@classytic/arc 2.34.0 → 2.36.0

package/dist/{createApp-zR-DEesr.mjs → preloadResources-CjnW4iIX.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { arcLog, configureArcLogger, createPinoWriter } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-Dm88DaTW.mjs";
-import { t as createTenantKeyGenerator } from "./rateLimitKey-XngqVNEV.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-CasG2A28.mjs";
-import { t as parseJsonBody } from "./jsonBody-CfGH-GxO.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-CLIOHsOK.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
+import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
+import { n as PUBLIC_SCOPE } from "./types-B8lwJv9Q.mjs";
+import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-jK99Ciw_.mjs";
+import { t as createTenantKeyGenerator } from "./rateLimitKey-Bma8VXDO.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-k6NODS8f.mjs";
+import { t as parseJsonBody } from "./jsonBody-CiHih3ZU.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-B4fNHRNc.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
@@ -48,6 +48,56 @@ const PLUGIN_REGISTRY = {
 		optional: true
 	}
 };
+/**
+* Fail ONCE with every missing package, before any plugin registers.
+*
+* Without this the first absent package throws and the operator installs it,
+* restarts, hits the next one, and repeats — six restarts to discover a peer
+* set that was pruned as a unit. These are OPTIONAL peers of arc, so nothing
+* at install or build time says they are gone; the first signal is a boot
+* crash naming exactly one of them.
+*
+* Required-ness is read from `PLUGIN_REGISTRY` (`!optional`), never a second
+* list — a hand-maintained copy is what goes stale the day a plugin is added.
+* Optional plugins are deliberately NOT preflighted: their absence is a
+* supported configuration, and `loadPlugin` already warns and skips.
+*
+* A plugin the host disabled (`{ helmet: false }`) is not checked — refusing to
+* boot over a package for a plugin nobody asked for would be the opposite of
+* helpful.
+*/
+async function preflightPlugins(config, options = {}) {
+	const { load } = options;
+	const required = Object.entries(PLUGIN_REGISTRY).filter(([name, entry]) => !entry.optional && config[name] !== false);
+	const results = await Promise.allSettled(required.map(([name, entry]) => load ? load(name) : entry.loader()));
+	const missing = [];
+	for (const [i, result] of results.entries()) {
+		if (result.status === "fulfilled") continue;
+		const [name, entry] = required[i];
+		if (!isModuleNotFound(result.reason)) throw new Error(`Failed to load plugin '${name}': ${result.reason.message}`);
+		missing.push({
+			name,
+			package: entry.package
+		});
+	}
+	if (missing.length === 0) return;
+	const packages = missing.map((m) => m.package);
+	throw new Error(`arc cannot start: ${missing.length} required plugin package(s) are not installed.\n` + missing.map((m) => `  - ${m.package}  (plugin '${m.name}')`).join("\n") + `\n\nInstall all of them:\n  npm install ${packages.join(" ")}\n\nOr disable the plugins you do not need in createApp options: ` + missing.map((m) => `${m.name}: false`).join(", "));
+}
+/** Shared by the preflight and the per-plugin loader so they agree on what "missing" means. */
+function isModuleNotFound(err) {
+	/**
+	* CODE first, message second. Node sets `ERR_MODULE_NOT_FOUND` (ESM) or
+	* `MODULE_NOT_FOUND` (CJS) on a real resolution failure; the message text
+	* varies by Node version, loader and bundler, so matching it alone is a
+	* predicate that silently stops matching after an upgrade — and this one
+	* decides between "install a package" and "your plugin crashed".
+	*/
+	const code = err?.code;
+	if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return true;
+	const m = err?.message ?? "";
+	return m.includes("Cannot find module") || m.includes("Cannot find package") || m.includes("MODULE_NOT_FOUND") || m.includes("Could not resolve");
+}
 async function loadPlugin(name, logger) {
 	const entry = PLUGIN_REGISTRY[name];
 	if (!entry) throw new Error(`Unknown plugin: ${name}`);
@@ -55,12 +105,12 @@ async function loadPlugin(name, logger) {
 		return await entry.loader();
 	} catch (error) {
 		const err = error;
-		const isModuleNotFound = err.message.includes("Cannot find module") || err.message.includes("Cannot find package") || err.message.includes("MODULE_NOT_FOUND") || err.message.includes("Could not resolve");
-		if (isModuleNotFound && entry.optional) {
+		const notFound = isModuleNotFound(err);
+		if (notFound && entry.optional) {
 			logger?.warn(`Optional plugin '${name}' skipped (${entry.package} not installed)`);
 			return null;
 		}
-		if (isModuleNotFound) throw new Error(`Plugin '${name}' requires package '${entry.package}' which is not installed.\nInstall it with: npm install ${entry.package}\nOr disable this plugin by setting ${name}: false in createApp options.`);
