@classytic/arc 2.20.0 → 2.21.0

package/dist/{createApp-D6uwzCKu.mjs → createApp-Bi61XxqU.mjs}

@@ -3,6 +3,134 @@ import { arcLog } from "./logger/index.mjs";
 import { n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
 import Fastify from "fastify";
 import qs from "qs";
+//#region src/factory/module.ts
+/**
+* Resolve any module-input form to a concrete `ArcModule`. A thunk is invoked
+* (this is where a dynamic `import()` fires); a promise (or plain module) is
+* awaited. Called once per module at the start of the bootstrap phase.
+*/
+async function resolveModule(input) {
+	const resolved = typeof input === "function" ? await input() : await input;
+	if (!resolved || typeof resolved !== "object" || typeof resolved.name !== "string") throw new Error("[arc] a `modules` entry resolved to something that is not an ArcModule (expected an object with a string `name`). Check dynamic-import thunks return `createXModule(deps)` (or the module object), not the namespace.");
+	return resolved;
+}
+/**
+* Order modules for composition by their `dependsOn` edges — a STABLE
+* topological sort. Called once at the start of the bootstrap phase; every
+* subsequent phase (bootstrap, resources, afterResources, and reverse-order
+* onClose) iterates the returned list, so a module's declared dependencies are
+* always composed before it.
+*
+* "Stable" = modules with no edge between them keep their original list order,
+* so declaring `dependsOn` on one module never silently reorders an unrelated
+* one. Backward compatible: a `modules` array with NO `dependsOn` anywhere is
+* returned unchanged.
+*
+* Fail-fast — throws (never reorders past a broken contract) on:
+*   - duplicate module names (the name is the graph key)
+*   - a `dependsOn` name not present in the composed set
+*   - a self-reference (`dependsOn` includes the module's own name)
+*   - a dependency cycle (reports the concrete `a → b → … → a` path)
+*/
+function orderModules(modules) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const m of modules) {
+		if (byName.has(m.name)) throw new Error(`[arc] Duplicate module name "${m.name}" — composed twice; check your modules array.`);
+		byName.set(m.name, m);
+	}
+	for (const m of modules) for (const dep of m.dependsOn ?? []) {
+		if (dep === m.name) throw new Error(`[arc] module "${m.name}" dependsOn itself — remove the self-reference.`);
+		if (!byName.has(dep)) throw new Error(`[arc] module "${m.name}" dependsOn "${dep}", which is not composed. Add the "${dep}" module to createApp({ modules }) (before this one is fine — arc orders them), or drop the dependency. Composed modules: ${[...byName.keys()].join(", ") || "(none)"}.`);
+	}
+	if (modules.every((m) => !m.dependsOn || m.dependsOn.length === 0)) return [...modules];
+	const originalIndex = /* @__PURE__ */ new Map();
+	let nextIndex = 0;
+	for (const m of modules) originalIndex.set(m.name, nextIndex++);
+	const pendingDeps = new Map(modules.map((m) => [m.name, (m.dependsOn ?? []).length]));
+	const dependents = /* @__PURE__ */ new Map();
+	for (const m of modules) for (const dep of m.dependsOn ?? []) {
+		const list = dependents.get(dep);
+		if (list) list.push(m.name);
+		else dependents.set(dep, [m.name]);
+	}
+	const ordered = [];
+	const remaining = new Set(modules.map((m) => m.name));
+	while (remaining.size > 0) {
+		let pick;
+		let pickIndex = Number.POSITIVE_INFINITY;
+		for (const name of remaining) {
+			if (pendingDeps.get(name) !== 0) continue;
+			const index = originalIndex.get(name) ?? Number.POSITIVE_INFINITY;
+			if (index < pickIndex) {
+				pick = name;
+				pickIndex = index;
+			}
+		}
+		if (pick === void 0) throw new Error(describeModuleCycle(remaining, byName));
+		const picked = byName.get(pick);
+		if (!picked) throw new Error(`[arc] internal: ordered module "${pick}" is missing from the index`);
