@classytic/arc 2.23.0 → 2.28.0

package/dist/plugins/index.mjs

@@ -1,18 +1,18 @@
 import { p as MUTATION_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { c as getOrgId } from "../types-bHblZ9YN.mjs";
-import { n as requestContext } from "../requestContext-BZKOr13H.mjs";
+import { c as getOrgId } from "../types-CSyCxl2V.mjs";
+import { n as requestContext } from "../requestContext-MrlJwECf.mjs";
 import { t as hasEvents } from "../typeGuards-C9KXUly6.mjs";
 import { t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
 import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
-import { i as sanitizeRequestId, n as requestIdPlugin, r as requestId_default, t as createRequestIdGenerator } from "../requestId-5BhTVzBv.mjs";
-import { n as health_default, t as healthPlugin } from "../health-ScyjIVo5.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-CB_m4S32.mjs";
 import { n as caching_default, t as cachingPlugin } from "../caching-_NJeDd1_.mjs";
 import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-Bq2OeEQL.mjs";
 import { n as metrics_default, t as metricsPlugin } from "../metrics-fdxI5mn_.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-I8OrfnMR.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-DEuDu9io.mjs";
 import { t as replyHelpersPlugin } from "../replyHelpers-67tRawQZ.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-0u4P4-OI.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-Dk-71iIz.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-CjOd2MG9.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-BQ1w0dfl.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-gKWyryT3.mjs";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
 const arcCorePlugin = async (fastify, opts = {}) => {
@@ -24,7 +24,10 @@ const arcCorePlugin = async (fastify, opts = {}) => {
 		registry: actualRegistry,
 		emitEvents,
 		externalOpenApiPaths: [],
-		plugins: /* @__PURE__ */ new Map()
+		plugins: /* @__PURE__ */ new Map(),
+		healthChecks: [],
+		moduleDefinitions: [],
+		scheduledJobs: []
 	});
 	for (const field of [
 		"_policyFilters",
@@ -201,91 +204,4 @@ var gracefulShutdown_default = fp(gracefulShutdownPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-//#region src/plugins/schedules.ts
-const MIN_SAFE_INTERVAL_MS = 1e3;
-const MAX_DEFAULT_LEASE_MS = 3e5;
-const schedulesPlugin = async (fastify, opts) => {
-	const { schedules, lock, enabled = true } = opts;
-	const holderId = opts.holderId ?? `arc-${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
-	const stats = /* @__PURE__ */ new Map();
-	fastify.decorate("getScheduleStats", () => [...stats.values()].map((s) => ({ ...s })));
-	if (!enabled) {
-		fastify.log.debug("schedulesPlugin disabled — registered as no-op");
-		return;
-	}
-	const seen = /* @__PURE__ */ new Set();
-	for (const s of schedules) {
-		if (!s.name) throw new TypeError("[arc-schedules] every schedule needs a name");
-		if (seen.has(s.name)) throw new TypeError(`[arc-schedules] duplicate schedule name "${s.name}"`);
-		seen.add(s.name);
-		if (!Number.isFinite(s.every) || s.every <= 0) throw new TypeError(`[arc-schedules] "${s.name}": \`every\` must be a positive number of ms`);
-		if (s.every < MIN_SAFE_INTERVAL_MS) fastify.log.warn(`[arc-schedules] "${s.name}" runs every ${s.every}ms — sub-second schedules are almost always a bug in production (DB pressure, lock churn). Intended for tests only.`);
-	}
-	const timers = /* @__PURE__ */ new Map();
-	const inFlight = /* @__PURE__ */ new Map();
-	let closing = false;
-	async function tick(s) {
-		const stat = stats.get(s.name);
-		if (!stat) return;
-		try {
-			if (lock) {
-				const leaseMs = s.leaseMs ?? Math.min(Math.floor(s.every * .9), MAX_DEFAULT_LEASE_MS);
-				if (!await lock.tryAcquire(`arc:schedule:${s.name}`, holderId, leaseMs)) {
-					stat.skippedByLock++;
-					return;
-				}
-			}
-			stat.runs++;
-			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
-			await s.handler(fastify);
-			stat.lastError = null;
-		} catch (err) {
-			stat.failures++;
-			stat.lastError = err instanceof Error ? err.message : String(err);
-			fastify.log.error({
-				err,
-				schedule: s.name
-			}, "[arc-schedules] schedule run failed");
-		}
-	}
-	function scheduleNext(s, delay) {
-		if (closing) return;
-		const timer = setTimeout(() => {
-			const run = tick(s).finally(() => {
-				inFlight.delete(s.name);
-				scheduleNext(s, s.every);
-			});
-			inFlight.set(s.name, run);
-		}, delay);
-		timer.unref?.();
-		timers.set(s.name, timer);
-	}
-	fastify.addHook("onReady", async () => {
-		for (const s of schedules) {
-			if (s.enabled === false) continue;
-			stats.set(s.name, {
-				name: s.name,
-				runs: 0,
-				failures: 0,
-				skippedByLock: 0,
-				lastRunAt: null,
-				lastError: null
-			});
-			const jitter = !s.runOnStart && s.jitterMs ? Math.floor(Math.random() * s.jitterMs) : 0;
-			scheduleNext(s, s.runOnStart ? 0 : s.every + jitter);
-		}
-		if (stats.size > 0) fastify.log.debug(`[arc-schedules] ${stats.size} schedule(s) armed${lock ? ` (leader-safe, holder ${holderId})` : ""}`);
-	});
-	fastify.addHook("onClose", async () => {
-		closing = true;
-		for (const timer of timers.values()) clearTimeout(timer);
-		timers.clear();
-		await Promise.allSettled([...inFlight.values()]);
-	});
-};
-var schedules_default = fp(schedulesPlugin, {
-	name: "arc-schedules",
-	fastify: "5.x"
-});
-//#endregion
 export { arcCorePlugin_default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, caching_default as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, gracefulShutdown_default as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, health_default as healthPlugin, healthPlugin as healthPluginFn, metrics_default as metricsPlugin, metricsPlugin as metricsPluginFn, realtime_default as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, requestId_default as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, schedules_default as schedulesPlugin, schedulesPlugin as schedulesPluginFn, sse_default as ssePlugin, ssePlugin as ssePluginFn, versioning_default as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/response-cache.mjs

