@classytic/arc 2.33.0 → 2.35.0

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-BcR2bFZQ.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Brin0ODU.mjs";
-export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };
+import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-C5K78SXo.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-h-mTgMqy.mjs";
+export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BxCoxmiN.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CaQC5EXX.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DR9vsUYy.mjs";
-import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-q69DZzgG.mjs";
-import { t as defineAggregation } from "../defineAggregation-Nv-DwfOf.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-dxhcHhUD.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BhzLXCfN.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-C-pofd0v.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-BOrGeocE.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-LFuOra7W.mjs";
+import { t as defineAggregation } from "../defineAggregation-DoIijIFq.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-DdEvmmkY.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/{core-dxhcHhUD.mjs → core-DdEvmmkY.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import "./constants-BxCoxmiN.mjs";
-import { t as defineResource } from "./defineResource-DR9vsUYy.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import "./constants-BhzLXCfN.mjs";
+import { t as defineResource } from "./defineResource-BOrGeocE.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema

package/dist/{createActionRouter-DVpoA0do.mjs → createActionRouter-EYWgd0ly.mjs}

@@ -1,11 +1,10 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import "./constants-BxCoxmiN.mjs";
-import { f as createError } from "./errors-Cd_yy7aW.mjs";
-import { a as buildRouteHooks, i as selectPluginMw, l as buildAuthMiddlewareForPermissions, n as buildRouteConfig, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
-import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-DNnd3vkz.mjs";
-import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-q69DZzgG.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+import "./constants-BhzLXCfN.mjs";
+import { f as createError } from "./errors-CLid6atr.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-u1opU66a.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-LFuOra7W.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-s3-ouZmP.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -186,65 +185,29 @@ function createActionRouter(fastify, config) {
 	});
 }
 /**
-* Build a discriminated body schema for the unified action endpoint.
+* Discriminated body schema for the unified action endpoint: a top-level
+* `action` enum plus a `oneOf` branch per action, each branch pinning
+* `action: { const }` and carrying its own `required`.
 *
-* Produces a schema of the form:
-* ```json
-* {
-*   "type": "object",
-*   "required": ["action"],
-*   "properties": {
-*     "action": { "type": "string", "enum": ["dispatch", "approve"] },
-*     "carrier": { "type": "string" }
-*   },
-*   "oneOf": [
-*     {
-*       "properties": {
-*         "action": { "const": "dispatch" },
-*         "carrier": { "type": "string" }       // ← every branch lists the union
-*       },
-*       "required": ["action", "carrier"]
-*     },
-*     {
-*       "properties": {
-*         "action": { "const": "approve" },
-*         "carrier": { "type": "string" }       // ← even though approve doesn't use it
-*       },
-*       "required": ["action"]
-*     }
-*   ]
-* }
-* ```
+* EVERY BRANCH LISTS THE FULL PROPERTY UNION — the non-obvious part. AJV's
+* `removeAdditional: 'all'` (Fastify's default) strips a field during a
+* branch's evaluation when that branch's `properties` omits it, EVEN IF
+* another branch would have allowed it. The strip mutates the body before
+* `oneOf` finishes discriminating, so the winning branch receives a body that
+* has already lost fields: `POST { action: 'hold', amount, reason }` arrived at
+* the handler as `{ action: 'hold' }`. Listing every action's properties on
+* every branch makes each walk see every field as its own, so nothing is
+* stripped; `required` stays per-action, so dispatch still gates correctly.
 *
-* **Why every branch carries the full property union.** AJV's
-* `removeAdditional: 'all'` (Fastify's framework default) interacts badly
-* with `oneOf`: when a branch's `properties` lacks a field, AJV strips it
-* from the body during that branch's evaluation — *even if a different
-* branch would have allowed it*. The strip mutates the body before
-* `oneOf` finishes discriminating, so by the time the matching branch
-* wins, the body has already lost fields. Concretely: `actions: { verify:
-* {}, hold: { schema: z.object({ amount, reason }.optional()) } }` +
-* `POST { action: 'hold', amount: 1, reason }` lands at the handler as
-* `{ action: 'hold' }`. Empirically reproduced and locked at
-* [tests/core/action-discriminator-strip.test.ts](../../tests/core/action-discriminator-strip.test.ts).
+* Per-branch `additionalProperties: false` survives but cannot reject
+* sibling-action fields under host `removeAdditional: 'all'` — those strip at
+* top level instead. That is the host's opt-in; arc's job is only to stop
+* losing an action's OWN declared fields. Under arc's `createApp`
+* (`removeAdditional: false`) strict rejection works normally.
 *
-* Listing every action's properties on every branch makes per-branch
-* removeAdditional walks see every caller field as "in this branch's
-* properties," so nothing gets stripped during oneOf evaluation. The
-* `required` array stays per-action, so the handler still gets called
-* only when the matching branch's required-field contract is satisfied.
-* Per-branch `additionalProperties: false` (Zod v4 default) carries
-* through but, under host removeAdditional: 'all', it can no longer
-* reject sibling-action fields — those become silently stripped at top
-* level instead. That's the host's opt-in to stripping; arc's job is to
-* stop accidentally losing the action's *own* declared fields.
-*
-* Under arc's own `createApp` (`removeAdditional: false`), strict-mode
-* rejection still functions normally — see
-* [tests/core/action-strict-schema-parity.test.ts](../../tests/core/action-strict-schema-parity.test.ts).
-*
-* Exported so OpenAPI generation and MCP tool generation can reuse the same
-* schema shape (single source of truth).
+* Pinned by `tests/core/action-discriminator-strip.test.ts` and
+* `action-strict-schema-parity.test.ts`. Exported so OpenAPI and MCP tool
+* generation reuse one shape.
 */
 function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 	const unionProperties = {};