+		ordered.push(picked);
+		remaining.delete(pick);
+		for (const dependent of dependents.get(pick) ?? []) pendingDeps.set(dependent, (pendingDeps.get(dependent) ?? 1) - 1);
+	}
+	return ordered;
+}
+/** Walk the still-unordered subgraph for one concrete cycle path. */
+function describeModuleCycle(remaining, byName) {
+	const stack = [];
+	const onStack = /* @__PURE__ */ new Set();
+	const done = /* @__PURE__ */ new Set();
+	let cycle = null;
+	const walk = (name) => {
+		if (cycle) return;
+		stack.push(name);
+		onStack.add(name);
+		for (const dep of byName.get(name)?.dependsOn ?? []) {
+			if (!remaining.has(dep)) continue;
+			if (onStack.has(dep)) {
+				cycle = [...stack.slice(stack.indexOf(dep)), dep];
+				return;
+			}
+			if (!done.has(dep)) walk(dep);
+			if (cycle) return;
+		}
+		onStack.delete(name);
+		stack.pop();
+		done.add(name);
+	};
+	for (const name of remaining) {
+		if (!done.has(name)) walk(name);
+		if (cycle) break;
+	}
+	return `[arc] module dependency cycle: ${cycle ? cycle.join(" → ") : [...remaining].join(", ")}. Modules cannot dependsOn each other circularly — break it with a shared module both point at, or wire the softer direction through an event/port instead of a hard dependsOn.`;
+}
+/**
+* Identity helper for authoring a typed module — mirrors `defineResource`.
+* Gives inference + a single obvious construction site; does no work.
+*
+* `TExports` is inferred from the `bootstrap` return value, so a module
+* author gets a typed public export for free:
+*
+* ```ts
+* export const accountingModule = (deps: Deps) =>
+*   defineModule({
+*     name: "accounting",
+*     bootstrap: async () => createAccountingEngine(deps), // TExports inferred
+*   });
+* ```
+*/
+function defineModule(module) {
+	return module;
+}
+function getModuleExports(fastify, name) {
+	const modules = fastify.arc?.modules;
+	if (!modules || !Object.hasOwn(modules, name)) {
+		const available = modules ? Object.keys(modules) : [];
+		throw new Error(`[arc] no public export recorded for module "${name}".\nA module's export is its bootstrap() return value; it is readable only AFTER that module's bootstrap ran (dependsOn / list order = init order).\nModules with recorded exports: ${available.length ? available.join(", ") : "(none)"}.`);
+	}
+	return modules[name];
+}
+//#endregion
 //#region src/factory/presets.ts
 /**
 * Production preset - strict security, performance optimized
@@ -344,11 +472,20 @@ async function registerElevation(fastify, config, trackPlugin) {
 }
 /**
 * Register error handler plugin (opt-out).
+*
+* `moduleErrorMappers` — mappers shipped by composed arc modules
+* (`defineModule({ errorMappers })`), appended AFTER host-declared mappers
+* so host config keeps priority. Collected by `createApp` from the
+* pre-resolved module graph.
 */
-async function registerErrorHandler(fastify, config, trackPlugin) {
+async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
 	const { errorHandlerPlugin } = await import("./errorHandler-Dxf6P_kV.mjs").then((n) => n.r);
-	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
+	let errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
+	if (moduleErrorMappers && moduleErrorMappers.length > 0) errorOpts = {
+		...errorOpts,
+		errorMappers: [...errorOpts.errorMappers ?? [], ...moduleErrorMappers]
+	};
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
 	fastify.log.debug("Arc error handler enabled");
@@ -384,134 +521,6 @@ function createOptionalAuthenticate(authenticate) {
 	};
 }
 //#endregion
-//#region src/factory/module.ts
-/**
-* Resolve any module-input form to a concrete `ArcModule`. A thunk is invoked
-* (this is where a dynamic `import()` fires); a promise (or plain module) is
-* awaited. Called once per module at the start of the bootstrap phase.