@@ -92,6 +92,7 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 		"PATCH",
 		"DELETE"
 	], xCacheHeader = true, statsPath = null, keyFn } = opts;
+	if (maxEntries > 5e3) fastify.log.warn(`[arc] responseCache maxEntries=${maxEntries}: prefix invalidation scans all entries synchronously on every mutating request — expect event-loop pauses at this size. This cache is an instance-local micro-cache; for large shared caching use the queryCache with a Redis store instead.`);
 	const cache = new LRUCache(maxEntries);
 	const invalidateMethods = new Set(invalidateOn.map((m) => m.toUpperCase()));
 	if (!fastify.hasRequestDecorator("__arcCacheTTL")) fastify.decorateRequest("__arcCacheTTL", void 0);

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.23.0";
+	const resolvedVersion = serviceVersion ?? "2.28.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{index-Ba10fdKp.d.mts → preloadResources-CM4uUaFv.d.mts}

@@ -1,38 +1,16 @@
-import { Wt as Authenticator } from "./index-BBsvQt7U.mjs";
-import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
+import { Wt as Authenticator } from "./index-DPRH0Cme.mjs";
+import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
 import { n as ElevationOptions } from "./elevation-C9s5hFP_.mjs";
 import { a as EventTransport } from "./EventTransport-QmY7A258.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-CfYWq-Ak.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-br4otiqF.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler-C6yv4ZTW.mjs";
-import { l as ResourceLike, n as ArcModuleInput } from "./module-B4u10iOJ.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-A6EbthXR.mjs";
-import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions, x as HealthOptions } from "./versioning-D6PvCwpq.mjs";
+import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-Cu6vVJmh.mjs";
+import "./index-CZY4EGga.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-Bg3cP2_u.mjs";
+import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-DXgY5BUm.mjs";
 import { r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
-//#region src/testing/preloadResources.d.ts
-/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
-type EagerGlobResult = Record<string, unknown>;
-/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
-type LazyGlobResult = Record<string, () => Promise<unknown>>;
-/**
- * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
- *
- * Accepts either:
- * - `{ import: 'default' }` form: values are the resource directly
- * - default form: values are the full module — picks first export with `toPlugin()`
- *
- * Throws if any module doesn't yield a valid `ResourceLike`.
- */
-declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
-/**
- * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
- *
- * Use this when resources depend on prior bootstrap (e.g., engine init) and
- * cannot be evaluated at import time of the preload file.
- */
-declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
-//#endregion
 //#region src/factory/types/auth.d.ts
 /**
  * Arc's built-in JWT auth
@@ -238,6 +216,8 @@ interface UnderPressureOptions {
   exposeStatusRoute?: boolean;
   /** Event loop lag threshold in ms — requests rejected above this (default: 1000) */
   maxEventLoopDelay?: number;
+  /** Event loop utilization threshold (0–1) — requests rejected above this */
+  maxEventLoopUtilization?: number;
   /** V8 heap usage threshold in bytes — requests rejected above this */
   maxHeapUsedBytes?: number;
   /** RSS memory threshold in bytes — requests rejected above this */
@@ -445,6 +425,12 @@ interface CreateAppOptions {
    * - `'10.0.0.0/8'` / `['10.0.0.0/8', '172.16.0.0/12']` — trust only these
    *   CIDR ranges
    *
+   * Default: `false` everywhere, including `preset: 'production'` (2.24
