes `kid` for key resolution before decrypt. */
+interface ParsedFieldEnvelope {
+  readonly kid: string;
+  readonly iv: Buffer;
+  readonly ciphertext: Buffer;
+  readonly tag: Buffer;
+}
+/** Returns the parsed envelope, or `null` when the token isn't `arc.v1`. */
+declare function parseFieldEnvelope(token: string): ParsedFieldEnvelope | null;
+/** Decrypt a parsed `arc.v1` envelope with the resolved key. Throws on tamper. */
+declare function decryptField(envelope: ParsedFieldEnvelope, key: unknown): string;
+//#endregion
+//#region src/encryption/keyProvider.d.ts
+interface StaticKeyProviderOptions {
+  /**
+   * Active key used to ENCRYPT outbound responses. For `jwe` mode this is the
+   * recipient's PUBLIC key; for `fields` mode a 32-byte symmetric secret.
+   */
+  readonly encryptionKey: ActiveKey;
+  /**
+   * Keys used to DECRYPT inbound requests, indexed by `kid`. For `jwe` mode
+   * these are PRIVATE keys; for `fields` mode the same symmetric secrets.
+   *
+   * Defaults to `{ [encryptionKey.kid]: encryptionKey.key }` — correct for
+   * symmetric field mode where one key both encrypts and decrypts. For
+   * asymmetric JWE you MUST pass the private key(s) here; the public
+   * `encryptionKey` cannot decrypt. Keep 2–3 entries during a rotation so
+   * in-flight messages signed with the previous `kid` still decrypt.
+   */
+  readonly decryptionKeys?: Readonly<Record<string, KeyMaterial>>;
+}
+/**
+ * A static, in-memory key provider with `kid`-based rotation. Keys are held
+ * for the process lifetime — resolve them from env / a secrets file at boot
+ * and pass the imported key material in (don't re-parse PEM per request).
+ *
+ * @example symmetric field mode
+ * ```ts
+ * const provider = createStaticKeyProvider({
+ *   encryptionKey: { kid: "2026-06", key: Buffer.from(process.env.FIELD_KEY!, "base64") },
+ * });
+ * ```
+ *
+ * @example asymmetric JWE (jose key material)
+ * ```ts
+ * const provider = createStaticKeyProvider({
+ *   encryptionKey: { kid: "client-1", key: await importSPKI(clientPubPem, "RSA-OAEP-256") },
+ *   decryptionKeys: { "server-1": await importPKCS8(serverPrivPem, "RSA-OAEP-256") },
+ * });
+ * ```
+ */
+declare function createStaticKeyProvider(options: StaticKeyProviderOptions): KeyProvider;
+//#endregion
+//#region src/encryption/index.d.ts
+declare module "../types/resource.js" {
+  interface ResourceExtensions {
+    /**
+     * Encrypt this resource's responses — full-body JWE or specific fields.
+     * Threaded to request time on
+     * `request.routeOptions.config.arcExtensions.encryption`.
+     */
+    encryption?: EncryptionDirective;
+  }
+}
+//#endregion
+export { type ActiveKey, type EncryptionDirective, type EncryptionMode, type EncryptionOptions, type JweAlg, type JweEnc, type KeyContext, type KeyMaterial, type KeyProvider, type ParsedFieldEnvelope, type StaticKeyProviderOptions, createStaticKeyProvider, decryptField, _default as default, encryptField, encryptionPlugin, parseFieldEnvelope };