@classytic/arc 2.19.0 → 2.21.0

package/dist/{init-Bqpt1Hxf.mjs → init-0YhHkXGk.mjs}

@@ -1,6 +1,8 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { accessSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { accessSync, existsSync, readFileSync } from "node:fs";
 import * as readline from "node:readline";
 import { execSync, spawn } from "node:child_process";
 //#region src/cli/commands/init/templates/adapter.ts
@@ -15,7 +17,7 @@ function createAdapterTemplate(config) {
 
 import { createMongooseAdapter } from '@classytic/mongokit/adapter';
 import { buildCrudSchemasFromModel } from '@classytic/mongokit';
-${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
+${ts ? "import type { DataAdapter } from '@classytic/repo-core/adapter';\nimport type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
 
 /**
  * Create a MongoKit-powered adapter for a resource.
@@ -28,7 +30,10 @@ ${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from
 export function createAdapter${ts ? "<TDoc = unknown>" : ""}(
   model${ts ? ": Model<TDoc>" : ""},
   repository${ts ? ": Repository<TDoc>" : ""}
-) {
+)${ts ? ": DataAdapter<TDoc>" : ""} {
+  // Explicit return type keeps the declaration portable — under pnpm's
+  // non-hoisted layout the inferred type references mongokit's internal
+  // paths and tsc fails with TS2742/TS2883.
   return createMongooseAdapter({
     model,
     repository,
@@ -482,20 +487,13 @@ ${[
 	].filter(Boolean).join("\n")}
 import config from '#config/index.js';
 
-let _auth${ts ? ": ReturnType<typeof betterAuth> | null" : ""} = null;
-
-/**
- * Get the Better Auth instance (lazy singleton)
- *
- * Must be called AFTER database connection is established.
- */
-export function getAuth()${ts ? ": ReturnType<typeof betterAuth>" : ""} {
-  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
-    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
-  }
-
-  if (!_auth) {
-    _auth = betterAuth({
+// Factory keeps the CONCRETE betterAuth({...}) instantiation as the source
+// of truth for the instance type — annotating with the wide
+// \`Auth<BetterAuthOptions>\` (aka \`ReturnType<typeof betterAuth>\`) does not
+// typecheck because Better Auth's \`Auth<T>\` is generic over the exact
+// options object.
+function createAuth() {
+  return betterAuth({
       secret: config.betterAuth.secret,
       baseURL: process.env.BETTER_AUTH_URL || \`http://localhost:\${config.server.port}\`,
       basePath: '/api/auth',
@@ -543,6 +541,26 @@ ${orgPluginUsage}
         enabled: process.env.NODE_ENV === 'production',
       },
     });
+}
+
+let _auth${ts ? ": ReturnType<typeof createAuth> | null" : ""} = null;
+
+/**
+ * Get the Better Auth instance (lazy singleton)
+ *
+ * Must be called AFTER database connection is established.
+ */
+export function getAuth()${ts ? ": ReturnType<typeof createAuth>" : ""} {
+  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
+    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
+  }
+
+  // Narrow through a local — assigning the module-level \`_auth\` directly
+  // would lose the non-null narrowing across the calls below.
+  let auth = _auth;
+  if (!auth) {
+    auth = createAuth();
+    _auth = auth;
 ${useStubs ? `
     // Register stub Mongoose models for Better Auth's collections so
     // \`.populate('user')\` / \`ref: 'organization'\` resolve against BA-owned
@@ -550,7 +568,7 @@ ${useStubs ? `
     registerBetterAuthStubs(mongoose, {${stubPluginsList ? ` plugins: [${stubPluginsList}]` : ""}${stubExtras} });
 ` : ""}  }
 
-  return _auth;
+  return auth;
 }
 
 export default getAuth;
@@ -690,6 +708,9 @@ export async function getUserProfile(request${ts ? ": FastifyRequest" : ""}, rep
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const user = await userRepository.getById(userId);
 
     if (!user) {
@@ -710,6 +731,9 @@ export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""},
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const updates${ts ? ": Record<string, unknown>" : ""} = { ...request.body${ts ? " as Record<string, unknown>" : ""} };
 