+   * flip — fail-closed; the preset previously trusted every proxy). Apps
+   * behind a proxy/LB must set this explicitly or `request.ip` is the
+   * proxy's address; a boot warning fires when the production preset's
+   * default is inherited without an explicit choice.
+   *
    * @example
    * ```ts
    * createApp({ preset: 'production', trustProxy: 1 });          // one LB hop
@@ -661,6 +647,18 @@ interface CreateAppOptions {
      * ```
      */
     events?: Omit<EventPluginOptions, "transport"> | boolean;
+    /**
+     * Runtime options for module-contributed `scheduledJobs`. Module schedules
+     * automatically use Arc's existing schedules plugin. Pass lock/holder
+     * options for multi-replica safety, `true` for single-instance defaults,
+     * or `false` to reject any module that declares schedules.
+     *
+     * `enabled: false` registers the scheduler as a NO-OP — the host's runtime
+     * kill switch (e.g. an ops instance that must run zero background work
+     * against a shared DB). Unlike `schedules: false`, it does NOT reject
+     * modules that declare schedules; they are collected but never armed.
+     */
+    schedules?: Omit<SchedulesPluginOptions, "schedules"> | boolean;
     /**
      * Caching headers (ETag + Cache-Control). Default: false (opt-in).
      * Set to true for defaults, or pass CachingOptions for fine control.
@@ -698,26 +696,6 @@ interface CreateAppOptions {
      */
     versioning?: VersioningOptions;
   };
-  /**
-   * Type provider for schema inference.
-   *
-   * When set to `'typebox'`, enables TypeBox type provider for
-   * automatic TypeScript inference from route schemas.
-   *
-   * Requires `@sinclair/typebox` and `@fastify/type-provider-typebox` installed.
-   *
-   * @example
-   * ```typescript
-   * import { Type } from '@classytic/arc/schemas';
-   *
-   * const app = await createApp({
-   *   typeProvider: 'typebox',
-   * });
-   *
-   * // Now route schemas built with Type.* give full TS inference
-   * ```
-   */
-  typeProvider?: "typebox";
   /**
    * Error handler plugin. Normalizes AJV, Mongoose, and ArcError responses
    * into a consistent JSON envelope. Enabled by default.
@@ -1092,4 +1070,27 @@ interface CreateAppOptions {
   onClose?: (fastify: FastifyInstance) => void | Promise<void>;
 }
 //#endregion
-export { AuthOption as a, CustomPluginAuthOption as c, preloadResourcesAsync as d, UnderPressureOptions as i, JwtAuthOption as l, MultipartOptions as n, BetterAuthOption as o, RawBodyOptions as r, CustomAuthenticatorOption as s, CreateAppOptions as t, preloadResources as u };
+//#region src/factory/preloadResources.d.ts
+/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
+type EagerGlobResult = Record<string, unknown>;
+/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
+type LazyGlobResult = Record<string, () => Promise<unknown>>;
+/**
+ * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+ *
+ * Accepts either:
+ * - `{ import: 'default' }` form: values are the resource directly
+ * - default form: values are the full module — picks first export with `toPlugin()`
+ *
+ * Throws if any module doesn't yield a valid `ResourceLike`.
+ */
+declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
+/**
+ * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+ *
+ * Use this when resources depend on prior bootstrap (e.g., engine init) and
+ * cannot be evaluated at import time of the preload file.
+ */
+declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
+//#endregion
+export { RawBodyOptions as a, BetterAuthOption as c, JwtAuthOption as d, MultipartOptions as i, CustomAuthenticatorOption as l, preloadResourcesAsync as n, UnderPressureOptions as o, CreateAppOptions as r, AuthOption as s, preloadResources as t, CustomPluginAuthOption as u };

package/dist/preloadResources-DSY5HGpS.mjs

@@ -0,0 +1,45 @@
+//#region src/factory/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { preloadResourcesAsync as n, preloadResources as t };

package/dist/presets/filesUpload.d.mts

@@ -1,6 +1,6 @@
-import { Y as PresetResult } from "../index-BBsvQt7U.mjs";
-import { i as RequestScope } from "../types-DH0GupI7.mjs";
-import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
+import { Y as PresetResult } from "../index-DPRH0Cme.mjs";
+import { i as RequestScope } from "../types-DjC-KUCz.mjs";
+import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,7 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-DkO8Nk6-.mjs";
-import { c as getOrgId, g as getUserId } from "../types-bHblZ9YN.mjs";
-import { C as allowPublic, D as requireAuth } from "../permissions-tbxFHxjZ.mjs";
-import { t as multipartBody } from "../multipartBody-CHEQSZ6G.mjs";
+import { c as getOrgId, g as getUserId } from "../types-CSyCxl2V.mjs";
+import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
+import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/presets/index.d.mts

@@ -1,4 +1,5 @@
-import { Jt as AnyRecord, Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-BBsvQt7U.mjs";
+import { Rt as IControllerResponse, U as ResourceConfig, Y as PresetResult, d as PaginationResult, zt as IRequestContext } from "../index-DPRH0Cme.mjs";
+import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BOe4Ugkl.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-DwFDVKP0.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { X as CrudRouteKey, Y as PresetResult } from "../index-BBsvQt7U.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-DPRH0Cme.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,5 +1,5 @@
 import "../constants-DNre0wRg.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-bHblZ9YN.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CSyCxl2V.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-BBsvQt7U.mjs";
-import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
+import { At as RouteDefinition, Pt as ControllerHandler, Y as PresetResult, jt as RouteMcpConfig } from "../index-DPRH0Cme.mjs";
+import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as allowPublic, D as requireAuth } from "../permissions-tbxFHxjZ.mjs";
+import { A as requireAuth, E as allowPublic } from "../permissions-BrtiBKGs.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-BOe4Ugkl.mjs → presets-DwFDVKP0.mjs}

@@ -1,6 +1,6 @@
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
+import { A as requireAuth, E as allowPublic, M as requireRoles } from "./permissions-BrtiBKGs.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
-import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-tbxFHxjZ.mjs";
 //#region src/presets/ownedByUser.ts
 /**
 * Create ownership check middleware.