+		if (notFound) throw new Error(`Plugin '${name}' requires package '${entry.package}' which is not installed.\nInstall it with: npm install ${entry.package}\nOr disable this plugin by setting ${name}: false in createApp options.`);
 		throw new Error(`Failed to load plugin '${name}': ${err.message}`);
 	}
 }
@@ -801,7 +851,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-Dar8qRaj.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-c3YwGzz9.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
@@ -860,15 +910,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-BcGmvnHh.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-CP3GLJ7U.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-DhsZ0ZIc.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-DHueQT9O.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-qYSB7rMQ.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-BU-C-MV3.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -878,7 +928,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-Cf0jUHsh.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-Bxt03Hk5.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -887,20 +937,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-G1TC6Yzc.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-BBoC91Bz.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-D7uchLjN.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-7_1GbJpl.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-rZbyLVD-.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-COpAyfpZ.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -977,7 +1027,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-B0tlY8y1.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-D_cmo80j.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -992,7 +1042,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-C7xBqHsI.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-2RT0hLSI.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1216,7 +1266,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-Bj-aSsXi.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-DGlfRQc9.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1342,7 +1392,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-CAcZgia0.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-CKKEL21P.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1552,6 +1602,11 @@ function compilePathMatcher(patterns) {
 * All enabled by default — set to `false` to opt out.
 */
 async function registerSecurityPlugins(fastify, config) {
+	/**
+	* Resolve every enabled plugin's package FIRST, so a pruned peer set is one
+	* error listing all of them rather than one restart per package.
+	*/
+	await preflightPlugins(config);
 	if (config.helmet !== false) {
 		const helmet = await loadPlugin("helmet");
 		await fastify.register(helmet, config.helmet ?? {});
@@ -1696,7 +1751,7 @@ const MEMORY_STORE_NAMES = /* @__PURE__ */ new Set(["memory", "memory-cache"]);
 * Hosts that need NO redaction (test fixtures, security audits) opt out
 * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
 * their own `redact` and arc steps aside — this default never overrides
-* an explicit setting. (2.15.1)
+* an explicit setting.
 */
 const DEFAULT_LOGGER_REDACT_PATHS = [
 	"req.headers.authorization",
@@ -1813,11 +1868,22 @@ async function createApp(options) {
 	*/
 	const declaredRole = options.role ?? "all";
 	if ((declaredRole === "relay" || declaredRole === "scheduler") && (options.resources !== void 0 || options.resourceDir !== void 0)) throw new Error(`createApp: role '${declaredRole}' declares HTTP resources — a ${declaredRole} process must not serve routes. Remove \`resources\`/\`resourceDir\`, or change the role.`);
+	/**
+	* This app's own `arcLog` config, entered for the WHOLE boot.
+	*
+	* Held by reference and mutated in `buildApp` once `fastify.log` exists:
+	* boot starts before Fastify does, so a copied snapshot would send every
+	* post-construction boot warning to the console instead of this app's
+	* logger. Scoping it per app is what stops two apps in one process from
+	* overwriting each other's writer — see `src/logger/index.ts`.
+	*/
+	const loggerScope = {};
+	if (options.debug !== void 0 && options.debug !== false) loggerScope.debug = options.debug;
 	let partial;
 	try {
-		return await buildApp(options, (instance) => {
+		return await runWithArcLogger(loggerScope, () => buildApp(options, loggerScope, (instance) => {
 			partial = instance;
-		});
+		}));
 	} catch (err) {
 		if (partial) try {
 			await partial.close();
@@ -1827,8 +1893,7 @@ async function createApp(options) {
 		throw err;
 	}
 }
-async function buildApp(options, onInstance) {
-	if (options.debug !== void 0 && options.debug !== false) configureArcLogger({ debug: options.debug });
