@classytic/arc 2.33.0 → 2.35.0

package/dist/{createApp-CLGegqiG.mjs → preloadResources-DYMzmUk1.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { arcLog, configureArcLogger, createPinoWriter } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-Dm88DaTW.mjs";
-import { t as createTenantKeyGenerator } from "./rateLimitKey-XngqVNEV.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-CasG2A28.mjs";
-import { t as parseJsonBody } from "./jsonBody-CfGH-GxO.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-CLIOHsOK.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
+import { n as PUBLIC_SCOPE } from "./types-GY4kATJb.mjs";
+import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-BagWc3TI.mjs";
+import { t as createTenantKeyGenerator } from "./rateLimitKey-pyevMUVf.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-_Zs3R_Sb.mjs";
+import { t as parseJsonBody } from "./jsonBody-CVKA7C5m.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-Dh2BnzJf.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
@@ -801,7 +801,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Dar8qRaj.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-ClPn5kjn.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
@@ -860,15 +860,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-BcGmvnHh.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-cN5X9VEL.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-DhsZ0ZIc.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-BI7Z88Cx.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-qYSB7rMQ.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-BwedEXau.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -878,7 +878,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-Cf0jUHsh.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-DUIP1XH6.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -887,20 +887,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-CTkv3O59.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-Cfl2bVjj.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-D7uchLjN.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-5LNPvL3P.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-rZbyLVD-.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-BbTs4pwM.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -977,7 +977,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-B0tlY8y1.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-tGIAldco.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -992,7 +992,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-C7xBqHsI.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-BbQ1nQdk.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1216,7 +1216,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-Bj-aSsXi.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-DdQb0qgV.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1342,7 +1342,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-CAcZgia0.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-BLpZLWGF.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1696,7 +1696,7 @@ const MEMORY_STORE_NAMES = /* @__PURE__ */ new Set(["memory", "memory-cache"]);
 * Hosts that need NO redaction (test fixtures, security audits) opt out
 * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
 * their own `redact` and arc steps aside — this default never overrides
-* an explicit setting. (2.15.1)
+* an explicit setting.
 */
 const DEFAULT_LOGGER_REDACT_PATHS = [
 	"req.headers.authorization",
@@ -1813,11 +1813,22 @@ async function createApp(options) {
 	*/
 	const declaredRole = options.role ?? "all";
 	if ((declaredRole === "relay" || declaredRole === "scheduler") && (options.resources !== void 0 || options.resourceDir !== void 0)) throw new Error(`createApp: role '${declaredRole}' declares HTTP resources — a ${declaredRole} process must not serve routes. Remove \`resources\`/\`resourceDir\`, or change the role.`);
+	/**
+	* This app's own `arcLog` config, entered for the WHOLE boot.
+	*
+	* Held by reference and mutated in `buildApp` once `fastify.log` exists:
+	* boot starts before Fastify does, so a copied snapshot would send every
+	* post-construction boot warning to the console instead of this app's
+	* logger. Scoping it per app is what stops two apps in one process from
+	* overwriting each other's writer — see `src/logger/index.ts`.
+	*/
+	const loggerScope = {};
+	if (options.debug !== void 0 && options.debug !== false) loggerScope.debug = options.debug;
 	let partial;
 	try {
-		return await buildApp(options, (instance) => {
+		return await runWithArcLogger(loggerScope, () => buildApp(options, loggerScope, (instance) => {
 			partial = instance;
-		});
+		}));
 	} catch (err) {
 		if (partial) try {
 			await partial.close();
@@ -1827,8 +1838,7 @@ async function createApp(options) {
 		throw err;
 	}
 }
-async function buildApp(options, onInstance) {
-	if (options.debug !== void 0 && options.debug !== false) configureArcLogger({ debug: options.debug });
+async function buildApp(options, loggerScope, onInstance) {
 	validateAuthOptions(options);
 	const deferredWarnings = validateDistributedRuntime(options);
 	if (options.beforeBoot) await options.beforeBoot();
@@ -1837,6 +1847,25 @@ async function buildApp(options, onInstance) {
 		...options
 	};
 	const inheritedTrustProxyDefault = options.preset === "production" && options.trustProxy === void 0;
+	/**
+	* A NUMERIC `trustProxy` is a no-op on Fastify >= 5.12.1.
+	*
+	* Fastify made hop-count trust fail-closed on purpose — the comment in
+	* `lib/request.js` is explicit: "Hop-count-only trust cannot validate the
+	* immediate peer. Fail closed so direct clients cannot spoof X-Forwarded-*
+	* values by supplying enough hops." So `trustProxy: 1` now trusts NOTHING.
+	*
+	* That is the right call upstream and the wrong thing to inherit silently:
+	* `request.ip` becomes the proxy's address, which is the exact failure the
+	* production-preset warning below describes — rate-limit keys collapse onto
+	* one bucket and audit rows record the wrong client. The host asked for
+	* proxy trust and got none, with no error.
+	*
+	* Warn rather than refuse: the app still serves, and a hard boot failure on
+	* a transitive `fastify` bump would be a harsher surprise than the one being
+	* reported. The replacement is named so the fix is a copy-paste.
+	*/
+	const numericTrustProxy = typeof config.trustProxy === "number";
 	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
 	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
 	const moduleHealthChecks = collectModuleHealthChecks(resolvedModules);
@@ -1869,11 +1898,19 @@ async function buildApp(options, onInstance) {
 		} }
 	});
 	onInstance(fastify);
-	if (resolvedLogger !== false) configureArcLogger({
-		...options.debug !== void 0 && options.debug !== false ? { debug: options.debug } : {},
-		writer: createPinoWriter(fastify.log)
+	if (resolvedLogger !== false) {
+		const writer = createPinoWriter(fastify.log);
+		loggerScope.writer = writer;
+		configureArcLogger({
+			...options.debug !== void 0 && options.debug !== false ? { debug: options.debug } : {},
+			writer
+		});
+	}
+	fastify.addHook("onRequest", (_request, _reply, done) => {
+		enterArcLoggerScope(loggerScope, done);
 	});
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
+	if (numericTrustProxy) fastify.log.warn(`[arc] trustProxy: ${String(config.trustProxy)} (a hop COUNT) trusts nothing on Fastify >= 5.12.1 — hop-count trust cannot validate the immediate peer, so it fails closed upstream to stop clients spoofing X-Forwarded-* with padded hops. \`request.ip\` is therefore the PROXY's address: rate-limit keys collapse onto one bucket and audit rows record the wrong client. Name the proxies instead — trustProxy: 'loopback', '10.0.0.0/8', a comma-separated list, or \`true\` if every upstream hop is genuinely trusted.`);
 	if (inheritedTrustProxyDefault) fastify.log.warn("[arc] preset: 'production' now defaults to trustProxy: false (fail-closed; was true before 2.24). If this app runs behind a load balancer or reverse proxy, request.ip is currently the PROXY's address — rate-limit keys collapse onto one bucket and audit logs record the wrong client. Set trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or false if clients truly connect directly.");
 	fastify.removeContentTypeParser("application/json");
 	fastify.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
@@ -1907,7 +1944,7 @@ async function buildApp(options, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-BSBVCwL3.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-2jfmMnnV.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {
@@ -1959,4 +1996,48 @@ const ArcFactory = {
 	}
 };
 //#endregion
-export { collectModuleScheduledJobs as _, developmentPreset as a, resolveModule as b, productionPreset as c, getModuleState as d, hasModule as f, collectModuleHealthChecks as g, describeResolvedModule as h, createApp_exports as i, testingPreset as l, subscribeModuleEventHandlers as m, DEFAULT_LOGGER_REDACT_PATHS as n, edgePreset as o, orderModules as p, createApp as r, getPreset as s, ArcFactory as t, workerPreset as u, collectModuleWorkflows as v, resolveContribution as y };
+//#region src/factory/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { resolveModule as S, describeResolvedModule as _, createApp as a, collectModuleWorkflows as b, edgePreset as c, testingPreset as d, workerPreset as f, subscribeModuleEventHandlers as g, orderModules as h, DEFAULT_LOGGER_REDACT_PATHS as i, getPreset as l, hasModule as m, preloadResourcesAsync as n, createApp_exports as o, getModuleState as p, ArcFactory as r, developmentPreset as s, preloadResources as t, productionPreset as u, collectModuleHealthChecks as v, resolveContribution as x, collectModuleScheduledJobs as y };

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
 
-import { i as RequestScope } from "../types-ChuShpCP.mjs";
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { Y as PresetResult } from "../index-BcR2bFZQ.mjs";
+import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
+import { l as PermissionCheck } from "../base-GZU3LlzP.mjs";
+import { Y as PresetResult } from "../index-C5K78SXo.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { c as getOrgId, g as getUserId } from "../types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-BAfwgBxc.mjs";
-import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-CLid6atr.mjs";
+import { c as getOrgId, g as getUserId } from "../types-GY4kATJb.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-CpSBlFXZ.mjs";
+import { t as multipartBody } from "../multipartBody-DjilSDAT.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/presets/index.d.mts

@@ -1,6 +1,6 @@
 
-import { t as AnyRecord } from "../base-Csjc2oF-.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-BcR2bFZQ.mjs";
+import { t as AnyRecord } from "../base-GZU3LlzP.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-C5K78SXo.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-D-h0uWtP.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-Bi0Z6Iq8.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,5 +1,5 @@
 
-import { X as CrudRouteKey, Y as PresetResult } from "../index-BcR2bFZQ.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-C5K78SXo.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import "../constants-BxCoxmiN.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CoqIRrkY.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import "../constants-BhzLXCfN.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-GY4kATJb.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-BcR2bFZQ.mjs";
+import { l as PermissionCheck } from "../base-GZU3LlzP.mjs";
+import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-C5K78SXo.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes
@@ -23,55 +23,17 @@ import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt a
  * GET-based autocomplete, pass `path`/`method` overrides or use `routes` for
  * fully bespoke endpoints.
  *
- * @example MongoKit wiring (elasticSearchPlugin + vectorPlugin)
- * ```typescript
- * import { Repository, methodRegistryPlugin, elasticSearchPlugin } from '@classytic/mongokit';
- * import { vectorPlugin } from '@classytic/mongokit/ai';
- * import { searchPreset } from '@classytic/arc/presets/search';
- *
- * const productRepo = new Repository(Product, [
- *   methodRegistryPlugin(),
- *   elasticSearchPlugin({ client: esClient, indexName: 'products' }),
- *   vectorPlugin({ fields: [{ path: 'embedding', dimensions: 1536 }], embedFn }),
- * ]);
- *
- * defineResource({
- *   name: 'product',
- *   adapter: createMongooseAdapter({ model: Product, repository: productRepo }),
- *   presets: [
- *     searchPreset({
- *       search:  { handler: (req) => productRepo.search(req.body.query, req.body) },
- *       similar: { handler: (req) => productRepo.searchSimilar(req.body.query, req.body) },
- *     }),
- *   ],
- * });
- * ```
- *
- * @example Custom vector backend (Pinecone)
+ * @example
  * ```typescript
  * searchPreset({
+ *   search:  { handler: (req) => repo.search(req.body.query, req.body) },
  *   similar: {
- *     path: '/vector-search',                 // custom path
- *     handler: async (req) => {
- *       const hits = await pinecone.query({
- *         vector: req.body.vector,
- *         topK: req.body.topK ?? 10,
- *       });
- *       return hits.matches;
- *     },
- *     schema: { body: { type: 'object', properties: { vector: { type: 'array' }, topK: { type: 'integer' } } } },
- *     mcp: false,                             // no MCP tool for this one
+ *     path: '/vector-search',   // override the default path
+ *     mcp: false,               // and skip the MCP tool for this one
+ *     handler: (req) => pinecone.query({ vector: req.body.vector }),
  *   },
- *   // Extra app-specific route
- *   routes: [
- *     {
- *       method: 'GET',
- *       path: '/autocomplete',
- *       handler: async (req) => algolia.suggest(req.query.q as string),
- *       permissions: allowPublic(),
- *     },
- *   ],
- * });
+ *   routes: [{ method: 'GET', path: '/autocomplete', handler, permissions }],
+ * })
  * ```
  */
 /**

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-BAfwgBxc.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-CpSBlFXZ.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-D-h0uWtP.mjs → presets-Bi0Z6Iq8.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-Cd_yy7aW.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-BAfwgBxc.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-CLid6atr.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-GY4kATJb.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-CpSBlFXZ.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{projection-BKM0Ui-s.mjs → projection-aevMua7Q.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CoqIRrkY.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-GY4kATJb.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{queryCachePlugin-DhsZ0ZIc.mjs → queryCachePlugin-BI7Z88Cx.mjs}

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { t as hasEvents } from "./typeGuards-jjKJDN13.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-WeKvY1dE.mjs";
-import { t as MemoryCacheStore } from "./memory-qYSB7rMQ.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+import { t as hasEvents } from "./typeGuards-B-_jqaMi.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-GlU7XpmG.mjs";
+import { t as MemoryCacheStore } from "./memory-BwedEXau.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{rateLimitKey-XngqVNEV.mjs → rateLimitKey-pyevMUVf.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/{realtime-CTkv3O59.mjs → realtime-Cfl2bVjj.mjs}

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-B3mP_QTy.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { c as getOrgId } from "./types-CoqIRrkY.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";
-import { t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-DsT1B5zJ.mjs";
-import { t as openSseStream } from "./sseStream-Bvpi-UXQ.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-DYXBBgtg.mjs";
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
+import { c as getOrgId } from "./types-GY4kATJb.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-BO-sFTQf.mjs";
+import { t as applyFieldReadPermissions } from "./fields-UtpiJO5R.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-DOpZVht6.mjs";
+import { t as openSseStream } from "./sseStream-ByFGyIVr.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({

package/dist/{rateLimit-D4-ASwsI.mjs → registerRoute-u1opU66a.mjs}

@@ -1,5 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as requestContext } from "./requestContext-uYE35JxI.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-DYXBBgtg.mjs";
+import { f as createError } from "./errors-CLid6atr.mjs";
+import { u as getRequestScope } from "./types-GY4kATJb.mjs";
+import { n as requestContext } from "./requestContext-DzOUGNdY.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -178,6 +181,79 @@ function describeValue(v) {
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
 //#endregion
+//#region src/core/middlewares/permissions.ts
+/**
+* Build a PermissionContext from a Fastify request. Extracted so the CRUD
+* permission middleware and the dynamic action-permission check use the same
+* field layout — divergence here silently broke policy filters for actions.
+*/
+function buildPermissionContext(req, opts) {
+	const reqWithExtras = req;
+	const params = req.params;
+	return {
+		user: reqWithExtras.user ?? null,
+		scope: getRequestScope(req),
+		request: req,
+		resource: opts.resource,
+		action: opts.action,
+		resourceId: opts.resourceId ?? params?.id,
+		params,
+		data: opts.data ?? req.body
+	};
+}
+/**
+* Static per-route CRUD permission gate. The permission and action are known
+* at route-registration time, so the gate is a plain preHandler.
+*
+* Actions use the dynamic counterpart `buildActionPermissionMw` — their
+* permission is resolved from `body.action` at request time.
+*/
+function buildCrudPermissionMw(permissionCheck, resourceName, action) {
+	if (!permissionCheck) return null;
+	return async (req, reply) => {
+		const context = buildPermissionContext(req, {
+			resource: resourceName,
+			action
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
+	};
+}
+/**
+* Dynamic per-action permission gate for the action router.
+*
+* Resolves the permission from `body.action` at request time and runs
+* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
+* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
+* (idempotency) and `routeGuards` run. Previously this check lived inside
+* the main action handler, which meant idempotency recorded unauthorized
+* requests and route guards saw unfiltered scope — the very divergence
+* routerShared exists to prevent.
+*
+* Also acts as a defensive fallback for invalid action names — the
+* `oneOf` body schema normally rejects these at AJV validation, but
+* hosts that disable schema validation still get a 400 here.
+*/
+function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
+	const enumSet = new Set(actionEnum);
+	const validActions = [...actionEnum];
+	return async (req, reply) => {
+		const body = req.body ?? {};
+		const action = body.action;
+		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
+		const permissionCheck = actionPermissions[action] ?? globalAuth;
+		if (!permissionCheck) return;
+		const { action: _discard, ...data } = body;
+		const params = req.params;
+		const context = buildPermissionContext(req, {
+			resource: resourceName,
+			action,
+			resourceId: params?.id,
+			data
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+	};
+}
+//#endregion
 //#region src/core/middlewares/pluginMw.ts
 /**
 * Pick the request-lifecycle plugin middleware for an HTTP method:
@@ -246,4 +322,39 @@ function buildRateLimitConfig(rateLimit) {
 	} };
 }
 //#endregion
-export { buildRouteHooks as a, buildAuthMiddleware as c, selectPluginMw as i, buildAuthMiddlewareForPermissions as l, buildRouteConfig as n, resolveRoutePreHandlers as o, resolveRouterPluginMw as r, routeHookOptions as s, buildRateLimitConfig as t, buildArcDecorator as u };
+//#region src/core/middlewares/registerRoute.ts
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
+//#endregion
+export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };

package/dist/registry/index.d.mts

@@ -1,6 +1,6 @@
 
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-BcR2bFZQ.mjs";
-import "../fastify-augmentation-DVsTAy6X.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-C5K78SXo.mjs";
+import "../fastify-augmentation-CMMTL3cj.mjs";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 import { FastifyPluginAsync } from "fastify";
 //#region src/registry/assertNoTenantData.d.ts