@classytic/arc 2.38.0 → 2.40.0

package/dist/plugins/index.mjs

@@ -1,20 +1,20 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { p as MUTATION_OPERATIONS } from "../constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS } from "../constants-BQ2FbhPB.mjs";
 import { arcLog } from "../logger/index.mjs";
-import { c as getOrgId } from "../types-BqLyyH0o.mjs";
-import { n as requestContext } from "../requestContext-DpmntRZy.mjs";
-import { t as hasEvents } from "../typeGuards-DHTnEs5X.mjs";
-import { t as HookSystem } from "../HookSystem-C0ikzqQf.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-DPcX--zk.mjs";
-import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-Bh0N_FLk.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-a3ZEcJJs.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-BdmIWPba.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-CsWaIVTa.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-CPmjjgqd.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-BHebarf0.mjs";
-import { n as schedules_default, t as schedulesPlugin } from "../schedules-DthM8Qag.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-D4MYqkic.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-C2r0eOZ4.mjs";
+import { c as getOrgId } from "../types-CNQyOrLk.mjs";
+import { n as requestContext } from "../requestContext-D4PuGhEw.mjs";
+import { t as hasEvents } from "../typeGuards-t_CVgRXN.mjs";
+import { t as HookSystem } from "../HookSystem-96nzZLmk.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-B9WnuG2Q.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-BlGHjkqZ.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-Bqcn3Brl.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-By9keRvX.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-P37sNV5H.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-zzoNLDtj.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-9h-a592u.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-Dm21pqHU.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-DbyXoQun.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-BXwmj5SD.mjs";
 import fp from "fastify-plugin";
 import { performance as performance$1 } from "node:perf_hooks";
 //#region src/core/arcCorePlugin.ts
@@ -41,6 +41,7 @@ const arcCorePlugin = async (fastify, opts = {}) => {
 	]) if (!fastify.hasRequestDecorator(field)) fastify.decorateRequest(field, void 0);
 	fastify.addHook("onRequest", (request, _reply, done) => {
 		const store = {
+			kind: "request",
 			requestId: request.id,
 			startTime: performance.now()
 		};

package/dist/plugins/response-cache.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as hasEvents } from "../typeGuards-DHTnEs5X.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as hasEvents } from "../typeGuards-t_CVgRXN.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -59,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.38.0";
+	const resolvedVersion = serviceVersion ?? "2.40.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-Da7IT_qJ.mjs → pluralize-BaQ62hOW.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-DlhH81py.mjs → preloadResources-BAx5s9EF.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-BqLyyH0o.mjs";
-import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-D793Pxci.mjs";
-import { t as createTenantKeyGenerator } from "./rateLimitKey-CewdR-m6.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-Bh0N_FLk.mjs";
-import { t as parseJsonBody } from "./jsonBody-DVui0uJl.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-CBZOi6pk.mjs";
+import { n as PUBLIC_SCOPE } from "./types-CNQyOrLk.mjs";
+import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-Bo7rSKjm.mjs";
+import { n as isScopeAwareKeyGenerator, t as createTenantKeyGenerator } from "./rateLimitKey-umrS6-vu.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-BlGHjkqZ.mjs";
+import { t as parseJsonBody } from "./jsonBody-Dx6jH_Nb.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-KgVEcn8L.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
@@ -851,7 +851,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-DJwpGMzx.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-DB26V7uX.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
@@ -910,15 +910,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-a3ZEcJJs.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-Bqcn3Brl.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-oTsmVyEQ.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-2Pp9w-8D.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-BiPVaCPg.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-CNvjxzB2.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -928,7 +928,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-D4MYqkic.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-DbyXoQun.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -937,20 +937,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-CPmjjgqd.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-zzoNLDtj.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-CsWaIVTa.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-P37sNV5H.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-C2r0eOZ4.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-BXwmj5SD.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -1027,7 +1027,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-C6woysGC.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-CZy6n50b.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -1042,7 +1042,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-BdmIWPba.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-By9keRvX.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1266,7 +1266,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-CNd1DWnK.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-E5UFlRrT.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1392,7 +1392,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-DthM8Qag.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-Dm21pqHU.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1566,6 +1566,7 @@ function buildPlanOpts(rest, plan) {
 */
 function buildRateLimitOpts(input) {
 	const { skipPaths, allowList, plan, ...bare } = input;
+	applyScopeAwareHook(bare);
 	const rest = plan ? buildPlanOpts(bare, plan) : bare;
 	if (!skipPaths || skipPaths.length === 0) return allowList === void 0 ? rest : {
 		...rest,
@@ -1584,6 +1585,27 @@ function buildRateLimitOpts(input) {
 		allowList: combined
 	};
 }
+/**
+* A scope-keyed generator must run AFTER authentication, so arc places the hook itself.
+*
+* `@fastify/rate-limit` defaults to `onRequest`; arc authenticates in a `preHandler`. A
+* generator from `createTenantKeyGenerator` therefore saw `PUBLIC_SCOPE` and returned the
+* caller's IP for EVERY request — and behind a proxy with `trustProxy` unset that is one
+* address, so a whole deployment shared a single bucket. Nothing threw: the limiter ran,
+* the host's key function ran, and the answer was silently wrong.
+*
+* Defaulted rather than merely warned, because the correct value is knowable here and the
+* failure is unobservable in production. An explicit `onRequest` is REFUSED rather than
+* honoured — it cannot do what the caller is asking for.
+*/
+function applyScopeAwareHook(bare) {
+	if (!isScopeAwareKeyGenerator(bare.keyGenerator)) return;
+	if (bare.hook === void 0) {
+		bare.hook = "preHandler";
+		return;
+	}
+	if (bare.hook === "onRequest") throw new Error("[arc] rateLimit.hook: 'onRequest' cannot be combined with a scope-aware keyGenerator (createTenantKeyGenerator). Authentication runs in a preHandler, so the generator would see PUBLIC_SCOPE and key every caller by IP — behind a proxy that is one bucket for the whole deployment. Use hook: 'preHandler' (arc's default for this generator), or supply a keyGenerator that derives identity without the scope.");
+}
 function compilePathMatcher(patterns) {
 	const prefixes = [];
 	const exact = /* @__PURE__ */ new Set();
@@ -1738,6 +1760,17 @@ var createApp_exports = /* @__PURE__ */ __exportAll({
 	createApp: () => createApp,
 	resolveLoggerConfig: () => resolveLoggerConfig
 });
+/**
+* The fail-loud switches, and what each one costs while OFF.
+*
+* Every one is a SPECIFIC instruction defeated by a GENERAL default, which is
+* why they are reported together rather than one at a time.
+*/
+const STRICT_ENV_FLAGS = [
+	["ARC_STRICT_PERMISSIONS", "An ungated write route warns instead of failing boot."],
+	["ARC_STRICT_QUERY_PARAMS", "An unknown filter key is DROPPED, which WIDENS the read."],
+	["ARC_STRICT_IMMUTABLE_WRITES", "A PATCH of an immutable field returns 200, unchanged."]
+];
 const MEMORY_STORE_NAMES = /* @__PURE__ */ new Set(["memory", "memory-cache"]);
 /**
 * Default redact paths layered into Fastify's pino logger when the host
@@ -1967,6 +2000,22 @@ async function buildApp(options, loggerScope, onInstance) {
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
 	if (numericTrustProxy) fastify.log.warn(`[arc] trustProxy: ${String(config.trustProxy)} (a hop COUNT) trusts nothing on Fastify >= 5.12.1 — hop-count trust cannot validate the immediate peer, so it fails closed upstream to stop clients spoofing X-Forwarded-* with padded hops. \`request.ip\` is therefore the PROXY's address: rate-limit keys collapse onto one bucket and audit rows record the wrong client. Name the proxies instead — trustProxy: 'loopback', '10.0.0.0/8', a comma-separated list, or \`true\` if every upstream hop is genuinely trusted.`);
 	if (inheritedTrustProxyDefault) fastify.log.warn("[arc] preset: 'production' now defaults to trustProxy: false (fail-closed; was true before 2.24). If this app runs behind a load balancer or reverse proxy, request.ip is currently the PROXY's address — rate-limit keys collapse onto one bucket and audit logs record the wrong client. Set trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or false if clients truly connect directly.");
+	/**
+	* `preset: 'production'` REPORTS the fail-loud switches it cannot set.
+	*
+	* All three are read where the object is CONSTRUCTED — `defineResource` at
+	* define time, `QueryParser` and `BodySanitizer` in their constructors — and a
+	* host imports its resources before it calls `createApp`. So setting
+	* `process.env` here would be too late for everything already built: wired to
+	* read, doing nothing. Reporting cannot fail that way.
+	*
+	* Set them in the process entrypoint, BEFORE the first resource import, with
+	* `??=` so an operator's explicit `false` still wins.
+	*/
+	if (config.preset === "production") {
+		const off = STRICT_ENV_FLAGS.filter(([name]) => process.env[name] !== "true");
+		if (off.length > 0) fastify.log.warn(`[arc] preset: 'production' with fail-loud OFF: ${off.map(([n]) => n).join(", ")}. ${off.map(([, what]) => what).join(" ")} Set them in the entrypoint BEFORE any resource import — they are read when resources, parsers and sanitizers are CONSTRUCTED, so setting them later is silently too late. Per-resource options still override.`);
+	}
 	fastify.removeContentTypeParser("application/json");
 	fastify.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
 		try {
@@ -1999,7 +2048,7 @@ async function buildApp(options, loggerScope, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-BHebarf0.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-9h-a592u.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {

package/dist/{preloadResources-BbBkNkqK.d.mts → preloadResources-DVgPCNcD.d.mts}

@@ -1,15 +1,15 @@
 
-import { It as Authenticator } from "./index-B78WZom8.mjs";
+import { It as Authenticator } from "./index-D3sIPcD4.mjs";
 import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 import { n as ElevationOptions } from "./elevation-BXCfVcNG.mjs";
-import { a as EventTransport } from "./EventTransport-Cx60_s-6.mjs";
+import { a as EventTransport } from "./EventTransport-BPOQsEer.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
 import { r as QueryCachePluginOptions } from "./queryCachePlugin-BzqxconG.mjs";
-import { t as ErrorHandlerOptions } from "./errorHandler-DI5AN2b5.mjs";
-import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-BRU-Kd3t.mjs";
-import "./index-D2uIUSQk.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-DFvHa4Nf.mjs";
-import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-B843jOYX.mjs";
+import { t as ErrorHandlerOptions } from "./errorHandler--4rSMMvq.mjs";
+import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-BVlowlm7.mjs";
+import "./index-DbMglURO.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-DfHaKEWQ.mjs";
+import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-P3V6ATyC.mjs";
 import { r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
 //#region src/factory/types/assets.d.ts

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Y as PresetResult } from "../index-B78WZom8.mjs";
+import { Y as PresetResult } from "../index-D3sIPcD4.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-2ExmOgIJ.mjs";
-import { c as getOrgId, g as getUserId } from "../types-BqLyyH0o.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-H7Zcb82Z.mjs";
-import { t as multipartBody } from "../multipartBody-u6VrS_iH.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-BHD3L8of.mjs";
+import { c as getOrgId, g as getUserId } from "../types-CNQyOrLk.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-C0GpDsB_.mjs";
+import { t as multipartBody } from "../multipartBody-Bl_gU3Wg.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/presets/index.d.mts

@@ -1,6 +1,6 @@
 
 import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-B78WZom8.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-D3sIPcD4.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CNyfaxGL.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CAaqVVcW.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,5 +1,5 @@
 
-import { X as CrudRouteKey, Y as PresetResult } from "../index-B78WZom8.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-D3sIPcD4.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:

package/dist/presets/multiTenant.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import "../constants-BONghE1Y.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-BqLyyH0o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import "../constants-BQ2FbhPB.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CNQyOrLk.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.d.mts

@@ -1,6 +1,6 @@
 
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-B78WZom8.mjs";
+import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-D3sIPcD4.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-C0GpDsB_.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-CNyfaxGL.mjs → presets-CAaqVVcW.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-2ExmOgIJ.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-BqLyyH0o.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-BHD3L8of.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CNQyOrLk.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-C0GpDsB_.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{projection-DSfEoooA.mjs → projection-qbCOEvsh.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-BqLyyH0o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CNQyOrLk.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{queryCachePlugin-oTsmVyEQ.mjs → queryCachePlugin-2Pp9w-8D.mjs}

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-BSuxGS-B.mjs";
-import { t as hasEvents } from "./typeGuards-DHTnEs5X.mjs";
-import { t as MemoryCacheStore } from "./memory-BiPVaCPg.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-Ds3ekBiu.mjs";
+import { t as hasEvents } from "./typeGuards-t_CVgRXN.mjs";
+import { t as MemoryCacheStore } from "./memory-CNvjxzB2.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {

package/dist/rateLimitKey-umrS6-vu.mjs

@@ -0,0 +1,41 @@
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+//#region src/scope/rateLimitKey.ts
+/**
+* Marks a key generator as SCOPE-AWARE, so `buildRateLimitOpts` can place the rate-limit
+* hook after authentication instead of before it.
+*
+* Without this, the degradation is invisible: `@fastify/rate-limit` runs at `onRequest`,
+* arc authenticates in a `preHandler`, so a scope-keyed generator sees `PUBLIC_SCOPE`,
+* returns the IP for every caller, and — behind a proxy — buckets an entire deployment
+* together. Nothing throws; the limiter simply answers a question nobody asked.
+*
+* `Symbol.for` so the marker survives two copies of arc in one tree.
+*/
+const SCOPE_AWARE_KEY_GENERATOR = Symbol.for("arc.rateLimit.scopeAwareKeyGenerator");
+/** True when this generator needs a resolved scope (see the symbol's docblock). */
+function isScopeAwareKeyGenerator(fn) {
+	return typeof fn === "function" && fn[SCOPE_AWARE_KEY_GENERATOR] === true;
+}
+function createTenantKeyGenerator(opts) {
+	const generator = opts?.strategy ?? defaultTenantStrategy;
+	/**
+	* Wrapped rather than tagged in place: a host's `strategy` is its own function, and
+	* stamping a symbol onto it would mutate a value it may reuse elsewhere.
+	*/
+	const tagged = (ctx) => generator(ctx);
+	Object.defineProperty(tagged, SCOPE_AWARE_KEY_GENERATOR, {
+		value: true,
+		enumerable: false
+	});
+	return tagged;
+}
+function defaultTenantStrategy(ctx) {
+	const scope = ctx.scope;
+	if (!scope || scope.kind === "public") return ctx.ip;
+	if (scope.kind === "member") return scope.organizationId;
+	if (scope.kind === "service") return scope.organizationId;
+	if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
+	return scope.userId ?? ctx.ip;
+}
+//#endregion
+export { isScopeAwareKeyGenerator as n, createTenantKeyGenerator as t };

package/dist/{realtime-CPmjjgqd.mjs → realtime-zzoNLDtj.mjs}

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-BP8GHtjc.mjs";
-import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
-import { c as getOrgId } from "./types-BqLyyH0o.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-B7qVjQBv.mjs";
-import { t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-DkpW1HwJ.mjs";
-import { t as openSseStream } from "./sseStream-BuMNPR6r.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-D_LFvMlm.mjs";
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
+import { c as getOrgId } from "./types-CNQyOrLk.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cldubvul.mjs";
+import { t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-CFwCzEvU.mjs";
+import { t as openSseStream } from "./sseStream-BfZtL5-m.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({

package/dist/{redis-stream-eh0eOtjh.d.mts → redis-stream-DSsPyYzd.d.mts}

@@ -1,5 +1,5 @@
 
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-Cx60_s-6.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-BPOQsEer.mjs";
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {
   xadd(key: string, id: string, ...fieldValues: string[]): Promise<string | null>;
@@ -232,8 +232,13 @@ declare class RedisStreamTransport implements EventTransport {
   private processEntries;
   private claimPending;
   private processEntry;
+  /**
+   * The canonical matcher from primitives — the SAME glob rules the memory
+   * transport speaks. A private matcher here once accepted `prefix.*` but not
+   * `prefix:*`, so an `order:*` subscription that worked in-process received
+   * nothing after a move to the stream, with no error.
+   */
   private getMatchingHandlers;
-  private matchesPattern;
   private moveToDlq;
   /**
    * Reconstruct a `DeadLetteredEvent` for a message id. Reads the original

package/dist/{registerRoute-XvcI_3sh.mjs → registerRoute-_6zHiz0x.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-BP8GHtjc.mjs";
-import { f as createError } from "./errors-2ExmOgIJ.mjs";
-import { u as getRequestScope } from "./types-BqLyyH0o.mjs";
-import { r as deriveHiddenFieldPermissions } from "./fields-Cha2QCKH.mjs";
-import { n as requestContext } from "./requestContext-DpmntRZy.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-D_LFvMlm.mjs";
+import { f as createError } from "./errors-BHD3L8of.mjs";
+import { u as getRequestScope } from "./types-CNQyOrLk.mjs";
+import { r as deriveHiddenFieldPermissions } from "./fields-fA-Dkou5.mjs";
+import { n as requestContext } from "./requestContext-D4PuGhEw.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.

package/dist/registry/index.d.mts

@@ -1,6 +1,6 @@
 
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-B78WZom8.mjs";
-import "../fastify-augmentation-jYA2oHyL.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-D3sIPcD4.mjs";
+import "../fastify-augmentation-HncZMmze.mjs";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 import { FastifyPluginAsync } from "fastify";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-UFEJQN8R.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-DPcX--zk.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-CEpoRpLP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-B9WnuG2Q.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-UFEJQN8R.mjs → registry-CEpoRpLP.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "./constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-BQ2FbhPB.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**

package/dist/{renewingLease-DuRGVOMe.mjs → renewingLease-B5Grm0pI.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the

package/dist/{replyHelpers-BHebarf0.mjs → replyHelpers-9h-a592u.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{requestContext-DpmntRZy.mjs → requestContext-D4PuGhEw.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**

package/dist/{rolldown-runtime-Add2L50I.mjs → rolldown-runtime-DzE6ikSH.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{runtimeCapabilities-D793Pxci.mjs → runtimeCapabilities-Bo7rSKjm.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/runtimeCapabilities.ts
 /**
 * `Symbol.for` so declarations from two arc copies in one dependency graph