package/dist/{createAggregationRouter-B_B48JZ-.mjs → createAggregationRouter-ByOK9Iev.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-B3mP_QTy.mjs";
-import { f as createError } from "./errors-Cd_yy7aW.mjs";
-import { u as getRequestScope } from "./types-CoqIRrkY.mjs";
-import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
-import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-DLE9xX-V.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-DYXBBgtg.mjs";
+import { f as createError } from "./errors-CLid6atr.mjs";
+import { u as getRequestScope } from "./types-GY4kATJb.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-u1opU66a.mjs";
+import { n as validateAggregations } from "./validate-dosAIvQU.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-Do9aMIvL.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is

package/dist/defineAggregation-DoIijIFq.mjs

@@ -0,0 +1,25 @@
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+//#region src/core/aggregation/defineAggregation.ts
+/**
+* Declare a single resource aggregation. Exported configs flow into
+* `defineResource({ aggregations: { ... } })` either as named keys or
+* via auto-discovery patterns (loadAggregations — future).
+*
+* A namespace import lets many live in their own files and flow in at once
+* (`import * as aggregations` → `defineResource({ aggregations })`).
+*
+* @example
+* ```ts
+* export const revenueByStatus = defineAggregation({
+*   groupBy: 'status',
+*   measures: { count: 'count', revenue: 'sum:totalPrice' },
+*   permissions: requireRoles(['admin']),
+*   cache: { staleTime: 60 },
+* });
+* ```
+*/
+function defineAggregation(config) {
+	return config;
+}
+//#endregion
+export { defineAggregation as t };

