@classytic/arc 2.28.0 → 2.31.0

package/dist/defineAggregation-DbPPS8RI.mjs

@@ -0,0 +1,48 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+//#region src/core/aggregation/defineAggregation.ts
+/**
+* Declare a single resource aggregation. Exported configs flow into
+* `defineResource({ aggregations: { ... } })` either as named keys or
+* via auto-discovery patterns (loadAggregations — future).
+*
+* @example Inline
+* ```ts
+* defineResource({
+*   name: 'order',
+*   aggregations: {
+*     revenueByStatus: defineAggregation({
+*       groupBy: 'status',
+*       measures: { count: 'count', revenue: 'sum:totalPrice' },
+*       permissions: requireRoles(['admin']),
+*     }),
+*   },
+* });
+* ```
+*
+* @example Multi-file
+* ```ts
+* // orders/aggregations/revenue-by-status.ts
+* import { defineAggregation } from '@classytic/arc';
+*
+* export const revenueByStatus = defineAggregation({
+*   groupBy: 'status',
+*   measures: { count: 'count', revenue: 'sum:totalPrice' },
+*   permissions: requireRoles(['admin']),
+*   timeout: 5000,
+*   cache: { staleTime: 60 },
+* });
+*
+* // orders/order.resource.ts
+* import * as aggregations from './aggregations/index.js';
+*
+* defineResource({
+*   name: 'order',
+*   aggregations,                                  // 30+ entries flow in
+* });
+* ```
+*/
+function defineAggregation(config) {
+	return config;
+}
+//#endregion
+export { defineAggregation as t };