     // Prevent updating protected fields — auth-managed only
@@ -838,20 +862,29 @@ function authTestTemplate(config) {
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\n" : ""}import { createAppInstance } from '../src/app.js';
+${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\nimport { MongoMemoryServer } from 'mongodb-memory-server';\n" : ""}import { createAppInstance } from '../src/app.js';
 ${ts ? "import type { FastifyInstance } from 'fastify';\n" : ""}
+// Resources mount under the app's resourcePrefix (see src/app.${ts ? "ts" : "js"}).
+const API = '/api';
+
 describe('Auth', () => {
   let app${ts ? ": FastifyInstance" : ""};
-  const testUser = {
+${config.adapter === "mongokit" ? `  let mongo${ts ? ": MongoMemoryServer | undefined" : ""};\n` : ""}  const testUser = {
     name: 'Test User',
     email: 'test@example.com',
     password: 'password123',
   };
 
   beforeAll(async () => {
-${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI || 'mongodb://localhost:27017/${config.name}-test';
-    await mongoose.connect(testDbUri);
-    // Clean up test data
+${config.adapter === "mongokit" ? `    // In-memory MongoDB — no local mongod required. Set MONGODB_URI to use
+    // a real instance instead (e.g. a CI service container).
+    let uri = process.env.MONGODB_URI;
+    if (!uri) {
+      mongo = await MongoMemoryServer.create();
+      uri = mongo.getUri();
+    }
+    await mongoose.connect(uri);
+    // Clean up test data (matters when MONGODB_URI points at a shared DB)
     await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
 ` : ""}
     app = await createAppInstance();
@@ -860,27 +893,29 @@ ${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI
 
   afterAll(async () => {
 ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
+    await app.close();
     await mongoose.connection.close();
-` : ""}    await app.close();
-  });
+    await mongo?.stop();
+` : `    await app.close();
+`}  });
 
   describe('POST /auth/register', () => {
     it('should register a new user', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
       expect(response.statusCode).toBe(201);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.message).toBeDefined();
     });
 
     it('should reject duplicate email', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
@@ -892,13 +927,13 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should login with valid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: testUser.password },
       });
 
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.user).toBeDefined();
       expect(body.accessToken).toBeDefined();
       expect(body.refreshToken).toBeDefined();
     });
@@ -906,7 +941,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should reject invalid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: 'wrongpassword' },
       });
 
@@ -918,7 +953,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should require authentication', async () => {
       const response = await app.inject({
         method: 'GET',
-        url: '/users/me',
+        url: \`\${API}/users/me\`,
       });
 
