@classytic/arc 2.18.4 → 2.18.5

package/dist/{validate-0__MuUsK.mjs → validate-CRcaWzp2.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 //#region src/core/aggregation/normalize.ts
 /**
 * Framework cap on URL-driven aggregation limits when the host opts

package/dist/{versioning-BSEDGXKC.d.mts → versioning-D_eBCfNr.d.mts}

@@ -1,4 +1,4 @@
-import { n as DomainEvent } from "./EventTransport-CaaXM5Y1.mjs";
+import { n as DomainEvent } from "./EventTransport-IEn7Tn-Q.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/plugins/health.d.ts
@@ -76,6 +76,13 @@ interface SSEOptions {
   orgScoped?: boolean;
   /** Custom event filter function */
   filter?: (event: DomainEvent<unknown>, request: FastifyRequest) => boolean;
+  /**
+   * Query parameter that carries the bearer token for browser `EventSource`
+   * clients (which cannot send an `Authorization` header). Promoted into the
+   * header before auth. Default `'token'` — matches arc-next's `buildStreamUrl`.
+   * Set `null` to disable promotion (e.g. cookie-only auth).
+   */
+  tokenQueryParam?: string | null;
 }
 declare const ssePlugin: FastifyPluginAsync<SSEOptions>;
 declare const _default$2: FastifyPluginAsync<SSEOptions>;

package/dist/{versioning-C0K8KQLx.mjs → versioning-Dk-71iIz.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/versioning.ts
 var versioning_exports = /* @__PURE__ */ __exportAll({

package/dist/{websocket-BFBT5rH-.d.mts → websocket-MlYlrYq0.d.mts}

@@ -1,4 +1,4 @@
-import { a as PushRefRegistry, l as EnvelopeWriter, s as PushRefStore } from "./pushref-registry-Dqclzjy7.mjs";
+import { a as PushRefRegistry, l as EnvelopeWriter, s as PushRefStore } from "./pushref-registry-DnCqL3aa.mjs";
 import { FastifyBaseLogger, FastifyPluginAsync } from "fastify";
 
