@classytic/arc 2.31.0 → 2.32.0

package/dist/fastify-augmentation-BppG5bMT.d.mts

@@ -0,0 +1,179 @@
+
+import { hn as HookSystem, z as ResourceRegistry } from "./index-CpzxqePp.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-CT5vu6M0.mjs";
+import { s as ModuleState } from "./index-ZWhLTp_s.mjs";
+import { FastifyPluginAsync } from "fastify";
+//#region src/factory/module/descriptor.d.ts
+/**
+ * Resolved module introspection — what a module ACTUALLY composed to.
+ *
+ * `ArcModule` is the authoring shape: `resources` may be an array or a factory,
+ * `owns` may be a list or `"provided"`, and neither tells you what the module
+ * ended up mounting. Consumers that needed the resolved answer were reduced to
+ * inspecting that shape — a downstream conformance suite had to treat every
+ * resource FACTORY as a violation, because it could not distinguish "late-bound
+ * and legitimate" from "unresolvable", and so rejected valid modules.
+ *
+ * A descriptor is the resolved, read-only answer, published after arc has done
+ * the work exactly once. It lets tooling assert on the real graph without
+ * touching arc internals:
+ *
+ *   - conformance suites verify what a module provides and supersedes;
+ *   - `doctor` surfaces duplicate resources and unmet dependencies;
+ *   - tests assert the composed graph instead of re-deriving it;
+ *   - operators inspect a large installation;
+ *   - documentation generators read one stable contract.
+ *
+ * Deliberately DATA — no functions, no live handles. It survives
+ * `structuredClone`, so it can cross a worker boundary or be written to a file
+ * as-is, and holding one cannot keep a closed app alive.
+ */
+/** One resource as arc resolved it. */
+interface ResolvedResourceDescriptor {
+  /** Resource name; absent for an anonymous resource (participates in no dedup). */
+  readonly name?: string;
+  /** Route prefix, when the resource declared one. */
+  readonly prefix?: string;
+  /** Whether the resource opted out of the app-wide `resourcePrefix`. */
+  readonly skipGlobalPrefix: boolean;
+}
+/** Lifecycle surface a module ended up with — counts, not handles. */
+interface ResolvedModuleLifecycle {
+  /** Does the module tear anything down? */
+  readonly hasClose: boolean;
+  /** Event-handler subscriptions arc owns for this module. */
+  readonly subscriptions: number;
+  /** Recurring schedules contributed. */
+  readonly scheduledJobs: number;
+  /** Readiness checks contributed. */
+  readonly healthChecks: number;
+  /** Whether the module contributed a public export at `arc.modules[name]`. */
+  readonly exports: boolean;
+}
+/** The resolved, read-only description of one composed module. */
+interface ResolvedModuleDescriptor {
+  readonly name: string;
+  /** Declared composition edges, in the order the module listed them. */
+  readonly dependsOn: readonly string[];
+  /** Resources this module actually mounted, in registration order. */
+  readonly resources: readonly ResolvedResourceDescriptor[];
+  /**
+   * The EFFECTIVE supersession list — already derived when the module declared
+   * `owns: "provided"`, so callers never re-implement that resolution.
+   */
+  readonly owns: readonly string[];
+  readonly lifecycle: ResolvedModuleLifecycle;
+}
+/** Minimal resource shape the descriptor reads. Structural — matches `ResourceLike`. */
+interface DescribableResource {
+  readonly name?: string | undefined;
+  readonly prefix?: string | undefined;
+  readonly skipGlobalPrefix?: boolean | undefined;
+}
+/**
+ * Build a descriptor. Called by `registerResources` once per module, after
+ * resources are resolved and `owns` is effective.
+ *
+ * Frozen at every level: a descriptor is a snapshot of a completed decision,
+ * and a consumer mutating it would silently disagree with the running app.
+ */
+declare function describeResolvedModule(input: {
+  readonly name: string;
+  readonly dependsOn?: readonly string[] | undefined;
+  readonly resources: readonly DescribableResource[];
+  readonly owns: readonly string[];
+  readonly lifecycle: ResolvedModuleLifecycle;
+}): ResolvedModuleDescriptor;
+//#endregion
+//#region src/core/arcCorePlugin.d.ts
+interface ArcCorePluginOptions {
+  /** Enable event emission for CRUD operations (requires eventPlugin) */
+  emitEvents?: boolean;
+  /** Hook system instance (for testing/custom setup) */
+  hookSystem?: HookSystem;
+  /** Resource registry instance (for testing/custom setup) */
+  registry?: ResourceRegistry;
+}
+interface PluginMeta {
+  name: string;
+  version?: string;
+  options?: Record<string, unknown>;
+  registeredAt: string;
+}
+interface ArcCore {
+  /** Instance-scoped hook system */
+  hooks: HookSystem;
+  /** Instance-scoped resource registry */
+  registry: ResourceRegistry;
+  /** Whether event emission is enabled */
+  emitEvents: boolean;
+  /** External OpenAPI paths contributed by auth adapters or third-party integrations */
+  externalOpenApiPaths: ExternalOpenApiPaths[];
+  /** Registered plugins for introspection */
+  plugins: Map<string, PluginMeta>;
+  /**
+   * Module public exports — `bootstrap()` return values keyed by module name
+   * (see `src/factory/module.ts`). Read via `getModuleExports(fastify, name)`:
+   * augment `ArcModuleRegistry` once and the name infers the export type;
+   * otherwise pass it inline. `Partial<ArcModuleRegistry>` gives augmented
+   * apps typed direct access (`fastify.arc.modules.order`), while the
+   * `Record<string, unknown>` intersection keeps un-augmented reads open.
+   * Populated lazily by `registerResources` — absent until a module exports.
+   */
+  modules?: Partial<ArcModuleRegistry> & Record<string, unknown>;
+  /**
+   * Lifecycle state per composed module (null-proto map, populated by
+   * `registerResources` the moment the graph is validated — so it answers
+   * "is this module composed?" even for resource-only modules that never
+   * record an export). Read via `hasModule(fastify, name)` /
+   * `getModuleState(fastify, name)`; the map itself is internal.
+   */
+  moduleStates?: Record<string, ModuleState>;
+  /**
+   * Module-contributed readiness checks, collected in dependency order and
+   * frozen by `createApp`. The API role merges these into its `healthPlugin`;
+   * `createWorker` reads this to give its probe listener the identical union
+   * (the worker preset disables the main health plugin, so this is how module
+   * checks reach the probe without a double registration). Empty until
+   * `createApp` populates it.
+   */
+  healthChecks?: readonly HealthCheck[];
+  /**
+   * The resolved, dependency-ordered module definitions (frozen by createApp).
+   * Integrations that collect a module arm at their OWN init time — e.g. the
+   * streamline integration calling `collectModuleWorkflows(fastify, defs)` after
+   * it has created + decorated its container — read the list from here. Empty
+   * until createApp populates it.
+   */
+  moduleDefinitions?: readonly ArcModule[];
+  /**
+   * RESOLVED module descriptors — what each module actually composed to
+   * (resources mounted, effective `owns`, lifecycle counts), published once
+   * boot has settled them.
+   *
+   * Read this rather than `moduleDefinitions` for anything that needs the real
+   * graph: a definition's `resources` may still be an unresolved factory and
+   * its `owns` may be `"provided"`, so the authoring shape cannot answer "what
+   * did this module actually mount?". Frozen, plain data — safe to clone, log,
+   * or hand to tooling.
+   */
+  moduleDescriptors?: readonly ResolvedModuleDescriptor[];
+  /**
+   * Module-contributed recurring schedules, resolved once in dependency order
+   * and frozen after bootstraps. The same definitions are executed by Arc's
+   * schedules plugin and exposed here for introspection. Empty until collection.
+   */
+  scheduledJobs?: readonly Readonly<ScheduleDefinition>[];
+}
+declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
+declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
+//#endregion
+//#region src/types/fastify-augmentation.d.ts
+declare module "fastify" {
+  interface FastifyInstance {
+    arc?: ArcCore;
+  }
+}
+//#endregion
+export { arcCorePlugin as a, ResolvedResourceDescriptor as c, _default as i, describeResolvedModule as l, ArcCorePluginOptions as n, ResolvedModuleDescriptor as o, PluginMeta as r, ResolvedModuleLifecycle as s, ArcCore as t };

package/dist/{fields-CB5Cuzk9.mjs → fields-DEi65pGj.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions
@@ -111,10 +111,7 @@ function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
 		case "visibleTo":
 			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
 			break;
-		case "redactFor":
-			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
-			break;
-		case "writableBy": break;
+		case "redactFor": if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
 	}
 	return result;
 }
@@ -140,12 +137,10 @@ function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
 				delete result[field];
 			}
 			break;
-		case "writableBy":
-			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
+		case "writableBy": if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
+			deniedFields.push(field);
+			delete result[field];
+		}
 	}
 	return {
 		body: result,

package/dist/{generate-EcA6ui4i.mjs → generate-CRSG0jTv.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts

package/dist/{headers-3zvE0rM3.mjs → headers-BXjQYbeC.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-Cj42AntO.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-Bh1KK5ps.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-DjZYjM7H.mjs → health-5XnTa2uo.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-BcmPyq5I.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-vimw5D7Z.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-3zvE0rM3.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-D1MP_gRG.mjs";
-import { t as createIdempotencyResult } from "../interface-DYzM0q-u.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-BXjQYbeC.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DmEMHlPQ.mjs";
+import { t as createIdempotencyResult } from "../interface-BP4IJCBO.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
@@ -138,8 +138,10 @@ var MemoryIdempotencyStore = class {
 	}
 	async tryLock(key, requestId, ttlMs) {
 		const existing = this.locks.get(key);
-		if (existing) if (/* @__PURE__ */ new Date() > existing.expiresAt) this.locks.delete(key);
-		else return false;
+		if (existing) {
+			if (/* @__PURE__ */ new Date() > existing.expiresAt) this.locks.delete(key);
+			else return false;
+		}
 		this.locks.set(key, {
 			key,
 			requestId,

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-Bc2ox8_U.d.mts → index-DXlHwvuE.d.mts}

@@ -2,7 +2,7 @@
 import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, H as CrudController, L as RequestWithExtras, Lt as IController, Rt as IControllerResponse, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig, zt as IRequestContext } from "./index-CpzxqePp.mjs";
 import { i as RequestScope } from "./types-ChuShpCP.mjs";
 import { l as AnyRecord, r as PermissionCheck } from "./types-B7XeLEgK.mjs";
-import "./fastify-augmentation-zh0_AYHa.mjs";
+import "./fastify-augmentation-BppG5bMT.mjs";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
 import { DataAdapter } from "@classytic/repo-core/adapter";