package/dist/{defineResource-2zvVVpxg.mjs → defineResource-Bv6EtN1x.mjs}

@@ -1,21 +1,22 @@
-import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-D3Dv4LAV.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B65zbz9m.mjs";
-import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
-import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-DTp18Ah_.mjs";
-import { c as getDefaultCrudSchemas } from "./utils-taUVD4p3.mjs";
-import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-DJvodiHj.mjs";
-import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
-import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-BGRnV-To.mjs";
-import { A as requireAuth } from "./permissions-BrtiBKGs.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-DwFDVKP0.mjs";
-import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
+import { r as ForbiddenError } from "./errors-Cj42AntO.mjs";
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-De7GqHck.mjs";
+import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-CMPY5Qms.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CB5Cuzk9.mjs";
+import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-CBN84fc7.mjs";
+import { c as getDefaultCrudSchemas } from "./utils-vL8BrDE2.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-D--wdJM-.mjs";
+import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-PSZwi8JV.mjs";
+import { t as hasEvents } from "./typeGuards-B0ryPo3I.mjs";
+import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps } from "./pipeline-UPQFatit.mjs";
+import { I as requireAuth } from "./permissions-L--QDAir.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-C4-g4_4P.mjs";
+import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
 //#region src/core/middlewares/fieldWrite.ts
 /**
 * Build a preHandler that enforces field-write permissions on the request body.
@@ -58,25 +59,30 @@ function methodCarriesBody(method) {
 //#region src/core/createCrudRouter.ts
 /**
 * Mount custom routes (from presets or user-defined `routes`) on Fastify.
-* `wrapHandler` is derived inline from `!route.raw`.
+* `wrapHandler` is derived inline from whether `rawHandler` was set.
 */
 function createCustomRoutes(fastify, routes, controller, options) {
 	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied, extensions } = options;
 	for (const route of routes) {
+		if ("raw" in route) throw new Error(`Route ${route.method} ${route.path}: \`raw\` was removed in arc 2.31 — the FIELD now carries the intent. Move the function to \`rawHandler\` (Fastify-native \`(request, reply)\`) or leave it in \`handler\` (arc pipeline, \`(ctx)\`), and delete the flag. If this route comes from a dependency, that package needs a release built against arc >=2.31.`);
 		const routeWithRefs = route;
-		const hasHandler = route.handler !== void 0;
+		const hasHandler = route.handler !== void 0 || route.rawHandler !== void 0;
 		const hasControllerMethod = typeof routeWithRefs.controllerMethod === "function";
 		if (hasHandler && hasControllerMethod) throw new Error(`Route ${route.method} ${route.path}: pass either \`handler\` or \`controllerMethod\`, not both. Prefer \`controllerMethod: (c: MyController) => c.method\` for typed handler refs (TS catches typos).`);
-		if (!hasHandler && !hasControllerMethod) throw new Error(`Route ${route.method} ${route.path}: must declare either \`handler\` (string / function) or \`controllerMethod: (c) => c.method\` (typed function-ref form).`);
+		if (!hasHandler && !hasControllerMethod) throw new Error(`Route ${route.method} ${route.path}: must declare one of \`handler\` (arc pipeline), \`rawHandler\` (Fastify-native), or \`controllerMethod: (c) => c.method\` (typed function-ref form).`);
 		let resolvedHandler;
 		if (hasControllerMethod) {
 			if (!controller) throw new Error(`Route ${route.method} ${route.path}: \`controllerMethod\` requires a controller. Provide one via \`defineResource({ controller, … })\`, or use \`defineResource\` with an \`adapter\` so arc auto-creates a BaseController.`);
 			const referenced = routeWithRefs.controllerMethod?.(controller);
 			if (typeof referenced !== "function") throw new Error(`Route ${route.method} ${route.path}: \`controllerMethod\` did not return a function. Return the method itself: \`controllerMethod: (c) => c.myMethod\`.`);
 			resolvedHandler = referenced.bind(controller);
-		} else resolvedHandler = route.handler;
+		} else {