+async function buildApp(options, loggerScope, onInstance) {
 	validateAuthOptions(options);
 	const deferredWarnings = validateDistributedRuntime(options);
 	if (options.beforeBoot) await options.beforeBoot();
@@ -1837,6 +1902,25 @@ async function buildApp(options, onInstance) {
 		...options
 	};
 	const inheritedTrustProxyDefault = options.preset === "production" && options.trustProxy === void 0;
+	/**
+	* A NUMERIC `trustProxy` is a no-op on Fastify >= 5.12.1.
+	*
+	* Fastify made hop-count trust fail-closed on purpose — the comment in
+	* `lib/request.js` is explicit: "Hop-count-only trust cannot validate the
+	* immediate peer. Fail closed so direct clients cannot spoof X-Forwarded-*
+	* values by supplying enough hops." So `trustProxy: 1` now trusts NOTHING.
+	*
+	* That is the right call upstream and the wrong thing to inherit silently:
+	* `request.ip` becomes the proxy's address, which is the exact failure the
+	* production-preset warning below describes — rate-limit keys collapse onto
+	* one bucket and audit rows record the wrong client. The host asked for
+	* proxy trust and got none, with no error.
+	*
+	* Warn rather than refuse: the app still serves, and a hard boot failure on
+	* a transitive `fastify` bump would be a harsher surprise than the one being
+	* reported. The replacement is named so the fix is a copy-paste.
+	*/
+	const numericTrustProxy = typeof config.trustProxy === "number";
 	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
 	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
 	const moduleHealthChecks = collectModuleHealthChecks(resolvedModules);
@@ -1869,11 +1953,19 @@ async function buildApp(options, onInstance) {
 		} }
 	});
 	onInstance(fastify);
-	if (resolvedLogger !== false) configureArcLogger({
-		...options.debug !== void 0 && options.debug !== false ? { debug: options.debug } : {},
-		writer: createPinoWriter(fastify.log)
+	if (resolvedLogger !== false) {
+		const writer = createPinoWriter(fastify.log);
+		loggerScope.writer = writer;
+		configureArcLogger({
+			...options.debug !== void 0 && options.debug !== false ? { debug: options.debug } : {},
+			writer
+		});
+	}
+	fastify.addHook("onRequest", (_request, _reply, done) => {
+		enterArcLoggerScope(loggerScope, done);
 	});
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
+	if (numericTrustProxy) fastify.log.warn(`[arc] trustProxy: ${String(config.trustProxy)} (a hop COUNT) trusts nothing on Fastify >= 5.12.1 — hop-count trust cannot validate the immediate peer, so it fails closed upstream to stop clients spoofing X-Forwarded-* with padded hops. \`request.ip\` is therefore the PROXY's address: rate-limit keys collapse onto one bucket and audit rows record the wrong client. Name the proxies instead — trustProxy: 'loopback', '10.0.0.0/8', a comma-separated list, or \`true\` if every upstream hop is genuinely trusted.`);
 	if (inheritedTrustProxyDefault) fastify.log.warn("[arc] preset: 'production' now defaults to trustProxy: false (fail-closed; was true before 2.24). If this app runs behind a load balancer or reverse proxy, request.ip is currently the PROXY's address — rate-limit keys collapse onto one bucket and audit logs record the wrong client. Set trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or false if clients truly connect directly.");
 	fastify.removeContentTypeParser("application/json");
 	fastify.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
@@ -1907,7 +1999,7 @@ async function buildApp(options, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-BSBVCwL3.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-BN16KPHr.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {
@@ -1959,4 +2051,48 @@ const ArcFactory = {
 	}
 };
 //#endregion
-export { collectModuleScheduledJobs as _, developmentPreset as a, resolveModule as b, productionPreset as c, getModuleState as d, hasModule as f, collectModuleHealthChecks as g, describeResolvedModule as h, createApp_exports as i, testingPreset as l, subscribeModuleEventHandlers as m, DEFAULT_LOGGER_REDACT_PATHS as n, edgePreset as o, orderModules as p, createApp as r, getPreset as s, ArcFactory as t, workerPreset as u, collectModuleWorkflows as v, resolveContribution as y };
+//#region src/factory/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { resolveModule as S, describeResolvedModule as _, createApp as a, collectModuleWorkflows as b, edgePreset as c, testingPreset as d, workerPreset as f, subscribeModuleEventHandlers as g, orderModules as h, DEFAULT_LOGGER_REDACT_PATHS as i, getPreset as l, hasModule as m, preloadResourcesAsync as n, createApp_exports as o, getModuleState as p, ArcFactory as r, developmentPreset as s, preloadResources as t, productionPreset as u, collectModuleHealthChecks as v, resolveContribution as x, collectModuleScheduledJobs as y };