 //#region src/integrations/websocket/adapter.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.18.4",
+  "version": "2.18.5",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -224,6 +224,7 @@
     "lint:all": "biome check src/ tests/",
     "test": "vitest run",
     "test:main": "vitest run --no-file-parallelism",
+    "test:fast": "vitest run --exclude \"**/tests/integrations/websocket/**\" && vitest run tests/integrations/websocket/ --no-file-parallelism",
     "test:perf": "node --expose-gc ./node_modules/vitest/vitest.mjs run --config vitest.perf.config.ts --no-file-parallelism",
     "test:ci": "npm run test:main && npm run test:perf",
     "test:watch": "vitest",
@@ -350,56 +351,61 @@
     }
   },
   "dependencies": {
-    "fastify-plugin": "^5.0.1",
+    "fastify-plugin": "^6.0.0",
     "qs": "^6.15.2",
     "secure-json-parse": "^4.1.0"
   },
   "devDependencies": {
-    "@better-auth/drizzle-adapter": "^1.6.9",
-    "@better-auth/mongo-adapter": "^1.6.9",
-    "@biomejs/biome": "^2.4.15",
+    "@better-auth/drizzle-adapter": "^1.6.19",
+    "@better-auth/mongo-adapter": "^1.6.19",
+    "@biomejs/biome": "^2.5.0",
     "@classytic/dev-tools": "^0.2.0",
-    "@classytic/mongokit": "^3.16.0",
-    "@classytic/primitives": "^0.6.0",
+    "@classytic/mongokit": "^3.16.1",
+    "@classytic/primitives": "^0.7.2",
     "@classytic/repo-core": "^0.6.0",
     "@classytic/sqlitekit": "^0.6.0",
-    "@classytic/streamline": "^2.3.3",
+    "@classytic/streamline": "^2.6.0",
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",
-    "@fastify/jwt": "^10.0.0",
+    "@fastify/jwt": "^10.1.0",
     "@fastify/multipart": "^10.0.0",
-    "@fastify/rate-limit": "^10.3.0",
+    "@fastify/rate-limit": "^11.0.0",
     "@fastify/sensible": "^6.0.4",
-    "@fastify/type-provider-typebox": "^6.0.0",
+    "@fastify/type-provider-typebox": "^6.1.0",
     "@fastify/under-pressure": "^9.0.3",
-    "@fastify/websocket": "^11.0.0",
+    "@fastify/websocket": "^11.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.1",
-    "@sinclair/typebox": "^0.34.0",
-    "@types/node": "^22.19.19",
+    "@sinclair/typebox": "^0.34.49",
+    "@types/node": "^22.19.21",
     "@types/qs": "^6.15.1",
-    "@vitest/coverage-v8": "^3.2.4",
-    "ajv": "^8.18.0",
-    "better-auth": "^1.6.9",
-    "better-sqlite3": "^12.10.0",
-    "bullmq": "^5.76.9",
+    "@vitest/coverage-v8": "^4.1.9",
+    "ajv": "^8.20.0",
+    "better-auth": "^1.6.19",
+    "better-sqlite3": "^12.11.1",
+    "bullmq": "^5.79.0",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "fast-check": "^4.8.0",
     "fastify": "^5.8.5",
     "fastify-raw-body": "^5.0.0",
     "h3-js": "^4.4.0",
-    "ioredis": "^5.10.1",
-    "jsonwebtoken": "^9.0.0",
-    "knip": "^6.14.1",
-    "mongodb": "^7.1.0",
-    "mongodb-memory-server": "^11.0.1",
-    "mongoose": "^9.6.2",
-    "tsdown": "^0.21.7",
-    "typescript": "^6.0.2",
-    "vitest": "^3.0.0",
-    "ws": "^8.20.1",
-    "zod": "^4.3.6"
+    "ioredis": "^5.11.1",
+    "jsonwebtoken": "^9.0.3",
+    "knip": "^6.17.1",
+    "mongodb": "^7.3.0",
+    "mongodb-memory-server": "^11.2.0",
+    "mongoose": "^9.7.1",
+    "tsdown": "^0.22.3",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9",
+    "ws": "^8.21.0",
+    "zod": "^4.4.3"
+  },
+  "config": {
+    "mongodbMemoryServer": {
+      "disablePostinstall": "1"
+    }
   },
   "keywords": [
     "fastify",

package/dist/EventTransport-7LPXLEUX.mjs

@@ -1,103 +0,0 @@
-import { createEvent, matchEventPattern } from "@classytic/primitives/events";
-//#region src/events/EventTransport.ts
-/**
-* Internal arc events module — concrete in-memory transport.
-*
-* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
-* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
-* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
-* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
-* Two reasons:
-*
-*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
-*      audit-log plugin, future kits and downstream services all share them.
-*      Owning them in `primitives` (pure types, zero runtime, zero deps)
-*      eliminates the "manually mirror in two places" problem the previous
-*      `primitives/src/events.ts` header explicitly called out.
-*   2. Inverting the dependency direction lets future packages (sqlitekit
-*      audit, billing services) consume the contract without depending on
-*      arc's HTTP-coupled stack.
-*
-* Hosts MUST import the types from primitives directly:
-*
-* ```typescript
-* import type {
-*   EventMeta, DomainEvent, EventHandler, EventTransport,
-*   DeadLetteredEvent, PublishManyResult,
-* } from '@classytic/primitives/events';
-* import { createEvent, createChildEvent } from '@classytic/primitives/events';
-* ```
-*
-* arc's `events/index.ts` barrel does NOT re-export these — by design, so
-* that consumer code is forced into the canonical import path and the org's
-* "no re-exports" rule holds at every public surface.
-*
-* What stays here:
-*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
-*     used as arc's default transport. Its handler-set state is process-local;
-*     wrong layer for primitives.
-*   - `MemoryEventTransportOptions` — its options shape.
-*
-* Inside arc, files that previously imported types from `./EventTransport.js`
-* keep working: this file re-exports them from primitives for arc's own
-* call sites. That re-export is an internal refactor convenience — the
-* public `events/index.ts` barrel stays clean.
-*/
-/**
-* In-memory event transport (default).
-*
-* Events are delivered synchronously within the process. Not suitable for
-* multi-instance deployments — pair with `RedisEventTransport` /
-* `RedisStreamTransport` (subpath imports) for those.
-*/
-var MemoryEventTransport = class {
-	name = "memory";
-	handlers = /* @__PURE__ */ new Map();
-	logger;
-	constructor(options) {
-		this.logger = options?.logger ?? console;
-	}
-	async publish(event) {
-		const allHandlers = /* @__PURE__ */ new Set();
-		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-		}
-	}
-	/**
-	* Reference `publishMany` implementation — delegates to `publish()` in order.
-	*
-	* Production transports (Kafka, Redis pipeline, SQS batch) should override
-	* this with a single batched network call. Memory transport has nothing to
-	* batch, so we just loop — the loop still returns a proper result map so
-	* `EventOutbox.relay` can exercise the batched code path in tests.
-	*/
-	async publishMany(events) {
-		const results = /* @__PURE__ */ new Map();
-		for (const event of events) try {
-			await this.publish(event);
-			results.set(event.meta.id, null);
-		} catch (err) {
-			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
-		}
-		return results;
-	}
-	async subscribe(pattern, handler) {
-		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
-		this.handlers.get(pattern)?.add(handler);
-		return () => {
-			const set = this.handlers.get(pattern);
-			if (set) {
-				set.delete(handler);
-				if (set.size === 0) this.handlers.delete(pattern);
-			}
-		};
-	}
-	async close() {
-		this.handlers.clear();
-	}
-};
-//#endregion
-export { createEvent as n, MemoryEventTransport as t };

package/dist/actionPermissions-CX9QIMTd.mjs

@@ -1,24 +0,0 @@
-//#region src/core/actionPermissions.ts
-/**
-* Return the effective `PermissionCheck` for a single action, or `undefined`
-* when the resource declares no gate at any level.
-*
-* Callers decide what "no gate" means:
-*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
-*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
-*     two surfaces fail closed identically so MCP can't expose an
-*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
-*     run).
-*   - OpenAPI: docs advertise the endpoint as unauthenticated.
-*/
-function resolveActionPermission(input) {
-	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
-	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
-	if (explicit) return explicit;
-	if (resourceActionPermissions) return resourceActionPermissions;
-	if (globalAuth) return globalAuth;
-	const updateFallback = resourcePermissions?.update;
-	if (updateFallback) return updateFallback;
-}
-//#endregion
-export { resolveActionPermission as t };

package/dist/betterAuthOpenApi-DAAhMZff.mjs

@@ -1,251 +0,0 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { a as toJsonSchema } from "./schemaConverter-DatAaVNj.mjs";
-//#region src/auth/betterAuthOpenApi.ts
-var betterAuthOpenApi_exports = /* @__PURE__ */ __exportAll({ extractBetterAuthOpenApi: () => extractBetterAuthOpenApi });
-/**
-* Check if a value looks like a Better Auth endpoint (has .path and .options)
-*/
-function isBetterAuthEndpoint(value) {
-	if (typeof value !== "function" && typeof value !== "object") return false;
-	if (!value) return false;
-	const v = value;
-	return typeof v.path === "string" && typeof v.options === "object" && v.options !== null;
-}
-/**
-* Convert Fastify-style path params (/:id) to OpenAPI-style (/{id})
-*/
-function toOpenApiPath(path) {
-	return path.replace(/:([^/]+)/g, "{$1}");
-}
-/**
-* Extract path parameters from a path string
-*/
-function extractPathParams(path) {
-	const params = [];
-	const matches = path.matchAll(/:(\w+)/g);
-	for (const match of matches) {
-		const name = match[1];
-		if (!name) continue;
-		params.push({
-			name,
-			in: "path",
-			required: true,
-			schema: { type: "string" }
-		});
-	}
-	return params;
-}
-/**
-* Extract OpenAPI paths from a Better Auth instance's API object.
-*
-* Walks `authApi` (the `auth.api` object from Better Auth), discovers
-* endpoints, converts their Zod schemas to JSON Schema via `z.toJSONSchema()`,
-* and returns a complete `ExternalOpenApiPaths` object ready for Arc's spec builder.
-*/
-function extractBetterAuthOpenApi(authApi, options = {}) {
-	const { basePath = "/api/auth", tagName = "Authentication", tagDescription = "Better Auth authentication endpoints", excludePaths = [], excludeServerOnly = true, userFields } = options;
-	const normalizedBase = basePath.replace(/\/+$/, "");
-	const paths = {};
-	const detectedPlugins = detectActivePlugins(authApi);
-	const securityOptions = [{ cookieAuth: [] }, { bearerAuth: [] }];
-	if (detectedPlugins.apiKey) securityOptions.push({ apiKeyAuth: [] });
-	for (const [key, value] of Object.entries(authApi)) {
-		if (!isBetterAuthEndpoint(value)) continue;
-		const { path: endpointPath, options: endpointOpts } = value;
-		if (excludePaths.includes(endpointPath)) continue;
-		if (excludeServerOnly && endpointOpts.metadata?.SERVER_ONLY) continue;
-		const fullPath = toOpenApiPath(`${normalizedBase}${endpointPath}`);
-		const methods = [];
-		if (endpointOpts.method) if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
-		else methods.push(endpointOpts.method.toLowerCase());
-		else methods.push(endpointOpts.body ? "post" : "get");
-		const openApiMeta = endpointOpts.metadata?.openapi;
-		for (const method of methods) {
-			const operation = {
-				tags: openApiMeta?.tags ?? [tagName],
-				operationId: openApiMeta?.operationId ?? key,
-				summary: openApiMeta?.summary ?? formatOperationSummary(key),
-				security: securityOptions
-			};
-			if (openApiMeta?.description) operation.description = openApiMeta.description;
-			const parameters = [...extractPathParams(endpointPath)];
-			if ((method === "get" || method === "delete") && endpointOpts.query) {
-				const querySchema = toJsonSchema(endpointOpts.query);
-				if (querySchema && querySchema.type === "object" && querySchema.properties) {
-					const props = querySchema.properties;
-					const required = querySchema.required ?? [];
-					for (const [name, prop] of Object.entries(props)) {
-						const paramEntry = {
-							name,
-							in: "query",
-							required: required.includes(name),
-							schema: prop
-						};
-						if (prop.description) paramEntry.description = prop.description;
-						parameters.push(paramEntry);
-					}
-				}
-			}
-			if (parameters.length > 0) operation.parameters = parameters;
-			if (method === "post" || method === "put" || method === "patch") {
-				if (openApiMeta?.requestBody) operation.requestBody = structuredClone(openApiMeta.requestBody);
-				else if (endpointOpts.body) {
-					const bodySchema = toJsonSchema(endpointOpts.body);
-					if (bodySchema) operation.requestBody = {
-						required: true,
-						content: { "application/json": { schema: bodySchema } }
-					};
-				}
-				if (userFields && isUserFieldEndpoint(endpointPath) && operation.requestBody) mergeUserFieldsIntoRequestBody(operation.requestBody, userFields, endpointPath);
-			}
-			if (openApiMeta?.responses) operation.responses = openApiMeta.responses;