+			if (route.rawHandler && route.handler) throw new Error(`Route ${route.method} ${route.path}: set either \`handler\` (arc pipeline) or \`rawHandler\` (Fastify-native), not both.`);
+			resolvedHandler = route.rawHandler ?? route.handler;
+		}
 		const opName = route.operation ?? (typeof resolvedHandler === "string" ? resolvedHandler : `${route.method.toLowerCase()}${route.path.replace(/[/:]/g, "_")}`);
-		const wrapHandler = !route.raw;
+		const isRaw = route.rawHandler !== void 0;
+		const wrapHandler = !isRaw;
 		let handler;
 		if (typeof resolvedHandler === "string") {
 			if (!controller) throw new Error(`Route ${route.method} ${route.path}: string handler '${resolvedHandler}' requires a controller. Either provide a controller or use a function handler instead.`);
@@ -104,7 +110,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			if (!tenantScopeMw || tenantScopeMw.length === 0) throw new Error(`Route ${route.method} ${route.path}: \`tenantScope: true\` requires a multi-tenant preset. Add \`multiTenantPreset()\` (or \`flexibleMultiTenantPreset()\`) to the resource's \`presets\`, or remove the \`tenantScope\` flag from this route.`);
 			customPreHandlers.unshift(...tenantScopeMw);
 		}
-		if (route.raw !== true && route.fieldWrite !== false && methodCarriesBody(route.method)) {
+		if (!isRaw && route.fieldWrite !== false && methodCarriesBody(route.method)) {
 			const fieldWriteMw = buildFieldWritePreHandler(fieldPermissions, onFieldWriteDenied);
 			if (fieldWriteMw) customPreHandlers.push(fieldWriteMw);
 		}
@@ -123,18 +129,18 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			url: route.path,
 			schema,
 			...routeHookOptions(hooks),
-			handler: isStream ? async (request, reply) => {
+			handler: isStream ? async function streamRoute(request, reply) {
 				reply.raw.setHeader("Content-Type", "text/event-stream");
 				reply.raw.setHeader("Cache-Control", "no-cache");
 				reply.raw.setHeader("Connection", "keep-alive");
-				const result = await handler(request, reply);
+				const result = await handler.call(this, request, reply);
 				if (isReadableStream(result)) {
 					await pipeUIMessageStreamToReply(reply, result);
 					return reply;
 				}
 				return result;
 			} : handler,
-			...buildRouteConfig(route.rateLimit !== void 0 ? buildRateLimitConfig(route.rateLimit) : rateLimitConfig, extensions)
+			...buildRouteConfig(route.rateLimit !== void 0 ? buildRateLimitConfig(route.rateLimit) : rateLimitConfig, extensions, route.cors)
 		}, {
 			resourceName,
 			op: opName
@@ -462,26 +468,6 @@ function buildBaseController(resolvedConfig, adapter, repository) {
 //#endregion
 //#region src/core/defineResource/hooks.ts
 /**
-* Phase 6 — wire preset hooks + inline `config.hooks` onto the
-* resource's `_pendingHooks`.
-*
-* Two sources feed the same array:
-*   1. Preset hooks collected during `applyPresets()` (raw `_hooks`
-*      on the internal config). Already in the canonical
-*      `{ operation, phase, handler, priority }` shape — copied
-*      verbatim (priority defaults to 10).
-*   2. Inline `config.hooks.beforeCreate` / `afterCreate` / etc.
-*      Authored by the user on the original `ResourceConfig`.
-*      Wrapped in a `ResourceHookContext` projection (v2.10.8) so
-*      authors can read `scope` / `context` without reaching into
-*      internal request fields.
-*
-* The 6 inline hook keys (before/after × create/update/delete) used
-* to be 6 nearly-identical blocks; collapsed into a table + loop so
-* a future hook (e.g. `beforeRead`) is one row, not seven scattered
-* edits.
-*/
-/**
 * Combined entry-point for Phase 6. Pushes preset-collected hooks
 * first, then inline `config.hooks` (so hosts can rely on
 * registration order if priorities tie).
@@ -544,19 +530,17 @@ const INLINE_HOOK_SPECS = [
 	}
 ];
 /**
-* Project a raw HookSystem context into a `ResourceHookContext` for
-* inline `config.hooks.*` handlers. The projection lifts `scope`
-* out of `context._scope` so authors don't reach into internal
-* fields.
+* Project a raw HookSystem context into a `ResourceHookContext` for inline
+* `config.hooks.*` handlers. `scope` rides in already computed — `HookContext`
+* carries the same projection — so the two surfaces cannot drift.
 */
 function buildHookContext(ctx) {
 	const context = ctx.context;
-	const rawScope = context?._scope;
 	return {
 		data: ctx.data ?? ctx.result ?? {},
 		user: ctx.user,
 		context,
-		scope: buildRequestScopeProjection(rawScope),