-*/
-async function resolveModule(input) {
-	const resolved = typeof input === "function" ? await input() : await input;
-	if (!resolved || typeof resolved !== "object" || typeof resolved.name !== "string") throw new Error("[arc] a `modules` entry resolved to something that is not an ArcModule (expected an object with a string `name`). Check dynamic-import thunks return `createXModule(deps)` (or the module object), not the namespace.");
-	return resolved;
-}
-/**
-* Order modules for composition by their `dependsOn` edges — a STABLE
-* topological sort. Called once at the start of the bootstrap phase; every
-* subsequent phase (bootstrap, resources, afterResources, and reverse-order
-* onClose) iterates the returned list, so a module's declared dependencies are
-* always composed before it.
-*
-* "Stable" = modules with no edge between them keep their original list order,
-* so declaring `dependsOn` on one module never silently reorders an unrelated
-* one. Backward compatible: a `modules` array with NO `dependsOn` anywhere is
-* returned unchanged.
-*
-* Fail-fast — throws (never reorders past a broken contract) on:
-*   - duplicate module names (the name is the graph key)
-*   - a `dependsOn` name not present in the composed set
-*   - a self-reference (`dependsOn` includes the module's own name)
-*   - a dependency cycle (reports the concrete `a → b → … → a` path)
-*/
-function orderModules(modules) {
-	const byName = /* @__PURE__ */ new Map();
-	for (const m of modules) {
-		if (byName.has(m.name)) throw new Error(`[arc] Duplicate module name "${m.name}" — composed twice; check your modules array.`);
-		byName.set(m.name, m);
-	}
-	for (const m of modules) for (const dep of m.dependsOn ?? []) {
-		if (dep === m.name) throw new Error(`[arc] module "${m.name}" dependsOn itself — remove the self-reference.`);
-		if (!byName.has(dep)) throw new Error(`[arc] module "${m.name}" dependsOn "${dep}", which is not composed. Add the "${dep}" module to createApp({ modules }) (before this one is fine — arc orders them), or drop the dependency. Composed modules: ${[...byName.keys()].join(", ") || "(none)"}.`);
-	}
-	if (modules.every((m) => !m.dependsOn || m.dependsOn.length === 0)) return [...modules];
-	const originalIndex = /* @__PURE__ */ new Map();
-	let nextIndex = 0;
-	for (const m of modules) originalIndex.set(m.name, nextIndex++);
-	const pendingDeps = new Map(modules.map((m) => [m.name, (m.dependsOn ?? []).length]));
-	const dependents = /* @__PURE__ */ new Map();
-	for (const m of modules) for (const dep of m.dependsOn ?? []) {
-		const list = dependents.get(dep);
-		if (list) list.push(m.name);
-		else dependents.set(dep, [m.name]);
-	}
-	const ordered = [];
-	const remaining = new Set(modules.map((m) => m.name));
-	while (remaining.size > 0) {
-		let pick;
-		let pickIndex = Number.POSITIVE_INFINITY;
-		for (const name of remaining) {
-			if (pendingDeps.get(name) !== 0) continue;
-			const index = originalIndex.get(name) ?? Number.POSITIVE_INFINITY;
-			if (index < pickIndex) {
-				pick = name;
-				pickIndex = index;
-			}
-		}
-		if (pick === void 0) throw new Error(describeModuleCycle(remaining, byName));
-		const picked = byName.get(pick);
-		if (!picked) throw new Error(`[arc] internal: ordered module "${pick}" is missing from the index`);
-		ordered.push(picked);
-		remaining.delete(pick);
-		for (const dependent of dependents.get(pick) ?? []) pendingDeps.set(dependent, (pendingDeps.get(dependent) ?? 1) - 1);
-	}
-	return ordered;
-}
-/** Walk the still-unordered subgraph for one concrete cycle path. */
-function describeModuleCycle(remaining, byName) {
-	const stack = [];
-	const onStack = /* @__PURE__ */ new Set();
-	const done = /* @__PURE__ */ new Set();
-	let cycle = null;
-	const walk = (name) => {
-		if (cycle) return;
-		stack.push(name);
-		onStack.add(name);
-		for (const dep of byName.get(name)?.dependsOn ?? []) {
-			if (!remaining.has(dep)) continue;
-			if (onStack.has(dep)) {
-				cycle = [...stack.slice(stack.indexOf(dep)), dep];
-				return;
-			}
-			if (!done.has(dep)) walk(dep);
-			if (cycle) return;
-		}
-		onStack.delete(name);
-		stack.pop();
-		done.add(name);
-	};
-	for (const name of remaining) {
-		if (!done.has(name)) walk(name);
-		if (cycle) break;
-	}
-	return `[arc] module dependency cycle: ${cycle ? cycle.join(" → ") : [...remaining].join(", ")}. Modules cannot dependsOn each other circularly — break it with a shared module both point at, or wire the softer direction through an event/port instead of a hard dependsOn.`;
-}
-/**
-* Identity helper for authoring a typed module — mirrors `defineResource`.