-			else operation.responses = {
-				"200": { description: "Success" },
-				"400": { description: "Bad request" },
-				"401": { description: "Unauthorized" }
-			};
-			if (!paths[fullPath]) paths[fullPath] = {};
-			paths[fullPath][method] = operation;
-		}
-	}
-	const schemas = {
-		User: {
-			type: "object",
-			properties: {
-				id: { type: "string" },
-				name: { type: "string" },
-				email: {
-					type: "string",
-					format: "email"
-				},
-				emailVerified: { type: "boolean" },
-				image: {
-					type: "string",
-					nullable: true
-				},
-				createdAt: {
-					type: "string",
-					format: "date-time"
-				},
-				updatedAt: {
-					type: "string",
-					format: "date-time"
-				}
-			}
-		},
-		Session: {
-			type: "object",
-			properties: {
-				id: { type: "string" },
-				userId: { type: "string" },
-				token: { type: "string" },
-				expiresAt: {
-					type: "string",
-					format: "date-time"
-				},
-				ipAddress: {
-					type: "string",
-					nullable: true
-				},
-				userAgent: {
-					type: "string",
-					nullable: true
-				},
-				createdAt: {
-					type: "string",
-					format: "date-time"
-				},
-				updatedAt: {
-					type: "string",
-					format: "date-time"
-				}
-			}
-		}
-	};
-	if (userFields) {
-		const userProps = schemas.User?.properties;
-		for (const [name, field] of Object.entries(userFields)) {
-			const prop = { type: field.type };
-			if (field.description) prop.description = field.description;
-			userProps[name] = prop;
-		}
-	}
-	const securitySchemes = { cookieAuth: {
-		type: "apiKey",
-		in: "cookie",
-		name: "better-auth.session_token",
-		description: "Session cookie set by Better Auth after sign-in"
-	} };
-	if (detectedPlugins.apiKey) securitySchemes.apiKeyAuth = {
-		type: "apiKey",
-		in: "header",
-		name: "x-api-key",
-		description: "API key for programmatic access. Pass org context via x-organization-id header."
-	};
-	const resourceSecurity = [];
-	if (detectedPlugins.apiKey) resourceSecurity.push({
-		apiKeyAuth: [],
-		orgHeader: []
-	});
-	return {
-		paths,
-		schemas,
-		securitySchemes,
-		tags: [{
-			name: tagName,
-			description: tagDescription
-		}],
-		resourceSecurity: resourceSecurity.length > 0 ? resourceSecurity : void 0
-	};
-}
-/**
-* Auto-detect active Better Auth plugins by inspecting the API object.
-*
-* Rather than hardcoding plugin-specific behavior, we check for known
-* endpoint signatures that each plugin registers. This way the OpenAPI
-* spec adapts automatically to whatever plugins the app has enabled —
-* no Arc update needed when adding/removing plugins.
-*/
-function detectActivePlugins(authApi) {
-	const endpointPaths = /* @__PURE__ */ new Set();
-	for (const value of Object.values(authApi)) if (isBetterAuthEndpoint(value)) endpointPaths.add(value.path);
-	return {
-		apiKey: endpointPaths.has("/api-key/create"),
-		organization: endpointPaths.has("/organization/create")
-	};
-}
-/**
-* Convert a camelCase key like 'signInEmail' to a readable summary like 'Sign in email'
-*/
-function formatOperationSummary(key) {
-	return key.replace(/([A-Z])/g, " $1").replace(/^./, (s) => s.toUpperCase()).trim();
-}
-/**
-* Check if an endpoint path should have userFields merged into its request body.
-*/
-function isUserFieldEndpoint(path) {
-	return path === "/sign-up/email" || path === "/update-user";
-}
-/**
-* Merge user-defined fields into an existing requestBody schema.
-* For updateUser, all fields are treated as optional regardless of their `required` setting.
-*/
-function mergeUserFieldsIntoRequestBody(requestBody, userFields, endpointPath) {
-	const content = requestBody?.content?.["application/json"];
-	if (!content?.schema) return;
-	const schema = content.schema;
-	if (!schema.properties) schema.properties = {};
-	if (!schema.required) schema.required = [];
-	const props = schema.properties;
-	const required = schema.required;
-	for (const [name, field] of Object.entries(userFields)) {
-		if (field.input === false) continue;
-		const isRequired = endpointPath === "/update-user" ? false : field.required ?? false;
-		const prop = { type: field.type };
-		if (field.description) prop.description = field.description;
-		props[name] = prop;
-		if (isRequired && !required.includes(name)) required.push(name);
-	}
-}
-//#endregion
-export { extractBetterAuthOpenApi as n, betterAuthOpenApi_exports as t };