@classytic/arc 2.21.0 → 2.23.0

package/dist/{createApp-Bi61XxqU.mjs → createApp-CjOeWJ9_.mjs}

@@ -1,8 +1,55 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { arcLog } from "./logger/index.mjs";
+import { arcLog, configureArcLogger, createPinoWriter } from "./logger/index.mjs";
 import { n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
+import { t as createTenantKeyGenerator } from "./rateLimitKey-BoWRH3e7.mjs";
+import { t as createRequestIdGenerator } from "./requestId-5BhTVzBv.mjs";
+import { t as parseJsonBody } from "./jsonBody-BlzAoGCe.mjs";
 import Fastify from "fastify";
 import qs from "qs";
+//#region src/testing/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
 //#region src/factory/module.ts
 /**
 * Resolve any module-input form to a concrete `ArcModule`. A thunk is invoked
@@ -310,8 +357,33 @@ const edgePreset = {
 /**
 * Get preset by name
 */
+/**
+* Worker preset (2.23) — the headless process role. Flips the HTTP surface
+* off and enables the `mountRoutes: false` primitive; runtime tiers
+* (events, jobs, schedules, caching, audit, usage) stay AS CONFIGURED by
+* the host's options. Per the preset contract, explicit narrow settings
+* win — `arcPlugins: { metrics: true }` re-enables Prometheus on workers,
+* `auth: {...}` keeps auth. See wiki/factory.md § createWorker.
+*/
+const workerPreset = {
+	mountRoutes: false,
+	auth: false,
+	helmet: false,
+	cors: false,
+	rateLimit: false,
+	underPressure: false,
+	sensible: false,
+	arcPlugins: {
+		requestId: false,
+		health: false,
+		sse: false,
+		metrics: false,
+		gracefulShutdown: true
+	}
+};
 function getPreset(name) {
 	switch (name) {
+		case "worker": return workerPreset;
 		case "production": return productionPreset;
 		case "development": return developmentPreset;
 		case "testing": return testingPreset;
@@ -384,11 +456,18 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-CfUjwjDk.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-0u4P4-OI.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
+	if (config.arcPlugins?.realtime) if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
+	else {
+		const { default: realtimePlugin } = await import("./realtime-I8OrfnMR.mjs").then((n) => n.r);
+		const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
+		await fastify.register(realtimePlugin, opts);
+		trackPlugin("arc-realtime", opts);
+	}
 	if (config.arcPlugins?.metrics) {
 		const { default: metricsPlugin } = await import("./metrics-fdxI5mn_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
@@ -424,7 +503,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 	}
 	switch (authConfig.type) {
 		case "betterAuth": {
-			const { plugin, openapi } = authConfig.betterAuth;
+			const { plugin, openapi } = typeof authConfig.betterAuth === "function" ? await authConfig.betterAuth() : authConfig.betterAuth;
 			await fastify.register(plugin);
 			trackPlugin("auth-better-auth");
 			const arc = fastify.arc;
@@ -480,7 +559,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-Dxf6P_kV.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-Bq2OeEQL.mjs").then((n) => n.r);
 	let errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	if (moduleErrorMappers && moduleErrorMappers.length > 0) errorOpts = {
 		...errorOpts,
@@ -526,10 +605,10 @@ function isResourcesFactory(value) {
 	return typeof value === "function";
 }
 /** Register a single resource with descriptive error on failure. */
-async function registerOne(parent, resource) {
+async function registerOne(parent, resource, mountRoutes) {
 	const name = resource.name ?? "unknown";
 	try {
-		await parent.register(resource.toPlugin());
+		await parent.register(resource.toPlugin(), mountRoutes === false ? { arcMountRoutes: false } : {});
 	} catch (err) {
 		const rawMsg = err instanceof Error ? err.message : String(err);
 		const stripped = rawMsg.replace(new RegExp(`^Resource "${name}"\\s*`), "").replace(/\.+\s*$/, "");
@@ -640,6 +719,16 @@ async function registerResources(fastify, config, preResolvedModules) {
 		}
 		resolvedResources = discovered;
 	}
+	if (modules.length && resolvedResources && resolvedResources.length > 0) {
