@classytic/arc 2.8.5 → 2.10.3

package/dist/cli/commands/describe.mjs

@@ -1,4 +1,4 @@
-import { t as CRUD_OPERATIONS } from "../../constants-Cxde4rpC.mjs";
+import { t as CRUD_OPERATIONS } from "../../constants-BhY1OHoH.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,5 @@
-import { t as ResourceRegistry } from "../../ResourceRegistry-C6uXlWe3.mjs";
-import { t as buildOpenApiSpec } from "../../openapi-CbKUJY_m.mjs";
+import { t as ResourceRegistry } from "../../ResourceRegistry-BPd6NQDm.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-B5F8AddX.mjs";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/generate.mjs

@@ -1,4 +1,4 @@
-import { t as pluralize } from "../../pluralize-CWP6MB39.mjs";
+import { t as pluralize } from "../../pluralize-A0tWEl1K.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate.ts

package/dist/cli/commands/init.mjs

@@ -102,7 +102,7 @@ async function installDependencies(projectPath, config, pm) {
 	];
 	if (config.auth === "better-auth") deps.push("better-auth@^1.6.0", "mongodb@latest");
 	else deps.push("@fastify/jwt@latest", "bcryptjs@latest");
-	if (config.adapter === "mongokit") deps.push("@classytic/mongokit@^3.5.5", "mongoose@^9.4.1");
+	if (config.adapter === "mongokit") deps.push("@classytic/mongokit@^3.10.2", "@classytic/repo-core@^0.1.0", "mongoose@^9.4.1");
 	const devDeps = ["vitest@latest", "pino-pretty@latest"];
 	if (config.typescript) devDeps.push("typescript@latest", "@types/node@latest", "tsx@latest");
 	const installCmd = getInstallCommand(pm, deps, false);

package/dist/cli/commands/introspect.mjs

@@ -1,4 +1,4 @@
-import { t as ResourceRegistry } from "../../ResourceRegistry-C6uXlWe3.mjs";
+import { t as ResourceRegistry } from "../../ResourceRegistry-BPd6NQDm.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/introspect.ts

