@classytic/arc 2.35.0 → 2.37.0

package/dist/{mcpPlugin-DkzZ7Nfx.mjs → mcpPlugin-dxMxBPIg.mjs}

@@ -1,18 +1,18 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-DYXBBgtg.mjs";
-import { p as isArcError, t as ArcError } from "./errors-CLid6atr.mjs";
-import { n as requireSingleHeaderValue } from "./headers-DODWf7aC.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-GY4kATJb.mjs";
-import { t as BaseController } from "./BaseController-C-pofd0v.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-UtpiJO5R.mjs";
-import { t as executePipeline } from "./pipe-DNOuCfAs.mjs";
-import { t as buildRequestScopeProjection } from "./projection-aevMua7Q.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-LFuOra7W.mjs";
-import { n as validateAggregations } from "./validate-dosAIvQU.mjs";
-import { n as executeAggregation } from "./buildHandler-Do9aMIvL.mjs";
-import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
-import { t as createIdempotencyResult } from "./interface-my7sxjw5.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-s3-ouZmP.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-DgyWdav8.mjs";
+import { p as isArcError, t as ArcError } from "./errors-DsdZc1Xv.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BFu1st_i.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-lDs9oF4z.mjs";
+import { t as BaseController } from "./BaseController-B5GZfUBy.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DvGz47Ul.mjs";
+import { t as executePipeline } from "./pipe-Dbs3GhOZ.mjs";
+import { t as buildRequestScopeProjection } from "./projection-BunxoeON.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-CQQrR4tu.mjs";
+import { n as validateAggregations } from "./validate-qK_-7MVk.mjs";
+import { n as executeAggregation } from "./buildHandler-D2DkqtiY.mjs";
+import { t as pluralize } from "./pluralize-DgaYX91M.mjs";
+import { t as createIdempotencyResult } from "./interface-CaPVHoVJ.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-BfI425RH.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/{memory-BwedEXau.mjs → memory-BnafVem_.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-5LNPvL3P.mjs → metrics-CeAIcVMY.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-C5K78SXo.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-C01wWGJt.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BhzLXCfN.mjs";
-import { t as multipartBody } from "../multipartBody-DjilSDAT.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-CUpamQMJ.mjs";
+import { t as multipartBody } from "../multipartBody-BVCoaTwu.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-5ESPMxp0.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-C5Ta_ImD.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-Bh5OC7ww.mjs → module-DIvG8qOg.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-DjilSDAT.mjs → multipartBody-BVCoaTwu.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-ItLH12_L.mjs → openapi-D_i6CifU.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-D2_bHGil.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-LFuOra7W.mjs";
-import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-EYWgd0ly.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DU_Z5OBA.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-C8zbW7tJ.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CQQrR4tu.mjs";
+import { t as pluralize } from "./pluralize-DgaYX91M.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-CwDU_j2S.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-GZU3LlzP.mjs";
-import { t as ArcModule } from "../types-DDD5RKTu.mjs";
+import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
+import { t as ArcModule } from "../types-BMa2EPtv.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-CLid6atr.mjs";
-import { t as defineResource } from "../defineResource-BOrGeocE.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-Bh5OC7ww.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-DsdZc1Xv.mjs";
+import { t as defineResource } from "../defineResource-WcbE1kJL.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-DIvG8qOg.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-b1TyDGGi.d.mts → outbox-module-BbdaMyqy.d.mts}

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-BEVP50ka.mjs";
-import { t as ArcModule } from "./types-DDD5RKTu.mjs";
+import { t as ArcModule } from "./types-BMa2EPtv.mjs";
 import { FastifyInstance } from "fastify";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 import { OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";

package/dist/{outbox-module-SGIZz6oS.mjs → outbox-module-CKaLL5BH.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "./transactionContext-BTZzEcRo.mjs";
-import { i as resolveEventTransport } from "./EventTransport-BrPeGUil.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-kIJCY0wI.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-Ca5peQpc.mjs";
+import { i as resolveEventTransport } from "./EventTransport-pGNNDQ__.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-bU8H5c-A.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-GZU3LlzP.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-C-NL2fTi.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-K7auNNW0.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BtYoMip1.mjs";
 export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-DYXBBgtg.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-AKcB4V03.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-UtpiJO5R.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-CpSBlFXZ.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-DgyWdav8.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DU_Z5OBA.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-DvGz47Ul.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-DWkl60hx.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-CpSBlFXZ.mjs → permissions-DWkl60hx.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-DYXBBgtg.mjs";
-import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-GY4kATJb.mjs";
-import { t as MemoryCacheStore } from "./memory-BwedEXau.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-DgyWdav8.mjs";
+import { n as getUserRoles } from "./userHelpers-DU_Z5OBA.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-lDs9oF4z.mjs";
+import { t as MemoryCacheStore } from "./memory-BnafVem_.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**
@@ -260,7 +260,8 @@ function allOf(...checks) {
 		});
 	};
 	const roleBranches = checks.filter((c) => (c._roles?.length ?? 0) > 0 || (c._orgRoles?.length ?? 0) > 0);
-	if (checks.length > 0 && checks.every((c) => c._isPublic)) check._isPublic = true;
+	if (checks.some((c) => c._isDenied)) check._isDenied = true;
+	else if (checks.length > 0 && checks.every((c) => c._isPublic)) check._isPublic = true;
 	else if (roleBranches.length === 1) {
 		const [rb] = roleBranches;
 		if (rb?._roles?.length) check._roles = [...rb._roles];
@@ -300,7 +301,8 @@ function anyOf(...checks) {
 		}
 		return deny(reasons.join("; "));
 	};
-	if (checks.some((c) => c._isPublic)) check._isPublic = true;
+	if (checks.length > 0 && checks.every((c) => c._isDenied)) check._isDenied = true;
+	else if (checks.some((c) => c._isPublic)) check._isPublic = true;
 	else if (checks.every((c) => (c._roles?.length ?? 0) > 0 || (c._orgRoles?.length ?? 0) > 0)) {
 		const roles = /* @__PURE__ */ new Set();
 		const orgRoles = /* @__PURE__ */ new Set();
@@ -344,7 +346,16 @@ function not(check, reason = "Access denied") {
 * ```
 */
 function denyAll(reason = "Access denied") {
-	return () => deny(reason);
+	const check = () => deny(reason);
+	/**
+	* MARKED, not bare. Introspection (`describePermission`) reads metadata, and a
+	* closure with none fell through to `{ kind: "authenticated" }` — publishing
+	* the library's most restrictive gate as "any signed-in user may do this".
+	* Enforcement was never wrong; the description was, in the direction that
+	* makes a UI offer an action nobody can perform.
+	*/
+	check._isDenied = true;
+	return check;
 }
 /**
 * Dynamic permission based on a condition function.
@@ -1068,6 +1079,7 @@ function createDynamicPermissionMatrix(config) {
 * fully captured statically carries `conditional: true` (see `_conditional`).
 */
 function describePermission(check) {
+	if (check._isDenied) return { kind: "denied" };
 	if (check._isPublic) return { kind: "public" };
 	const roles = [...check._roles ?? [], ...check._orgRoles ?? []];
 	const scope = check._scopeContext;
@@ -1100,6 +1112,17 @@ function describePermission(check) {
 */
 function explainAccess(check, principal) {
 	const requirement = describePermission(check);
+	/**
+	* DEFINITIVE, and checked before everything else. `denyAll()` is the one gate
+	* whose answer needs no principal and no request — reporting it as
+	* `conditional` (which "authenticated" does) tells a UI to render the action
+	* and find out later, and later is a 403 the user cannot act on.
+	*/
+	if (requirement.kind === "denied") return {
+		decision: "deny",
+		reason: "denied to everyone",
+		requirement
+	};
 	if (requirement.kind === "public") return {
 		decision: "allow",
 		reason: "public — no authentication required",
@@ -1594,6 +1617,10 @@ function introspectCheck(check) {
 		roles: req.roles ? [...req.roles] : [],
 		scope: { ...req.scope }
 	};
+	if (req.kind === "denied") return {
+		type: "denied",
+		roles: []
+	};
 	return {
 		type: "authenticated",
 		roles: []

package/dist/{pipe-DNOuCfAs.mjs → pipe-Dbs3GhOZ.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-CLid6atr.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-DsdZc1Xv.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,5 +1,5 @@
 
-import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-C5K78SXo.mjs";
+import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-C01wWGJt.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-DNOuCfAs.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-Dbs3GhOZ.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,9 +1,9 @@
 
-import { t as AnyRecord } from "../base-GZU3LlzP.mjs";
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-C5K78SXo.mjs";
+import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-C01wWGJt.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DI5AN2b5.mjs";
-import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-DDD5RKTu.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-CMMTL3cj.mjs";
+import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-BMa2EPtv.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-CdY8FINU.mjs";
 import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DEs-_hFi.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";

package/dist/plugins/index.mjs

@@ -1,20 +1,20 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { p as MUTATION_OPERATIONS } from "../constants-BhzLXCfN.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS } from "../constants-CUpamQMJ.mjs";
 import { arcLog } from "../logger/index.mjs";
-import { c as getOrgId } from "../types-GY4kATJb.mjs";
-import { n as requestContext } from "../requestContext-DzOUGNdY.mjs";
-import { t as hasEvents } from "../typeGuards-B-_jqaMi.mjs";
-import { t as HookSystem } from "../HookSystem-LlPm3Anm.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-yuD1Ra53.mjs";
-import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-_Zs3R_Sb.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-cN5X9VEL.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BbQ1nQdk.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-5LNPvL3P.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-Cfl2bVjj.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-2jfmMnnV.mjs";
-import { n as schedules_default, t as schedulesPlugin } from "../schedules-BLpZLWGF.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-DUIP1XH6.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-BbTs4pwM.mjs";
+import { c as getOrgId } from "../types-lDs9oF4z.mjs";
+import { n as requestContext } from "../requestContext-DGM7EZRI.mjs";
+import { t as hasEvents } from "../typeGuards-ALWme5WB.mjs";
+import { t as HookSystem } from "../HookSystem-CuhHvcyZ.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-DFOmazXg.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-Cc_sb94d.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-BmC2T-pX.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-CB75oY5i.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-CeAIcVMY.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-CiAp2-LH.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-D1k0wHoO.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-CVtolEa-.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-vRuwDd6N.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-Dtw0MyX4.mjs";
 import fp from "fastify-plugin";
 import { performance as performance$1 } from "node:perf_hooks";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/response-cache.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as hasEvents } from "../typeGuards-B-_jqaMi.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as hasEvents } from "../typeGuards-ALWme5WB.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -59,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.35.0";
+	const resolvedVersion = serviceVersion ?? "2.37.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-DGAQQKL8.mjs → pluralize-DgaYX91M.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-DYMzmUk1.mjs → preloadResources-BUoGKPaS.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
 import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-GY4kATJb.mjs";
-import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-BagWc3TI.mjs";
-import { t as createTenantKeyGenerator } from "./rateLimitKey-pyevMUVf.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-_Zs3R_Sb.mjs";
-import { t as parseJsonBody } from "./jsonBody-CVKA7C5m.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-Dh2BnzJf.mjs";
+import { n as PUBLIC_SCOPE } from "./types-lDs9oF4z.mjs";
+import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-c4Sc85X-.mjs";
+import { t as createTenantKeyGenerator } from "./rateLimitKey-DlqmDHA5.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-Cc_sb94d.mjs";
+import { t as parseJsonBody } from "./jsonBody-BuzxOZV8.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-BrcG3NlV.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
@@ -48,6 +48,56 @@ const PLUGIN_REGISTRY = {
 		optional: true
 	}
 };
+/**
+* Fail ONCE with every missing package, before any plugin registers.
+*
+* Without this the first absent package throws and the operator installs it,
+* restarts, hits the next one, and repeats — six restarts to discover a peer
+* set that was pruned as a unit. These are OPTIONAL peers of arc, so nothing
+* at install or build time says they are gone; the first signal is a boot
+* crash naming exactly one of them.
+*
+* Required-ness is read from `PLUGIN_REGISTRY` (`!optional`), never a second
+* list — a hand-maintained copy is what goes stale the day a plugin is added.
+* Optional plugins are deliberately NOT preflighted: their absence is a
+* supported configuration, and `loadPlugin` already warns and skips.
+*
+* A plugin the host disabled (`{ helmet: false }`) is not checked — refusing to
+* boot over a package for a plugin nobody asked for would be the opposite of
+* helpful.
+*/
+async function preflightPlugins(config, options = {}) {
+	const { load } = options;
+	const required = Object.entries(PLUGIN_REGISTRY).filter(([name, entry]) => !entry.optional && config[name] !== false);
+	const results = await Promise.allSettled(required.map(([name, entry]) => load ? load(name) : entry.loader()));
+	const missing = [];
+	for (const [i, result] of results.entries()) {
+		if (result.status === "fulfilled") continue;
+		const [name, entry] = required[i];
+		if (!isModuleNotFound(result.reason)) throw new Error(`Failed to load plugin '${name}': ${result.reason.message}`);
+		missing.push({
+			name,
+			package: entry.package
+		});
+	}
+	if (missing.length === 0) return;
+	const packages = missing.map((m) => m.package);
+	throw new Error(`arc cannot start: ${missing.length} required plugin package(s) are not installed.\n` + missing.map((m) => `  - ${m.package}  (plugin '${m.name}')`).join("\n") + `\n\nInstall all of them:\n  npm install ${packages.join(" ")}\n\nOr disable the plugins you do not need in createApp options: ` + missing.map((m) => `${m.name}: false`).join(", "));
+}
+/** Shared by the preflight and the per-plugin loader so they agree on what "missing" means. */
+function isModuleNotFound(err) {
+	/**
+	* CODE first, message second. Node sets `ERR_MODULE_NOT_FOUND` (ESM) or
+	* `MODULE_NOT_FOUND` (CJS) on a real resolution failure; the message text
+	* varies by Node version, loader and bundler, so matching it alone is a
+	* predicate that silently stops matching after an upgrade — and this one
+	* decides between "install a package" and "your plugin crashed".
+	*/
+	const code = err?.code;
+	if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") return true;
+	const m = err?.message ?? "";
+	return m.includes("Cannot find module") || m.includes("Cannot find package") || m.includes("MODULE_NOT_FOUND") || m.includes("Could not resolve");
+}
 async function loadPlugin(name, logger) {
 	const entry = PLUGIN_REGISTRY[name];
 	if (!entry) throw new Error(`Unknown plugin: ${name}`);
@@ -55,12 +105,12 @@ async function loadPlugin(name, logger) {
 		return await entry.loader();
 	} catch (error) {
 		const err = error;
-		const isModuleNotFound = err.message.includes("Cannot find module") || err.message.includes("Cannot find package") || err.message.includes("MODULE_NOT_FOUND") || err.message.includes("Could not resolve");
-		if (isModuleNotFound && entry.optional) {
+		const notFound = isModuleNotFound(err);
+		if (notFound && entry.optional) {
 			logger?.warn(`Optional plugin '${name}' skipped (${entry.package} not installed)`);
 			return null;
 		}
-		if (isModuleNotFound) throw new Error(`Plugin '${name}' requires package '${entry.package}' which is not installed.\nInstall it with: npm install ${entry.package}\nOr disable this plugin by setting ${name}: false in createApp options.`);
+		if (notFound) throw new Error(`Plugin '${name}' requires package '${entry.package}' which is not installed.\nInstall it with: npm install ${entry.package}\nOr disable this plugin by setting ${name}: false in createApp options.`);
 		throw new Error(`Failed to load plugin '${name}': ${err.message}`);
 	}
 }
@@ -801,7 +851,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-ClPn5kjn.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-DEIfV1iC.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
@@ -860,15 +910,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-cN5X9VEL.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-BmC2T-pX.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-BI7Z88Cx.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-BYqmg89O.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-BwedEXau.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-BnafVem_.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -878,7 +928,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-DUIP1XH6.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-vRuwDd6N.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -887,20 +937,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-Cfl2bVjj.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-CiAp2-LH.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-5LNPvL3P.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-CeAIcVMY.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-BbTs4pwM.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-Dtw0MyX4.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -977,7 +1027,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-tGIAldco.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-Bc6Gafv9.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -992,7 +1042,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-BbQ1nQdk.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-CB75oY5i.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1216,7 +1266,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-DdQb0qgV.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-CPlRWJCv.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1342,7 +1392,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-BLpZLWGF.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-CVtolEa-.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1552,6 +1602,11 @@ function compilePathMatcher(patterns) {
 * All enabled by default — set to `false` to opt out.
 */
 async function registerSecurityPlugins(fastify, config) {
+	/**
+	* Resolve every enabled plugin's package FIRST, so a pruned peer set is one
+	* error listing all of them rather than one restart per package.
+	*/
+	await preflightPlugins(config);
 	if (config.helmet !== false) {
 		const helmet = await loadPlugin("helmet");
 		await fastify.register(helmet, config.helmet ?? {});
@@ -1944,7 +1999,7 @@ async function buildApp(options, loggerScope, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-2jfmMnnV.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-D1k0wHoO.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {