@classytic/arc 2.17.1 → 2.18.0

package/dist/{BaseController-CgHomZ4d.mjs → BaseController-DPwe89qs.mjs}

@@ -3,7 +3,7 @@ import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
 import { b as isElevated, c as getOrgId } from "./types-Bi0r0vjG.mjs";
 import { I as simpleEqualityMatcher, b as ArcQueryParser, o as scheduleBackground, t as getUserId } from "./utils-BMQK8mRl.mjs";
-import { w as BodySanitizer } from "./routerShared-nCyJGOKX.mjs";
+import { w as BodySanitizer } from "./routerShared-Dl0A77Ba.mjs";
 import { t as buildQueryKey } from "./keys-DopsCuyQ.mjs";
 //#region src/core/AccessControl.ts
 const log = arcLog("access-control");

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-DKDs9NfD.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-CLZx9bwS.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DCjYMgfC.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-DYzfniuX.mjs";
+import { t as init } from "../../init-DQ_rY1J7.mjs";
 export { init };

package/dist/cli/index.mjs

@@ -2,6 +2,6 @@ import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
 import { t as generate } from "../generate-CcM24hoq.mjs";
-import { t as init } from "../init-DYzfniuX.mjs";
+import { t as init } from "../init-DQ_rY1J7.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/context/index.d.mts

@@ -23,6 +23,18 @@ interface RequestStore {
   resourceName?: string;
   /** Request start time (for timing) */
   startTime: number;
+  /**
+   * W3C Trace Context traceparent header (RFC 9457 / W3C Recommendation).
+   * Format: `00-<trace-id>-<parent-id>-<flags>` (e.g. `00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01`).
+   * Populated by `requestIdPlugin` when the header is present and valid.
+   */
+  traceparent?: string;
+  /**
+   * W3C Trace Context tracestate header.
+   * Vendor-specific, comma-separated `key=value` pairs.
+   * Populated by `requestIdPlugin` when the header is present.
+   */
+  tracestate?: string;
   /** Additional context — extensible by app */
   [key: string]: unknown;
 }
@@ -54,5 +66,46 @@ declare const requestContext: {
    */
   storage: AsyncLocalStorage<RequestStore>;
 };
+/**
+ * Returns the W3C Trace Context headers (`traceparent`, `tracestate`) from
+ * the current request context as a plain `Record<string, string>`, suitable
+ * for passing to `OutboxWriteOptions.headers` or forwarding to downstream
+ * HTTP clients.
+ *
+ * Returns `undefined` when called outside a request scope or when no trace
+ * context was propagated by the upstream caller.
+ *
+ * @example
+ * ```typescript
+ * // Propagate trace context through the outbox so downstream consumers
+ * // can stitch together distributed traces.
+ * const traceHeaders = getTraceHeaders();
+ * await outbox.store(event, { headers: traceHeaders });
+ * ```
+ */
+declare function getTraceHeaders(): Record<string, string> | undefined;
+//#endregion
+//#region src/context/transactionContext.d.ts
+/** DB session/transaction handle. Typed as unknown — arc is DB-agnostic. */
+type DbSession = unknown;
+/**
+ * Transaction context API.
+ *
+ * - `run(session, fn)` — install an active DB session for the duration of `fn`
+ * - `get()` — read the current session (undefined if outside a transaction scope)
+ */
+declare const transactionContext: {
+  /**
+   * Run `fn` with `session` as the active DB transaction context.
+   * Any call to `get()` within `fn`'s async call stack returns `session`.
+   */
+  run<T>(session: DbSession, fn: () => T): T;
+  /**
+   * Get the current DB session, or `undefined` if not inside a
+   * `transactionContext.run(...)` scope.
+   */
+  get(): DbSession | undefined; /** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
+  storage: AsyncLocalStorage<unknown>;
+};
 //#endregion
-export { type RequestStore, requestContext };
+export { type DbSession, type RequestStore, getTraceHeaders, requestContext, transactionContext };

package/dist/context/index.mjs

@@ -1,2 +1,65 @@
-import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
-export { requestContext };
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-DDLS3NVU.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/context/transactionContext.ts
+/**
+* Transaction Context via AsyncLocalStorage
+*
+* Provides a Unit-of-Work (UoW) hook so any code in the call stack can
+* retrieve the active database session/transaction without it being threaded
+* through every function parameter.
+*
+* Arc is DB-agnostic — the session type is `unknown` so any backend
+* (Mongoose session, Prisma transaction, pg client, Drizzle client) can
+* participate. Kit adapters call `runInTransaction(session, fn)` to install
+* the active context; the outbox's `store()` reads it automatically when no
+* explicit `options.session` is passed.
+*
+* @example
+* ```typescript
+* // In a Mongoose-backed service (mongokit adapter)
+* import { transactionContext } from '@classytic/arc/context';
+*
+* await mongoose.connection.withSession(async (session) => {
+*   await session.withTransaction(async () => {
+*     await transactionContext.run(session, async () => {
+*       await orders.insertOne(order, { session });
+*       // outbox.store() auto-picks up `session` — no manual threading
+*       await outbox.store(orderCreatedEvent);
+*     });
+*   });
+* });
+* ```
+*
+* @example
+* ```typescript
+* // Opt-out: explicit session always wins over the ALS context
+* await outbox.store(event, { session: explicitSession });
+* ```
+*/
+const storage = new AsyncLocalStorage();
+/**
+* Transaction context API.
+*
+* - `run(session, fn)` — install an active DB session for the duration of `fn`
+* - `get()` — read the current session (undefined if outside a transaction scope)
+*/
+const transactionContext = {
+	/**
+	* Run `fn` with `session` as the active DB transaction context.
+	* Any call to `get()` within `fn`'s async call stack returns `session`.
+	*/
+	run(session, fn) {
+		return storage.run(session, fn);
+	},
+	/**
+	* Get the current DB session, or `undefined` if not inside a
+	* `transactionContext.run(...)` scope.
+	*/
+	get() {
+		return storage.getStore();
+	},
+	/** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
+	storage
+};
+//#endregion
+export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-TrJVIJl0.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as AccessControl } from "../BaseController-CgHomZ4d.mjs";
-import { S as sendControllerResponse, _ as createCrudHandlers, b as getControllerContext, v as createFastifyHandler, w as BodySanitizer, x as getControllerScope, y as createRequestContext } from "../routerShared-nCyJGOKX.mjs";
-import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-D8tpQ4ZL.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as AccessControl } from "../BaseController-DPwe89qs.mjs";
+import { S as sendControllerResponse, _ as createCrudHandlers, b as getControllerContext, v as createFastifyHandler, w as BodySanitizer, x as getControllerScope, y as createRequestContext } from "../routerShared-Dl0A77Ba.mjs";
+import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-B41eZxyM.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/{core-D8tpQ4ZL.mjs → core-B41eZxyM.mjs}

@@ -1,11 +1,11 @@
 import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { N as assertValidConfig, f as getDefaultCrudSchemas, i as pipeUIMessageStreamToReply, r as isReadableStream } from "./utils-BMQK8mRl.mjs";
-import { t as BaseController } from "./BaseController-CgHomZ4d.mjs";
+import { t as BaseController } from "./BaseController-DPwe89qs.mjs";
 import { t as applyPresets } from "./presets-BYbPobbF.mjs";
 import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-De34B1ZG.mjs";
 import { t as hasEvents } from "./typeGuards-BzkXkvVv.mjs";
-import { C as buildRequestScopeProjection, _ as createCrudHandlers, c as buildPipelineHandler, d as methodCarriesBody, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, o as buildCrudPermissionMw, p as resolveRoutePreHandlers, r as buildArcDecorator, s as buildFieldWritePreHandler, u as buildRateLimitConfig, v as createFastifyHandler, y as createRequestContext } from "./routerShared-nCyJGOKX.mjs";
+import { C as buildRequestScopeProjection, _ as createCrudHandlers, c as buildPipelineHandler, d as methodCarriesBody, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, o as buildCrudPermissionMw, p as resolveRoutePreHandlers, r as buildArcDecorator, s as buildFieldWritePreHandler, u as buildRateLimitConfig, v as createFastifyHandler, y as createRequestContext } from "./routerShared-Dl0A77Ba.mjs";
 import { t as pluralize } from "./pluralize-B9M8xvy-.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-Bjmvn7Eb.mjs";
 //#region src/core/aggregation/defineAggregation.ts
@@ -127,7 +127,10 @@ function createCustomRoutes(fastify, routes, controller, options) {
 				reply.raw.setHeader("Cache-Control", "no-cache");
 				reply.raw.setHeader("Connection", "keep-alive");
 				const result = await handler(request, reply);
-				if (isReadableStream(result)) await pipeUIMessageStreamToReply(reply, result);
+				if (isReadableStream(result)) {
+					await pipeUIMessageStreamToReply(reply, result);
+					return reply;
+				}
 				return result;
 			} : handler,
 			...rateLimitConfig ? { config: rateLimitConfig } : {}
@@ -1093,7 +1096,7 @@ function buildResourcePlugin(resource) {
 				idField: resource.idField
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-BHUMb1-y.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-CRaIwB5S.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1107,7 +1110,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-BYVvhfc5.mjs"), import("./validate-DFIP2VrM.mjs").then((n) => n.i)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-n3O6WdLO.mjs"), import("./validate-DFIP2VrM.mjs").then((n) => n.i)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/{createActionRouter-BHUMb1-y.mjs → createActionRouter-CRaIwB5S.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import "./constants-TrJVIJl0.mjs";
 import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { S as sendControllerResponse, a as buildAuthMiddlewareForPermissions, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, l as buildPreHandlerChain, m as resolveRouterPluginMw, n as buildActionPipelineHandler, r as buildArcDecorator, t as buildActionPermissionMw, u as buildRateLimitConfig } from "./routerShared-nCyJGOKX.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-DAOvBWgT.mjs";
+import { S as sendControllerResponse, a as buildAuthMiddlewareForPermissions, f as resolvePipelineSteps, g as tryRegisterRoute, h as selectPluginMw, l as buildPreHandlerChain, m as resolveRouterPluginMw, n as buildActionPipelineHandler, r as buildArcDecorator, t as buildActionPermissionMw, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Bk6Tns82.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,

package/dist/{createAggregationRouter-BYVvhfc5.mjs → createAggregationRouter-n3O6WdLO.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-j4aJm1Wg.mjs";
-import { h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, r as buildArcDecorator, u as buildRateLimitConfig } from "./routerShared-nCyJGOKX.mjs";
+import { h as selectPluginMw, i as buildAuthMiddleware, l as buildPreHandlerChain, m as resolveRouterPluginMw, r as buildArcDecorator, u as buildRateLimitConfig } from "./routerShared-Dl0A77Ba.mjs";
 import { r as validateAggregations } from "./validate-DFIP2VrM.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-C_SkBNF3.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts

package/dist/{createApp-CzCEEsEm.mjs → createApp-D56t2Dsj.mjs}

@@ -202,7 +202,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-CnJCUyM0.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-Dxp9JlKK.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -828,7 +828,12 @@ async function createApp(options) {
 		...config.bodyLimit !== void 0 ? { bodyLimit: config.bodyLimit } : {},
 		allowErrorHandlerOverride: true,
 		routerOptions: {
-			querystringParser: (str) => qs.parse(str),
+			querystringParser: (str) => qs.parse(str, {
+				depth: 5,
+				parameterLimit: 100,
+				arrayLimit: 20,
+				allowPrototypes: false
+			}),
 			maxParamLength: config.maxParamLength ?? 400
 		},
 		ajv: { customOptions: {

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-DV9WDfeg.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-DKDs9NfD.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-CLZx9bwS.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{eventPlugin-CnJCUyM0.mjs → eventPlugin-Dxp9JlKK.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError } from "./errors-j4aJm1Wg.mjs";
-import { t as requestContext } from "./requestContext-SSaaTgW8.mjs";
+import { n as requestContext } from "./requestContext-DDLS3NVU.mjs";
 import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-ClEDfiMS.mjs";
 import fp from "fastify-plugin";
 //#region src/events/retry.ts

package/dist/events/index.d.mts

@@ -450,6 +450,52 @@ interface EventOutboxOptions {
    * on next poll) — legacy behaviour, unchanged.
    */
   readonly failurePolicy?: OutboxFailurePolicy;
+  /**
+   * Unit-of-Work session provider (AsyncLocalStorage integration).
+   *
+   * When set, `store()` calls this to get the active DB session and uses
+   * it as `OutboxWriteOptions.session` — **only when the caller has not
+   * already passed an explicit `options.session`**. This eliminates the
+   * boilerplate of threading the transaction handle from the controller
+   * through every service layer down to the outbox call site.
+   *
+   * Wire up with arc's `transactionContext`:
+   * ```typescript
+   * import { transactionContext } from '@classytic/arc/context';
+   *
+   * const outbox = new EventOutbox({
+   *   store: myOutboxStore,
+   *   sessionProvider: () => transactionContext.get(),
+   * });
+   *
+   * // In your service layer — session is auto-picked up:
+   * await transactionContext.run(mongooseSession, async () => {
+   *   await orders.insertOne(order, { session: mongooseSession });
+   *   await outbox.store(orderCreatedEvent); // no session arg needed
+   * });
+   * ```
+   */
+  readonly sessionProvider?: () => unknown;
+  /**
+   * W3C Trace Context provider.
+   *
+   * When set, `store()` calls this and merges the returned headers into
+   * `OutboxWriteOptions.headers` — only when `traceparent` is not already
+   * present in the caller-supplied headers. Downstream relay workers can
+   * then forward the headers to the transport, preserving the distributed
+   * trace tree across service boundaries.
+   *
+   * Wire up with arc's `getTraceHeaders`:
+   * ```typescript
+   * import { getTraceHeaders } from '@classytic/arc/context';
+   *
+   * const outbox = new EventOutbox({
+   *   store: myOutboxStore,
+   *   traceContextProvider: getTraceHeaders,
+   * });
+   * ```
+   */
+  readonly traceContextProvider?: () => Record<string, string> | undefined;
 }
 declare class EventOutbox {
   private readonly _store;
@@ -459,6 +505,8 @@ declare class EventOutbox {
   private readonly _leaseMs;
   private readonly _onError?;
   private readonly _usePublishMany;
+  private readonly _sessionProvider?;
+  private readonly _traceContextProvider?;
   private readonly _failurePolicy?;
   /**
    * In-process attempt counter per event id. Accurate within this relay

package/dist/events/index.mjs

@@ -1,6 +1,6 @@
 import { t as MemoryEventTransport } from "../EventTransport-ClEDfiMS.mjs";
 import { n as defineEvent, t as createEventRegistry } from "../defineEvent-NPKUJRt8.mjs";
-import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-CnJCUyM0.mjs";
+import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-Dxp9JlKK.mjs";
 import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-5JgaxieH.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { update } from "@classytic/repo-core/update";
@@ -387,6 +387,8 @@ var EventOutbox = class {
 	_leaseMs;
 	_onError;
 	_usePublishMany;
+	_sessionProvider;
+	_traceContextProvider;
 	_failurePolicy;
 	/**
 	* In-process attempt counter per event id. Accurate within this relay
@@ -406,6 +408,8 @@ var EventOutbox = class {
 		this._onError = opts.onError;
 		this._usePublishMany = opts.usePublishMany ?? true;
 		this._failurePolicy = opts.failurePolicy;
+		this._sessionProvider = opts.sessionProvider;
+		this._traceContextProvider = opts.traceContextProvider;
 	}
 	/** Unique consumer ID used for lease ownership when the store supports claims */
 	get consumerId() {
@@ -427,11 +431,29 @@ var EventOutbox = class {
 		if (!event || typeof event !== "object") throw new InvalidOutboxEventError("event is not an object");
 		if (!event.type || typeof event.type !== "string") throw new InvalidOutboxEventError("event.type is required");
 		if (!event.meta?.id || typeof event.meta.id !== "string") throw new InvalidOutboxEventError("event.meta.id is required");
-		const effectiveOptions = options?.dedupeKey === void 0 && event.meta.idempotencyKey ? {
-			...options ?? {},
+		let effective = options;
+		if (effective?.session === void 0 && this._sessionProvider) {
+			const autoSession = this._sessionProvider();
+			if (autoSession !== void 0) effective = {
+				...effective ?? {},
+				session: autoSession
+			};
+		}
+		if (!effective?.headers?.["traceparent"] && this._traceContextProvider) {
+			const traceHeaders = this._traceContextProvider();
+			if (traceHeaders && Object.keys(traceHeaders).length > 0) effective = {
+				...effective ?? {},
+				headers: {
+					...traceHeaders,
+					...effective?.headers ?? {}
+				}
+			};
+		}
+		if (effective?.dedupeKey === void 0 && event.meta.idempotencyKey) effective = {
+			...effective ?? {},
 			dedupeKey: event.meta.idempotencyKey
-		} : options;
-		await this._store.save(event, effectiveOptions);
+		};
+		await this._store.save(event, effective);
 	}
 	_reportError(kind, error, event) {
 		if (!this._onError) return;

package/dist/factory/index.mjs

@@ -1,5 +1,5 @@
 import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BOXzPhKU.mjs";
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-CzCEEsEm.mjs";
+import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-D56t2Dsj.mjs";
 import { t as loadResources } from "../loadResources-fol6JuvW.mjs";
 //#region src/factory/edge.ts
 /**

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-TrJVIJl0.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-j4aJm1Wg.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CgHomZ4d.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DPwe89qs.mjs";
 import { C as requireAuth, D as when, M as applyFieldWritePermissions, N as fields, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyFieldReadPermissions, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "./permissions-B1Qy55fg.mjs";
-import { x as getControllerScope } from "./routerShared-nCyJGOKX.mjs";
-import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-D8tpQ4ZL.mjs";
+import { x as getControllerScope } from "./routerShared-Dl0A77Ba.mjs";
+import { a as defineResource, i as defineResourceVariants, o as ResourceDefinition, s as defineAction, u as defineAggregation } from "./core-B41eZxyM.mjs";
 //#region src/index.ts
-const version = "2.17.1";
+const version = "2.18.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-DYzfniuX.mjs → init-DQ_rY1J7.mjs}

@@ -917,9 +917,9 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 //#region src/cli/commands/init/dependency-plan.ts
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
-		"@classytic/arc": "^2.13.0",
+		"@classytic/arc": "^2.17.2",
 		"@classytic/primitives": "^0.6.0",
-		"@classytic/repo-core": "^0.4.2",
+		"@classytic/repo-core": "^0.5.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -929,27 +929,27 @@ const SCAFFOLD_DEP_VERSIONS = {
 		fastify: "^5.8.5"
 	},
 	authJwt: {
-		"@fastify/jwt": "^10.0.0",
-		bcryptjs: "^3.0.0"
+		"@fastify/jwt": "^10.1.0",
+		bcryptjs: "^3.0.3"
 	},
 	authBetterAuth: {
-		"better-auth": "^1.6.9",
-		mongodb: "^7.1.0"
+		"better-auth": "^1.6.11",
+		mongodb: "^7.2.0"
 	},
-	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.9" },
+	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.11" },
 	adapterMongokit: {
-		"@classytic/mongokit": "^3.13.0",
-		mongoose: "^9.6.1"
+		"@classytic/mongokit": "^3.14.0",
+		mongoose: "^9.6.2"
 	},
 	devCommon: {
 		"mongodb-memory-server": "^11.1.0",
-		"pino-pretty": "^13.0.0",
-		vitest: "^4.1.5"
+		"pino-pretty": "^13.1.3",
+		vitest: "^4.1.7"
 	},
 	devTypescript: {
 		"@types/node": "^22.10.0",
-		tsx: "^4.21.0",
-		typescript: "^5.7.2"
+		tsx: "^4.22.3",
+		typescript: "^6.0.3"
 	},
 	typesJwt: { "@types/bcryptjs": "^3.0.0" }
 };

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
 import { n as DomainEvent } from "../EventTransport-B1GFiYUy.mjs";
-import { a as WebSocketMessage, i as WebSocketClient } from "../websocket-BJ0w-3Dt.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BZMUP7Gr.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
-import { a as WebSocketMessage, i as WebSocketClient, o as WebSocketPluginOptions } from "../websocket-BJ0w-3Dt.mjs";
+import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BZMUP7Gr.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-CoMjNmkF.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-D3HV0r5L.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export { type BetterAuthHandler, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type EventGatewayOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobsPluginOptions, type McpAuthResult, type McpPluginOptions, type McpResourceConfig, type PromptDefinition, type QueueStats, type StreamlinePluginOptions, type ToolAnnotations, type ToolContext, type ToolDefinition, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, type WebhookDeliveryRecord, type WebhookManager, type WebhookPluginOptions, type WebhookStore, type WebhookSubscription, type WorkflowLike, type WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,7 +1,7 @@
 import { V as ResourceDefinition, bt as IRequestContext, yt as IControllerResponse } from "../../index-C1JSBan-.mjs";
 import { i as RequestScope } from "../../types-CfapW2t8.mjs";
 import { c as PermissionCheck } from "../../fields-DqZLp5d6.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-CoMjNmkF.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-D3HV0r5L.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -505,6 +505,46 @@ declare function filterResourcesForMcp<T extends {
 }>(resources: readonly T[], inputs: ResourceFilterInputs): T[];
 declare const mcpPlugin: FastifyPluginAsync<McpPluginOptions>;
 //#endregion
+//#region src/integrations/mcp/realtimeBridge.d.ts
+/**
+ * Inbound tool-call shape — accepts both LiveKit Agents (`arguments`)
+ * and OpenAI Realtime (`arguments_json` string) variants. Other realtime
+ * vendors stay flexible because we only look at the canonical fields.
+ */
+interface RealtimeToolCall {
+  id: string;
+  name: string;
+  /** Parsed object form. Preferred over `arguments_json`. */
+  arguments?: Record<string, unknown>;
+  /** JSON-string form (OpenAI Realtime tools). Parsed if `arguments` is absent. */
+  arguments_json?: string;
+}
+/** Outbound shape — mirrors js-genai's sendToolResponse. */
+interface RealtimeToolResponse {
+  id: string;
+  name: string;
+  /** Tool result — `content` from the MCP CallToolResult, normalized to plain JSON. */
+  response: Record<string, unknown>;
+  /** Surfaces tool-side errors so the model can recover. */
+  isError?: boolean;
+}
+interface DispatchOptions<TSession = unknown> {
+  session?: TSession | null;
+  log?: ToolContext<TSession>["log"];
+  /** Forwarded into `ctx.extra` for advanced handlers. */
+  extra?: Record<string, unknown>;
+}
+/**
+ * Dispatch a batch of tool calls through the host's MCP tool registry.
+ *
+ * Returns the response array in the same order as the input. Each
+ * response carries either the tool's `content` (success path) or a
+ * `{isError:true, error:{message,...}}` shape (validation failure or
+ * handler throw). The realtime client uses the `id` to correlate
+ * responses to the original calls.
+ */
+declare function dispatchRealtimeToolCall<TSession = unknown>(tools: readonly ToolDefinition[], calls: readonly RealtimeToolCall[], opts?: DispatchOptions<TSession>): Promise<RealtimeToolResponse[]>;
+//#endregion
 //#region src/integrations/mcp/resourceToTools.d.ts
 interface ResourceToToolsConfig extends McpResourceConfig {
   toolNamePrefix?: string;
@@ -578,4 +618,4 @@ declare function permissionDeniedResult(args: {
   session: McpAuthResult | null;
 }): CallToolResult;
 //#endregion
-export { type AuthRef, type BetterAuthHandler, type BuildMcpToolsFromBridgesOptions, type CallToolResult, type CreateMcpAuthFromBetterAuthApiKeyOptions, type CreateMcpServerConfig, type CrudDescriptionMeta, type CrudDescriptionOverride, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type FieldRuleEntry, type FieldRulesToZodOptions, type InvokeControllerOptions, type McpAuthResolver, type McpAuthResult, type McpBridge, type McpGuard, type McpOperation, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, bridgeToMcp, buildMcpToolsFromBridges, buildRequestContext, createMcpAuthFromBetterAuthApiKey, createMcpServer, customGuard, defaultCrudDescription, definePrompt, defineTool, denied, fieldRulesToZod, filterResourcesForMcp, getOrgId, getUserId, guard, hasOrg, invokeController, isAuthenticated, isOrg, mcpHandlerAdapter, mcpPlugin, permissionDeniedResult, requireAuth, requireOrg, requireOrgId, requireRole, resolveCrudDescription, resolveToolCollisions, resourceToTools, toCallToolError, toCallToolResult, toCallToolSuccess };
+export { type AuthRef, type BetterAuthHandler, type BuildMcpToolsFromBridgesOptions, type CallToolResult, type CreateMcpAuthFromBetterAuthApiKeyOptions, type CreateMcpServerConfig, type CrudDescriptionMeta, type CrudDescriptionOverride, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type DispatchOptions, type FieldRuleEntry, type FieldRulesToZodOptions, type InvokeControllerOptions, type McpAuthResolver, type McpAuthResult, type McpBridge, type McpGuard, type McpOperation, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type RealtimeToolCall, type RealtimeToolResponse, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, bridgeToMcp, buildMcpToolsFromBridges, buildRequestContext, createMcpAuthFromBetterAuthApiKey, createMcpServer, customGuard, defaultCrudDescription, definePrompt, defineTool, denied, dispatchRealtimeToolCall, fieldRulesToZod, filterResourcesForMcp, getOrgId, getUserId, guard, hasOrg, invokeController, isAuthenticated, isOrg, mcpHandlerAdapter, mcpPlugin, permissionDeniedResult, requireAuth, requireOrg, requireOrgId, requireRole, resolveCrudDescription, resolveToolCollisions, resourceToTools, toCallToolError, toCallToolResult, toCallToolSuccess };