package/dist/{index-CFThn1K9.d.mts → index-ZWhLTp_s.d.mts}

@@ -1,5 +1,5 @@
 
-import { a as ModuleContribution, h as HealthCheck, n as ArcModuleInput, r as ArcModuleRegistry, t as ArcModule, u as ScheduleDefinition } from "./types-CBgvkp8O.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-CT5vu6M0.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**
@@ -25,7 +25,67 @@ declare function collectModuleWorkflows(fastify: FastifyInstance, modules: reado
  * modules. The caller passes the returned definitions to the canonical
  * schedules plugin; factories must therefore be resolved only once.
  */
-declare function collectModuleScheduledJobs(fastify: FastifyInstance, modules: readonly ArcModule[]): Promise<ScheduleDefinition[]>;
+declare function collectModuleScheduledJobs(fastify: FastifyInstance, modules: readonly ArcModule[],
+/**
+ * Optional sink for per-module counts, filled as each arm resolves.
+ *
+ * Exists so `arc.moduleDescriptors` can report real numbers without
+ * resolving the factories a SECOND time — a contribution factory closes over
+ * booted engines and may register or allocate, so running it twice is not a
+ * free read. One resolution feeds both activation and introspection.
+ */
+countsByModule?: Map<string, number>): Promise<ScheduleDefinition[]>;
+//#endregion
+//#region src/factory/module/extend.d.ts
+/**
+ * What a caller may add. Every mergeable arm of `ArcModule`, plus `bootstrap`
+ * in wrapper form only.
+ *
+ * `name` is absent on purpose: renaming a module mid-composition breaks the
+ * `dependsOn` graph and the registry key its consumers read, and it is the one
+ * "extension" that is never additive.
+ */
+interface ModuleExtension<TExports = unknown> {
+  dependsOn?: readonly string[];
+  owns?: readonly string[] | "provided";
+  resources?: ArcModule<TExports>["resources"];
+  eventHandlers?: ArcModule<TExports>["eventHandlers"];
+  scheduledJobs?: ArcModule<TExports>["scheduledJobs"];
+  workflows?: ArcModule<TExports>["workflows"];
+  healthChecks?: ArcModule<TExports>["healthChecks"];
+  errorMappers?: ArcModule<TExports>["errorMappers"];
+  plugins?: ArcModule<TExports>["plugins"];
+  afterResources?: ArcModule<TExports>["afterResources"];
+  onClose?: ArcModule<TExports>["onClose"];
+  /**
+   * WRAP the module's bootstrap — it is never replaced.
+   *
+   * Bootstrap returns the module's exports, so two of them cannot be
+   * concatenated: one value has to win, and a host silently winning is the gym
+   * failure (`{ ...mod, bootstrap }` overwrote the factory's own, so the engine
+   * the module published was never created). The wrapper form makes the
+   * relationship explicit — call `inner` and decorate its result, or
+   * deliberately do not.
+   *
+   * `inner` is `undefined` when the module has no bootstrap of its own.
+   */
+  bootstrap?: (inner: ((f: FastifyInstance, c: ModuleSetupContext) => TExports | Promise<TExports>) | undefined) => (f: FastifyInstance, c: ModuleSetupContext) => TExports | Promise<TExports>;
+}
+/**
+ * Merge a host's additions onto a module. Nothing the module declared is lost.
+ *
+ * ```ts
+ * return extendModule(createOrderModule({ … }), {
+ *   eventHandlers: () => hostHandlers(),      // appended after the module's
+ *   dependsOn: ["outbox"],                    // unioned
+ *   bootstrap: (inner) => async (f, c) => {   // wraps, never replaces
+ *     const exports = await inner?.(f, c);
+ *     return decorate(exports);
+ *   },
+ * });
+ * ```
+ */
+declare function extendModule<TExports = unknown>(mod: ArcModule<TExports>, extension: ModuleExtension<TExports>): ArcModule<TExports>;
 //#endregion
 //#region src/factory/module/lifecycle.d.ts
 /**
@@ -38,7 +98,13 @@ declare function collectModuleScheduledJobs(fastify: FastifyInstance, modules: r
  * Resolves factory contributions (after bootstraps) so a handler can close over
  * booted engines rather than a global getter.
  */
-declare function subscribeModuleEventHandlers(fastify: FastifyInstance, modules: readonly ArcModule[]): Promise<Array<() => void | Promise<void>>>;
+declare function subscribeModuleEventHandlers(fastify: FastifyInstance, modules: readonly ArcModule[],
+/**
+ * Optional sink for per-module handler counts, filled as each arm resolves.
+ * Lets `arc.moduleDescriptors` report real numbers without resolving the
+ * factories a SECOND time — see the note on `collectModuleScheduledJobs`.
+ */
+countsByModule?: Map<string, number>): Promise<Array<() => void | Promise<void>>>;
 //#endregion
 //#region src/factory/module/order.d.ts
 /**
@@ -221,4 +287,4 @@ declare function lazyModuleExports<TExports = unknown>(fastify: FastifyInstance,
 declare function lazyRequiredModuleExports<K extends keyof ArcModuleRegistry>(fastify: FastifyInstance, name: K): () => ArcModuleRegistry[K];
 declare function lazyRequiredModuleExports<TExports = unknown>(fastify: FastifyInstance, name: string): () => TExports;
 //#endregion
-export { lazyModuleExports as a, getModuleState as c, resolveModule as d, orderModules as f, collectModuleWorkflows as g, collectModuleScheduledJobs as h, hasModuleExports as i, hasModule as l, collectModuleHealthChecks as m, getModuleExports as n, lazyRequiredModuleExports as o, subscribeModuleEventHandlers as p, getOptionalModuleExports as r, ModuleState as s, defineModule as t, resolveContribution as u };
+export { collectModuleScheduledJobs as _, lazyModuleExports as a, getModuleState as c, resolveModule as d, orderModules as f, collectModuleHealthChecks as g, extendModule as h, hasModuleExports as i, hasModule as l, ModuleExtension as m, getModuleExports as n, lazyRequiredModuleExports as o, subscribeModuleEventHandlers as p, getOptionalModuleExports as r, ModuleState as s, defineModule as t, resolveContribution as u, collectModuleWorkflows as v };

package/dist/{index-CEJNZFtX.d.mts → index-zq6VrjaB.d.mts}

@@ -990,4 +990,73 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
  */
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
-export { evaluatePermissionDecision as $, explainAccess as A, anyOf as B, requireGrant as C, collectPublicSurface as D, PermissionRequirement as E, createDynamicPermissionMatrix as F, requireOwnership as G, denyAll as H, createOrgPermissions as I, roles as J, requirePlatformRole as K, allOf as L, DynamicPermissionMatrix as M, DynamicPermissionMatrixConfig as N, describePermission as O, PermissionEventBus as P, applyAuthorizationDecision as Q, allow as R, modeSatisfies as S, AccessExplanation as T, not as U, deny as V, requireAuth as W, scopeOf as X, when as Y, PermissionCheckReturn as Z, createRoleHierarchy as _, permissionMatrix as a, requireMandate as at, GrantResolution as b, publicReadAdminWrite as c, requireOrgMembership as d, normalizeToDecision as et, requireOrgRole as f, RoleHierarchy as g, requireTeamMembership as h, ownerWithAdminBypass as i, requireDPoP as it, ConnectEventsOptions as j, describePermissionMap as k, readOnly as l, requireServiceScope as m, authenticated as n, RequireMandateOptions as nt, presets_d_exports as o, requireScopeContext as p, requireRoles as q, fullPublic as r, requireAgentScope as rt, publicRead as s, adminOnly as t, RequireAgentScopeOptions as tt, requireOrgInScope as u, GRANT_MODES as v, conjoinPolicyFilters as w, RequireGrantOptions as x, GrantMode as y, allowPublic as z };
+//#region src/permissions/matrix.d.ts
+type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped";
+interface PermissionEntry {
+  type: PermissionEntryType;
+  roles: string[];
+  /**
+   * Present only for `scoped` — the caller-scope dimensions the gate requires
+   * (e.g. `{ branchRole: "head_office" }`), for the client to resolve against
+   * the viewer's active context.
+   */
+  scope?: Record<string, unknown>;
+}
+/**
+ * The slice of arc's `ResourceRegistry` this reads.
+ *
+ * Structural on purpose: coupling to the full registry type would drag the
+ * resource layer into the permissions layer, and this only ever reads names
+ * and gates.
+ */
+interface PermissionMatrixRegistry {
+  getAll(): ReadonlyArray<{
+    name: string;
+    permissions?: Record<string, unknown>;
+    actions?: ReadonlyArray<{
+      name: string;
+      permissions?: unknown;
+    }>;
+    aggregations?: ReadonlyArray<{
+      name: string;
+      permissions?: unknown;
+    }>;
+  }>;
+}
+interface PermissionMatrixOptions {
+  /** The live registry. Omit and the matrix carries only curated modules. */
+  registry?: PermissionMatrixRegistry;
+  /**
+   * Curated, human-named groupings the client already organises around
+   * (`products`, `finance`, …). Overlaid FIRST — the live registry wins on an
+   * exact name collision, because the enforced gate beats an approximation.
+   */
+  curatedModules?: Record<string, unknown>;
+  /**
+   * Second curated layer, applied only where `curatedModules` has no entry —
+   * typically per-resource policies behind the domain groupings.
+   */
+  fallbackModules?: Record<string, unknown>;
+  /** Platform-level role names. */
+  platformRoles?: readonly string[];
+  /** Organization/branch-level role names. */
+  orgRoles?: readonly string[];
+}
+interface PermissionMatrix {
+  /** Every role name, both namespaces — so a role picker has one source. */
+  roles: string[];
+  roleGroups: {
+    platform: string[];
+    branch: string[];
+  };
+  modules: Record<string, Record<string, PermissionEntry>>;
+}
+/** Re-shape arc's typed requirement into the wire entry. */
+declare function introspectCheck(check: PermissionCheck): PermissionEntry;
+/** Introspect a permission module, flattening nested groups to `a.b`. */
+declare function introspectModule(mod: Record<string, unknown>): Record<string, PermissionEntry>;
+/** Every live resource's ACTUAL gates, keyed by arc resource name. */
+declare function introspectRegistry(registry: PermissionMatrixRegistry): Record<string, Record<string, PermissionEntry>>;
+declare function buildPermissionMatrix(options?: PermissionMatrixOptions): PermissionMatrix;
+//#endregion
+export { requireAuth as $, RequireGrantOptions as A, ConnectEventsOptions as B, requireServiceScope as C, GRANT_MODES as D, createRoleHierarchy as E, PermissionRequirement as F, createOrgPermissions as G, DynamicPermissionMatrixConfig as H, collectPublicSurface as I, allowPublic as J, allOf as K, describePermission as L, requireGrant as M, conjoinPolicyFilters as N, GrantMode as O, AccessExplanation as P, not as Q, describePermissionMap as R, requireScopeContext as S, RoleHierarchy as T, PermissionEventBus as U, DynamicPermissionMatrix as V, createDynamicPermissionMatrix as W, deny as X, anyOf as Y, denyAll as Z, publicReadAdminWrite as _, PermissionMatrixRegistry as a, scopeOf as at, requireOrgMembership as b, introspectModule as c, evaluatePermissionDecision as ct, authenticated as d, RequireMandateOptions as dt, requireOwnership as et, fullPublic as f, requireAgentScope as ft, publicRead as g, presets_d_exports as h, PermissionMatrixOptions as i, when as it, modeSatisfies as j, GrantResolution as k, introspectRegistry as l, normalizeToDecision as lt, permissionMatrix as m, requireMandate as mt, PermissionEntryType as n, requireRoles as nt, buildPermissionMatrix as o, PermissionCheckReturn as ot, ownerWithAdminBypass as p, requireDPoP as pt, allow as q, PermissionMatrix as r, roles as rt, introspectCheck as s, applyAuthorizationDecision as st, PermissionEntry as t, requirePlatformRole as tt, adminOnly as u, RequireAgentScopeOptions as ut, readOnly as v, requireTeamMembership as w, requireOrgRole as x, requireOrgInScope as y, explainAccess as z };

package/dist/index.d.mts

@@ -2,9 +2,9 @@
 import { $t as TreeMixin, A as RequestIdOptions, An as BaseControllerOptions, B as defineResource, Bt as RawRouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcGetResult, E as GracefulShutdownOptions, En as ArcDeleteResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, L as RequestWithExtras, Lt as IController, Mn as ControllerConstructionOptions, N as FastifyRequestExtras, Nn as ListResult, Nt as RateLimitConfig, O as HealthOptions, On as ArcListResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeExt, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcCreateResult, U as ResourceConfig, V as ResourceDefinition, Vt as RouteHandler, Wt as AuthPluginOptions, X as CrudRouteKey, Xt as SoftDeleteExt, Y as PresetResult, Yt as BaseController, Z as CrudSchemas, Zt as SoftDeleteMixin, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugExt, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, in as BaseCrudController, jn as ControllerConfigurableOptions, k as IntrospectionPluginOptions, kn as ArcUpdateResult, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkExt, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BulkMixin, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as SlugMixin, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, y as OwnershipCheck, zt as IRequestContext } from "./index-CpzxqePp.mjs";
 import { a as UserBase, d as JWTPayload, i as PermissionContext, l as AnyRecord, m as UserOrganization, n as DataPolicy, r as PermissionCheck, t as AuthorizationDecision, u as ArcRequest } from "./types-B7XeLEgK.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-zh0_AYHa.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-Bc2ox8_U.mjs";
-import { B as anyOf, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, W as requireAuth, Y as when, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, q as requireRoles, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as allowPublic } from "./index-CEJNZFtX.mjs";
+import "./fastify-augmentation-BppG5bMT.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-DXlHwvuE.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-zq6VrjaB.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-D3Dv4LAV.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Cj42AntO.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-De7GqHck.mjs";
-import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-Bv6EtN1x.mjs";
-import { c as getControllerScope } from "./pipeline-UPQFatit.mjs";
-import { t as defineAggregation } from "./defineAggregation-DbPPS8RI.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BGpIxINN.mjs";
-import { C as requireScopeContext, I as requireAuth, L as requireOwnership, M as anyOf, P as denyAll, S as requireOrgRole, T as requireTeamMembership, V as when, b as requireOrgInScope, c as publicReadAdminWrite, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions, z as requireRoles } from "./permissions-L--QDAir.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-J99LGTJI.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Bh1KK5ps.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-Dk34dxhI.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-XFPPUu2c.mjs";
+import { c as getControllerScope } from "./pipeline-CPA-jx0M.mjs";
+import { t as defineAggregation } from "./defineAggregation-gX4No1gt.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BwwmNSp7.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-Dl_m0NCe.mjs";
 //#region src/index.ts
-const version = "2.31.0";
+const version = "2.32.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-BEiNZBsJ.mjs → init-BbfP8aky.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -997,7 +997,7 @@ export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""},
     delete updates.role;
     delete updates.organizations;
 
-    const user = await userRepository.Model.findByIdAndUpdate(userId, updates, { new: true });
+    const user = await userRepository.Model.findByIdAndUpdate(userId, updates, { returnDocument: 'after' });
     return reply.send(user);
   } catch (error) {
     request.log.error({ err: error }, 'Update profile error');
@@ -2379,7 +2379,8 @@ export const requireAdmin = ()${returnType} =>
 export const requireSuperadmin = ()${returnType} =>
   requireRoles(['superadmin']);
 `;
-	if (config.tenant === "multi") if (config.auth === "better-auth") content += `
+	if (config.tenant === "multi") {
+		if (config.auth === "better-auth") content += `
 // ============================================================================
 // Better Auth Organization & Team Permission Helpers
 // ============================================================================
@@ -2431,7 +2432,7 @@ export const requireOrgManager = ()${returnType} =>
 export const requireOrgStaff = ()${returnType} =>
   requireOrgMembership();
 `;
-	else content += `
+		else content += `
 /**
  * Require organization owner (elevated scope auto-bypasses)
  */
@@ -2450,6 +2451,7 @@ export const requireOrgManager = ()${returnType} =>
 export const requireOrgStaff = ()${returnType} =>
   requireRoles(['owner', 'manager', 'staff', 'admin', 'superadmin']);
 `;
+	}
 	content += `
 // ============================================================================
 // Standard Permission Sets
@@ -3016,7 +3018,7 @@ class UserRepository extends Repository${ts ? "<UserDocument>" : ""} {
     return this.Model.findByIdAndUpdate(
       userId,
       { resetPasswordToken: token, resetPasswordExpires: expiresAt },
-      { new: true }
+      { returnDocument: 'after' }
     );
   }
 ${config.tenant === "multi" ? `

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-CUTo9y0X.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-B9P4Y-UI.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-ChvUQGG1.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-__T3EJDA.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {
@@ -325,7 +325,7 @@ const jobsPluginImpl = async (fastify, options) => {
 		});
 		workers.set(queueName, worker);
 	}
-	const JOB_PAYLOAD_WARN_BYTES = 100 * 1024;
+	const JOB_PAYLOAD_WARN_BYTES = 102400;
 	const jobDefsByName = /* @__PURE__ */ new Map();
 	for (const job of jobs) if (!jobDefsByName.has(job.name)) jobDefsByName.set(job.name, job);
 	const dispatcher = {

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-B_es0hiF.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-CpfVpKHE.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-B_es0hiF.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-CpfVpKHE.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities