@classytic/arc 2.21.0 → 2.23.0

package/dist/realtime-I8OrfnMR.mjs

@@ -0,0 +1,375 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { arcLog } from "./logger/index.mjs";
+import { c as getOrgId } from "./types-bHblZ9YN.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
+import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
+import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
+import fp from "fastify-plugin";
+//#region src/plugins/realtime.ts
+var realtime_exports = /* @__PURE__ */ __exportAll({
+	buildChangeFrame: () => buildChangeFrame,
+	connectionDeadlineMs: () => connectionDeadlineMs,
+	default: () => realtime_default,
+	realtimePlugin: () => realtimePlugin,
+	resolveDelivery: () => resolveDelivery,
+	resolveRowMatcher: () => resolveRowMatcher
+});
+const log = arcLog("realtime");
+const CHANGE_OPERATIONS = [
+	"created",
+	"updated",
+	"deleted"
+];
+/**
+* SSE `retry:` reconnection hint (ms). Deliberate: the feed has no replay,
+* so a reconnecting client refetches the list anyway — a short retry keeps
+* the gap small without hammering the server.
+*/
+const DEFAULT_RETRY_MS = 3e3;
+/**
+* Cap on resources per multiplexed connection. Generous for real
+* dashboards (Supabase caps channels-per-client similarly); prevents a
+* single socket from fanning out unbounded subscription work.
+*/
+const MAX_MULTIPLEX_RESOURCES = 20;
+/** Node's `setTimeout` ceiling (~24.8 days); larger delays fire immediately. */
+const MAX_TIMER_MS = 2147483647;
+/**
+* Milliseconds from `now` until the feed should force-close to bound
+* permission staleness — `min(auth-token exp, maxConnectionMs)`. Returns
+* `undefined` when neither bound applies (no `exp` claim, no cap → the feed
+* lives until client disconnect), `0` when already expired, else the
+* (setTimeout-ceiling-clamped) delay. Pure; exported for tests.
+*/
+function connectionDeadlineMs(user, maxConnectionMs, now = Date.now()) {
+	let deadline;
+	const exp = user?.exp;
+	if (typeof exp === "number" && Number.isFinite(exp)) deadline = exp * 1e3 - now;
+	if (maxConnectionMs !== void 0 && maxConnectionMs > 0) deadline = deadline === void 0 ? maxConnectionMs : Math.min(deadline, maxConnectionMs);
+	if (deadline === void 0) return void 0;
+	if (deadline <= 0) return 0;
+	return Math.min(deadline, MAX_TIMER_MS);
+}
+/**
+* Are these filters flat equality (every value a scalar, no `$` operators)?
+* That is the shape `simpleEqualityMatcher` is safe for — anything richer
+* needs the adapter's own matcher.
+*/
+function isFlatEquality(filters) {
+	for (const [key, value] of Object.entries(filters)) {
+		if (key.startsWith("$")) return false;
+		if (value !== null && typeof value === "object" && !(value instanceof Date)) return false;
+	}
+	return true;
+}
+/**
+* Decide how (or whether) this subscription's row filters can be enforced
+* in process: adapter matcher when supplied, `simpleEqualityMatcher` for
+* flat-equality shapes, UNENFORCEABLE (fail-closed → 501) for
+* operator-shaped filters with no adapter matcher. No filters → nothing
+* to enforce.
+*/
+function resolveRowMatcher(filters, adapter) {
+	const hasFilters = !!filters && Object.keys(filters).length > 0;
+	if (adapter?.matchesFilter) {
+		const matcher = adapter.matchesFilter.bind(adapter);
+		if (hasFilters && filters) try {
+			matcher({}, filters);
+		} catch {
+			return { enforceable: false };
+		}
+		return {
+			enforceable: true,
+			matcher
+		};
+	}
+	if (!hasFilters) return { enforceable: true };
+	if (isFlatEquality(filters)) return {
+		enforceable: true,
+		matcher: simpleEqualityMatcher
+	};
+	return { enforceable: false };
+}
+/**
+* Decide this event's fate for one subscriber. Pure — the whole
+* authorization + membership-transition story lives here:
+*
+*   1. tenant guard: org-carrying events only reach matching-org subscribers
+*      (a cross-org record was never visible → drop, never a leave).
+*   2. row filters (connect-time snapshot):
+*      - matches (or no filters)                     → deliver.
+*      - no match + operation is `updated`           → LEAVE (membership
+*        transition out; the record may have been in the subscriber's view).
+*      - no match + operation is `created`/`deleted` → drop (never entered
+*        the view — a created record that doesn't match was never shown; a
+*        deleted record that doesn't match was already filtered out).
+*
+* The ENTER transition (a record updated so it now DOES match) needs no
+* special signal: the matching `updated` frame carries the full record, so
+* the client adds it if absent.
+*/
+function resolveDelivery(event, policy, operation) {
+	if (policy.tenantScoped) {
+		const eventOrgId = event.meta?.organizationId;
+		if (eventOrgId && eventOrgId !== policy.subscriberOrgId) return { kind: "drop" };
+	}
+	const doc = event.payload?.data;
+	if (!(!!policy.filters && Object.keys(policy.filters).length > 0)) return {
+		kind: "deliver",
+		doc
+	};
+	if (!!doc && typeof doc === "object" && !!policy.matcher?.(doc, policy.filters)) return {
+		kind: "deliver",
+		doc
+	};
+	return operation === "updated" ? { kind: "leave" } : { kind: "drop" };
+}
+/**
+* Build the wire frame for one delivered change. Envelope note: this is
+* deliberately DOCUMENT-CHANGE-shaped (`data` = the masked document),
+* unlike the sse plugin's raw event mirror (`payload` = whatever was
+* published) — the two streams serve different consumers and the
+* divergence is intentional, not drift.
+*/
+function buildChangeFrame(event, resourceName, data) {
+	return JSON.stringify({
+		type: event.type,
+		resource: resourceName,
+		id: event.meta?.resourceId,
+		data,
+		meta: {
+			timestamp: event.meta?.timestamp,
+			correlationId: event.meta?.correlationId
+		}
+	});
+}
+const realtimePlugin = async (fastify, opts = {}) => {
+	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs } = opts;
+	if (!fastify.hasDecorator("events")) {
+		log.warn("Events plugin (arc-events) not registered. Realtime plugin will not function. Register eventPlugin before realtimePlugin.");
+		return;
+	}
+	if (!path.includes(":resource")) throw new Error(`[arc-realtime] path must contain ':resource' (got '${path}')`);
+	const activeConnections = /* @__PURE__ */ new Set();
+	const isProtected = (entry) => {
+		const listCheck = entry.permissions?.list;
+		return typeof listCheck === "function" && listCheck._isPublic !== true;
+	};
+	/**
+	* Run auth once for a set of requested resources: `authenticate` when ANY
+	* is protected (401 on missing/invalid token), `optionalAuthenticate`
+	* otherwise so tokens still parse. Returns false when a reply was sent.
+	*/
+	const runAuth = async (request, reply, entries) => {
+		const needsAuth = entries.some(isProtected);
+		if (tokenQueryParam) promoteStreamTokenToHeader(request, tokenQueryParam);
+		const authenticate = needsAuth ? fastify.authenticate : fastify.optionalAuthenticate;
+		if (needsAuth && typeof authenticate !== "function") {
+			await reply.code(401).send({
+				code: "arc.unauthorized",
+				message: "Authentication required",
+				status: 401
+			});
+			return false;
+		}
+		if (typeof authenticate === "function") {
+			await authenticate(request, reply);
+			if (reply.sent) return false;
+		}
+		return true;
+	};
+	/**
+	* Authorize ONE resource for this connection: run its list permission,
+	* snapshot its row filters IN ISOLATION (evaluateAndApplyPermission
+	* accumulates onto request._policyFilters — on a multiplexed connection
+	* resource B must never inherit resource A's filters, so the field is
+	* saved/reset/restored around each evaluation), and resolve the row
+	* matcher fail-closed. Sends the denial/501 reply itself; returns null
+	* when the caller should stop.
+	*/
+	const authorizeResource = async (resourceName, entry, request, reply) => {
+		const holder = request;
+		const saved = holder._policyFilters;
+		holder._policyFilters = void 0;
+		try {
+			const listCheck = entry.permissions?.list;
+			if (typeof listCheck === "function") {
+				if (!await evaluateAndApplyPermission(listCheck, {
+					user: request.user ?? null,
+					request,
+					resource: resourceName,
+					action: "list"
+				}, request, reply)) return null;
+			}
+			const filters = holder._policyFilters;
+			const resolution = resolveRowMatcher(filters, fastify.arc?.registry?.getAdapter(resourceName));
+			if (!resolution.enforceable) {
+				await reply.code(501).send({
+					code: "arc.realtime.unfilterable",
+					message: `The '${resourceName}' list permission returned operator-shaped row filters, which this feed cannot enforce in-process. Supply \`matchesFilter\` on the resource's DataAdapter to enable realtime for filter-scoped subscribers.`,
+					status: 501
+				});
+				return null;
+			}
+			const scope = request.scope;
+			return {
+				name: resourceName,
+				policy: {
+					tenantScoped: entry.tenantField !== false,
+					subscriberOrgId: scope ? getOrgId(scope) : void 0,
+					filters,
+					matcher: resolution.matcher
+				},
+				fields: entry.fields
+			};
+		} finally {
+			holder._policyFilters = saved;
+		}
+	};
+	/** Open the stream and wire every authorized subscription onto it. */
+	const sharedFrames = /* @__PURE__ */ new WeakMap();
+	const streamSubscriptions = async (request, reply, subscriptions) => {
+		const userRoles = getUserRoles(request.user ?? {});
+		const stream = openSseStream(request, reply, {
+			heartbeatMs: heartbeat,
+			retryMs: DEFAULT_RETRY_MS
+		});
+		stream.onCleanup(() => activeConnections.delete(stream.close));
+		activeConnections.add(stream.close);
+		const closeAt = connectionDeadlineMs(request.user, maxConnectionMs);
+		if (closeAt !== void 0) {
+			if (closeAt <= 0) {
+				stream.close();
+				return;
+			}
+			const timer = setTimeout(stream.close, closeAt);
+			timer.unref?.();
+			stream.onCleanup(() => clearTimeout(timer));
+		}
+		for (const sub of subscriptions) {
+			const deliver = (event, operation) => {
+				const decision = resolveDelivery(event, sub.policy, operation);
+				if (decision.kind === "drop") return;
+				if (decision.kind === "leave") {
+					stream.write(`${sub.name}.left`, JSON.stringify({
+						type: `${sub.name}.left`,
+						resource: sub.name,
+						id: event.meta?.resourceId
+					}), event.meta?.id);
+					return;
+				}
+				const { doc } = decision;
+				const needsMask = !!sub.fields && !!doc && typeof doc === "object";
+				let frame;
+				if (needsMask) {
+					const masked = applyFieldReadPermissions(doc, sub.fields, userRoles);
+					frame = buildChangeFrame(event, sub.name, masked);
+				} else {
+					const cached = sharedFrames.get(event);
+					frame = cached ?? buildChangeFrame(event, sub.name, doc);
+					if (!cached) sharedFrames.set(event, frame);
+				}
+				stream.write(event.type, frame, event.meta?.id);
+			};
+			for (const operation of operations) {
+				const unsub = await fastify.events.subscribe(`${sub.name}.${operation}`, (event) => deliver(event, operation));
+				stream.onCleanup(unsub);
+			}
+		}
+		stream.write("ready", JSON.stringify({
+			resources: subscriptions.map((s) => s.name),
+			operations: [...operations]
+		}));
+	};
+	const lookupEntry = (name) => {
+		if (allowlist && !allowlist.includes(name)) return void 0;
+		return fastify.arc?.registry?.get(name);
+	};
+	const notFound = (reply, name) => reply.code(404).send({
+		code: "arc.not_found",
+		message: `Resource '${name}' has no realtime feed`,
+		status: 404
+	});
+	fastify.route({
+		method: "GET",
+		url: path,
+		schema: {
+			tags: ["Events"],
+			summary: "Realtime resource change feed",
+			description: "SSE stream of created/updated/deleted events for one resource, gated by its list permission — row filters and field-level read permissions apply per event.",
+			response: { 200: {
+				type: "string",
+				description: "text/event-stream"
+			} }
+		},
+		handler: async (request, reply) => {
+			const resourceName = request.params.resource;
+			const entry = lookupEntry(resourceName);
+			if (!entry) return notFound(reply, resourceName);
+			if (!await runAuth(request, reply, [entry])) return;
+			const sub = await authorizeResource(resourceName, entry, request, reply);
+			if (!sub) return;
+			await streamSubscriptions(request, reply, [sub]);
+		}
+	});
+	const multiplexPath = path.replace(/\/:resource$/, "");
+	fastify.route({
+		method: "GET",
+		url: multiplexPath,
+		schema: {
+			tags: ["Events"],
+			summary: "Realtime multi-resource change feed",
+			description: "Multiplexed SSE stream for several resources over one connection (?resources=a,b,c). Every resource is gated by its own list permission; any denial rejects the subscription.",
+			querystring: {
+				type: "object",
+				properties: { resources: { type: "string" } },
+				required: ["resources"]
+			},
+			response: { 200: {
+				type: "string",
+				description: "text/event-stream"
+			} }
+		},
+		handler: async (request, reply) => {
+			const raw = request.query.resources;
+			const names = [...new Set(raw.split(",").map((s) => s.trim()).filter(Boolean))];
+			if (names.length === 0 || names.length > MAX_MULTIPLEX_RESOURCES) return reply.code(400).send({
+				code: "arc.bad_request",
+				message: `resources must name 1–${MAX_MULTIPLEX_RESOURCES} registered resources`,
+				status: 400
+			});
+			const entries = [];
+			for (const name of names) {
+				const entry = lookupEntry(name);
+				if (!entry) return notFound(reply, name);
+				entries.push(entry);
+			}
+			if (!await runAuth(request, reply, entries)) return;
+			const subscriptions = [];
+			for (let i = 0; i < names.length; i++) {
+				const sub = await authorizeResource(names[i], entries[i], request, reply);
+				if (!sub) return;
+				subscriptions.push(sub);
+			}
+			await streamSubscriptions(request, reply, subscriptions);
+		}
+	});
+	fastify.addHook("onClose", async () => {
+		for (const close of activeConnections) close();
+		activeConnections.clear();
+	});
+	log.debug("Plugin registered", {
+		path,
+		operations,
+		allowlist
+	});
+};
+var realtime_default = fp(realtimePlugin, {
+	name: "arc-realtime",
+	fastify: "5.x",
+	dependencies: ["arc-events"]
+});
+//#endregion
+export { realtime_default as n, realtime_exports as r, realtimePlugin as t };

package/dist/{registerRoute-oGAl0oA8.mjs → registerRoute-CWO6mdYe.mjs}

@@ -1,6 +1,6 @@
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
 import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
-import { N as evaluateAndApplyPermission } from "./permissions-BJMuKMl7.mjs";
+import { n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -81,24 +81,44 @@ function buildAuthMiddlewareForPermissions(fastify, permissions) {
 //#endregion
 //#region src/core/middlewares/chain.ts
 /**
-* Compose preHandler[] in the canonical order. Every null/undefined entry is
-* dropped. Keeps CRUD and Action routers from accidentally ordering the same
-* ingredients differently (regression risk: cache before auth → user-scoped
-* cache keys leak across users).
+* Compose the route-level `onRequest` + `preHandler` arrays in the canonical
+* order. Every null/undefined entry is dropped. Keeps the three routers from
+* accidentally ordering the same ingredients differently (regression risk:
+* cache before auth → user-scoped cache keys leak across users; auth after
+* body parse → anonymous schema probing).
 *
-* Canonical order:
-*   preAuth → arcDecorator → authMw → permissionMw → pluginMw → routeGuards → customMws
+* onRequest constraints (Fastify lifecycle): `request.body` is undefined —
+* everything placed there must be header/cookie/param/query-driven. arc's
+* `authenticate` / `optionalAuthenticate` qualify by contract (Bearer
+* header, session cookie, api-key header); `preAuth` handlers exist
+* precisely to promote query tokens into headers (SSE `?token=`); the arc
+* decorator stamps static route metadata.
 */
-function buildPreHandlerChain(parts) {
-	return [
-		...parts.preAuth ?? [],
-		parts.arcDecorator,
-		parts.authMw ?? null,
-		parts.permissionMw ?? null,
-		parts.pluginMw ?? null,
-		...parts.routeGuards ?? [],
-		...parts.customMws ?? []
-	].filter(Boolean);
+function buildRouteHooks(parts) {
+	return {
+		onRequest: [
+			...parts.preAuth ?? [],
+			parts.arcDecorator,
+			parts.authMw ?? null
+		].filter(Boolean),
+		preHandler: [
+			parts.permissionMw ?? null,
+			parts.pluginMw ?? null,
+			...parts.routeGuards ?? [],
+			...parts.customMws ?? []
+		].filter(Boolean)
+	};
+}
+/**
+* Spread helper — turns `RouteHookChains` into the two Fastify route-option
+* fields, omitting empty arrays so routes without middleware stay
+* option-free (Fastify skips absent hooks faster than empty arrays).
+*/
+function routeHookOptions(hooks) {
+	return {
+		...hooks.onRequest.length > 0 ? { onRequest: hooks.onRequest } : {},
+		...hooks.preHandler.length > 0 ? { preHandler: hooks.preHandler } : {}
+	};
 }
 /**
 * `RouteDefinition.preHandler` accepts two shapes:
@@ -329,4 +349,4 @@ function tryRegisterRoute(fastify, opts, context) {
 	}
 }
 //#endregion
-export { selectPluginMw as a, buildPreHandlerChain as c, buildAuthMiddlewareForPermissions as d, buildArcDecorator as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, buildAuthMiddleware as u };
+export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };

package/dist/registry/index.d.mts

@@ -1,5 +1,5 @@
-import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-Dtrj6XZk.mjs";
-import "../fastify-augmentation-DafigGQp.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-BBsvQt7U.mjs";
+import "../fastify-augmentation-g_f9omSc.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
 import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-vcOCtPij.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-7RnrEWNP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/requestId-5BhTVzBv.mjs

@@ -0,0 +1,113 @@
+import { randomUUID } from "node:crypto";
+import fp from "fastify-plugin";
+//#region src/plugins/requestId.ts
+/**
+* Request ID Plugin
+*
+* Propagates request IDs for distributed tracing.
+* - Accepts incoming x-request-id header (sanitized)
+* - Generates UUID if not provided
+* - Echoes the id on the response header + W3C trace-context propagation
+*
+* ID RESOLUTION LIVES AT THE SERVER LEVEL, NOT HERE. Fastify binds
+* `request.log = logger.child({ reqId: request.id })` at request
+* construction — before any hook runs — so an id assigned inside a hook
+* never reaches the logs. `createApp` therefore wires
+* {@link createRequestIdGenerator} into Fastify's `genReqId` option, and
+* this plugin simply adopts `request.id`. Standalone registration on a
+* bare Fastify instance falls back to the legacy in-hook resolution
+* (header echo / UUID), with the documented limitation that
+* `request.log`'s `reqId` binding predates the overwrite — pass
+* `genReqId: createRequestIdGenerator()` to `Fastify()` to fix that.
+*
+* @example
+* import { requestIdPlugin, createRequestIdGenerator } from '@classytic/arc';
+*
+* const fastify = Fastify({ genReqId: createRequestIdGenerator() });
+* await fastify.register(requestIdPlugin);
+*
+* fastify.get('/', async (request) => {
+*   request.log.info('traced');   // carries the same reqId as the header
+*   return { id: request.id };
+* });
+*/
+/**
+* Sanitize an incoming request-id header value: max 128 chars, alphanumeric
+* plus dashes/underscores/dots/colons only. Returns `undefined` for anything
+* else (crafted values could pollute logs or response headers). Array values
+* (repeated headers) are rejected outright — a client sending multiple
+* request-id headers is not tracing in good faith.
+*/
+function sanitizeRequestId(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 && trimmed.length <= 128 && /^[\w.:-]+$/.test(trimmed) ? trimmed : void 0;
+}
+/**
+* Build a Fastify `genReqId` function: adopt a sanitized incoming request-id
+* header, or generate one. Wire this into the `Fastify()` constructor so
+* `request.id`, `request.log`'s `reqId` binding, and the echoed response
+* header all agree — `createApp` does this automatically.
+*/
+function createRequestIdGenerator(opts = {}) {
+	const { header = "x-request-id", generator = randomUUID } = opts;
+	const headerName = header.toLowerCase();
+	return (req) => sanitizeRequestId(req.headers[headerName]) ?? generator();
+}
+/** Fastify's default request ids are `req-<base36 counter>`. */
+const FASTIFY_DEFAULT_ID = /^req-[0-9a-z]+$/;
+/** W3C traceparent format: `version-traceid-parentid-flags` */
+const TRACEPARENT_RE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/i;
+/** W3C spec: version ff is reserved and invalid; trace/parent IDs must not be all zeros */
+const TRACEID_ZEROS = "0".repeat(32);
+const PARENTID_ZEROS = "0".repeat(16);
+/** tracestate: printable ASCII, <= 512 bytes */
+const TRACESTATE_MAX = 512;
+function isValidTraceparent(tp) {
+	const m = TRACEPARENT_RE.exec(tp);
+	if (!m) return false;
+	const version = m[1] ?? "";
+	const traceId = m[2] ?? "";
+	const parentId = m[3] ?? "";
+	if (version.toLowerCase() === "ff") return false;
+	if (traceId.toLowerCase() === TRACEID_ZEROS) return false;
+	if (parentId.toLowerCase() === PARENTID_ZEROS) return false;
+	return true;
+}
+const requestIdPlugin = async (fastify, opts = {}) => {
+	const { header = "x-request-id", generator = randomUUID, setResponseHeader = true, propagateTraceContext = true } = opts;
+	if (!fastify.hasRequestDecorator("requestId")) fastify.decorateRequest("requestId", "");
+	if (!fastify.hasRequestDecorator("traceContext")) fastify.decorateRequest("traceContext", void 0);
+	fastify.addHook("onRequest", async (request, reply) => {
+		const incoming = sanitizeRequestId(request.headers[header]);
+		let requestId = String(request.id);
+		if (incoming && incoming !== requestId) requestId = incoming;
+		else if (!incoming && FASTIFY_DEFAULT_ID.test(requestId)) requestId = generator();
+		if (requestId !== request.id) request.id = requestId;
+		request.requestId = requestId;
+		if (setResponseHeader) reply.header(header, requestId);
+		if (propagateTraceContext) {
+			const rawTraceparent = request.headers["traceparent"];
+			const rawTracestate = request.headers["tracestate"];
+			if (typeof rawTraceparent === "string") {
+				const tp = rawTraceparent.trim();
+				if (isValidTraceparent(tp)) {
+					const ts = typeof rawTracestate === "string" && rawTracestate.length > 0 && rawTracestate.length <= TRACESTATE_MAX ? rawTracestate : void 0;
+					request.traceContext = {
+						traceparent: tp,
+						...ts ? { tracestate: ts } : {}
+					};
+					reply.header("traceparent", tp);
+					if (ts) reply.header("tracestate", ts);
+				}
+			}
+		}
+	});
+	fastify.log?.debug?.("Request ID plugin registered");
+};
+var requestId_default = fp(requestIdPlugin, {
+	name: "arc-request-id",
+	fastify: "5.x"
+});
+//#endregion
+export { sanitizeRequestId as i, requestIdPlugin as n, requestId_default as r, createRequestIdGenerator as t };