       expect(response.statusCode).toBe(401);
@@ -929,11 +964,32 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 }
 //#endregion
 //#region src/cli/commands/init/dependency-plan.ts
+/**
+* Single source of truth for scaffolded project dependencies.
+*
+* Two layers keep the scaffold from ever contradicting the arc release
+* that ships it:
+*
+*   1. The static table below — tracks published npm latest, bumped on
+*      release. Serves as the offline fallback.
+*   2. A runtime overlay from arc's OWN package.json (version + declared
+*      peer floors). The 2.20.0 review found the static pins had drifted
+*      (`arc ^2.18.5` + `primitives ^0.6.0` while arc 2.20 peers demand
+*      >=0.9.0 → ERESOLVE on the first `arc init` a new user runs).
+*      Deriving from the installed package.json makes that class of
+*      breakage structurally impossible: the scaffold always pins the
+*      arc version actually running and ranges that satisfy its peers.
+*
+* Used by both `packageJsonTemplate` (declares the deps in the generated
+* `package.json` so `npm install` works without a pre-pass) and
+* `installDependencies` (runs the package manager's `install` against
+* the declared ranges). One source — no drift.
+*/
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
-		"@classytic/arc": "^2.18.5",
-		"@classytic/primitives": "^0.6.0",
-		"@classytic/repo-core": "^0.6.0",
+		"@classytic/arc": "^2.20.0",
+		"@classytic/primitives": "^0.11.0",
+		"@classytic/repo-core": "^0.8.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -953,7 +1009,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	},
 	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.11" },
 	adapterMongokit: {
-		"@classytic/mongokit": "^3.16.1",
+		"@classytic/mongokit": "^3.21.0",
 		mongoose: "^9.6.2"
 	},
 	devCommon: {
@@ -965,11 +1021,69 @@ const SCAFFOLD_DEP_VERSIONS = {
 	devTypescript: {
 		"@types/node": "^22.10.0",
 		tsx: "^4.22.3",
-		typescript: "^6.0.3"
+		typescript: "^7.0.2"
 	},
 	typesJwt: { "@types/bcryptjs": "^3.0.0" }
 };
 /**
+* Locate arc's own package.json by walking up from the executing file.
+* A path walk (vs `require.resolve('@classytic/arc/package.json')`) works
+* regardless of bundle chunk layout and of package.json not being in the
+* exports map. Returns undefined when not found — callers fall back to
+* the static table.
+*/
+function readOwnPackageJson() {
+	try {
+		let dir = dirname(fileURLToPath(import.meta.url));
+		for (let depth = 0; depth < 6; depth++) {
+			const candidate = join(dir, "package.json");
+			if (existsSync(candidate)) {
+				const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+				if (parsed.name === "@classytic/arc") return parsed;
+			}
+			const parent = dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	} catch {}
+}
+/** First x.y.z triple in a range string, or undefined. */
+function parseFloor(range) {
+	const m = /(\d+)\.(\d+)\.(\d+)/.exec(range);
+	if (!m) return void 0;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
+}
+function floorLessThan(a, b) {
+	if (a[0] !== b[0]) return a[0] < b[0];
+	if (a[1] !== b[1]) return a[1] < b[1];
+	return a[2] < b[2];
+}
+/**
+* Overlay live truth from arc's own package.json onto the static pins:
+*   - `@classytic/arc` pins the exact running version (`^<version>`).
+*   - Any scaffolded dep that is also an arc peer gets raised to `^<peer
+*     floor>` when the static pin's floor is BELOW the declared peer floor
+*     (never lowered — static pins may legitimately be ahead of the floor).
+*/
+function overlayLiveArcVersions(dependencies) {
+	const own = readOwnPackageJson();
+	if (!own) return;
+	if (own.version && dependencies["@classytic/arc"]) dependencies["@classytic/arc"] = `^${own.version}`;
+	const peers = own.peerDependencies ?? {};
+	for (const [name, staticRange] of Object.entries(dependencies)) {
+		const peerRange = peers[name];
+		if (!peerRange) continue;
+		const peerFloor = parseFloor(peerRange);
+		const staticFloor = parseFloor(staticRange);
+		if (!peerFloor || !staticFloor) continue;
+		if (floorLessThan(staticFloor, peerFloor)) dependencies[name] = `^${peerFloor.join(".")}`;
+	}
+}
+/**
 * Resolve the dependency manifest for a scaffold configuration.
 *
 * Returns sorted records (alphabetical by package name) so the generated
@@ -980,6 +1094,7 @@ function resolveScaffoldDependencies(config) {
 	const devDependencies = { ...SCAFFOLD_DEP_VERSIONS.devCommon };
 	if (config.auth === "better-auth") {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuth);
+		devDependencies["@fastify/jwt"] = SCAFFOLD_DEP_VERSIONS.authJwt["@fastify/jwt"];
 		if (config.apiKey) Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuthApiKey);
 	} else {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authJwt);
@@ -987,6 +1102,7 @@ function resolveScaffoldDependencies(config) {
 	}
 	if (config.adapter === "mongokit") Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.adapterMongokit);
 	if (config.typescript) Object.assign(devDependencies, SCAFFOLD_DEP_VERSIONS.devTypescript);
+	overlayLiveArcVersions(dependencies);
 	return {
 		dependencies: sortByKey(dependencies),
 		devDependencies: sortByKey(devDependencies)
@@ -1077,6 +1193,7 @@ function tsconfigTemplate() {
 			declarationMap: true,
 			sourceMap: true,
 			resolveJsonModule: true,
+			types: ["node"],
 			paths: {
 				"#shared/*": ["./src/shared/*"],
 				"#resources/*": ["./src/resources/*"],
@@ -1971,7 +2088,13 @@ import { describe, it, beforeAll, afterAll } from 'vitest';
 import { createTestApp, expectArc } from '@classytic/arc/testing';
 import type { TestAppContext${ts ? ", TestAuthProvider" : ""} } from '@classytic/arc/testing';
 import exampleResource from '../src/resources/example/example.resource.js';
-
+${config.tenant === "multi" ? `
+// Valid ObjectId hex — the example model types organizationId and createdBy
+// as ObjectId (createdBy is auto-stamped from the caller's user id).
+const TEST_ORG_ID = '64f000000000000000000001';
+const MANAGER_ID = '64f0000000000000000000a1';
+const STAFF_ID = '64f0000000000000000000a2';
+` : ""}
 describe('Example Resource', () => {
   let ctx${ts ? ": TestAppContext" : ""};
   // Narrowed once below — \`authMode: 'jwt'\` guarantees a provider, but
@@ -1986,17 +2109,70 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
 
     if (!ctx.auth) throw new Error('Test auth provider was not configured');
     auth = ctx.auth;
-
+${config.tenant === "multi" ? `
+    // Arc's JWT auth builds a MEMBER scope straight from token claims —
+    // \`organizationId\` + \`orgRoles\` land on \`request.scope\`. The org-staff
+    // permission set reads those org roles; the tenant preset filters and
+    // stamps rows by the org id.
+    auth.register('manager', {
+      user: { id: MANAGER_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['manager'] },
+      orgId: TEST_ORG_ID,
+    });
+    auth.register('staff', {
+      user: { id: STAFF_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['staff'] },
+      orgId: TEST_ORG_ID,
+    });
+` : `
     // Arc's permission engine reads singular user.role — string,
     // comma-separated string, or array all normalise via getUserRoles().
+    // The id must be ObjectId-shaped: the example model's createdBy is an
+    // ObjectId, auto-stamped from the caller's user id.
     auth.register('admin', {
-      user: { id: '1', role: 'admin' },
-      orgId: 'org-1',
+      user: { id: '64f0000000000000000000ad', role: 'admin' },
     });
-  });
+`}  });
 
   afterAll(() => ctx.close());
+${config.tenant === "multi" ? `
+  describe('GET /examples', () => {
+    it('should reject unauthenticated listing (org-staff gated)', async () => {
+      const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
+      expectArc(res).unauthorized();
+    });
+
+    it('should list for an org member (rows scoped to their org)', async () => {
+      const res = await ctx.app.inject({
+        method: 'GET',
+        url: '/examples',
+        headers: auth.as('staff').headers,
+      });
+      expectArc(res).ok().paginated();
+    });
+  });
 
+  describe('POST /examples', () => {
+    it('should require authentication', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).unauthorized();
+    });
+
+    it('should create for an org manager — organizationId stamped server-side', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        headers: auth.as('manager').headers,
+        // No organizationId in the body — the tenant preset injects it from
+        // the caller's scope (the field is systemManaged in the schema).
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).ok(201);
+    });
+  });
+` : `
   describe('GET /examples', () => {
     it('should return a list of examples (public)', async () => {
       const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
@@ -2021,9 +2197,10 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
         headers: auth.as('admin').headers,
         payload: { name: 'Test Example' },
       });
-      expectArc(res).ok();
+      expectArc(res).ok(201);
     });
   });
+`}
 
   // Add more tests as needed:
   // - GET /examples/:id         (expectArc(res).ok().hasData({ name: '...' }))
@@ -2413,113 +2590,35 @@ function flexibleMultiTenantPresetTemplate(config) {
 	return `/**
  * Flexible Multi-Tenant Preset
  *
- * Smarter tenant filtering that works with public + authenticated routes.
+ * Thin wrapper around arc's built-in 'multiTenantPreset' with public reads:
  *
- * Philosophy:
- * - No org scope → No filtering (public data, all orgs)
- * - Org scope present → Filter by org
- * - Elevated scope → No filter (platform admin sees all)
+ * - list/get WITHOUT org context → allowed through unfiltered (public data)
+ * - org context present → rows filtered + stamped to the caller's org
+ * - elevated (platform admin) → unfiltered, cross-tenant
+ * - create/update fail closed without org context, and update overwrites any
+ *   client-supplied tenant field (no cross-tenant document hops)
  *
- * Uses request.scope (RequestScope) from Arc's scope system.
+ * The built-in preset also registers 'systemManaged' field rules for the
+ * tenant field, so generated request schemas never demand it in the body —
+ * the server stamps it from the caller's scope instead. Don't hand-roll
+ * tenant middleware: without those field rules Fastify's validation rejects
+ * creates before injection can run.
+ *
+ * Want members-only reads? Drop 'allowPublic' below, or use
+ * 'multiTenantPreset({ tenantField })' directly on the resource.
  */
 ${ts ? `
-import { getOrgId, isElevated, isMember } from '@classytic/arc/scope';
-import type { RequestScope } from '@classytic/arc/scope';
+import { multiTenantPreset } from '@classytic/arc/presets/tenant';
 
 interface FlexibleMultiTenantOptions {
   tenantField?: string;
 }
-
-interface PresetMiddlewares {
-  list: ((request: any, reply: any) => Promise<void>)[];
-  get: ((request: any, reply: any) => Promise<void>)[];
-  create: ((request: any, reply: any) => Promise<void>)[];
-  update: ((request: any, reply: any) => Promise<void>)[];
-  delete: ((request: any, reply: any) => Promise<void>)[];
-}
-
-interface Preset {
-  [key: string]: unknown;
-  name: string;
-  middlewares: PresetMiddlewares;
-}
 ` : `
-const { getOrgId, isElevated, isMember } = require('@classytic/arc/scope');
+const { multiTenantPreset } = require('@classytic/arc/presets/tenant');
 `}
-/**
- * Create flexible tenant filter middleware.
- * Only filters when org context is present.
- */
-function createFlexibleTenantFilter(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-
-    // Elevated scope — platform admin sees all, no filter
-    if (isElevated(scope)) {
-      request.log?.debug?.({ msg: 'Elevated scope — no tenant filter' });
-      return;
-    }
-
-    // Member scope — filter by org
-    if (isMember(scope)) {
-      request.query = request.query ?? {};
-      request.query._policyFilters = {
-        ...(request.query._policyFilters ?? {}),
-        [tenantField]: scope.organizationId,
-      };
-      request.log?.debug?.({ msg: 'Tenant filter applied', orgId: scope.organizationId, tenantField });
-      return;
-    }
-
-    // Public / authenticated — no org context, show all data (public routes)
-    request.log?.debug?.({ msg: 'No org context — showing all data' });
-  };
-}
-
-/**
- * Create tenant injection middleware.
- * Injects tenant ID into request body on create.
- */
-function createTenantInjection(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-    const orgId = getOrgId(scope);
-
-    // Fail-closed: Require orgId for create operations
-    if (!orgId) {
-      return reply.code(403).send({
-        error: 'Organization context required to create resources',
-        code: 'arc.org_required',
-      });
-    }
-
-    if (request.body) {
-      request.body[tenantField] = orgId;
-    }
-  };
-}
-
-/**
- * Flexible Multi-Tenant Preset
- *
- * @param options.tenantField - Field name in database (default: 'organizationId')
- */
-export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"})${ts ? ": Preset" : ""} {
+export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"}) {
   const { tenantField = 'organizationId' } = options;
-
-  const tenantFilter = createFlexibleTenantFilter(tenantField);
-  const tenantInjection = createTenantInjection(tenantField);
-
-  return {
-    name: 'flexibleMultiTenant',
-    middlewares: {
-      list: [tenantFilter],
-      get: [tenantFilter],
-      create: [tenantInjection],
-      update: [tenantFilter],
-      delete: [tenantFilter],
-    },
-  };
+  return multiTenantPreset({ tenantField, allowPublic: ['list', 'get'] });
 }
 