+		scope: ctx.scope,
 		meta: ctx.meta
 	};
 }
@@ -662,8 +646,7 @@ function expandHistory(config) {
 		method: "GET",
 		path: "/:id/history",
 		summary: `Change history for a ${resourceName} record (audit-backed timeline)`,
-		raw: true,
-		handler: async (request, reply) => {
+		rawHandler: async (request, reply) => {
 			const audit = request.server.audit;
 			if (!audit?.query || audit._noop === true) return reply.code(503).send({
 				code: "history.audit_unavailable",
@@ -802,7 +785,7 @@ function stripFromRequired(schema, fieldName) {
 }
 /**
 * Strip framework-injected fields from the `required[]` list of every
-* body-shaped slot in an adapter's generated schemas (v2.11.0).
+* body-shaped slot in an adapter's generated schemas.
 *
 * A "framework-injected field" is any field marked `systemManaged: true`
 * in `schemaOptions.fieldRules`. Arc populates those fields from the
@@ -957,22 +940,32 @@ const WRITE_OPERATIONS = /* @__PURE__ */ new Set([
 * wiring, ...) count as gates and don't false-positive.
 *
 * Severity ladder:
-*   - `warn` when any enabled WRITE op (create/update/delete) is ungated —
-*     this is real exposure the host must acknowledge.
+*   - `error` when any enabled WRITE op is ungated AND `strict` is on — the
+*     resource fails boot (`defineResource()` throws). This is the fail-closed
+*     production invariant: an unauthenticated write must never ship silently.
+*   - `warn` (default) when any enabled WRITE op (create/update/delete) is
+*     ungated — real exposure the host must acknowledge, but non-fatal so
+*     existing hosts are not broken.
 *   - `info` when only reads are ungated — public catalogs
 *     (`referenceData: true`) are a legitimate shape, but the host should
 *     still state intent with `permissions.fullPublic()` / `allowPublic()`.
+*
+* `strict` is opt-in (resource `strictPermissions: true` or the
+* `ARC_STRICT_PERMISSIONS` env), so the default behavior is unchanged.
 */
-function collectUngatedCrudDiagnostics(config) {
+function collectUngatedCrudDiagnostics(config, strict = false) {
 	if (config.disableDefaultRoutes) return [];
 	const disabled = new Set(config.disabledRoutes ?? []);
 	const permissions = config.permissions ?? {};
 	const ungated = CRUD_OPERATIONS.filter((op) => !disabled.has(op) && typeof permissions[op] !== "function");
 	if (ungated.length === 0) return [];
+	const severity = ungated.some((op) => WRITE_OPERATIONS.has(op)) ? strict ? "error" : "warn" : "info";
 	return [{
-		severity: ungated.some((op) => WRITE_OPERATIONS.has(op)) ? "warn" : "info",
+		severity,
 		code: "crud-public-by-omission",
-		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\nAn omitted permission mounts the route WITHOUT auth. State intent explicitly:\n  permissions: permissions.fullPublic()     // intentionally public\n  permissions: permissions.authenticated()  // require auth on every op\n  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
+		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\n` + (severity === "error" ? "strictPermissions is on and an ungated WRITE is fatal. State intent explicitly:\n" : "An omitted permission mounts the route WITHOUT auth. State intent explicitly:\n") + `  permissions: permissions.fullPublic()     // intentionally public
+  permissions: permissions.authenticated()  // require auth on every op
+  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
 	}];
 }
 //#endregion
@@ -1217,7 +1210,7 @@ function buildResourcePlugin(resource) {
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
 		if (isFirstMount && resource._diagnostics?.length) for (const diagnostic of resource._diagnostics) {
-			const level = diagnostic.severity === "info" ? "info" : "warn";
+			const level = diagnostic.severity === "info" ? "info" : diagnostic.severity === "error" ? "error" : "warn";
 			fastify.log?.[level]?.(diagnostic.message);
 		}
 		const arc = fastify.arc;
@@ -1278,7 +1271,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-C-N7z2EL.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-CDXEdasl.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1293,7 +1286,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-wzwFa_dW.mjs"), import("./validate-Bk44F2yT.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-KrQDzx-k.mjs"), import("./validate-_KbifpHF.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1549,7 +1542,7 @@ var ResourceDefinition = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
-				raw: r.raw,
+				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),
 			routes: [],
@@ -1827,17 +1820,22 @@ function validateResourceConfig(config, options = {}) {
 }
 function validateRouteHandlers(controller, routes, errors) {
 	const ctrl = controller;
-	for (const route of routes) if (typeof route.handler === "string") {
-		if (typeof ctrl[route.handler] !== "function") errors.push({
+	for (const route of routes) {
+		const named = typeof route.handler === "string" ? route.handler : route.rawHandler;
+		if (typeof named !== "string") continue;
+		if (typeof ctrl[named] !== "function") errors.push({
 			field: `routes[${route.method} ${route.path}]`,
-			message: `Handler "${route.handler}" not found on controller`,
-			suggestion: `Add method "${route.handler}" to controller or use a function handler`
+			message: `Handler "${named}" not found on controller`,
+			suggestion: `Add method "${named}" to controller or use a function handler`
 		});
 	}
 }
 function validatePermissionKeys(config, options, _errors, warnings) {
 	const validKeys = /* @__PURE__ */ new Set([...CRUD_OPERATIONS, ...options.additionalPermissionKeys ?? []]);
-	for (const route of config.routes ?? []) if (typeof route.handler === "string") validKeys.add(route.handler);
+	for (const route of config.routes ?? []) {
+		if (typeof route.handler === "string") validKeys.add(route.handler);
+		if (typeof route.rawHandler === "string") validKeys.add(route.rawHandler);
+	}
 	for (const preset of config.presets ?? []) {
 		const presetName = typeof preset === "string" ? preset : preset.name;
 		if (presetName === "softDelete") {
@@ -1978,11 +1976,26 @@ function validateRoutes(routes, errors) {
 			suggestion: `Change to "/${route.path}"`
 		});
 		const routeWithRefs = route;
-		if (!route.handler && typeof routeWithRefs.controllerMethod !== "function") errors.push({
+		if (!route.handler && !route.rawHandler && typeof routeWithRefs.controllerMethod !== "function") errors.push({
 			field: `routes[${i}].handler`,
-			message: "Route must declare either `handler` (string / function) or `controllerMethod`",
+			message: "Route must declare one of `handler` (arc pipeline), `rawHandler` (Fastify-native), or `controllerMethod`",
 			suggestion: "Prefer `controllerMethod: (c: MyController) => c.method` for typed handler refs."
 		});
+		if (route.handler && route.rawHandler) errors.push({
+			field: `routes[${i}].rawHandler`,
+			message: "Route declares BOTH `handler` and `rawHandler`",
+			suggestion: "Use `handler` for the arc pipeline (receives IRequestContext) or `rawHandler` for a Fastify-native handler (receives request, reply) — not both."
+		});
+		if ("raw" in route) errors.push({
+			field: `routes[${i}].raw`,
+			message: "`raw` was removed in arc 2.31 — the field now carries the intent",
+			suggestion: "Move the function to `rawHandler` (Fastify-native) or leave it in `handler` (arc pipeline), and delete the flag. If the route comes from a dependency, that package needs a release built against arc >=2.31."
+		});
+		if (route.streamResponse === true && route.rawHandler === void 0) errors.push({
+			field: `routes[${i}].streamResponse`,
+			message: "`streamResponse: true` requires `rawHandler`",
+			suggestion: "Streaming routes are invoked with `(request, reply)` and own the socket — declare the function as `rawHandler` (not `handler` or `controllerMethod`)."
+		});
 		const routeKey = `${route.method} ${route.path}`;
 		if (seenRoutes.has(routeKey)) errors.push({
 			field: `routes[${i}]`,
@@ -2169,7 +2182,12 @@ function defineResource(config) {
 	const configWithId = resolveIdField(normalisedConfig, repository);
 	const resolvedConfig = applyPresetsAndAutoInject(configWithId);
 	const hasCrudRoutes = computeHasCrudRoutes(resolvedConfig);
-	if (!normalisedConfig.skipValidation) diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig));
+	if (!normalisedConfig.skipValidation) {
+		const strict = resolvedConfig.strictPermissions ?? process.env.ARC_STRICT_PERMISSIONS === "true";
+		diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig, strict));
+	}
+	const fatal = diagnostics.filter((d) => d.severity === "error");
+	if (fatal.length > 0) throw new Error(fatal.map((d) => d.message).join("\n\n"));
 	const narrowedConfig = resolvedConfig;
 	const narrowedAdapter = configWithId.adapter;
 	const controller = resolveOrAutoCreateController(narrowedConfig, narrowedAdapter, repository, hasCrudRoutes);

package/dist/discovery/index.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync } from "fastify";
 //#region src/discovery/index.d.ts
 /** A discovered resource — must have toPlugin() method */

package/dist/discovery/index.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { readdir } from "node:fs/promises";
 import { extname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/docs/index.d.mts

@@ -1,5 +1,6 @@
-import { p as RegistryEntry } from "../index-DPRH0Cme.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
+
+import { p as RegistryEntry } from "../index-CpzxqePp.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts
 /**

package/dist/docs/index.mjs

@@ -1,5 +1,6 @@
-import { n as getUserRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BLV4OMXb.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "../userHelpers-ChYJ6CdK.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-B2L4js1v.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-C9s5hFP_.d.mts → elevation-BXCfVcNG.d.mts}

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/scope/elevation.d.ts
 interface ElevationOptions {

package/dist/{elevation-CIz1GjGm.mjs → elevation-D2l1mh4g.mjs}

@@ -1,7 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
 import fp from "fastify-plugin";
 //#region src/scope/elevation.ts
 var elevation_exports = /* @__PURE__ */ __exportAll({

package/dist/encryption/index.d.mts

@@ -1,4 +1,5 @@
-import { a as JweAlg, c as KeyMaterial, i as EncryptionOptions, l as KeyProvider, n as EncryptionDirective, o as JweEnc, r as EncryptionMode, s as KeyContext, t as ActiveKey } from "../types-Cc91nXuA.mjs";
+
+import { a as JweAlg, c as KeyMaterial, i as EncryptionOptions, l as KeyProvider, n as EncryptionDirective, o as JweEnc, r as EncryptionMode, s as KeyContext, t as ActiveKey } from "../types-ByHn9rEO.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/encryption/encryptionPlugin.d.ts
 declare const encryptionPlugin: FastifyPluginAsync<EncryptionOptions>;

package/dist/encryption/index.mjs

@@ -1,5 +1,6 @@
-import { t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { t as parseJsonBody } from "../jsonBody-BlzAoGCe.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as ArcError } from "../errors-Cj42AntO.mjs";
+import { t as parseJsonBody } from "../jsonBody-BYbLDi5D.mjs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/encryption/fieldCipher.ts

package/dist/{errorHandler-Bq2OeEQL.mjs → errorHandler-C5NeD6bT.mjs}

@@ -1,5 +1,6 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { m as statusToArcCode, p as isArcError } from "./errors-DkO8Nk6-.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+import { m as statusToArcCode, p as isArcError } from "./errors-Cj42AntO.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";
 //#region src/plugins/errorHandler.ts

package/dist/{errorHandler-C6yv4ZTW.d.mts → errorHandler-CpYUJmPA.d.mts}

@@ -1,3 +1,4 @@
+
 import { ErrorDetail } from "@classytic/repo-core/errors";
 import { FastifyInstance, FastifyRequest } from "fastify";
 //#region src/plugins/errorHandler.d.ts

package/dist/{errors-DHcHVAgk.d.mts → errors-BGdVwP25.d.mts}

@@ -1,3 +1,4 @@
+
 import { HttpError } from "@classytic/repo-core/errors";
 //#region src/utils/errors.d.ts
 interface ErrorOptions {

package/dist/{errors-DkO8Nk6-.mjs → errors-Cj42AntO.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/utils/errors.ts
 /**
 * Base Arc Error. Implements the canonical `HttpError` contract — `status`

package/dist/{eventPlugin-DrQ_FesK.mjs → eventPlugin-CkffEihm.mjs}

@@ -1,110 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError } from "./errors-DkO8Nk6-.mjs";
-import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
+import { d as createDomainError } from "./errors-Cj42AntO.mjs";
+import { n as requestContext } from "./requestContext-2TxXOJ7T.mjs";
+import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-9mlTgqzE.mjs";
 import fp from "fastify-plugin";
-import { createEvent, matchEventPattern } from "@classytic/primitives/events";
-//#region src/events/EventTransport.ts
-/**
-* Internal arc events module — concrete in-memory transport.
-*
-* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
-* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
-* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
-* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
-* Two reasons:
-*
-*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
-*      audit-log plugin, future kits and downstream services all share them.
-*      Owning them in `primitives` (pure types, zero runtime, zero deps)
-*      eliminates the "manually mirror in two places" problem the previous
-*      `primitives/src/events.ts` header explicitly called out.
-*   2. Inverting the dependency direction lets future packages (sqlitekit
-*      audit, billing services) consume the contract without depending on
-*      arc's HTTP-coupled stack.
-*
-* Hosts MUST import the types from primitives directly:
-*
-* ```typescript
-* import type {
-*   EventMeta, DomainEvent, EventHandler, EventTransport,
-*   DeadLetteredEvent, PublishManyResult,
-* } from '@classytic/primitives/events';
-* import { createEvent, createChildEvent } from '@classytic/primitives/events';
-* ```
-*
-* arc's `events/index.ts` barrel does NOT re-export these — by design, so
-* that consumer code is forced into the canonical import path and the org's
-* "no re-exports" rule holds at every public surface.
-*
-* What stays here:
-*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
-*     used as arc's default transport. Its handler-set state is process-local;
-*     wrong layer for primitives.
-*   - `MemoryEventTransportOptions` — its options shape.
-*
-* Inside arc, files that previously imported types from `./EventTransport.js`
-* keep working: this file re-exports them from primitives for arc's own
-* call sites. That re-export is an internal refactor convenience — the
-* public `events/index.ts` barrel stays clean.
-*/
-/**
-* In-memory event transport (default).
-*
-* Events are delivered synchronously within the process. Not suitable for
-* multi-instance deployments — pair with `RedisEventTransport` /
-* `RedisStreamTransport` (subpath imports) for those.
-*/
-var MemoryEventTransport = class {
-	name = "memory";
-	handlers = /* @__PURE__ */ new Map();
-	logger;
-	constructor(options) {
-		this.logger = options?.logger ?? console;
-	}
-	async publish(event) {
-		const allHandlers = /* @__PURE__ */ new Set();
-		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-		}
-	}
-	/**
-	* Reference `publishMany` implementation — delegates to `publish()` in order.
-	*
-	* Production transports (Kafka, Redis pipeline, SQS batch) should override
-	* this with a single batched network call. Memory transport has nothing to
-	* batch, so we just loop — the loop still returns a proper result map so
-	* `EventOutbox.relay` can exercise the batched code path in tests.
-	*/
-	async publishMany(events) {
-		const results = /* @__PURE__ */ new Map();
-		for (const event of events) try {
-			await this.publish(event);
-			results.set(event.meta.id, null);
-		} catch (err) {
-			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
-		}
-		return results;
-	}
-	async subscribe(pattern, handler) {
-		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
-		this.handlers.get(pattern)?.add(handler);
-		return () => {
-			const set = this.handlers.get(pattern);
-			if (set) {
-				set.delete(handler);
-				if (set.size === 0) this.handlers.delete(pattern);
-			}
-		};
-	}
-	async close() {
-		this.handlers.clear();
-	}
-};
-//#endregion
 //#region src/events/retry.ts
 /**
 * Wrap an event handler with retry logic and dead letter support.
@@ -338,4 +238,4 @@ var eventPlugin_default = fp(eventPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { MemoryEventTransport as a, withRetry as i, eventPlugin_exports as n, createEvent as o, createDeadLetterPublisher as r, eventPlugin as t };
+export { withRetry as i, eventPlugin_exports as n, createDeadLetterPublisher as r, eventPlugin as t };

package/dist/{eventPlugin-Bg3cP2_u.d.mts → eventPlugin-GF5nnBIq.d.mts}

@@ -1,4 +1,5 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-QmY7A258.mjs";
+
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-2uVV34WU.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/events/defineEvent.d.ts
 interface EventSchema {

package/dist/events/index.d.mts

@@ -1,7 +1,8 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-QmY7A258.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-Bg3cP2_u.mjs";
+
+import { a as EventTransport, i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions, t as DeadLetteredEvent } from "../EventTransport-2uVV34WU.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-GF5nnBIq.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
-import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-uIaauNpZ.mjs";
+import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-qN6A-RFv.mjs";
 import { OutboxAcknowledgeOptions, OutboxClaimOptions, OutboxErrorInfo, OutboxFailOptions, OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/events/eventTypes.d.ts