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
 
-import { i as RequestScope } from "../types-ChuShpCP.mjs";
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { Y as PresetResult } from "../index-BcR2bFZQ.mjs";
+import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
+import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
+import { Y as PresetResult } from "../index-C01wWGJt.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { c as getOrgId, g as getUserId } from "../types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-CP47jdi7.mjs";
-import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-DDKni6Tz.mjs";
+import { c as getOrgId, g as getUserId } from "../types-B8lwJv9Q.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-DgPrZsJh.mjs";
+import { t as multipartBody } from "../multipartBody-Bi5yqW0M.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/presets/index.d.mts

@@ -1,6 +1,6 @@
 
-import { t as AnyRecord } from "../base-Csjc2oF-.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-BcR2bFZQ.mjs";
+import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-C01wWGJt.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BAPijK_A.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CsGg8B58.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,5 +1,5 @@
 
-import { X as CrudRouteKey, Y as PresetResult } from "../index-BcR2bFZQ.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-C01wWGJt.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import "../constants-BxCoxmiN.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CoqIRrkY.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import "../constants-DUoKAGYD.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-B8lwJv9Q.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-BcR2bFZQ.mjs";
+import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
+import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-C01wWGJt.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes
@@ -23,55 +23,17 @@ import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt a
  * GET-based autocomplete, pass `path`/`method` overrides or use `routes` for
  * fully bespoke endpoints.
  *
- * @example MongoKit wiring (elasticSearchPlugin + vectorPlugin)
- * ```typescript
- * import { Repository, methodRegistryPlugin, elasticSearchPlugin } from '@classytic/mongokit';
- * import { vectorPlugin } from '@classytic/mongokit/ai';
- * import { searchPreset } from '@classytic/arc/presets/search';
- *
- * const productRepo = new Repository(Product, [
- *   methodRegistryPlugin(),
- *   elasticSearchPlugin({ client: esClient, indexName: 'products' }),
- *   vectorPlugin({ fields: [{ path: 'embedding', dimensions: 1536 }], embedFn }),
- * ]);
- *
- * defineResource({
- *   name: 'product',
- *   adapter: createMongooseAdapter({ model: Product, repository: productRepo }),
- *   presets: [
- *     searchPreset({
- *       search:  { handler: (req) => productRepo.search(req.body.query, req.body) },
- *       similar: { handler: (req) => productRepo.searchSimilar(req.body.query, req.body) },
- *     }),
- *   ],
- * });
- * ```
- *
- * @example Custom vector backend (Pinecone)
+ * @example
  * ```typescript
  * searchPreset({
+ *   search:  { handler: (req) => repo.search(req.body.query, req.body) },
  *   similar: {
- *     path: '/vector-search',                 // custom path
- *     handler: async (req) => {
- *       const hits = await pinecone.query({
- *         vector: req.body.vector,
- *         topK: req.body.topK ?? 10,
- *       });
- *       return hits.matches;
- *     },
- *     schema: { body: { type: 'object', properties: { vector: { type: 'array' }, topK: { type: 'integer' } } } },
- *     mcp: false,                             // no MCP tool for this one
+ *     path: '/vector-search',   // override the default path
+ *     mcp: false,               // and skip the MCP tool for this one
+ *     handler: (req) => pinecone.query({ vector: req.body.vector }),
  *   },
- *   // Extra app-specific route
- *   routes: [
- *     {
- *       method: 'GET',
- *       path: '/autocomplete',
- *       handler: async (req) => algolia.suggest(req.query.q as string),
- *       permissions: allowPublic(),
- *     },
- *   ],
- * });
+ *   routes: [{ method: 'GET', path: '/autocomplete', handler, permissions }],
+ * })
  * ```
  */
 /**

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-DgPrZsJh.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-BAPijK_A.mjs → presets-CsGg8B58.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-Cd_yy7aW.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-DDKni6Tz.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-B8lwJv9Q.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-DgPrZsJh.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{projection-BKM0Ui-s.mjs → projection-koISNyQo.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CoqIRrkY.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-B8lwJv9Q.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{queryCachePlugin-DhsZ0ZIc.mjs → queryCachePlugin-DHueQT9O.mjs}

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { t as hasEvents } from "./typeGuards-jjKJDN13.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-WeKvY1dE.mjs";
-import { t as MemoryCacheStore } from "./memory-qYSB7rMQ.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
+import { t as hasEvents } from "./typeGuards-IE1laMDf.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-BcNl12HN.mjs";
+import { t as MemoryCacheStore } from "./memory-BU-C-MV3.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/{rateLimitKey-XngqVNEV.mjs → rateLimitKey-Bma8VXDO.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/{realtime-G1TC6Yzc.mjs → realtime-BBoC91Bz.mjs}

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { c as getOrgId } from "./types-CoqIRrkY.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";
-import { t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-DsT1B5zJ.mjs";
-import { t as openSseStream } from "./sseStream-Bvpi-UXQ.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-EsiY3nUu.mjs";
+import { n as getUserRoles } from "./userHelpers-xQAi5bPF.mjs";
+import { c as getOrgId } from "./types-B8lwJv9Q.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-_9NAMHUD.mjs";
+import { t as applyFieldReadPermissions } from "./fields-DdP225wt.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-CiTJW8kZ.mjs";
+import { t as openSseStream } from "./sseStream-BMHTLlhR.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({