package/dist/{defineResource-DR9vsUYy.mjs → defineResource-BOrGeocE.mjs}

@@ -1,22 +1,20 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { p as MUTATION_OPERATIONS, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-BhzLXCfN.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { d as isWriteVerbCapable, p as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController, u as detectOverriddenWriteSlots } from "./BaseController-CaQC5EXX.mjs";
-import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-D4-ASwsI.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CojeUkS4.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-DNnd3vkz.mjs";
-import { c as getDefaultCrudSchemas } from "./utils-h1V_sT-t.mjs";
-import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-XH1RZRyu.mjs";
-import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-DsT1B5zJ.mjs";
-import { t as hasEvents } from "./typeGuards-jjKJDN13.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
-import { B as requireAuth } from "./permissions-BAfwgBxc.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-D-h0uWtP.mjs";
-import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
+import { r as ForbiddenError } from "./errors-CLid6atr.mjs";
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-GY4kATJb.mjs";
+import { d as isWriteVerbCapable, p as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController, u as detectOverriddenWriteSlots } from "./BaseController-C-pofd0v.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-u1opU66a.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-UtpiJO5R.mjs";
+import { c as getDefaultCrudSchemas } from "./utils-CBK9HQOI.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-D2_bHGil.mjs";
+import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-DOpZVht6.mjs";
+import { t as hasEvents } from "./typeGuards-B-_jqaMi.mjs";
+import { a as createCrudHandlers, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-LFuOra7W.mjs";
+import { B as requireAuth } from "./permissions-CpSBlFXZ.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-Bi0Z6Iq8.mjs";
+import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
 import { isReadOnlyRepo } from "@classytic/repo-core/repository";
 //#region src/core/middlewares/fieldWrite.ts
 /**
@@ -939,50 +937,27 @@ function stripFromRequired(schema, fieldName) {
 	return next;
 }
 /**
-* Strip framework-injected fields from the `required[]` list of every
-* body-shaped slot in an adapter's generated schemas.
-*
-* A "framework-injected field" is any field marked `systemManaged: true`
-* in `schemaOptions.fieldRules`. Arc populates those fields from the
-* request scope / preset middleware / controller — the client is never
-* expected to supply them, so they must not be in the wire contract's
-* `required[]` even if the underlying engine's Mongoose/Zod schema
-* declares them as required at the DB layer.
-*
-* **The primary gotcha this closes:** engines built on
-* `@classytic/primitives` (mongokit, pricelist, and every downstream
-* `@classytic/*` engine) default to `tenant: { required: true }` in
-* `resolveTenantConfig()`. That stamps `organizationId: { required: true }`
-* on the Mongoose schema, which the adapter faithfully reflects into the
-* generated `createBody` / `updateBody` schema's `required[]`. Fastify's
-* preValidation runs BEFORE arc's preHandler chain, so
-* `multiTenantPreset`'s tenant-injection hook never gets a chance to run —
-* the request is rejected with `must have required property 'organizationId'`
-* even though the client correctly supplied `x-organization-id` and the
-* framework had already promised to inject the value.
-*
-* The only workaround before 2.11 was
-* `createEngine({ tenant: { required: false } })` at every consumer site —
-* a leaky abstraction every new engine-backed resource had to remember.
-*
-* **Secondary coverage (defense-in-depth):** the same transform also fires
-* for `auditedPreset`'s `createdBy` / `updatedBy`, any future preset that
-* marks fields `systemManaged`, and any host-declared `fieldRules` with
-* `systemManaged: true`. Every framework-injected field gets the wire
-* contract / runtime pairing for free.
-*
-* **Leaves `properties` intact** — elevated admins or advanced callers can
-* still send systemManaged fields in the body. `BodySanitizer` enforces
-* the runtime policy (`preserveForElevated`, `strip` vs `reject`, etc.).
-*
-* **No-op when:**
-* - `schemaOptions.fieldRules` is undefined / empty
-* - No rule has `systemManaged: true`
-* - The generated schemas object is undefined (adapter didn't generate any)
-*
-* Applies to both `createBody` and `updateBody` — update middleware also
-* injects tenant/audit fields, so the update wire contract has the same
-* problem as create.
+* Drop `systemManaged` fields from `required[]` in generated body schemas.
+*
+* Arc populates those from scope / preset middleware / controller, so a client
+* never supplies them — but the DB schema may still mark them required, and the
+* adapter reflects that into the wire contract.
+*
+* THE GOTCHA THIS CLOSES: engines on `@classytic/primitives` default to
+* `tenant: { required: true }`, stamping `organizationId` as required. Fastify
+* preValidation runs BEFORE arc's preHandler chain, so the tenant-injection
+* hook never gets to run and the request dies on
+* `must have required property 'organizationId'` — even though the client sent
+* `x-organization-id` and arc had promised to inject it. The alternative was
+* `tenant: { required: false }` at every consumer site.
+*
+* Also covers `auditedPreset`'s `createdBy`/`updatedBy` and any host rule
+* marked `systemManaged`. Applies to create AND update, since update middleware
+* injects the same fields.
+*
+* `properties` is left INTACT — an elevated caller may still send these, and
+* `BodySanitizer` owns that runtime policy (`preserveForElevated`,
+* strip-vs-reject). No-op without `systemManaged` rules or generated schemas.
 */
 function stripSystemManagedFromBodyRequired(schemas, schemaOptions) {
 	if (!schemas) return schemas;
@@ -1188,8 +1163,8 @@ function buildGeneratedCrudSchemas(openApi, customSchemas) {
 		const { createBody, updateBody, params } = openApi;
 		if (createBody) generated.create = { body: safeBody(createBody) };
 		if (updateBody) {
-			const patchBody = { ...updateBody };
-			delete patchBody.required;
+			const patchBody = structuredClone(updateBody);
+			stripRequiredDeep(patchBody);
 			generated.update = { body: safeBody(patchBody) };
 			if (params) generated.update.params = cloneShallow(params);
 		}
@@ -1287,6 +1262,27 @@ function deepMergeSchemas(base, override) {
 function cloneShallow(value) {
 	return { ...value };
 }
+/**
+* Delete every `required` from a JSON-schema subtree — PATCH means optional at
+* every depth, not just the root.
+*
+* A generator may legitimately return an `updateBody` whose nested
+* subdocument-array `items` carries its own `required`. Stripping only the
+* root left that intact, so a PATCH adding one item to a subdocument array was
+* rejected by AJV for a field the caller had no way to know it must resend.
+* Recursing here enforces PATCH semantics on whatever a generator produces,
+* rather than trusting each to recurse correctly.
+*/
+function stripRequiredDeep(node) {
+	if (Array.isArray(node)) {
+		for (const item of node) stripRequiredDeep(item);
+		return;
+	}
+	if (!node || typeof node !== "object") return;
+	const obj = node;
+	delete obj.required;
+	for (const value of Object.values(obj)) stripRequiredDeep(value);
+}
 function safeBody(schema) {
 	if (schema && typeof schema === "object" && schema.type === "object") return {
 		additionalProperties: true,
@@ -1429,7 +1425,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-DVpoA0do.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-EYWgd0ly.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1444,7 +1440,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B_B48JZ-.mjs"), import("./validate-CdQlz52F.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-ByOK9Iev.mjs"), import("./validate-dosAIvQU.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/discovery/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { readdir } from "node:fs/promises";
 import { extname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/docs/index.d.mts

@@ -1,5 +1,5 @@
 
-import { p as RegistryEntry } from "../index-BcR2bFZQ.mjs";
+import { p as RegistryEntry } from "../index-C5K78SXo.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BN5cQaO2.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "../userHelpers-AKcB4V03.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-ItLH12_L.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-B0tlY8y1.mjs → elevation-tGIAldco.mjs}

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
+import { n as requireSingleHeaderValue } from "./headers-DODWf7aC.mjs";
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
 import fp from "fastify-plugin";
 //#region src/scope/elevation.ts
 var elevation_exports = /* @__PURE__ */ __exportAll({

package/dist/encryption/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as ArcError } from "../errors-Cd_yy7aW.mjs";
-import { t as parseJsonBody } from "../jsonBody-CfGH-GxO.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as ArcError } from "../errors-CLid6atr.mjs";
+import { t as parseJsonBody } from "../jsonBody-CVKA7C5m.mjs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/encryption/fieldCipher.ts

package/dist/{errorHandler-C7xBqHsI.mjs → errorHandler-BbQ1nQdk.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { m as statusToArcCode, p as isArcError } from "./errors-Cd_yy7aW.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+import { m as statusToArcCode, p as isArcError } from "./errors-CLid6atr.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import fp from "fastify-plugin";

package/dist/{errors-Cd_yy7aW.mjs → errors-CLid6atr.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/utils/errors.ts
 /**
 * Base Arc Error. Implements the canonical `HttpError` contract — `status`

package/dist/{eventPlugin-DSNEZWfV.d.mts → eventPlugin-B47sfCJ8.d.mts}

@@ -340,7 +340,7 @@ interface EventPluginOptions {
    */
   validateMode?: "warn" | "reject" | "off";
   /**
-   * Dev-mode duplicate-publish detector (v2.12).
+   * Dev-mode duplicate-publish detector.
    *
    * When enabled, arc keeps a 5-second LRU on `(eventType, correlationId)`
    * and emits an `arcLog("events").warn(...)` the second time a request

package/dist/{eventPlugin-Dar8qRaj.mjs → eventPlugin-ClPn5kjn.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError } from "./errors-Cd_yy7aW.mjs";
-import { n as requestContext } from "./requestContext-uYE35JxI.mjs";
-import { n as MemoryEventTransport, r as createEvent, t as ARC_EVENT_TRANSPORT } from "./EventTransport-tq4CEB-q.mjs";
+import { d as createDomainError } from "./errors-CLid6atr.mjs";
+import { n as requestContext } from "./requestContext-DzOUGNdY.mjs";
+import { n as MemoryEventTransport, r as createEvent, t as ARC_EVENT_TRANSPORT } from "./EventTransport-BrPeGUil.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import fp from "fastify-plugin";
 //#region src/events/retry.ts