-* Gives inference + a single obvious construction site; does no work.
-*
-* `TExports` is inferred from the `bootstrap` return value, so a module
-* author gets a typed public export for free:
-*
-* ```ts
-* export const accountingModule = (deps: Deps) =>
-*   defineModule({
-*     name: "accounting",
-*     bootstrap: async () => createAccountingEngine(deps), // TExports inferred
-*   });
-* ```
-*/
-function defineModule(module) {
-	return module;
-}
-function getModuleExports(fastify, name) {
-	const modules = fastify.arc?.modules;
-	if (!modules || !Object.hasOwn(modules, name)) {
-		const available = modules ? Object.keys(modules) : [];
-		throw new Error(`[arc] no public export recorded for module "${name}".\nA module's export is its bootstrap() return value; it is readable only AFTER that module's bootstrap ran (dependsOn / list order = init order).\nModules with recorded exports: ${available.length ? available.join(", ") : "(none)"}.`);
-	}
-	return modules[name];
-}
-//#endregion
 //#region src/factory/registerResources.ts
 function isResourcesFactory(value) {
 	return typeof value === "function";
@@ -553,7 +562,7 @@ async function registerOne(parent, resource) {
 *                                  THEN app onClose, in ONE hook so module
 *                                  teardown runs before shared infra closes.
 */
-async function registerResources(fastify, config) {
+async function registerResources(fastify, config, preResolvedModules) {
 	if (config.preset === "production") {
 		if (config.strictResources === void 0) config = {
 			...config,
@@ -564,7 +573,7 @@ async function registerResources(fastify, config) {
 			strictResourceDir: true
 		};
 	}
-	const modules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
+	const modules = preResolvedModules ?? orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
 	if (config.plugins) {
 		await config.plugins(fastify);
 		fastify.log.debug("Custom plugins registered");
@@ -617,7 +626,7 @@ async function registerResources(fastify, config) {
 	let discoveryPath;
 	let discoveryYieldedZero = false;
 	if (resolvedResources === void 0 && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-B8UmpITt.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-DpU8pfjV.mjs").then((n) => n.n);
 		const { resolve, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const rawDir = config.resourceDir;
@@ -1006,7 +1015,7 @@ Missing:\n${lines}\n\nFix: pass durable adapters under \`stores\`, or use runtim
 *
 * Boot order:
 * ```
-* 0. Logger, validation, preset merge
+* 0. Logger, validation → beforeBoot() (DB connect etc.), preset merge
 * 1. Create Fastify instance
 * 2. Security plugins (Helmet, CORS, Rate Limit) — opt-out
 * 3. Utility plugins (Under Pressure, Sensible, Multipart, Raw Body)
@@ -1027,10 +1036,13 @@ async function createApp(options) {
 	}
 	validateAuthOptions(options);
 	const deferredWarnings = validateDistributedRuntime(options);
+	if (options.beforeBoot) await options.beforeBoot();
 	const config = {
 		...options.preset ? getPreset(options.preset) : {},
 		...options
 	};
+	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
+	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
 	const fastify = Fastify({
 		logger: resolveLoggerConfig(config.logger),
 		trustProxy: config.trustProxy ?? false,
@@ -1086,8 +1098,8 @@ async function createApp(options) {
 	decorateRequestScope(fastify);
 	await registerAuth(fastify, config, trackPlugin);
 	await registerElevation(fastify, config, trackPlugin);
-	await registerErrorHandler(fastify, config, trackPlugin);
-	await registerResources(fastify, config);
+	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
+	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
 		const { replyHelpersPlugin } = await import("./replyHelpers-67tRawQZ.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
@@ -1140,4 +1152,4 @@ const ArcFactory = {
 	}
 };
 //#endregion
-export { getModuleExports as a, developmentPreset as c, productionPreset as d, testingPreset as f, defineModule as i, edgePreset as l, createApp as n, orderModules as o, createApp_exports as r, resolveModule as s, ArcFactory as t, getPreset as u };
+export { edgePreset as a, testingPreset as c, orderModules as d, resolveModule as f, developmentPreset as i, defineModule as l, createApp as n, getPreset as o, createApp_exports as r, productionPreset as s, ArcFactory as t, getModuleExports as u };

package/dist/discovery/index.d.mts

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/discovery/index.d.ts
 /** A discovered resource — must have toPlugin() method */
 interface DiscoverableResource {

package/dist/docs/index.d.mts

@@ -1,7 +1,6 @@
-import { p as RegistryEntry } from "../index-_--GyzcO.mjs";
+import { p as RegistryEntry } from "../index-Dtrj6XZk.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/docs/openapi/types.d.ts
 /**
  * OpenAPI 3.0 type primitives used by arc's spec emitter.

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-Dq6RbEGK.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-Kyod_di6.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-xGUBq6p_.d.mts → elevation-C9s5hFP_.d.mts}

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
 //#region src/scope/elevation.d.ts
 interface ElevationOptions {
   /** Roles that can use elevation (default: ['superadmin']) */

package/dist/encryption/index.d.mts

@@ -1,135 +1,5 @@
-import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
-//#region src/encryption/types.d.ts
-/** JWE key-management algorithm — the protected-header `alg`. */
-type JweAlg = "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512" | "ECDH-ES" | "ECDH-ES+A256KW" | "A256GCMKW" | "dir";
-/** JWE content-encryption algorithm — the protected-header `enc`. AEAD only. */
-type JweEnc = "A128GCM" | "A192GCM" | "A256GCM";
-/** Encryption strategy for a route's response. */
-type EncryptionMode = "jwe" | "fields";
-/**
- * Opaque key material. For `jwe` mode this is a `jose` `KeyLike` /
- * `CryptoKey` / `Uint8Array`; for `fields` mode a 32-byte secret
- * (`Buffer` / `Uint8Array`). Kept `unknown` at the contract layer so the
- * `KeyProvider` interface carries no hard `jose` type dependency — hosts
- * without `jose` installed can still implement field-mode providers.
- */
-type KeyMaterial = unknown;
-/** A key paired with its identifier — what encrypt operations consume. */
-interface ActiveKey {
-  /** Key id, stamped into the JWE `kid` header / field envelope for rotation. */
-  readonly kid: string;
-  /** The key material (public key for JWE, 32-byte secret for fields). */
-  readonly key: KeyMaterial;
-  /** Optional per-key `alg` override (else the plugin default applies). */
-  readonly alg?: JweAlg;
-}
-/** Context handed to the key provider so resolution can be request-scoped. */
-interface KeyContext {
-  readonly request: FastifyRequest;
-}
-type MaybePromise<T> = T | Promise<T>;
-/**
- * Pluggable key resolution. Arc owns the request-time plumbing — `kid` →
- * key, algorithm allowlist enforcement; the host owns the trust store —
- * which keys are valid and where they live (file / env / AWS KMS / GCP KMS
- * / Vault). Encryption and decryption are deliberately separate operations
- * because they often use DIFFERENT keys (JWE: a public key encrypts the
- * outbound response, a private key by `kid` decrypts the inbound request —
- * exactly Visa's two-key-pair model).
- *
- * Rotation mirrors `@fastify/secure-session`: the active key encrypts; any
- * key resolvable by `kid` can decrypt, so you can roll keys without dropping
- * in-flight traffic.
- */
-interface KeyProvider {
-  /** Active key for encrypting OUTBOUND responses. */
-  encryptionKey(ctx: KeyContext): MaybePromise<ActiveKey>;
-  /** Resolve a DECRYPTION key by the inbound message's `kid`. */
-  decryptionKey(kid: string, ctx: KeyContext): MaybePromise<KeyMaterial | undefined>;
-}
-/**
- * Per-resource encryption directive — the typed slice plugins register on
- * `ResourceExtensions`. Declared on a resource via
- * `defineResource({ extensions: { encryption: { … } } })`; arc threads it
- * to request time on `request.routeOptions.config.arcExtensions.encryption`.
- */
-interface EncryptionDirective {
-  /** Strategy. Defaults to the plugin-level `mode` (default `'jwe'`). */
-  readonly mode?: EncryptionMode;
-  /**
-   * For `mode: 'fields'` — dot-paths of fields to encrypt, resolved against
-   * the serialized response body (e.g. `'cardNumber'`, `'account.iban'`).
-   * Ignored for `mode: 'jwe'` (the whole body is encrypted).
-   */
-  readonly fields?: readonly string[];
-  /**
-   * Explicit opt-out — set `false` to disable encryption for this resource
-   * even when a plugin-level default (`routes`) would otherwise apply.
-   */
-  readonly enabled?: boolean;
-}
-/**
- * Plugin-level options. `keyProvider` is the only required field; everything
- * else has a secure default.
- */
-interface EncryptionOptions {
-  /**
-   * Master on/off. Default `true`. Set `false` to register the plugin as a
-   * typed no-op (config-gated environments) — same pattern as
-   * `idempotencyPlugin`.
-   */
-  readonly enabled?: boolean;
-  /** Key provider — resolves `kid` → key for encrypt/decrypt. Required. */
-  readonly keyProvider: KeyProvider;
-  /** Default mode when a route opts in without naming one. Default `'jwe'`. */
-  readonly mode?: EncryptionMode;
-  /** JWE key-management algorithm. Default `'RSA-OAEP-256'`. */
-  readonly alg?: JweAlg;
-  /** JWE content-encryption algorithm. Default `'A256GCM'`. */
-  readonly enc?: JweEnc;
-  /**
-   * Inbound-decryption algorithm allowlists — block algorithm-substitution
-   * downgrade attacks. Default `[alg]` / `[enc]`. Set explicitly only when a
-   * client legitimately uses more than one algorithm.
-   */
-  readonly allowedAlgs?: readonly JweAlg[];
-  readonly allowedEncs?: readonly JweEnc[];
-  /**
-   * Fallback opt-in for routes that don't declare
-   * `extensions.encryption`. Return a directive (or `true` for the default
-   * mode) to encrypt, `false`/`undefined` to skip. The per-resource
-   * `extensions.encryption` ALWAYS wins when present. Use this to scope ALE
-   * to sensitive prefixes without touching every resource.
-   *
-   * @example confine ALE to `/payments` and `/accounts`
-   * ```ts
-   * routes: (req) => /^\/(payments|accounts)\b/.test(req.url)
-   * ```
-   */
-  readonly routes?: (request: FastifyRequest) => EncryptionDirective | boolean | undefined;
-  /** Decrypt inbound `application/jose` request bodies. Default `true`. */
-  readonly decryptRequests?: boolean;
-  /** Media type that signals an encrypted REQUEST body. Default `'application/jose'`. */
-  readonly contentType?: string;
-  /** Content-Type set on full-body JWE RESPONSES. Default `'application/jose'`. */
-  readonly responseContentType?: string;
-  /**
-   * Response header advertising that the body is encrypted, so generic
-   * client SDKs know to decrypt. Default `'x-encrypted'`; set `false` to omit.
-   */
-  readonly flagHeader?: string | false;
-}
-/** Request decorations added by the plugin. */
-declare module "fastify" {
-  interface FastifyRequest {
-    /** `true` when the inbound body was decrypted from a JWE by this plugin. */
-    requestDecrypted?: boolean;
-    /** `true` when the outbound body was encrypted by this plugin. */
-    responseEncrypted?: boolean;
-  }
-}
-//#endregion
+import { a as JweAlg, c as KeyMaterial, i as EncryptionOptions, l as KeyProvider, n as EncryptionDirective, o as JweEnc, r as EncryptionMode, s as KeyContext, t as ActiveKey } from "../types-Cc91nXuA.mjs";
+import { FastifyPluginAsync } from "fastify";
 //#region src/encryption/encryptionPlugin.d.ts
 declare const encryptionPlugin: FastifyPluginAsync<EncryptionOptions>;
 declare const _default: FastifyPluginAsync<EncryptionOptions>;
@@ -207,16 +77,4 @@ interface StaticKeyProviderOptions {
  */
 declare function createStaticKeyProvider(options: StaticKeyProviderOptions): KeyProvider;
 //#endregion
-//#region src/encryption/index.d.ts
-declare module "../types/resource.js" {
-  interface ResourceExtensions {
-    /**
-     * Encrypt this resource's responses — full-body JWE or specific fields.
-     * Threaded to request time on
-     * `request.routeOptions.config.arcExtensions.encryption`.
-     */
-    encryption?: EncryptionDirective;
-  }
-}
-//#endregion
 export { type ActiveKey, type EncryptionDirective, type EncryptionMode, type EncryptionOptions, type JweAlg, type JweEnc, type KeyContext, type KeyMaterial, type KeyProvider, type ParsedFieldEnvelope, type StaticKeyProviderOptions, createStaticKeyProvider, decryptField, _default as default, encryptField, encryptionPlugin, parseFieldEnvelope };

package/dist/{errorHandler-BtUUDPEa.d.mts → errorHandler-B0e-bq-O.d.mts}

@@ -1,6 +1,5 @@
 import { ErrorDetail } from "@classytic/repo-core/errors";
 import { FastifyInstance, FastifyRequest } from "fastify";
-
 //#region src/plugins/errorHandler.d.ts
 /**
  * Class-based error mapper — `instanceof` check converts a thrown class

package/dist/{errors-DOHkjQlD.d.mts → errors-DHcHVAgk.d.mts}

@@ -1,5 +1,4 @@
 import { HttpError } from "@classytic/repo-core/errors";
-
 //#region src/utils/errors.d.ts
 interface ErrorOptions {
   code?: string;

package/dist/{eventPlugin-DbBFd3x_.d.mts → eventPlugin-A6EbthXR.d.mts}

@@ -1,6 +1,5 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-IEn7Tn-Q.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-QmY7A258.mjs";
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/events/defineEvent.d.ts
 interface EventSchema {
   type: "object";
@@ -249,7 +248,8 @@ interface EventPluginOptions {
    * failed events are published to the `$deadLetter` event type by default.
    */
   deadLetterQueue?: {
-    /** Custom store function. If omitted, publishes to '$deadLetter' event type. */store?: (event: DomainEvent, errors: Error[]) => void | Promise<void>;
+    /** Custom store function. If omitted, publishes to '$deadLetter' event type. */
+    store?: (event: DomainEvent, errors: Error[]) => void | Promise<void>;
   };
   /** Callback after successful publish (for metrics/tracking) */
   onPublish?: (event: DomainEvent) => void;
@@ -302,9 +302,13 @@ interface EventPluginOptions {
 declare module "fastify" {
   interface FastifyInstance {
     events: {
-      /** Publish an event */publish: <T>(type: string, payload: T, meta?: Partial<DomainEvent["meta"]>) => Promise<void>; /** Subscribe to events */
-      subscribe: (pattern: string, handler: EventHandler) => Promise<() => void>; /** Get transport name */
-      transportName: string; /** Event registry for introspection (undefined when no registry configured) */
+      /** Publish an event */
+      publish: <T>(type: string, payload: T, meta?: Partial<DomainEvent["meta"]>) => Promise<void>;
+      /** Subscribe to events */
+      subscribe: (pattern: string, handler: EventHandler) => Promise<() => void>;
+      /** Get transport name */
+      transportName: string;
+      /** Event registry for introspection (undefined when no registry configured) */
       registry?: EventRegistry;
     };
   }

package/dist/events/index.d.mts

@@ -1,9 +1,8 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-IEn7Tn-Q.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-DbBFd3x_.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-QmY7A258.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-A6EbthXR.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
-import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-DsP1vqZB.mjs";
+import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-iVR2l7aS.mjs";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
-
 //#region src/events/eventTypes.d.ts
 /**
  * Event Type Constants and Helpers
@@ -38,14 +37,18 @@ type CrudEventSuffix = (typeof CRUD_EVENT_SUFFIXES)[number];
 declare function crudEventType(resource: string, suffix: CrudEventSuffix): string;
 /** Arc framework lifecycle events — emitted automatically by the framework */
 declare const ARC_LIFECYCLE_EVENTS: Readonly<{
-  /** Emitted when a resource plugin is registered */readonly RESOURCE_REGISTERED: "arc.resource.registered"; /** Emitted when Arc is fully ready (all resources registered, onReady fired) */
+  /** Emitted when a resource plugin is registered */
+  readonly RESOURCE_REGISTERED: "arc.resource.registered";
+  /** Emitted when Arc is fully ready (all resources registered, onReady fired) */
   readonly READY: "arc.ready";
 }>;
 /** Type for Arc lifecycle event names */
 type ArcLifecycleEvent = (typeof ARC_LIFECYCLE_EVENTS)[keyof typeof ARC_LIFECYCLE_EVENTS];
 /** Cache-specific event types for observability and external triggers */
 declare const CACHE_EVENTS: Readonly<{
-  /** Emitted when a resource's cache version is bumped */readonly VERSION_BUMPED: "arc.cache.version.bumped"; /** Emitted when a tag version is bumped */
+  /** Emitted when a resource's cache version is bumped */
+  readonly VERSION_BUMPED: "arc.cache.version.bumped";
+  /** Emitted when a tag version is bumped */
   readonly TAG_VERSION_BUMPED: "arc.cache.tag.bumped";
 }>;
 /** Type for cache event names */

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,2 +1,2 @@
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-DsP1vqZB.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-iVR2l7aS.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis.d.mts

@@ -1,5 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-IEn7Tn-Q.mjs";
-
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-QmY7A258.mjs";
 //#region src/events/transports/redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/factory/index.d.mts

@@ -1,14 +1,14 @@
-import { a as getModuleExports, c as LoadResourcesOptions, d as loadResources, i as defineModule, l as ResourceLike, n as ArcModuleInput, o as orderModules, r as ArcModuleRegistry, s as resolveModule, t as ArcModule, u as ResourceModule } from "../module-JYH9V0I8.mjs";
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-BHMKlMBU.mjs";
+import { a as getModuleExports, c as LoadResourcesOptions, d as loadResources, i as defineModule, l as ResourceLike, n as ArcModuleInput, o as orderModules, r as ArcModuleRegistry, s as resolveModule, t as ArcModule, u as ResourceModule } from "../module-WeuU5jfd.mjs";
+import "../fastify-augmentation-DafigGQp.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as preloadResourcesAsync, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as preloadResources } from "../types-DpxoNX5v.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
-
 //#region src/factory/createApp.d.ts
 /**
  * Create a production-ready Fastify application with Arc framework.
  *
  * Boot order:
  * ```
- * 0. Logger, validation, preset merge
+ * 0. Logger, validation → beforeBoot() (DB connect etc.), preset merge
  * 1. Create Fastify instance
  * 2. Security plugins (Helmet, CORS, Rate Limit) — opt-out
  * 3. Utility plugins (Under Pressure, Sensible, Multipart, Raw Body)