+		const owned = /* @__PURE__ */ new Set();
+		for (const m of modules) for (const name of m.owns ?? []) owned.add(name);
+		if (owned.size > 0) {
+			const before = resolvedResources.length;
+			resolvedResources = resolvedResources.filter((r) => !(r.name != null && owned.has(r.name)));
+			const dropped = before - resolvedResources.length;
+			if (dropped > 0) fastify.log.debug(`[arc] ${dropped} app resource(s) superseded by module owns() — the module version registers instead`);
+		}
+	}
 	if (modules.length) {
 		const moduleResources = [];
 		for (const m of modules) {
@@ -668,11 +757,11 @@ async function registerResources(fastify, config, preResolvedModules) {
 		const root = [];
 		for (const resource of resolvedResources) if (resource.skipGlobalPrefix) root.push(resource);
 		else prefixed.push(resource);
-		for (const resource of root) await registerOne(fastify, resource);
+		for (const resource of root) await registerOne(fastify, resource, config.mountRoutes);
 		if (prefixed.length) if (config.resourcePrefix) await fastify.register(async (scoped) => {
-			for (const resource of prefixed) await registerOne(scoped, resource);
+			for (const resource of prefixed) await registerOne(scoped, resource, config.mountRoutes);
 		}, { prefix: config.resourcePrefix });
-		else for (const resource of prefixed) await registerOne(fastify, resource);
+		else for (const resource of prefixed) await registerOne(fastify, resource, config.mountRoutes);
 		const names = resolvedResources.map((r) => r.name ?? "?").join(", ");
 		const prefix = config.resourcePrefix ? ` (prefix: ${config.resourcePrefix})` : "";
 		fastify.log.info(`${resolvedResources.length} resource(s) registered${prefix}: ${names}`);
@@ -709,42 +798,69 @@ async function registerResources(fastify, config, preResolvedModules) {
 	});
 }
 //#endregion
-//#region src/factory/registerSecurity.ts
+//#region src/factory/security/cors.ts
 /**
-* Translate `skipPaths` sugar into a `@fastify/rate-limit` `allowList`
-* function. A user-supplied `allowList` (array of IPs or function) is
-* preserved and OR-ed with the path match.
+* Headers ARC ITSELF reads from cross-origin requests. Auto-merged into a
+* host-declared CORS `allowedHeaders` allow-list (2.22) so hosts never
+* enumerate framework internals. Lowercase — header names are
+* case-insensitive and @fastify/cors joins them verbatim.
 */
-function buildRateLimitOpts(input) {
-	const { skipPaths, allowList, ...rest } = input;
-	if (!skipPaths || skipPaths.length === 0) return allowList === void 0 ? rest : {
-		...rest,
-		allowList
-	};
-	const matchesPath = compilePathMatcher(skipPaths);
-	const combined = async (req, key) => {
-		const path = (req.url ?? "").split("?", 1)[0] ?? "";
-		if (matchesPath(path)) return true;
-		if (typeof allowList === "function") return await allowList(req, key);
-		if (Array.isArray(allowList)) return allowList.includes(key);
-		return false;
-	};
+const ARC_PROTOCOL_HEADERS = [
+	"x-organization-id",
+	"x-arc-scope",
+	"x-request-id"
+];
+/**
+* Response headers ARC'S OWN auth protocol emits that cross-origin JS MUST
+* be able to read. Better Auth's bearer plugin returns the session token in
+* `set-auth-token` — without exposing it, cross-origin clients (Capacitor /
+* Ionic WebViews at `https://localhost`, cross-domain SPAs) complete the
+* login POST but can never READ the token, so bearer auth silently dies
+* (login appears to succeed, then every request is unauthenticated).
+* Unlike `allowedHeaders`, an UNSET `exposedHeaders` is NOT safe — CORS
+* exposes nothing beyond the safelist by default — so this is always
+* merged, creating the list when the host declared none.
+*/
+const ARC_EXPOSED_HEADERS = ["set-auth-token"];
+/**
+* Default `Access-Control-Max-Age` (seconds) when the host didn't set one.
+* Arc's CORS method/header lists are static per deploy, so letting browsers
+* cache the preflight kills the extra OPTIONS round-trip on every request —
+* on high-latency links (mobile webviews) that's a visible chunk of every
+* API call. Browsers clamp internally (Chromium 2h, Firefox 24h).
+*/
+const DEFAULT_CORS_MAX_AGE = 86400;
+/**
+* Resolve the host's CORS config into `@fastify/cors` options + warnings.
+* Throws on the one configuration arc refuses to ship (see module header).
+* Callers decide only HOW to surface warnings — the policy is all here.
+*/
+function resolveCorsOptions(config) {
+	const corsOptions = { ...config.cors ?? {} };
+	const warnings = [];
+	const originDeclared = "origin" in corsOptions && corsOptions.origin !== void 0;
+	if (config.preset === "production" && !originDeclared) warnings.push("CORS origin is not explicitly configured in production. Browser apps: set cors.origin to allowed domains (e.g. ['https://app.example.com']) with credentials: true. Server-to-server / API-key services: cors: { origin: '*', credentials: false } OR cors: false to disable. Tip: when wiring cors.origin from an env var, fail fast on missing (`if (!process.env.ALLOWED_ORIGINS) throw ...`) instead of letting `undefined` slip through.");
+	if (corsOptions.credentials === true && corsOptions.origin === "*") throw new Error("[Arc] cors: `origin: '*'` cannot be combined with `credentials: true`.\nReflecting arbitrary origins with credentials lets any website read authenticated responses (CSRF-adjacent data theft).\nFix one of:\n  • cors: { origin: ['https://app.example.com'], credentials: true }  — explicit allow-list\n  • cors: { origin: /\\.example\\.com$/, credentials: true }            — pattern allow-list\n  • cors: { origin: '*', credentials: false }                         — public, uncredentialed API");
+	if (Array.isArray(corsOptions.allowedHeaders)) {
+		const allowed = [...corsOptions.allowedHeaders];
+		const declared = new Set(allowed.map((h) => h.toLowerCase()));
+		for (const arcHeader of ARC_PROTOCOL_HEADERS) if (!declared.has(arcHeader)) allowed.push(arcHeader);
+		corsOptions.allowedHeaders = allowed;
+	}
+	{
+		const exposed = Array.isArray(corsOptions.exposedHeaders) ? [...corsOptions.exposedHeaders] : typeof corsOptions.exposedHeaders === "string" ? corsOptions.exposedHeaders.split(",").map((h) => h.trim()) : [];
+		const declared = new Set(exposed.map((h) => h.toLowerCase()));
+		for (const arcHeader of ARC_EXPOSED_HEADERS) if (!declared.has(arcHeader)) exposed.push(arcHeader);
+		corsOptions.exposedHeaders = exposed;
+	}
+	if (corsOptions.maxAge === void 0) corsOptions.maxAge = DEFAULT_CORS_MAX_AGE;
 	return {
-		...rest,
-		allowList: combined
-	};
-}
-function compilePathMatcher(patterns) {
-	const prefixes = [];
-	const exact = /* @__PURE__ */ new Set();
-	for (const p of patterns) if (p.endsWith("*")) prefixes.push(p.slice(0, -1));
-	else exact.add(p);
-	return (path) => {
-		if (exact.has(path)) return true;
-		for (const pre of prefixes) if (path.startsWith(pre)) return true;
-		return false;
+		options: corsOptions,
+		warnings
 	};
 }
+//#endregion
+//#region src/factory/security/pluginLoader.ts
 const PLUGIN_REGISTRY = {
 	cors: {
 		package: "@fastify/cors",
@@ -793,6 +909,77 @@ async function loadPlugin(name, logger) {
 		throw new Error(`Failed to load plugin '${name}': ${err.message}`);
 	}
 }
+//#endregion
+//#region src/factory/security/rateLimit.ts
+/** "Unlimited" as a number — @fastify/rate-limit's `max` fn must return one. */
+const UNLIMITED_MAX = Number.MAX_SAFE_INTEGER;
+/**
+* Expand `plan` sugar (2.22) into `@fastify/rate-limit` primitives: a
+* per-request async `max` that resolves the caller's plan once (cached
+* per request), and — unless the host supplied one — the tenant
+* keyGenerator so buckets follow actors, not IPs. Unknown plans and
+* resolver errors fall back to `plan.default`, then the global `max`
+* (fail-safe: never fail-open to unlimited).
+*/
+function buildPlanOpts(rest, plan) {
+	const globalMax = typeof rest.max === "number" ? rest.max : 100;
+	const fallbackLimit = plan.default !== void 0 ? plan.limits[plan.default] ?? { max: globalMax } : { max: globalMax };
+	const planCache = /* @__PURE__ */ new WeakMap();
+	const limitOf = (req) => {
+		let cached = planCache.get(req);
+		if (!cached) {
+			cached = Promise.resolve().then(() => plan.resolve(req)).then((name) => name !== void 0 ? plan.limits[name] ?? fallbackLimit : fallbackLimit).catch(() => fallbackLimit);
+			planCache.set(req, cached);
+		}
+		return cached;
+	};
+	return {
+		...rest,
+		max: async (req, _key) => {
+			const limit = await limitOf(req);
+			return limit === false ? UNLIMITED_MAX : limit.max;
+		},
+		keyGenerator: rest.keyGenerator ?? createTenantKeyGenerator()
+	};
+}
+/**
+* Translate `skipPaths` sugar into a `@fastify/rate-limit` `allowList`
+* function. A user-supplied `allowList` (array of IPs or function) is
+* preserved and OR-ed with the path match.
+*/
+function buildRateLimitOpts(input) {
+	const { skipPaths, allowList, plan, ...bare } = input;
+	const rest = plan ? buildPlanOpts(bare, plan) : bare;
+	if (!skipPaths || skipPaths.length === 0) return allowList === void 0 ? rest : {
+		...rest,
+		allowList
+	};
+	const matchesPath = compilePathMatcher(skipPaths);
+	const combined = async (req, key) => {
+		const path = (req.url ?? "").split("?", 1)[0] ?? "";
+		if (matchesPath(path)) return true;
+		if (typeof allowList === "function") return await allowList(req, key);
+		if (Array.isArray(allowList)) return allowList.includes(key);
+		return false;
+	};
+	return {
+		...rest,
+		allowList: combined
+	};
+}
+function compilePathMatcher(patterns) {
+	const prefixes = [];
+	const exact = /* @__PURE__ */ new Set();
+	for (const p of patterns) if (p.endsWith("*")) prefixes.push(p.slice(0, -1));
+	else exact.add(p);
+	return (path) => {
+		if (exact.has(path)) return true;
+		for (const pre of prefixes) if (path.startsWith(pre)) return true;
+		return false;
+	};
+}
+//#endregion
+//#region src/factory/registerSecurity.ts
 /**
 * Register security plugins (Helmet, CORS, Rate Limiting).
 * All enabled by default — set to `false` to opt out.
@@ -805,10 +992,8 @@ async function registerSecurityPlugins(fastify, config) {
 	} else fastify.log.warn("Helmet disabled - security headers not applied");
 	if (config.cors !== false) {
 		const cors = await loadPlugin("cors");
-		const corsOptions = { ...config.cors ?? {} };
-		const originDeclared = "origin" in corsOptions && corsOptions.origin !== void 0;
-		if (config.preset === "production" && !originDeclared) fastify.log.warn("CORS origin is not explicitly configured in production. Browser apps: set cors.origin to allowed domains (e.g. ['https://app.example.com']) with credentials: true. Server-to-server / API-key services: cors: { origin: '*', credentials: false } OR cors: false to disable. Tip: when wiring cors.origin from an env var, fail fast on missing (`if (!process.env.ALLOWED_ORIGINS) throw ...`) instead of letting `undefined` slip through.");
-		if (corsOptions.credentials && corsOptions.origin === "*") corsOptions.origin = true;
+		const { options: corsOptions, warnings } = resolveCorsOptions(config);
+		for (const warning of warnings) fastify.log.warn(warning);
 		await fastify.register(cors, corsOptions);
 		fastify.log.debug("CORS enabled");
 	} else fastify.log.warn("CORS disabled");
@@ -844,13 +1029,17 @@ async function registerUtilityPlugins(fastify, config) {
 	if (config.multipart !== false) {
 		const multipart = await loadPlugin("multipart", fastify.log);
 		if (multipart) {
+			const hostMultipart = typeof config.multipart === "object" && config.multipart !== null ? config.multipart : {};
 			await fastify.register(multipart, {
+				throwFileSizeLimit: true,
+				...hostMultipart,
 				limits: {
 					fileSize: 10 * 1024 * 1024,
-					files: 10
-				},
-				throwFileSizeLimit: true,
-				...config.multipart
+					files: 10,
+					fields: 100,
+					parts: 120,
+					...hostMultipart.limits
+				}
 			});
 			fastify.log.debug("Multipart (file uploads) enabled");
 		}
@@ -1030,10 +1219,7 @@ Missing:\n${lines}\n\nFix: pass durable adapters under \`stores\`, or use runtim
 * ```
 */
 async function createApp(options) {
-	if (options.debug !== void 0 && options.debug !== false) {
-		const { configureArcLogger } = await import("./logger/index.mjs");
-		configureArcLogger({ debug: options.debug });
-	}
+	if (options.debug !== void 0 && options.debug !== false) configureArcLogger({ debug: options.debug });
 	validateAuthOptions(options);
 	const deferredWarnings = validateDistributedRuntime(options);
 	if (options.beforeBoot) await options.beforeBoot();
@@ -1041,13 +1227,19 @@ async function createApp(options) {
 		...options.preset ? getPreset(options.preset) : {},
 		...options
 	};
+	const inheritedPermissiveTrustProxy = options.preset === "production" && options.trustProxy === void 0;
 	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
 	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
+	const resolvedLogger = resolveLoggerConfig(config.logger);
 	const fastify = Fastify({
-		logger: resolveLoggerConfig(config.logger),
+		logger: resolvedLogger,
+		genReqId: createRequestIdGenerator(),
 		trustProxy: config.trustProxy ?? false,
 		pluginTimeout: config.pluginTimeout ?? 1e4,
 		...config.bodyLimit !== void 0 ? { bodyLimit: config.bodyLimit } : {},
+		...config.requestTimeout !== void 0 ? { requestTimeout: config.requestTimeout } : {},
+		...config.connectionTimeout !== void 0 ? { connectionTimeout: config.connectionTimeout } : {},
+		...config.keepAliveTimeout !== void 0 ? { keepAliveTimeout: config.keepAliveTimeout } : {},
 		allowErrorHandlerOverride: true,
 		routerOptions: {
 			querystringParser: (str) => qs.parse(str, {
@@ -1066,19 +1258,22 @@ async function createApp(options) {
 			keywords: ["example", ...config.ajv?.keywords ?? []]
 		} }
 	});
+	if (resolvedLogger !== false) configureArcLogger({
+		...options.debug !== void 0 && options.debug !== false ? { debug: options.debug } : {},
+		writer: createPinoWriter(fastify.log)
+	});
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
+	if (inheritedPermissiveTrustProxy) fastify.log.warn("[arc] preset: 'production' defaults to trustProxy: true (trust EVERY proxy). If this app is reachable without your load balancer, clients can spoof X-Forwarded-For/Proto (rate-limit bypass, wrong audit IPs, forged protocol). Silence this by setting trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or true if you accept the trade-off. v3 flips this preset default to false — set it now to be upgrade-proof.");
 	if (config.typeProvider === "typebox") try {
 		const { TypeBoxValidatorCompiler } = await import("@fastify/type-provider-typebox");
 		fastify.setValidatorCompiler(TypeBoxValidatorCompiler);
 	} catch {
 		fastify.log.warn("typeProvider: \"typebox\" requested but @fastify/type-provider-typebox is not installed.");
 	}
-	const sjp = await import("secure-json-parse");
 	fastify.removeContentTypeParser("application/json");
 	fastify.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
-		if (!body || body.length === 0) return done(null, void 0);
 		try {
-			done(null, sjp.parse(body));
+			done(null, parseJsonBody(body));
 		} catch (err) {
 			done(err);
 		}
@@ -1152,4 +1347,4 @@ const ArcFactory = {
 	}
 };
 //#endregion
-export { edgePreset as a, testingPreset as c, orderModules as d, resolveModule as f, developmentPreset as i, defineModule as l, createApp as n, getPreset as o, createApp_exports as r, productionPreset as s, ArcFactory as t, getModuleExports as u };
+export { edgePreset as a, testingPreset as c, getModuleExports as d, orderModules as f, preloadResourcesAsync as h, developmentPreset as i, workerPreset as l, preloadResources as m, createApp as n, getPreset as o, resolveModule as p, createApp_exports as r, productionPreset as s, ArcFactory as t, defineModule as u };

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-Dtrj6XZk.mjs";
+import { p as RegistryEntry } from "../index-BBsvQt7U.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-Kyod_di6.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-jSDx-VDv.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/encryption/index.mjs

@@ -1,3 +1,5 @@
+import { t as ArcError } from "../errors-DkO8Nk6-.mjs";
+import { t as parseJsonBody } from "../jsonBody-BlzAoGCe.mjs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/encryption/fieldCipher.ts
@@ -182,17 +184,19 @@ const encryptionPlugin = async (fastify, opts) => {
 	}
 	if (decryptRequests) fastify.addContentTypeParser(contentType, { parseAs: "string" }, async (request, body) => {
 		const provider = keyProvider;
-		const plaintext = await jweDecrypt(body, (kid) => provider.decryptionKey(kid, { request }), allowedAlgs, allowedEncs);
-		request.requestDecrypted = true;
-		if (plaintext.length === 0) return void 0;
+		let plaintext;
 		try {
-			return JSON.parse(plaintext);
+			plaintext = await jweDecrypt(body, (kid) => provider.decryptionKey(kid, { request }), allowedAlgs, allowedEncs);
 		} catch (cause) {
-			throw Object.assign(/* @__PURE__ */ new Error("[arc/encryption] decrypted request body is not valid JSON"), {
+			throw new ArcError("Invalid encrypted request body", {
+				code: "arc.bad_request",
 				statusCode: 400,
 				cause
 			});
 		}
+		request.requestDecrypted = true;
+		if (plaintext.length === 0) return void 0;
+		return parseJsonBody(plaintext, "Decrypted request body is not valid JSON");
 	});
 	fastify.addHook("preSerialization", async (request, reply, payload) => {
 		const directive = resolveDirective(request, defaultMode, fallback);

package/dist/{errorHandler-Dxf6P_kV.mjs → errorHandler-Bq2OeEQL.mjs}

@@ -14,13 +14,16 @@ var errorHandler_exports = /* @__PURE__ */ __exportAll({
 * {@link ErrorHandlerOptions.isDuplicateKeyError}.
 */
 function defaultIsDuplicateKeyError(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (e.code === 11e3 || e.codeName === "DuplicateKey") return true;
-	if (e.code === "P2002") return true;
-	if (e.code === "23505") return true;
-	if (e.code === "ER_DUP_ENTRY" || e.errno === 1062) return true;
-	if (e.code === "SQLITE_CONSTRAINT_UNIQUE" || e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
+	let current = err;
+	for (let depth = 0; depth < 5 && current && typeof current === "object"; depth++) {
+		const e = current;
+		if (e.code === 11e3 || e.codeName === "DuplicateKey") return true;
+		if (e.code === "P2002") return true;
+		if (e.code === "23505") return true;
+		if (e.code === "ER_DUP_ENTRY" || e.errno === 1062) return true;
+		if (e.code === "SQLITE_CONSTRAINT_UNIQUE" || e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
+		current = e.cause;
+	}
 	return false;
 }
 function extractDuplicateFields(err) {
@@ -91,7 +94,7 @@ function mongooseValidationDetails(errors) {
 }
 async function errorHandlerPluginFn(fastify, options = {}) {
 	const isProduction = process.env.NODE_ENV === "production";
-	const { includeStack = !isProduction, onError, errorMap = {}, errorMappers = [], isDuplicateKeyError = defaultIsDuplicateKeyError } = options;
+	const { includeStack = !isProduction, exposeInternalMessages = !isProduction, onError, errorMap = {}, errorMappers = [], isDuplicateKeyError = defaultIsDuplicateKeyError } = options;
 	fastify.setErrorHandler(async (error, request, reply) => {
 		if (onError) try {
 			await onError(error, request);
@@ -112,6 +115,7 @@ async function errorHandlerPluginFn(fastify, options = {}) {
 			...Object.keys(meta).length > 0 ? { meta } : {}
 		};
 		const status = wire.status ?? 500;
+		if (status >= 500 && wire.code === "arc.internal_error" && !exposeInternalMessages) wire.message = "Internal Server Error";
 		if (status >= 500) request.log.error({
 			err: error,
 			status
@@ -120,11 +124,31 @@ async function errorHandlerPluginFn(fastify, options = {}) {
 			err: error,
 			status
 		}, "Client error");
-		if (isArcError(error) && error.cause) request.log.error({ cause: error.cause }, "Error cause chain");
+		if (isArcError(error) && error.cause) {
+			const causeLevel = status >= 500 ? "error" : "warn";
+			request.log[causeLevel]({ cause: error.cause }, "Error cause chain");
+		}
 		return reply.status(status).send(wire);
 	});
 }
 /**
+* Is `code` a caller-defined DOMAIN error code that is safe to surface on the
+* wire, as opposed to a framework/runtime code that must never leak?