package/dist/{queryCachePlugin-DzqLN904.mjs → queryCachePlugin-DSGuSVLW.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { t as MemoryCacheStore } from "./memory-CLXA2VeJ.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
 import { i as versionKey, r as tagVersionKey } from "./keys-Cd316u_y.mjs";
+import { t as MemoryCacheStore } from "./memory-CmnzXE5Z.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {
@@ -33,7 +33,9 @@ var QueryCache = class {
 		};
 	}
 	async set(key, data, config) {
-		const staleTimeSec = config.staleTime ?? 0;
+		const baseStaleTimeSec = config.staleTime ?? 0;
+		const jitter = config.jitter ?? 0;
+		const staleTimeSec = jitter > 0 ? Math.max(0, baseStaleTimeSec * (1 + (Math.random() * 2 - 1) * jitter)) : baseStaleTimeSec;
 		const totalTtlSec = staleTimeSec + (config.gcTime ?? 60);
 		const now = Date.now();
 		const envelope = {
@@ -54,9 +56,7 @@ var QueryCache = class {
 	}
 	/** Bump resource version — orphans all cached queries for this resource */
 	async bumpResourceVersion(resource) {
-		const key = versionKey(resource);
-		const newVersion = Date.now();
-		await this.store.set(key, newVersion, 1440 * 60);
+		await this.bumpVersion(versionKey(resource));
 	}
 	/** Get current version for a tag */
 	async getTagVersion(tag) {
@@ -64,11 +64,42 @@ var QueryCache = class {
 	}
 	/** Bump tag version — orphans all cached queries tagged with this tag */
 	async bumpTagVersion(tag) {
-		const key = tagVersionKey(tag);
-		const newVersion = Date.now();
-		await this.store.set(key, newVersion, 1440 * 60);
+		await this.bumpVersion(tagVersionKey(tag));
+	}
+	/**
+	* Version-bump semantics:
+	*
+	*  - `store.increment` present (Redis `INCR`) — atomic and strictly
+	*    monotonic across replicas; concurrent bumps can never collide or
+	*    go backwards.
+	*  - fallback — read-modify-write with `max(now, current + 1)`: two
+	*    bumps in the same millisecond and clock regressions still advance
+	*    the version. Concurrent bumps from DIFFERENT replicas can lose one
+	*    write, which is why distributed hosts should use an incrementing
+	*    store (`runtime: 'distributed'` already requires a shared one).
+	*
+	* Version keys must outlive every derived cache entry — that invariant
+	* is what makes version invalidation sound (a version key expiring back
+	* to 0 would make entries written under the pre-reset version
+	* addressable again). The 1-year TTL applies with the repo-core
+	* TTL-ON-CREATE semantics, so a version key expires one year after its
+	* FIRST bump — safe, because a revived collision would need an entry to
+	* outlive that reset and entry TTLs are minutes-scale (staleTime +
+	* gcTime). The read-modify-write fallback uses plain `set`, which
+	* refreshes the TTL per bump — strictly longer-lived, equally safe.
+	*/
+	async bumpVersion(key) {
+		if (typeof this.store.increment === "function") {
+			await this.store.increment(key, 1, VERSION_TTL_SECONDS);
+			return;
+		}
+		const current = await this.store.get(key);
+		const next = Math.max(Date.now(), (current ?? 0) + 1);
+		await this.store.set(key, next, VERSION_TTL_SECONDS);
 	}
 };
+/** See `bumpVersion` — effectively non-expiring, refreshed on every bump. */
+const VERSION_TTL_SECONDS = 365 * 24 * 60 * 60;
 //#endregion
 //#region src/cache/queryCachePlugin.ts
 var queryCachePlugin_exports = /* @__PURE__ */ __exportAll({ queryCachePlugin: () => queryCachePlugin });

package/dist/{queryCachePlugin-CfYWq-Ak.d.mts → queryCachePlugin-br4otiqF.d.mts}

@@ -1,5 +1,5 @@
-import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
-import { i as QueryCache } from "./QueryCache-Z1B38koh.mjs";
+import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
+import { i as QueryCache } from "./QueryCache-DOMT_iq7.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/cache/queryCachePlugin.d.ts
 interface QueryCachePluginOptions {

package/dist/{registerRoute-CWO6mdYe.mjs → rateLimit-DrED-C4v.mjs}

@@ -1,6 +1,4 @@
-import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
-import { n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -179,76 +177,6 @@ function describeValue(v) {
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
 //#endregion
-//#region src/core/middlewares/permissions.ts
-/**
-* Build a PermissionContext from a Fastify request. Extracted so the CRUD
-* permission middleware and the dynamic action-permission check use the same
-* field layout — divergence here silently broke policy filters for actions.
-*/
-function buildPermissionContext(req, opts) {
-	const reqWithExtras = req;
-	const params = req.params;
-	return {
-		user: reqWithExtras.user ?? null,
-		request: req,
-		resource: opts.resource,
-		action: opts.action,
-		resourceId: opts.resourceId ?? params?.id,
-		params,
-		data: opts.data ?? req.body
-	};
-}
-/**
-* Static per-route CRUD permission gate. The permission and action are known
-* at route-registration time, so the gate is a plain preHandler.
-*
-* Actions use the dynamic counterpart `buildActionPermissionMw` — their
-* permission is resolved from `body.action` at request time.
-*/
-function buildCrudPermissionMw(permissionCheck, resourceName, action) {
-	if (!permissionCheck) return null;
-	return async (req, reply) => {
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action
-		}), req, reply);
-	};
-}
-/**
-* Dynamic per-action permission gate for the action router.
-*
-* Resolves the permission from `body.action` at request time and runs
-* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
-* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
-* (idempotency) and `routeGuards` run. Previously this check lived inside
-* the main action handler, which meant idempotency recorded unauthorized
-* requests and route guards saw unfiltered scope — the very divergence
-* routerShared exists to prevent.
-*
-* Also acts as a defensive fallback for invalid action names — the
-* `oneOf` body schema normally rejects these at AJV validation, but
-* hosts that disable schema validation still get a 400 here.
-*/
-function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
-	const enumSet = new Set(actionEnum);
-	const validActions = [...actionEnum];
-	return async (req, reply) => {
-		const body = req.body ?? {};
-		const action = body.action;
-		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
-		const permissionCheck = actionPermissions[action] ?? globalAuth;
-		if (!permissionCheck) return;
-		const { action: _discard, ...data } = body;
-		const params = req.params;
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action,
-			resourceId: params?.id,
-			data
-		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
-	};
-}
-//#endregion
 //#region src/core/middlewares/pluginMw.ts
 /**
 * Pick the request-lifecycle plugin middleware for an HTTP method:
@@ -314,39 +242,4 @@ function buildRateLimitConfig(rateLimit) {
 	} };
 }
 //#endregion
-//#region src/core/middlewares/registerRoute.ts
-/**
-* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
-*
-* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
-* overlaps before Fastify ever runs, but a few cases still slip through to
-* Fastify itself: two presets contributing the same `routes` entry, hosts
-* mounting two resources at the same prefix, custom routes that share a
-* URL with another plugin. Fastify's default message ("Method 'GET'
-* already declared for route '/'") gives no hint at the resource-shaped
-* fix — `disabledRoutes: ['list']` — so wrap it with one.
-*/
-function tryRegisterRoute(fastify, opts, context) {
-	try {
-		fastify.route(opts);
-	} catch (err) {
-		const fastifyErr = err;
-		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
-		const method = opts.method;
-		const url = opts.url;
-		const opHint = context.op ? ` (op: ${context.op})` : "";
-		const fixHint = context.op && [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
-		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
-		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
-		enhanced.cause = err;
-		throw enhanced;
-	}
-}
-//#endregion
-export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };
+export { buildRouteHooks as a, buildAuthMiddleware as c, selectPluginMw as i, buildAuthMiddlewareForPermissions as l, buildRouteConfig as n, resolveRoutePreHandlers as o, resolveRouterPluginMw as r, routeHookOptions as s, buildRateLimitConfig as t, buildArcDecorator as u };

package/dist/{realtime-I8OrfnMR.mjs → realtime-DEuDu9io.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId } from "./types-bHblZ9YN.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { c as getOrgId } from "./types-CSyCxl2V.mjs";
 import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
-import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-BnyVE9eD.mjs";
 import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
 import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
 import fp from "fastify-plugin";