 export default flexibleMultiTenantPreset;
@@ -3022,7 +3121,7 @@ async function gatherConfig(options) {
 		output: process.stdout
 	});
 	const question = (prompt) => new Promise((resolve) => rl.question(prompt, resolve));
-	const nonInteractive = !!options.name;
+	const nonInteractive = !!options.name || !process.stdin.isTTY;
 	try {
 		const name = options.name || await question("Project name: ") || "my-arc-app";
 		let adapter = options.adapter || "mongokit";

package/dist/integrations/event-gateway.d.mts

@@ -1,7 +1,6 @@
-import { n as DomainEvent } from "../EventTransport-IEn7Tn-Q.mjs";
-import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-MlYlrYq0.mjs";
+import { n as DomainEvent } from "../EventTransport-QmY7A258.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-uuWqM6UY.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
 //#region src/integrations/event-gateway.d.ts
 interface EventGatewayOptions {
   /** Require auth for all real-time connections (default: true) */

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
-import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
+import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-uuWqM6UY.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-DpvSF5Hh.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-DRj-Ut4n.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/jobs.d.mts

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/integrations/jobs.d.ts
 /** Repeat schedule — cron pattern or fixed interval. Explicit timezone is required. */
 interface JobRepeatOptions {

package/dist/integrations/mcp/index.d.mts

@@ -1,11 +1,10 @@
-import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-CUTG2Cuo.mjs";
-import { i as RequestScope } from "../../types-LNebCoJx.mjs";
-import { c as PermissionCheck } from "../../fields-C7ahdGYf.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-DpvSF5Hh.mjs";
+import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-Dtrj6XZk.mjs";
+import { i as RequestScope } from "../../types-DH0GupI7.mjs";
+import { c as PermissionCheck } from "../../fields-BGqrAa_u.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-DRj-Ut4n.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
-
 //#region src/integrations/mcp/aiSdkBridge.d.ts
 /** Minimal AI SDK tool shape we need to invoke. */
 interface AiSdkExecutable {
@@ -170,7 +169,7 @@ interface DefinePromptConfig<TArgs extends Record<string, z.ZodTypeAny>> {
   title?: string;
   /** Flat Zod shape for prompt arguments */
   args?: TArgs;
-  handler: (args: { [K in keyof TArgs]: z.infer<TArgs[K]> }) => PromptResult;
+  handler: (args: { [K in keyof TArgs]: z.infer<TArgs[K]>; }) => PromptResult;
 }
 /**
  * Define a type-safe MCP prompt.
@@ -197,7 +196,7 @@ interface DefineToolConfig<TInput extends Record<string, z.ZodTypeAny>, TSession
   /** Flat Zod shape for structured output */
   output?: Record<string, z.ZodTypeAny>;
   annotations?: ToolAnnotations;
-  handler: (input: { [K in keyof TInput]: z.infer<TInput[K]> }, ctx: ToolContext<TSession>) => Promise<CallToolResult>;
+  handler: (input: { [K in keyof TInput]: z.infer<TInput[K]>; }, ctx: ToolContext<TSession>) => Promise<CallToolResult>;
 }
 /**
  * Define a type-safe MCP tool.

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-C088Nd-G.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-B9XjjNVG.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.