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { At as BaseController, Ft as BodySanitizerConfig, It as AccessControl, Jt as defineResource, Lt as AccessControlConfig, Mt as QueryResolver, Nt as QueryResolverConfig, Pt as BodySanitizer, jt as BaseControllerOptions, qt as ResourceDefinition } from "../interface-CMRutPfe.mjs";
-import { A as MUTATION_OPERATIONS, C as HOOK_OPERATIONS, D as MAX_FILTER_DEPTH, E as HookPhase, M as RESERVED_QUERY_PARAMS, N as SYSTEM_FIELDS, O as MAX_REGEX_LENGTH, S as DEFAULT_UPDATE_METHOD, T as HookOperation, _ as DEFAULT_ID_FIELD, a as getControllerScope, b as DEFAULT_SORT, c as createCrudRouter, d as ActionRouterConfig, f as IdempotencyService, g as CrudOperation, h as CRUD_OPERATIONS, i as getControllerContext, j as MutationOperation, k as MAX_SEARCH_LENGTH, l as createPermissionMiddleware, m as createActionRouter, n as createFastifyHandler, o as sendControllerResponse, p as buildActionBodySchema, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as ActionHandler, v as DEFAULT_LIMIT, w as HOOK_PHASES, x as DEFAULT_TENANT_FIELD, y as DEFAULT_MAX_LIMIT } from "../index-DtDzOBn8.mjs";
-export { AccessControl, AccessControlConfig, ActionHandler, ActionRouterConfig, BaseController, BaseControllerOptions, BodySanitizer, BodySanitizerConfig, CRUD_OPERATIONS, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, IdempotencyService, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, buildActionBodySchema, createActionRouter, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };
+import { G as ResourceDefinition, K as defineResource, a as QueryResolverConfig, c as AccessControl, i as QueryResolver, l as AccessControlConfig, n as BaseController, o as BodySanitizer, r as BaseControllerOptions, s as BodySanitizerConfig } from "../index-Cl0uoKd5.mjs";
+import { C as MAX_REGEX_LENGTH, D as RESERVED_QUERY_PARAMS, E as MutationOperation, O as SYSTEM_FIELDS, S as MAX_FILTER_DEPTH, T as MUTATION_OPERATIONS, _ as DEFAULT_UPDATE_METHOD, a as getControllerScope, b as HookOperation, c as createCrudRouter, d as CrudOperation, f as DEFAULT_ID_FIELD, g as DEFAULT_TENANT_FIELD, h as DEFAULT_SORT, i as getControllerContext, l as createPermissionMiddleware, m as DEFAULT_MAX_LIMIT, n as createFastifyHandler, o as sendControllerResponse, p as DEFAULT_LIMIT, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as CRUD_OPERATIONS, v as HOOK_OPERATIONS, w as MAX_SEARCH_LENGTH, x as HookPhase, y as HOOK_PHASES } from "../index-8qw4y6ff.mjs";
+export { AccessControl, AccessControlConfig, BaseController, BaseControllerOptions, BodySanitizer, BodySanitizerConfig, CRUD_OPERATIONS, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,6 +1,4 @@
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-Cxde4rpC.mjs";
-import { i as AccessControl, n as QueryResolver, r as BodySanitizer, t as BaseController } from "../BaseController-DAGGc5Xn.mjs";
-import { n as createActionRouter, t as buildActionBodySchema } from "../createActionRouter-BORM8f17.mjs";
-import { c as createCrudHandlers, d as getControllerContext, f as getControllerScope, l as createFastifyHandler, n as defineResource, o as createCrudRouter, p as sendControllerResponse, s as createPermissionMiddleware, t as ResourceDefinition, u as createRequestContext } from "../defineResource-tcgySDo1.mjs";
-import { t as defineResourceVariants } from "../core-F0QoWBt2.mjs";
-export { AccessControl, BaseController, BodySanitizer, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, buildActionBodySchema, createActionRouter, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BhY1OHoH.mjs";
+import { i as AccessControl, n as QueryResolver, r as BodySanitizer, t as BaseController } from "../BaseController-CbKKIflT.mjs";
+import { c as createPermissionMiddleware, d as createRequestContext, f as getControllerContext, l as createCrudHandlers, m as sendControllerResponse, n as ResourceDefinition, p as getControllerScope, r as defineResource, s as createCrudRouter, t as defineResourceVariants, u as createFastifyHandler } from "../core-CcR01lup.mjs";
+export { AccessControl, BaseController, BodySanitizer, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };

package/dist/{defineResource-tcgySDo1.mjs → core-CcR01lup.mjs}

@@ -1,15 +1,15 @@
-import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-Cxde4rpC.mjs";
+import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-BhY1OHoH.mjs";
 import { _ as isElevated, n as PUBLIC_SCOPE, v as isMember } from "./types-AOD8fxIw.mjs";
-import { t as BaseController } from "./BaseController-DAGGc5Xn.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-ipsbIRPK.mjs";
-import { t as getUserRoles } from "./types-ZUu_h0jp.mjs";
-import { n as normalizePermissionResult, t as applyPermissionResult } from "./applyPermissionResult-D6GPMsvh.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-Y7nCYaLJ.mjs";
-import { t as requestContext } from "./requestContext-DYvHl113.mjs";
-import { i as getDefaultCrudSchemas } from "./utils-yYT3HDXt.mjs";
-import { r as ForbiddenError } from "./errors-BF2bIOIS.mjs";
-import { t as hasEvents } from "./typeGuards-CcFZXgU7.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-C2xgzW6x.mjs";
+import { t as BaseController } from "./BaseController-CbKKIflT.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-bxkeltzz.mjs";
+import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
+import { r as ForbiddenError } from "./errors-D5c-5BJL.mjs";
+import { t as requestContext } from "./requestContext-xHIKedG6.mjs";
+import { n as normalizePermissionResult, t as applyPermissionResult } from "./applyPermissionResult-QhV1Pa-g.mjs";
+import { i as getDefaultCrudSchemas } from "./utils-B2fNOD_i.mjs";
+import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-BxFDdtXu.mjs";
+import { t as hasEvents } from "./typeGuards-Cj5Rgvlg.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-fLJVXdVn.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.
@@ -387,24 +387,26 @@ function buildPermissionMiddleware(permissionCheck, resourceName, action) {
 	};
 }
 /**
-* Create additional routes from preset/custom definitions
+* Mount custom routes (from presets or user-defined `routes`) on Fastify.
+* `wrapHandler` is derived inline from `!route.raw`.
 */
-function createAdditionalRoutes(fastify, routes, controller, options) {
+function createCustomRoutes(fastify, routes, controller, options) {
 	const { tag, resourceName, arcDecorator, rateLimitConfig, cacheMw, idempotencyMw, pipeline, routeGuards } = options;
 	for (const route of routes) {
 		const opName = route.operation ?? (typeof route.handler === "string" ? route.handler : `${route.method.toLowerCase()}${route.path.replace(/[/:]/g, "_")}`);
+		const wrapHandler = !route.raw;
 		let handler;
 		if (typeof route.handler === "string") {
 			if (!controller) throw new Error(`Route ${route.method} ${route.path}: string handler '${route.handler}' requires a controller. Either provide a controller or use a function handler instead.`);
 			const method = controller[route.handler];
 			if (typeof method !== "function") throw new Error(`Handler '${route.handler}' not found on controller`);
 			const boundMethod = method.bind(controller);
-			if (route.wrapHandler) {
+			if (wrapHandler) {
 				const steps = pipeline ? resolvePipelineSteps(pipeline, opName) : [];
 				if (steps.length > 0) handler = createPipelineHandler(boundMethod, steps, opName, resourceName);
 				else handler = createFastifyHandler(boundMethod);
 			} else handler = boundMethod;
-		} else if (route.wrapHandler) {
+		} else if (wrapHandler) {
 			const steps = pipeline ? resolvePipelineSteps(pipeline, opName) : [];
 			if (steps.length > 0) handler = createPipelineHandler(route.handler, steps, opName, resourceName);
 			else handler = createFastifyHandler(route.handler);
@@ -480,7 +482,7 @@ function createPipelineHandler(controllerMethod, steps, operation, resourceName)
 * @param options - Router configuration
 */
 function createCrudRouter(fastify, controller, options = {}) {
-	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], additionalRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, updateMethod = DEFAULT_UPDATE_METHOD } = options;
+	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, updateMethod = DEFAULT_UPDATE_METHOD } = options;
 	const rateLimitConfig = buildRateLimitConfig(rateLimit);
