@classytic/arc 2.19.0 → 2.20.0

package/dist/{validate-CRcaWzp2.mjs → validate-C2mGgSXg.mjs}

@@ -316,14 +316,14 @@ function validateTopNConfig(resource, aggregation, topN, groupBy, measures, buck
 	if (!topN.sortBy || Object.keys(topN.sortBy).length === 0) throw new ArcAggregationConfigError(`Resource "${resource}" aggregation "${aggregation}" topN.sortBy must declare at least one ranking field.`);
 	const partitionList = Array.isArray(topN.partitionBy) ? topN.partitionBy : [topN.partitionBy];
 	if (partitionList.length === 0) throw new ArcAggregationConfigError(`Resource "${resource}" aggregation "${aggregation}" topN.partitionBy must declare at least one partition column.`);
-	const validKeys = new Set([
+	const validKeys = /* @__PURE__ */ new Set([
 		...groupBy,
 		...bucketAliases,
 		...Object.keys(measures)
 	]);
 	for (const key of partitionList) if (!validKeys.has(key)) throw new ArcAggregationConfigError(`Resource "${resource}" aggregation "${aggregation}" topN.partitionBy "${key}" is not a groupBy field, dateBucket alias, or measure alias. Available: ${[...validKeys].join(", ") || "(none — declare groupBy, dateBuckets, or measures)"}.`);
 }
-const VALID_BUCKET_UNITS = new Set([
+const VALID_BUCKET_UNITS = /* @__PURE__ */ new Set([
 	"minute",
 	"hour",
 	"day",
@@ -332,7 +332,7 @@ const VALID_BUCKET_UNITS = new Set([
 	"quarter",
 	"year"
 ]);
-const CUSTOM_BIN_UNIT_BLOCKLIST = new Set(["quarter", "year"]);
+const CUSTOM_BIN_UNIT_BLOCKLIST = /* @__PURE__ */ new Set(["quarter", "year"]);
 /**
 * Validate `dateBuckets`. Catches the two classes of misconfig kits
 * already throw on at runtime — alias collisions and field-rule

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.19.0",
+  "version": "2.20.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -203,6 +203,10 @@
     "./auth/audit": {
       "types": "./dist/auth/audit.d.mts",
       "default": "./dist/auth/audit.mjs"
+    },
+    "./sync": {
+      "types": "./dist/sync/changelog.d.mts",
+      "default": "./dist/sync/changelog.mjs"
     }
   },
   "main": "./dist/index.mjs",
@@ -242,15 +246,16 @@
     "push": "classytic-push",
     "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
     "release": "npm run push -- main && npm run release:tag && npm publish",
-    "prepublishOnly": "npm run typecheck && npm run lint && npm run build && npm run test:ci && npm run smoke"
+    "check:peer-skew": "node scripts/check-peer-skew.mjs",
+    "prepublishOnly": "npm run check:peer-skew && npm run typecheck && npm run lint && npm run build && npm run test:ci && npm run smoke"
   },
   "engines": {
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.6.0",
-    "@classytic/repo-core": ">=0.5.0",
-    "@classytic/streamline": ">=2.3.3",
+    "@classytic/primitives": ">=0.9.0",
+    "@classytic/repo-core": ">=0.7.0",
+    "@classytic/streamline": ">=2.7.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
     "@fastify/jwt": ">=10.0.0",
@@ -369,10 +374,10 @@
     "@biomejs/biome": "^2.5.0",
     "@classytic/dev-tools": "^0.2.0",
     "@classytic/mongokit": "^3.16.1",
-    "@classytic/primitives": "^0.7.2",
-    "@classytic/repo-core": "^0.6.0",
+    "@classytic/primitives": "^0.9.1",
+    "@classytic/repo-core": "^0.7.0",
     "@classytic/sqlitekit": "^0.6.0",
-    "@classytic/streamline": "^2.6.0",
+    "@classytic/streamline": "^2.7.0",
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",
     "@fastify/jwt": "^10.1.0",

package/skills/arc/SKILL.md

@@ -706,6 +706,16 @@ routes: [
   { method: 'GET', path: '/stream', raw: true, handler: async (req, reply) => reply.send(stream) },
 ]
 
+// Per-route rate limit (2.20) — overrides the resource/app default for ONE endpoint.
+// `false` = never throttle, object = tighten, omit = inherit. Custom routes only;
+// actions share one POST /:id/action mount, so throttle an action by making it a route.
+routes: [
+  { method: 'POST', path: '/export', handler: 'export', permissions: requireAuth(),
+    rateLimit: { max: 5, timeWindow: '1 minute' } },
+  { method: 'GET', path: '/health', handler: 'health', permissions: allowPublic(),
+    rateLimit: false },
+]
+
 // Per-resource opt-out of resourcePrefix (webhooks / admin routes)
 defineResource({ name: 'webhook', prefix: '/hooks', skipGlobalPrefix: true });
 

package/skills/arc/references/mcp.md

@@ -50,6 +50,8 @@ Resource `actions` (v2.8) also auto-generate MCP tools — each action becomes a
 
 Tool handlers call `BaseController` — same pipeline as REST (auth, org-scoping, hooks, field permissions, cache).
 
+**Query params on generated tools (2.20):** `list_*` accepts `page`/`limit` (offset) **and** `cursor` (keyset, stable under concurrent inserts — when set, `page` is ignored), plus `sort`/`search`/`select`/`populate`. `get_*` accepts `select` for field projection alongside `id`. Both mirror REST exactly (same `QueryResolver`).
+
 ### McpPluginOptions
 
 | Option | Type | Default | Description |