package/dist/events/index.d.mts

@@ -1,7 +1,7 @@
 
 import { i as EventLogger, n as DomainEvent, o as MemoryEventTransport, r as EventHandler, s as MemoryEventTransportOptions } from "../EventTransport-BEVP50ka.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-DSNEZWfV.mjs";
-import { a as EventOutbox, c as OutboxRelayErrorKind, i as MemoryOutboxStore, l as RelayResult, n as OutboxModuleOptions, o as EventOutboxOptions, r as createOutboxModule, s as OutboxRelayErrorHandler, t as OutboxModuleExports } from "../outbox-module-D-VFq37T.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-B47sfCJ8.mjs";
+import { a as EventOutbox, c as OutboxRelayErrorKind, i as MemoryOutboxStore, l as RelayResult, n as OutboxModuleOptions, o as EventOutboxOptions, r as createOutboxModule, s as OutboxRelayErrorHandler, t as OutboxModuleExports } from "../outbox-module-b1TyDGGi.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
 import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-mwLWlfHG.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";

package/dist/events/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as MemoryEventTransport } from "../EventTransport-tq4CEB-q.mjs";
-import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-CLIOHsOK.mjs";
-import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-Dar8qRaj.mjs";
-import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-CXB79bvt.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as MemoryEventTransport } from "../EventTransport-BrPeGUil.mjs";
+import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-Dh2BnzJf.mjs";
+import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-ClPn5kjn.mjs";
+import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-SGIZz6oS.mjs";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 //#region src/events/eventTypes.ts
 /**

package/dist/events/transports/redis-stream-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis-stream.ts
 /**

package/dist/events/transports/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis.ts
 /**

package/dist/factory/index.d.mts

@@ -1,8 +1,8 @@
 
-import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-BcTumAz_.mjs";
-import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-C5NnMEKF.mjs";
-import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-DVsTAy6X.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-g07ldtzh.mjs";
+import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-DDD5RKTu.mjs";
+import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-C50BUxKs.mjs";
+import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-CMMTL3cj.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources--ZtY9pe9.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**
@@ -17,7 +17,7 @@ import { FastifyInstance, FastifyServerOptions } from "fastify";
  * Hosts that need NO redaction (test fixtures, security audits) opt out
  * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
  * their own `redact` and arc steps aside — this default never overrides
- * an explicit setting. (2.15.1)
+ * an explicit setting.
  */
 declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
 /**

package/dist/factory/index.mjs

@@ -1,9 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-CasG2A28.mjs";
-import { _ as collectModuleScheduledJobs, a as developmentPreset, b as resolveModule, c as productionPreset, d as getModuleState, f as hasModule, g as collectModuleHealthChecks, h as describeResolvedModule, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as orderModules, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset, v as collectModuleWorkflows, y as resolveContribution } from "../createApp-CLGegqiG.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
-import { t as loadResources } from "../loadResources-Bj-aSsXi.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BkyqeTDz.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-_Zs3R_Sb.mjs";
+import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-DYMzmUk1.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-Bh5OC7ww.mjs";
+import { t as loadResources } from "../loadResources-DdQb0qgV.mjs";
 //#region src/factory/module/extend.ts
 /** Concatenate two contributions, resolving factories only when arc asks. */
 function mergeContribution(own, extra) {

package/dist/{fastify-augmentation-DVsTAy6X.d.mts → fastify-augmentation-CMMTL3cj.d.mts}

@@ -1,8 +1,8 @@
 
-import { on as HookSystem, z as ResourceRegistry } from "./index-BcR2bFZQ.mjs";
+import { on as HookSystem, z as ResourceRegistry } from "./index-C5K78SXo.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
-import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-BcTumAz_.mjs";
-import { s as ModuleState } from "./index-C5NnMEKF.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-DDD5RKTu.mjs";
+import { s as ModuleState } from "./index-C50BUxKs.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/factory/module/descriptor.d.ts
 /**

package/dist/{fields-CojeUkS4.mjs → fields-UtpiJO5R.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions