@classytic/arc 2.22.0 → 2.25.0

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DbtgCOCj.mjs";
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DPRH0Cme.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/{actionPermissions-ze70xXJi.mjs → pipeline-BN5G05rd.mjs}

@@ -1,6 +1,6 @@
-import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { F as applyFieldReadPermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
-import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
+import { i as applyFieldReadPermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/scope/projection.ts
@@ -334,27 +334,4 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-//#region src/core/actionPermissions.ts
-/**
-* Return the effective `PermissionCheck` for a single action, or `undefined`
-* when the resource declares no gate at any level.
-*
-* Callers decide what "no gate" means:
-*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
-*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
-*     two surfaces fail closed identically so MCP can't expose an
-*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
-*     run).
-*   - OpenAPI: docs advertise the endpoint as unauthenticated.
-*/
-function resolveActionPermission(input) {
-	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
-	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
-	if (explicit) return explicit;
-	if (resourceActionPermissions) return resourceActionPermissions;
-	if (globalAuth) return globalAuth;
-	const updateFallback = resourcePermissions?.update;
-	if (updateFallback) return updateFallback;
-}
-//#endregion
-export { createCrudHandlers as a, getControllerContext as c, buildRequestScopeProjection as d, resolvePipelineSteps as i, getControllerScope as l, buildActionPipelineHandler as n, createFastifyHandler as o, buildPipelineHandler as r, createRequestContext as s, resolveActionPermission as t, sendControllerResponse as u };
+export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t, buildRequestScopeProjection as u };

package/dist/plugins/index.d.mts

@@ -1,7 +1,9 @@
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions, qt as AnyRecord } from "../index-DbtgCOCj.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DPRH0Cme.mjs";
+import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-C6yv4ZTW.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-9_fuetB4.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$8, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$7, v as _default$3, y as healthPlugin } from "../versioning-DLwklPlG.mjs";
+import { C as schedulesPlugin, D as healthPlugin, E as _default$3, S as _default$7, T as HealthOptions, b as ScheduleStats, w as HealthCheck, x as SchedulesPluginOptions, y as ScheduleDefinition } from "../index-KUoxjIq1.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-dPNBVeIj.mjs";
+import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DXgY5BUm.mjs";
 import { t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -163,79 +165,6 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
   headers: Record<string, string | string[] | undefined>;
 }) => string;
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
-declare const _default$5: FastifyPluginAsync<RequestIdOptions>;
+declare const _default$6: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-//#region src/plugins/schedules.d.ts
-/**
- * Structural view of the ecosystem lock contract — matches
- * `LockAdapter` from `@classytic/repo-core/lock` (and every kit
- * implementation) WITHOUT importing the subpath, so arc's emitted
- * declarations carry no repo-core@>=0.8 subpath reference and the
- * peer floor stays honest. Any conforming adapter assigns.
- */
-interface ScheduleLockLike {
-  tryAcquire(name: string, holderId: string, leaseMs: number): Promise<boolean> | boolean;
-  release(name: string, holderId: string): Promise<boolean> | boolean;
-}
-interface ScheduleDefinition {
-  /** Unique name — also the lock key (`arc:schedule:<name>`). */
-  name: string;
-  /** Interval in milliseconds between the END of one run and the next tick. */
-  every: number;
-  /** The work. Receives the Fastify instance; errors are logged, never fatal. */
-  handler: (fastify: FastifyInstance) => void | Promise<void>;
-  /** Fire once immediately when the app becomes ready (default: false). */
-  runOnStart?: boolean;
-  /**
-   * Random extra delay in `[0, jitterMs)` added to the FIRST tick only.
-   * Spreads boot-aligned jobs so multiple same-cadence schedules don't all
-   * fire at exactly `boot + every` after every restart (and, with a lock,
-   * de-synchronizes replicas competing for the same lease). Ignored when
-   * `runOnStart` is true.
-   */
-  jitterMs?: number;
-  /**
-   * Lease duration when a `lock` is configured. Default: `every * 0.9`
-   * (capped at 5 minutes) — long enough that other replicas skip the same
-   * tick, short enough that a crashed leader fails over within one cycle.
-   */
-  leaseMs?: number;
-  /** Per-schedule kill switch (default: true). */
-  enabled?: boolean;
-}
-interface SchedulesPluginOptions {
-  schedules: ScheduleDefinition[];
-  /**
-   * Ecosystem lock adapter for multi-replica deployments. Omit for
-   * single-instance apps — every tick runs locally.
-   */
-  lock?: ScheduleLockLike;
-  /**
-   * Identity of this replica for lease ownership. Default: a random id per
-   * process (repo-core's `getInstanceId()` is a good explicit value).
-   */
-  holderId?: string;
-  /**
-   * Master switch — `false` registers a typed no-op (config-gated
-   * environments), same pattern as `idempotencyPlugin`.
-   */
-  enabled?: boolean;
-}
-/** Per-schedule runtime counters, readable via `fastify.getScheduleStats()`. */
-interface ScheduleStats {
-  name: string;
-  runs: number;
-  failures: number;
-  skippedByLock: number;
-  lastRunAt: string | null;
-  lastError: string | null;
-}
-declare module "fastify" {
-  interface FastifyInstance {
-    getScheduleStats?: () => ScheduleStats[];
-  }
-}
-declare const schedulesPlugin: FastifyPluginAsync<SchedulesPluginOptions>;
-declare const _default$6: FastifyPluginAsync<SchedulesPluginOptions>;
-//#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleLockLike, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, _default$5 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$6 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$7 as ssePlugin, ssePlugin as ssePluginFn, _default$8 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$6 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$7 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$8 as ssePlugin, ssePlugin as ssePluginFn, _default$9 as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/index.mjs

@@ -1,17 +1,18 @@
 import { p as MUTATION_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { c as getOrgId } from "../types-bHblZ9YN.mjs";
-import { n as requestContext } from "../requestContext-BZKOr13H.mjs";
+import { c as getOrgId } from "../types-CSyCxl2V.mjs";
+import { n as requestContext } from "../requestContext-MrlJwECf.mjs";
 import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
 import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-7RnrEWNP.mjs";
-import { i as sanitizeRequestId, n as requestIdPlugin, r as requestId_default, t as createRequestIdGenerator } from "../requestId-5BhTVzBv.mjs";
-import { n as health_default, t as healthPlugin } from "../health-ScyjIVo5.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-CB_m4S32.mjs";
 import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BTzXSwIg.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bq2OeEQL.mjs";
 import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-Cuw_deA-.mjs";
 import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-CfUjwjDk.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-Dk-71iIz.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-CjOd2MG9.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-BQ1w0dfl.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-gKWyryT3.mjs";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
 const arcCorePlugin = async (fastify, opts = {}) => {
@@ -23,7 +24,10 @@ const arcCorePlugin = async (fastify, opts = {}) => {
 		registry: actualRegistry,
 		emitEvents,
 		externalOpenApiPaths: [],
-		plugins: /* @__PURE__ */ new Map()
+		plugins: /* @__PURE__ */ new Map(),
+		healthChecks: [],
+		moduleDefinitions: [],
+		scheduledJobs: []
 	});
 	for (const field of [
 		"_policyFilters",
@@ -200,91 +204,4 @@ var gracefulShutdown_default = fp(gracefulShutdownPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-//#region src/plugins/schedules.ts
-const MIN_SAFE_INTERVAL_MS = 1e3;
-const MAX_DEFAULT_LEASE_MS = 3e5;
-const schedulesPlugin = async (fastify, opts) => {
-	const { schedules, lock, enabled = true } = opts;
-	const holderId = opts.holderId ?? `arc-${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
-	const stats = /* @__PURE__ */ new Map();
-	fastify.decorate("getScheduleStats", () => [...stats.values()].map((s) => ({ ...s })));
-	if (!enabled) {
-		fastify.log.debug("schedulesPlugin disabled — registered as no-op");
-		return;
-	}
-	const seen = /* @__PURE__ */ new Set();
-	for (const s of schedules) {
-		if (!s.name) throw new TypeError("[arc-schedules] every schedule needs a name");
-		if (seen.has(s.name)) throw new TypeError(`[arc-schedules] duplicate schedule name "${s.name}"`);
-		seen.add(s.name);
-		if (!Number.isFinite(s.every) || s.every <= 0) throw new TypeError(`[arc-schedules] "${s.name}": \`every\` must be a positive number of ms`);
-		if (s.every < MIN_SAFE_INTERVAL_MS) fastify.log.warn(`[arc-schedules] "${s.name}" runs every ${s.every}ms — sub-second schedules are almost always a bug in production (DB pressure, lock churn). Intended for tests only.`);
-	}
-	const timers = /* @__PURE__ */ new Map();
-	const inFlight = /* @__PURE__ */ new Map();
-	let closing = false;
-	async function tick(s) {
-		const stat = stats.get(s.name);
-		if (!stat) return;
-		try {
-			if (lock) {
-				const leaseMs = s.leaseMs ?? Math.min(Math.floor(s.every * .9), MAX_DEFAULT_LEASE_MS);
-				if (!await lock.tryAcquire(`arc:schedule:${s.name}`, holderId, leaseMs)) {
-					stat.skippedByLock++;
-					return;
-				}
-			}
-			stat.runs++;
-			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
-			await s.handler(fastify);
-			stat.lastError = null;
-		} catch (err) {
-			stat.failures++;
-			stat.lastError = err instanceof Error ? err.message : String(err);
-			fastify.log.error({
-				err,
-				schedule: s.name
-			}, "[arc-schedules] schedule run failed");
-		}
-	}
-	function scheduleNext(s, delay) {
-		if (closing) return;
-		const timer = setTimeout(() => {
-			const run = tick(s).finally(() => {
-				inFlight.delete(s.name);
-				scheduleNext(s, s.every);
-			});
-			inFlight.set(s.name, run);
-		}, delay);
-		timer.unref?.();
-		timers.set(s.name, timer);
-	}
-	fastify.addHook("onReady", async () => {
-		for (const s of schedules) {
-			if (s.enabled === false) continue;
-			stats.set(s.name, {
-				name: s.name,
-				runs: 0,
-				failures: 0,
-				skippedByLock: 0,
-				lastRunAt: null,
-				lastError: null
-			});
-			const jitter = !s.runOnStart && s.jitterMs ? Math.floor(Math.random() * s.jitterMs) : 0;
-			scheduleNext(s, s.runOnStart ? 0 : s.every + jitter);
-		}
-		if (stats.size > 0) fastify.log.debug(`[arc-schedules] ${stats.size} schedule(s) armed${lock ? ` (leader-safe, holder ${holderId})` : ""}`);
-	});
-	fastify.addHook("onClose", async () => {
-		closing = true;
-		for (const timer of timers.values()) clearTimeout(timer);
-		timers.clear();
-		await Promise.allSettled([...inFlight.values()]);
-	});
-};
-var schedules_default = fp(schedulesPlugin, {
-	name: "arc-schedules",
-	fastify: "5.x"
-});
-//#endregion
-export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, schedules_default as schedulesPlugin, schedulesPlugin as schedulesPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, realtime_default as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, schedules_default as schedulesPlugin, schedulesPlugin as schedulesPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/response-cache.mjs

@@ -92,6 +92,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 		"PATCH",
 		"DELETE"
 	], xCacheHeader = true, statsPath = null, keyFn } = opts;
+	if (maxEntries > 5e3) fastify.log.warn(`[arc] responseCache maxEntries=${maxEntries}: prefix invalidation scans all entries synchronously on every mutating request — expect event-loop pauses at this size. This cache is an instance-local micro-cache; for large shared caching use the queryCache with a Redis store instead.`);
 	const cache = new LRUCache(maxEntries);
 	const invalidateMethods = new Set(invalidateOn.map((m) => m.toUpperCase()));
 	if (!fastify.hasRequestDecorator("__arcCacheTTL")) fastify.decorateRequest("__arcCacheTTL", void 0);

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.22.0";
+	const resolvedVersion = serviceVersion ?? "2.25.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{index-BEu4wjbL.d.mts → preloadResources-0oe-JSSS.d.mts}

@@ -1,38 +1,15 @@
-import { Ut as Authenticator } from "./index-DbtgCOCj.mjs";
-import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
+import { Wt as Authenticator } from "./index-DPRH0Cme.mjs";
+import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
 import { n as ElevationOptions } from "./elevation-C9s5hFP_.mjs";
 import { a as EventTransport } from "./EventTransport-QmY7A258.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-CfYWq-Ak.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-br4otiqF.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler-C6yv4ZTW.mjs";
-import { l as ResourceLike, n as ArcModuleInput } from "./module-B4u10iOJ.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-A6EbthXR.mjs";
-import { _ as HealthOptions, f as CachingOptions, l as SSEOptions, o as MetricsOptions, t as VersioningOptions } from "./versioning-DLwklPlG.mjs";
+import { T as HealthOptions, d as ArcModuleInput, g as ResourceLike, x as SchedulesPluginOptions } from "./index-KUoxjIq1.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-Bg3cP2_u.mjs";
+import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-DXgY5BUm.mjs";
 import { r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
-//#region src/testing/preloadResources.d.ts
-/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
-type EagerGlobResult = Record<string, unknown>;
-/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
-type LazyGlobResult = Record<string, () => Promise<unknown>>;
-/**
- * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
- *
- * Accepts either:
- * - `{ import: 'default' }` form: values are the resource directly
- * - default form: values are the full module — picks first export with `toPlugin()`
- *
- * Throws if any module doesn't yield a valid `ResourceLike`.
- */
-declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
-/**
- * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
- *
- * Use this when resources depend on prior bootstrap (e.g., engine init) and
- * cannot be evaluated at import time of the preload file.
- */
-declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
-//#endregion
 //#region src/factory/types/auth.d.ts
 /**
  * Arc's built-in JWT auth
@@ -238,6 +215,8 @@ interface UnderPressureOptions {
   exposeStatusRoute?: boolean;
   /** Event loop lag threshold in ms — requests rejected above this (default: 1000) */
   maxEventLoopDelay?: number;
+  /** Event loop utilization threshold (0–1) — requests rejected above this */
+  maxEventLoopUtilization?: number;
   /** V8 heap usage threshold in bytes — requests rejected above this */
   maxHeapUsedBytes?: number;
   /** RSS memory threshold in bytes — requests rejected above this */
@@ -445,6 +424,12 @@ interface CreateAppOptions {
    * - `'10.0.0.0/8'` / `['10.0.0.0/8', '172.16.0.0/12']` — trust only these
    *   CIDR ranges
    *
+   * Default: `false` everywhere, including `preset: 'production'` (2.24
+   * flip — fail-closed; the preset previously trusted every proxy). Apps
+   * behind a proxy/LB must set this explicitly or `request.ip` is the
+   * proxy's address; a boot warning fires when the production preset's
+   * default is inherited without an explicit choice.
+   *
    * @example
    * ```ts
    * createApp({ preset: 'production', trustProxy: 1 });          // one LB hop
@@ -661,6 +646,18 @@ interface CreateAppOptions {
      * ```
      */
     events?: Omit<EventPluginOptions, "transport"> | boolean;
+    /**
+     * Runtime options for module-contributed `scheduledJobs`. Module schedules
+     * automatically use Arc's existing schedules plugin. Pass lock/holder
+     * options for multi-replica safety, `true` for single-instance defaults,
+     * or `false` to reject any module that declares schedules.
+     *
+     * `enabled: false` registers the scheduler as a NO-OP — the host's runtime
+     * kill switch (e.g. an ops instance that must run zero background work
+     * against a shared DB). Unlike `schedules: false`, it does NOT reject
+     * modules that declare schedules; they are collected but never armed.
+     */
+    schedules?: Omit<SchedulesPluginOptions, "schedules"> | boolean;
     /**
      * Caching headers (ETag + Cache-Control). Default: false (opt-in).
      * Set to true for defaults, or pass CachingOptions for fine control.
@@ -672,6 +669,15 @@ interface CreateAppOptions {
      * Requires emitEvents to be enabled (or events plugin registered).
      */
     sse?: SSEOptions | boolean;
+    /**
+     * Realtime resource change feed (2.22) — `GET /realtime/:resource`
+     * streams that resource's created/updated/deleted events over SSE,
+     * gated by its own `list` permission with per-event row filtering,
+     * tenant scoping, and field-level masking. Default: false (opt-in).
+     * Set true for defaults, or pass RealtimeOptions (path, heartbeat,
+     * resource allowlist, operations). Requires events.
+     */
+    realtime?: RealtimeOptions | boolean;
     /**
      * QueryCache — TanStack Query-inspired server cache with SWR.
      * Default: false (opt-in). Set to true for memory store defaults.
@@ -689,26 +695,6 @@ interface CreateAppOptions {
      */
     versioning?: VersioningOptions;
   };
-  /**
-   * Type provider for schema inference.
-   *
-   * When set to `'typebox'`, enables TypeBox type provider for
-   * automatic TypeScript inference from route schemas.
-   *
-   * Requires `@sinclair/typebox` and `@fastify/type-provider-typebox` installed.
-   *
-   * @example
-   * ```typescript
-   * import { Type } from '@classytic/arc/schemas';
-   *
-   * const app = await createApp({
-   *   typeProvider: 'typebox',
-   * });
-   *
-   * // Now route schemas built with Type.* give full TS inference
-   * ```
-   */
-  typeProvider?: "typebox";
   /**
    * Error handler plugin. Normalizes AJV, Mongoose, and ArcError responses
    * into a consistent JSON envelope. Enabled by default.
@@ -1083,4 +1069,27 @@ interface CreateAppOptions {
   onClose?: (fastify: FastifyInstance) => void | Promise<void>;
 }
 //#endregion
-export { AuthOption as a, CustomPluginAuthOption as c, preloadResourcesAsync as d, UnderPressureOptions as i, JwtAuthOption as l, MultipartOptions as n, BetterAuthOption as o, RawBodyOptions as r, CustomAuthenticatorOption as s, CreateAppOptions as t, preloadResources as u };
+//#region src/factory/preloadResources.d.ts
+/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
+type EagerGlobResult = Record<string, unknown>;
+/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
+type LazyGlobResult = Record<string, () => Promise<unknown>>;
+/**
+ * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+ *
+ * Accepts either:
+ * - `{ import: 'default' }` form: values are the resource directly
+ * - default form: values are the full module — picks first export with `toPlugin()`
+ *
+ * Throws if any module doesn't yield a valid `ResourceLike`.
+ */
+declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
+/**
+ * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+ *
+ * Use this when resources depend on prior bootstrap (e.g., engine init) and
+ * cannot be evaluated at import time of the preload file.
+ */
+declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
+//#endregion
+export { RawBodyOptions as a, BetterAuthOption as c, JwtAuthOption as d, MultipartOptions as i, CustomAuthenticatorOption as l, preloadResourcesAsync as n, UnderPressureOptions as o, CreateAppOptions as r, AuthOption as s, preloadResources as t, CustomPluginAuthOption as u };