+*
+* Rejects Fastify internals (`FST_*`) and Node system errnos (`ECONNREFUSED`,
+* `ENOENT`, …). Domain codes in the wild use separators (`PURCHASE_NOT_FOUND`,
+* `access.forbidden`) so they pass; a bare all-caps single word that collides
+* with the Node-errno shape (e.g. `EXPIRED`) is conservatively treated as a
+* runtime code — use a separatored code (`TOKEN_EXPIRED`) to surface it, or
+* throw via `createDomainError` which bypasses this heuristic entirely.
+*/
+function isDomainErrorCode(code) {
+	if (typeof code !== "string" || code.length === 0) return false;
+	if (code.startsWith("FST_")) return false;
+	if (/^E[A-Z]{2,}$/.test(code)) return false;
+	return true;
+}
+/**
 * Single-pass error → `ErrorContract` classifier. Dispatch order is fixed:
 *
 *   1. Class-based mappers (`instanceof`) — user-registered domain errors
@@ -167,7 +191,7 @@ function classify(error, ctx) {
 		};
 	}
 	if (typeof fastifyErr.statusCode === "number") return {
-		code: statusToArcCode(fastifyErr.statusCode),
+		code: (isDomainErrorCode(fastifyErr.code) ? fastifyErr.code : void 0) ?? statusToArcCode(fastifyErr.statusCode),
 		message: error.message || "Error",
 		status: fastifyErr.statusCode
 	};

package/dist/{errorHandler-B0e-bq-O.d.mts → errorHandler-C6yv4ZTW.d.mts}

@@ -18,6 +18,19 @@ interface ErrorMapper<T extends Error = Error> {
 interface ErrorHandlerOptions {
   /** Include `meta.stack` on the wire (defaults to `NODE_ENV !== 'production'`). */
   includeStack?: boolean;
+  /**
+   * Ship the raw `error.message` of UNCLASSIFIED 500s on the wire
+   * (defaults to `NODE_ENV !== 'production'`).
+   *
+   * Only the `arc.internal_error` fallback is affected — an unclassified
+   * throw carries whatever some driver/library put in the message (connection
+   * strings, file paths, SQL fragments), which must not reach clients in
+   * production. Deliberate 5xx contracts are untouched: `ArcError` /
+   * domain-coded throws (`payment.gateway.timeout`, …) keep their message
+   * because the thrower chose it for the client. The raw message is always
+   * logged via `request.log.error({ err })` regardless of this flag.
+   */
+  exposeInternalMessages?: boolean;
   /** Custom callback fired for every error — log to Sentry / Datadog / etc. */
   onError?: (error: Error, request: FastifyRequest) => void | Promise<void>;
   /** Map by `error.name` string. Lower priority than `errorMappers`. */

package/dist/events/index.mjs

@@ -176,8 +176,11 @@ function validatePayload(payload, schema) {
 			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
 				const expectedType = propSchema.type;
 				if (expectedType) {
-					const actualType = Array.isArray(record[key]) ? "array" : typeof record[key];
-					if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
+					const value = record[key];
+					const actualType = Array.isArray(value) ? "array" : typeof value;
+					if (expectedType === "integer") {
+						if (actualType !== "number" || !Number.isInteger(value)) errors.push(`Field '${key}': expected integer, got ${actualType}`);
+					} else if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
 				}
 			}
 		}