 	const cacheMw = !(fastify.hasDecorator("queryCache") && controller && typeof controller._cacheConfig !== "undefined" && controller._cacheConfig !== void 0) && fastify.hasDecorator("responseCache") ? fastify.responseCache.middleware : null;
 	const idempotencyMw = fastify.hasDecorator("idempotency") ? fastify.idempotency.middleware : null;
@@ -646,7 +648,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 			});
 		}
 	}
-	if (additionalRoutes.length > 0) createAdditionalRoutes(fastify, additionalRoutes, controller, {
+	if (customRoutes.length > 0) createCustomRoutes(fastify, customRoutes, controller, {
 		tag,
 		resourceName,
 		arcDecorator,
@@ -706,7 +708,7 @@ function validateResourceConfig(config, options = {}) {
 		else if (!config.adapter.repository) errors.push({
 			field: "adapter.repository",
 			message: "Adapter must provide a repository",
-			suggestion: "Ensure your adapter returns a valid CrudRepository"
+			suggestion: "Ensure your adapter returns a valid StandardRepo (see @classytic/repo-core)"
 		});
 	} else if (!config.adapter && !config.routes?.length) warnings.push({
 		field: "config",
@@ -941,6 +943,7 @@ function defineResource(config) {
 			idField: resolvedConfig.idField,
 			matchesFilter: config.adapter?.matchesFilter,
 			cache: resolvedConfig.cache,
+			onFieldWriteDenied: resolvedConfig.onFieldWriteDenied,
 			presetFields: resolvedConfig._controllerOptions ? {
 				slugField: resolvedConfig._controllerOptions.slugField,
 				parentField: resolvedConfig._controllerOptions.parentField
@@ -1088,16 +1091,6 @@ var ResourceDefinition = class {
 	schemaOptions;
 	customSchemas;
 	permissions;
-	additionalRoutes;
-	/**
-	* Original v2.8 `routes` declaration — retained for downstream consumers
-	* (OpenAPI, MCP, registry, CLI introspect). Preserves fields dropped during
-	* normalization to `additionalRoutes` (notably `mcp`, `description`,
-	* `annotations`). Undefined when the resource was defined with the legacy
-	* `additionalRoutes` shape.
-	*
-	* Added in 2.8.1 — the source-of-truth fix for "canonical resource manifest".
-	*/
 	routes;
 	middlewares;
 	routeGuards;
@@ -1130,8 +1123,7 @@ var ResourceDefinition = class {
 		this.schemaOptions = config.schemaOptions ?? {};
 		this.customSchemas = config.customSchemas ?? {};
 		this.permissions = config.permissions ?? {};
-		this.routes = config.routes;
-		this.additionalRoutes = config.routes ? convertRoutesToAdditionalRoutes(config.routes) : [];
+		this.routes = config.routes ?? [];
 		this.middlewares = config.middlewares ?? {};
 		this.routeGuards = config.routeGuards;
 		this.disableDefaultRoutes = config.disableDefaultRoutes ?? false;
@@ -1150,7 +1142,6 @@ var ResourceDefinition = class {
 		this.queryParser = config.queryParser;
 		this._appliedPresets = config._appliedPresets ?? [];
 		this._pendingHooks = config._pendingHooks ?? [];
-		if (config.onRegister) this._onRegister = config.onRegister;
 	}
 	/** Get repository from adapter (if available) */
 	get repository() {
@@ -1166,7 +1157,7 @@ var ResourceDefinition = class {
 			const ctrl = this.controller;
 			for (const method of enabledCrudRoutes) if (typeof ctrl[method] !== "function") errors.push(`CRUD method '${method}' not found on controller`);
 		}
-		for (const route of this.additionalRoutes) if (typeof route.handler === "string") {
+		for (const route of this.routes) if (typeof route.handler === "string") {
 			if (!this.controller) errors.push(`Route ${route.method} ${route.path}: string handler '${route.handler}' requires a controller`);
 			else if (typeof this.controller[route.handler] !== "function") errors.push(`Route ${route.method} ${route.path}: handler '${route.handler}' not found`);
 		}
@@ -1207,8 +1198,6 @@ var ResourceDefinition = class {
 			});
 			await fastify.register(async (instance) => {
 				const typedInstance = instance;
-				const onRegister = self._onRegister;
-				if (onRegister) await onRegister(instance);
 				let schemas = null;
 				const openApi = self._registryMeta?.openApiSchemas;
 				if (openApi && (!self.customSchemas || Object.keys(self.customSchemas).length === 0)) {
@@ -1281,14 +1270,13 @@ var ResourceDefinition = class {
 					schemas = schemas ?? {};
 					schemas.list = schemas.list ? deepMergeSchemas({ querystring: normalizedSchema }, schemas.list) : { querystring: normalizedSchema };
 				}
-				const resolvedRoutes = self.additionalRoutes;
 				createCrudRouter(typedInstance, self.controller, {
 					tag: self.tag,
 					schemas: schemas ?? void 0,
 					permissions: self.permissions,
 					middlewares: self.middlewares,
 					routeGuards: self.routeGuards,
-					additionalRoutes: resolvedRoutes,
+					routes: self.routes,
 					disableDefaultRoutes: self.disableDefaultRoutes,
 					disabledRoutes: self.disabledRoutes,
 					resourceName: self.name,
@@ -1299,7 +1287,7 @@ var ResourceDefinition = class {
 					fields: self.fields
 				});
 				if (self.actions && Object.keys(self.actions).length > 0) {
-					const { createActionRouter } = await import("./createActionRouter-BORM8f17.mjs").then((n) => n.r);
+					const { createActionRouter } = await import("./createActionRouter-Bp_5c_2b.mjs").then((n) => n.n);
 					createActionRouter(instance, normalizeActionsToRouterConfig(self.actions, self.actionPermissions, self.tag));
 				}
 				if (self.events && Object.keys(self.events).length > 0) typedInstance.log?.debug?.(`Resource '${self.name}' defined ${Object.keys(self.events).length} events`);
@@ -1366,29 +1354,6 @@ function capitalize(str) {
 	return str.charAt(0).toUpperCase() + str.slice(1);
 }
 /**
-* Convert v2.8 RouteDefinition[] to internal AdditionalRoute[] format.
-* The internal format is what createCrudRouter understands.
-*/
-function convertRoutesToAdditionalRoutes(routes) {
-	return routes.map((route) => ({
-		method: route.method,
-		path: route.path,
-		handler: route.handler,
-		permissions: route.permissions,
-		wrapHandler: !route.raw,
-		operation: route.operation,
-		summary: route.summary,
-		description: route.description,
-		tags: route.tags,
-		preHandler: route.preHandler,
-		preAuth: route.preAuth,
-		streamResponse: route.streamResponse,
-		schema: route.schema,
-		mcpHandler: route.mcpHandler,
-		mcp: route.mcp
-	}));
-}
-/**
 * Normalize ActionsMap into the ActionRouterConfig shape that createActionRouter expects.
 */
 function normalizeActionsToRouterConfig(actions, globalAuth, tag) {
@@ -1411,4 +1376,36 @@ function normalizeActionsToRouterConfig(actions, globalAuth, tag) {
 	};
 }
 //#endregion
-export { validateResourceConfig as a, createCrudHandlers as c, getControllerContext as d, getControllerScope as f, formatValidationErrors as i, createFastifyHandler as l, pipe as m, defineResource as n, createCrudRouter as o, sendControllerResponse as p, assertValidConfig as r, createPermissionMiddleware as s, ResourceDefinition as t, createRequestContext as u };
+//#region src/core/defineResourceVariants.ts
+/**
+* Define multiple resources from a shared base config and per-variant overrides.
+*
+* Each variant is independently passed through `defineResource()` — the
+* returned `ResourceDefinition`s are real, fully-registered resources.
+* Register each one's plugin in your app:
+*
+* ```typescript
+* await app.register(articlePublic.toPlugin());
+* await app.register(articleAdmin.toPlugin());
+* ```
+*
+* @param base    Shared config — adapter, queryParser, schemaOptions, hooks, etc.
+*                Must NOT include `name` or `prefix` (those are per-variant).
+* @param variants  Map of variant key → override. Each variant must declare
+*                  its own `name` and `prefix`. Other fields override the base.
+* @returns A record where each key from `variants` maps to a real
+*          `ResourceDefinition` ready for `.toPlugin()` registration.
+*/
+function defineResourceVariants(base, variants) {
+	const out = {};
+	for (const key of Object.keys(variants)) {
+		const override = variants[key];
+		out[key] = defineResource({
+			...base,
+			...override
+		});
+	}
+	return out;
+}
+//#endregion
+export { formatValidationErrors as a, createPermissionMiddleware as c, createRequestContext as d, getControllerContext as f, pipe as h, assertValidConfig as i, createCrudHandlers as l, sendControllerResponse as m, ResourceDefinition as n, validateResourceConfig as o, getControllerScope as p, defineResource as r, createCrudRouter as s, defineResourceVariants as t, createFastifyHandler as u };

package/dist/{createActionRouter-BORM8f17.mjs → createActionRouter-Bp_5c_2b.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { n as normalizePermissionResult, t as applyPermissionResult } from "./applyPermissionResult-D6GPMsvh.mjs";
-import { a as toJsonSchema } from "./schemaConverter-Y7nCYaLJ.mjs";
+import { n as normalizePermissionResult, t as applyPermissionResult } from "./applyPermissionResult-QhV1Pa-g.mjs";
+import { a as toJsonSchema } from "./schemaConverter-BxFDdtXu.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -246,4 +246,4 @@ function buildActionDescription(actions, actionPermissions) {
 	return lines.join("\n");
 }
 //#endregion
-export { createActionRouter as n, createActionRouter_exports as r, buildActionBodySchema as t };
+export { createActionRouter_exports as n, buildActionBodySchema as t };

package/dist/{createApp-B1EY8zxa.mjs → createApp-BuvPma24.mjs}

@@ -207,7 +207,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-CDjVTM82.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-DCUjuiQT.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -243,15 +243,15 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 		trackPlugin("arc-graceful-shutdown");
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-IMuYVjTL.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-CBpK_SCM.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-BH-fidlv.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-DQCEfJis.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-Cp7_cAko.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-B5Amv9A1.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -260,19 +260,19 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-Ad7ypl9e.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-yBCgOLGu.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-B-PU4-Yu.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-DuhiSEZI.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-CDugduqI.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-C2U_bLY0.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -340,7 +340,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-DtFxrG0s.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-C7hgL_aI.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -350,7 +350,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-f869_8PQ.mjs").then((n) => n.n);
+	const { errorHandlerPlugin } = await import("./errorHandler-Bb49BvPD.mjs").then((n) => n.r);
 	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
@@ -417,7 +417,7 @@ async function registerResources(fastify, config) {
 		fastify.log.debug(`${config.bootstrap.length} bootstrap function(s) executed`);
 	}
 	if (!config.resources?.length && config.resourceDir) {
-		const { loadResources } = await import("./loadResources-PWd0OCpV.mjs").then((n) => n.n);
+		const { loadResources } = await import("./loadResources-BAzJItAJ.mjs").then((n) => n.n);
 		const { resolve } = await import("node:path");
 		const dir = resolve(config.resourceDir);
 		config = {
@@ -643,14 +643,14 @@ function validateDistributedRuntime(options) {
 	if (!events || MEMORY_STORE_NAMES.has(events.name)) missing.push("events transport");
 	if (options.arcPlugins?.caching) {
 		const cache = options.stores?.cache;
-		if (!cache || MEMORY_STORE_NAMES.has(cache.name)) missing.push("cache store");
+		if (!cache || cache.name !== void 0 && MEMORY_STORE_NAMES.has(cache.name)) missing.push("cache store");
 	}
 	const idempotency = options.stores?.idempotency;
 	if (idempotency && MEMORY_STORE_NAMES.has(idempotency.name)) missing.push("idempotency store (memory-backed in distributed mode)");
 	else if (!idempotency) deferredWarnings.push("runtime: 'distributed' — no idempotency store configured. Write-path deduplication will be instance-local. If resources use the idempotency plugin, provide stores.idempotency with a Redis/MongoDB store.");
 	if (options.arcPlugins?.queryCache) {
 		const qc = options.stores?.queryCache;
-		if (!qc || MEMORY_STORE_NAMES.has(qc.name)) missing.push("queryCache store");
+		if (!qc || qc.name !== void 0 && MEMORY_STORE_NAMES.has(qc.name)) missing.push("queryCache store");
 	}
 	if (missing.length > 0) throw new Error(`[Arc] runtime: 'distributed' requires Redis/durable adapters.\nMissing: ${missing.join(", ")}.\nProvide Redis-backed stores or use runtime: 'memory' for development.`);
 	return deferredWarnings;
@@ -676,7 +676,7 @@ function validateDistributedRuntime(options) {
 */
 async function createApp(options) {
 	if (options.debug !== void 0 && options.debug !== false) {
-		const { configureArcLogger } = await import("./logger-D1YrIImS.mjs").then((n) => n.r);
+		const { configureArcLogger } = await import("./logger-DLg8-Ueg.mjs").then((n) => n.r);
 		configureArcLogger({ debug: options.debug });
 	}
 	validateAuthOptions(options);
@@ -688,6 +688,7 @@ async function createApp(options) {
 	const fastify = Fastify({
 		logger: config.logger ?? true,
 		trustProxy: config.trustProxy ?? false,
+		pluginTimeout: config.pluginTimeout ?? 1e4,
 		routerOptions: { querystringParser: (str) => qs.parse(str) },
 		ajv: { customOptions: {
 			coerceTypes: true,
@@ -729,7 +730,7 @@ async function createApp(options) {
 	await registerErrorHandler(fastify, config, trackPlugin);
 	await registerResources(fastify, config);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-CxkYGT81.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-CXtJDAZ0.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) fastify.addHook("preSerialization", async (_request, _reply, payload) => {

package/dist/docs/index.d.mts

@@ -1,5 +1,5 @@
-import { it as RegistryEntry } from "../interface-CMRutPfe.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BnkYrNzp.mjs";
+import { x as RegistryEntry } from "../index-Cl0uoKd5.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-BQ8QijNH.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/docs/openapi.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
-import { t as getUserRoles } from "../types-ZUu_h0jp.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-CbKUJY_m.mjs";
+import { t as getUserRoles } from "../types-DV9WDfeg.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-B5F8AddX.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{elevation-DtFxrG0s.mjs → elevation-C7hgL_aI.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { t as getUserRoles } from "./types-ZUu_h0jp.mjs";
-import { t as arcLog } from "./logger-D1YrIImS.mjs";
+import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
+import { t as arcLog } from "./logger-DLg8-Ueg.mjs";
 import fp from "fastify-plugin";
 //#region src/scope/elevation.ts
 var elevation_exports = /* @__PURE__ */ __exportAll({
@@ -57,13 +57,27 @@ const elevationPlugin = async (fastify, opts = {}) => {
 			userId,
 			organizationId: orgId
 		});
-		if (onElevation) try {
-			await onElevation({
-				userId,
-				organizationId: orgId || void 0,
-				request,
-				timestamp: /* @__PURE__ */ new Date()
+		const event = {
+			userId,
+			organizationId: orgId || void 0,
+			request,
+			timestamp: /* @__PURE__ */ new Date()
+		};
+		const publish = fastify.events?.publish;
+		if (publish) try {
+			await publish("arc.scope.elevated", {
+				userId: event.userId,
+				organizationId: event.organizationId,
+				route: request.routeOptions?.url ?? request.url,
+				method: request.method,
+				requestId: request.id,
+				timestamp: event.timestamp.toISOString()
 			});
+		} catch (err) {
+			log.warn("Failed to publish arc.scope.elevated event", { error: err instanceof Error ? err.message : String(err) });
+		}
+		if (onElevation) try {
+			await onElevation(event);
 		} catch {
 			log.warn("onElevation callback threw — continuing request");
 		}

package/dist/{errorHandler-f869_8PQ.mjs → errorHandler-Bb49BvPD.mjs}

@@ -1,11 +1,61 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { p as isArcError } from "./errors-BF2bIOIS.mjs";
+import { p as isArcError } from "./errors-D5c-5BJL.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/errorHandler.ts
-var errorHandler_exports = /* @__PURE__ */ __exportAll({ errorHandlerPlugin: () => errorHandlerPlugin });
+var errorHandler_exports = /* @__PURE__ */ __exportAll({
+	defaultIsDuplicateKeyError: () => defaultIsDuplicateKeyError,
+	errorHandlerPlugin: () => errorHandlerPlugin
+});
+/**
+* Default duplicate-key detector covering the mainstream drivers arc sees
+* most. Detection is strictly by known driver codes — never by message
+* string matching — because false positives on dup-key silently mask real
+* errors (WriteConflict, NotWritablePrimary, etc.) as 409s. For long-tail
+* drivers (Neo4j, MSSQL, DynamoDB, custom kits), compose rather than
+* replace:
+*
+* ```ts
+* import { defaultIsDuplicateKeyError } from '@classytic/arc/plugins';
+*
+* errorHandler: {
+*   isDuplicateKeyError: (err) =>
+*     defaultIsDuplicateKeyError(err) || isNeo4jDupKey(err),
+* }
+* ```
+*
+* Drizzle apps get coverage transitively (Drizzle doesn't wrap driver
+* errors — pg/mysql2/better-sqlite3 codes propagate as-is). Neon is
+* Postgres-wire-compatible → `23505` covers `@neondatabase/serverless`.
+*/
+function defaultIsDuplicateKeyError(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (e.code === 11e3 || e.codeName === "DuplicateKey") return true;
+	if (e.code === "P2002") return true;
+	if (e.code === "23505") return true;
+	if (e.code === "ER_DUP_ENTRY" || e.errno === 1062) return true;
+	if (e.code === "SQLITE_CONSTRAINT_UNIQUE" || e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
+	return false;
+}
+/**
+* Extract the duplicate-field names for the `details.duplicateFields`
+* response. Only called when the caller has opted into detail exposure
+* (`includeStack: true`) — shape differs per driver.
+*/
+function extractDuplicateFields(err) {
+	if (!err || typeof err !== "object") return null;
+	const e = err;
+	if (e.keyValue && typeof e.keyValue === "object") return Object.keys(e.keyValue);
+	if (e.meta?.target) {
+		if (Array.isArray(e.meta.target)) return e.meta.target.map(String);
+		if (typeof e.meta.target === "string") return [e.meta.target];
+	}
+	if (typeof e.constraint === "string") return [e.constraint];
+	return null;
+}
 async function errorHandlerPluginFn(fastify, options = {}) {
 	const isProduction = process.env.NODE_ENV === "production";
-	const { includeStack = !isProduction, onError, errorMap = {}, errorMappers = [] } = options;
+	const { includeStack = !isProduction, onError, errorMap = {}, errorMappers = [], isDuplicateKeyError = defaultIsDuplicateKeyError } = options;
 	fastify.setErrorHandler(async (error, request, reply) => {
 		if (onError) try {
 			await onError(error, request);
@@ -75,12 +125,14 @@ async function errorHandlerPluginFn(fastify, options = {}) {
 			statusCode = 400;
 			response.code = "INVALID_ID";
 			response.error = "Invalid identifier format";
-		} else if (error.name === "MongoServerError" && error.code === 11e3) {
+		} else if (isDuplicateKeyError(error)) {
 			statusCode = 409;
 			response.code = "DUPLICATE_KEY";
 			response.error = "Resource already exists";
-			const keyValue = error.keyValue;
-			if (keyValue && includeStack) response.details = { duplicateFields: Object.keys(keyValue) };
+			if (includeStack) {
+				const duplicateFields = extractDuplicateFields(error);
+				if (duplicateFields && duplicateFields.length > 0) response.details = { duplicateFields };
+			}
 		}
 		if (includeStack && error.stack) response.stack = error.stack;
 		if (statusCode >= 500) request.log.error({
@@ -118,4 +170,4 @@ const errorHandlerPlugin = fp(errorHandlerPluginFn, {
 	fastify: "5.x"
 });
 //#endregion
-export { errorHandler_exports as n, errorHandlerPlugin as t };
+export { errorHandlerPlugin as n, errorHandler_exports as r, defaultIsDuplicateKeyError as t };