@classytic/arc 2.20.0 → 2.21.0

package/dist/{init-YH_nslQR.mjs → init-0YhHkXGk.mjs}

@@ -17,7 +17,7 @@ function createAdapterTemplate(config) {
 
 import { createMongooseAdapter } from '@classytic/mongokit/adapter';
 import { buildCrudSchemasFromModel } from '@classytic/mongokit';
-${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
+${ts ? "import type { DataAdapter } from '@classytic/repo-core/adapter';\nimport type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
 
 /**
  * Create a MongoKit-powered adapter for a resource.
@@ -30,7 +30,10 @@ ${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from
 export function createAdapter${ts ? "<TDoc = unknown>" : ""}(
   model${ts ? ": Model<TDoc>" : ""},
   repository${ts ? ": Repository<TDoc>" : ""}
-) {
+)${ts ? ": DataAdapter<TDoc>" : ""} {
+  // Explicit return type keeps the declaration portable — under pnpm's
+  // non-hoisted layout the inferred type references mongokit's internal
+  // paths and tsc fails with TS2742/TS2883.
   return createMongooseAdapter({
     model,
     repository,
@@ -484,20 +487,13 @@ ${[
 	].filter(Boolean).join("\n")}
 import config from '#config/index.js';
 
-let _auth${ts ? ": ReturnType<typeof betterAuth> | null" : ""} = null;
-
-/**
- * Get the Better Auth instance (lazy singleton)
- *
- * Must be called AFTER database connection is established.
- */
-export function getAuth()${ts ? ": ReturnType<typeof betterAuth>" : ""} {
-  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
-    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
-  }
-
-  if (!_auth) {
-    _auth = betterAuth({
+// Factory keeps the CONCRETE betterAuth({...}) instantiation as the source
+// of truth for the instance type — annotating with the wide
+// \`Auth<BetterAuthOptions>\` (aka \`ReturnType<typeof betterAuth>\`) does not
+// typecheck because Better Auth's \`Auth<T>\` is generic over the exact
+// options object.
+function createAuth() {
+  return betterAuth({
       secret: config.betterAuth.secret,
       baseURL: process.env.BETTER_AUTH_URL || \`http://localhost:\${config.server.port}\`,
       basePath: '/api/auth',
@@ -545,6 +541,26 @@ ${orgPluginUsage}
         enabled: process.env.NODE_ENV === 'production',
       },
     });
+}
+
+let _auth${ts ? ": ReturnType<typeof createAuth> | null" : ""} = null;
+
+/**
+ * Get the Better Auth instance (lazy singleton)
+ *
+ * Must be called AFTER database connection is established.
+ */
+export function getAuth()${ts ? ": ReturnType<typeof createAuth>" : ""} {
+  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
+    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
+  }
+
+  // Narrow through a local — assigning the module-level \`_auth\` directly
+  // would lose the non-null narrowing across the calls below.
+  let auth = _auth;
+  if (!auth) {
+    auth = createAuth();
+    _auth = auth;
 ${useStubs ? `
     // Register stub Mongoose models for Better Auth's collections so
     // \`.populate('user')\` / \`ref: 'organization'\` resolve against BA-owned
@@ -552,7 +568,7 @@ ${useStubs ? `
     registerBetterAuthStubs(mongoose, {${stubPluginsList ? ` plugins: [${stubPluginsList}]` : ""}${stubExtras} });
 ` : ""}  }
 
-  return _auth;
+  return auth;
 }
 
 export default getAuth;
@@ -692,6 +708,9 @@ export async function getUserProfile(request${ts ? ": FastifyRequest" : ""}, rep
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const user = await userRepository.getById(userId);
 
     if (!user) {
@@ -712,6 +731,9 @@ export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""},
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const updates${ts ? ": Record<string, unknown>" : ""} = { ...request.body${ts ? " as Record<string, unknown>" : ""} };
 
     // Prevent updating protected fields — auth-managed only
@@ -840,20 +862,29 @@ function authTestTemplate(config) {
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\n" : ""}import { createAppInstance } from '../src/app.js';
+${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\nimport { MongoMemoryServer } from 'mongodb-memory-server';\n" : ""}import { createAppInstance } from '../src/app.js';
 ${ts ? "import type { FastifyInstance } from 'fastify';\n" : ""}
+// Resources mount under the app's resourcePrefix (see src/app.${ts ? "ts" : "js"}).
+const API = '/api';
+
 describe('Auth', () => {
   let app${ts ? ": FastifyInstance" : ""};
-  const testUser = {
+${config.adapter === "mongokit" ? `  let mongo${ts ? ": MongoMemoryServer | undefined" : ""};\n` : ""}  const testUser = {
     name: 'Test User',
     email: 'test@example.com',
     password: 'password123',
   };
 
   beforeAll(async () => {
-${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI || 'mongodb://localhost:27017/${config.name}-test';
-    await mongoose.connect(testDbUri);
-    // Clean up test data
+${config.adapter === "mongokit" ? `    // In-memory MongoDB — no local mongod required. Set MONGODB_URI to use
+    // a real instance instead (e.g. a CI service container).
+    let uri = process.env.MONGODB_URI;
+    if (!uri) {
+      mongo = await MongoMemoryServer.create();
+      uri = mongo.getUri();
+    }
+    await mongoose.connect(uri);
+    // Clean up test data (matters when MONGODB_URI points at a shared DB)
     await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
 ` : ""}
     app = await createAppInstance();
@@ -862,27 +893,29 @@ ${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI
 
   afterAll(async () => {
 ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
+    await app.close();
     await mongoose.connection.close();
-` : ""}    await app.close();
-  });
+    await mongo?.stop();
+` : `    await app.close();
+`}  });
 
   describe('POST /auth/register', () => {
     it('should register a new user', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
       expect(response.statusCode).toBe(201);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.message).toBeDefined();
     });
 
     it('should reject duplicate email', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
@@ -894,13 +927,13 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should login with valid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: testUser.password },
       });
 
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.user).toBeDefined();
       expect(body.accessToken).toBeDefined();
       expect(body.refreshToken).toBeDefined();
     });
@@ -908,7 +941,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should reject invalid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: 'wrongpassword' },
       });
 
@@ -920,7 +953,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should require authentication', async () => {
       const response = await app.inject({
         method: 'GET',
-        url: '/users/me',
+        url: \`\${API}/users/me\`,
       });
 
       expect(response.statusCode).toBe(401);
@@ -955,8 +988,8 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
 		"@classytic/arc": "^2.20.0",
-		"@classytic/primitives": "^0.9.1",
-		"@classytic/repo-core": "^0.7.0",
+		"@classytic/primitives": "^0.11.0",
+		"@classytic/repo-core": "^0.8.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -976,7 +1009,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	},
 	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.11" },
 	adapterMongokit: {
-		"@classytic/mongokit": "^3.16.1",
+		"@classytic/mongokit": "^3.21.0",
 		mongoose: "^9.6.2"
 	},
 	devCommon: {
@@ -988,7 +1021,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	devTypescript: {
 		"@types/node": "^22.10.0",
 		tsx: "^4.22.3",
-		typescript: "^6.0.3"
+		typescript: "^7.0.2"
 	},
 	typesJwt: { "@types/bcryptjs": "^3.0.0" }
 };
@@ -1061,6 +1094,7 @@ function resolveScaffoldDependencies(config) {
 	const devDependencies = { ...SCAFFOLD_DEP_VERSIONS.devCommon };
 	if (config.auth === "better-auth") {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuth);
+		devDependencies["@fastify/jwt"] = SCAFFOLD_DEP_VERSIONS.authJwt["@fastify/jwt"];
 		if (config.apiKey) Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuthApiKey);
 	} else {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authJwt);
@@ -1159,6 +1193,7 @@ function tsconfigTemplate() {
 			declarationMap: true,
 			sourceMap: true,
 			resolveJsonModule: true,
+			types: ["node"],
 			paths: {
 				"#shared/*": ["./src/shared/*"],
 				"#resources/*": ["./src/resources/*"],
@@ -2053,7 +2088,13 @@ import { describe, it, beforeAll, afterAll } from 'vitest';
 import { createTestApp, expectArc } from '@classytic/arc/testing';
 import type { TestAppContext${ts ? ", TestAuthProvider" : ""} } from '@classytic/arc/testing';
 import exampleResource from '../src/resources/example/example.resource.js';
-
+${config.tenant === "multi" ? `
+// Valid ObjectId hex — the example model types organizationId and createdBy
+// as ObjectId (createdBy is auto-stamped from the caller's user id).
+const TEST_ORG_ID = '64f000000000000000000001';
+const MANAGER_ID = '64f0000000000000000000a1';
+const STAFF_ID = '64f0000000000000000000a2';
+` : ""}
 describe('Example Resource', () => {
   let ctx${ts ? ": TestAppContext" : ""};
   // Narrowed once below — \`authMode: 'jwt'\` guarantees a provider, but
@@ -2068,17 +2109,70 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
 
     if (!ctx.auth) throw new Error('Test auth provider was not configured');
     auth = ctx.auth;
-
+${config.tenant === "multi" ? `
+    // Arc's JWT auth builds a MEMBER scope straight from token claims —
+    // \`organizationId\` + \`orgRoles\` land on \`request.scope\`. The org-staff
+    // permission set reads those org roles; the tenant preset filters and
+    // stamps rows by the org id.
+    auth.register('manager', {
+      user: { id: MANAGER_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['manager'] },
+      orgId: TEST_ORG_ID,
+    });
+    auth.register('staff', {
+      user: { id: STAFF_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['staff'] },
+      orgId: TEST_ORG_ID,
+    });
+` : `
     // Arc's permission engine reads singular user.role — string,
     // comma-separated string, or array all normalise via getUserRoles().
+    // The id must be ObjectId-shaped: the example model's createdBy is an
+    // ObjectId, auto-stamped from the caller's user id.
     auth.register('admin', {
-      user: { id: '1', role: 'admin' },
-      orgId: 'org-1',
+      user: { id: '64f0000000000000000000ad', role: 'admin' },
     });
-  });
+`}  });
 
   afterAll(() => ctx.close());
+${config.tenant === "multi" ? `
+  describe('GET /examples', () => {
+    it('should reject unauthenticated listing (org-staff gated)', async () => {
+      const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
+      expectArc(res).unauthorized();
+    });
 
+    it('should list for an org member (rows scoped to their org)', async () => {
+      const res = await ctx.app.inject({
+        method: 'GET',
+        url: '/examples',
+        headers: auth.as('staff').headers,
+      });
+      expectArc(res).ok().paginated();
+    });
+  });
+
+  describe('POST /examples', () => {
+    it('should require authentication', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).unauthorized();
+    });
+
+    it('should create for an org manager — organizationId stamped server-side', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        headers: auth.as('manager').headers,
+        // No organizationId in the body — the tenant preset injects it from
+        // the caller's scope (the field is systemManaged in the schema).
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).ok(201);
+    });
+  });
+` : `
   describe('GET /examples', () => {
     it('should return a list of examples (public)', async () => {
       const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
@@ -2103,9 +2197,10 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
         headers: auth.as('admin').headers,
         payload: { name: 'Test Example' },
       });
-      expectArc(res).ok();
+      expectArc(res).ok(201);
     });
   });
+`}
 
   // Add more tests as needed:
   // - GET /examples/:id         (expectArc(res).ok().hasData({ name: '...' }))
@@ -2495,113 +2590,35 @@ function flexibleMultiTenantPresetTemplate(config) {
 	return `/**
  * Flexible Multi-Tenant Preset
  *
- * Smarter tenant filtering that works with public + authenticated routes.
+ * Thin wrapper around arc's built-in 'multiTenantPreset' with public reads:
+ *
+ * - list/get WITHOUT org context → allowed through unfiltered (public data)
+ * - org context present → rows filtered + stamped to the caller's org
+ * - elevated (platform admin) → unfiltered, cross-tenant
+ * - create/update fail closed without org context, and update overwrites any
+ *   client-supplied tenant field (no cross-tenant document hops)
  *
- * Philosophy:
- * - No org scope → No filtering (public data, all orgs)
- * - Org scope present → Filter by org
- * - Elevated scope → No filter (platform admin sees all)
+ * The built-in preset also registers 'systemManaged' field rules for the
+ * tenant field, so generated request schemas never demand it in the body —
+ * the server stamps it from the caller's scope instead. Don't hand-roll
+ * tenant middleware: without those field rules Fastify's validation rejects
+ * creates before injection can run.
  *
- * Uses request.scope (RequestScope) from Arc's scope system.
+ * Want members-only reads? Drop 'allowPublic' below, or use
+ * 'multiTenantPreset({ tenantField })' directly on the resource.
  */
 ${ts ? `
-import { getOrgId, isElevated, isMember } from '@classytic/arc/scope';
-import type { RequestScope } from '@classytic/arc/scope';
+import { multiTenantPreset } from '@classytic/arc/presets/tenant';
 
 interface FlexibleMultiTenantOptions {
   tenantField?: string;
 }
-
-interface PresetMiddlewares {
-  list: ((request: any, reply: any) => Promise<void>)[];
-  get: ((request: any, reply: any) => Promise<void>)[];
-  create: ((request: any, reply: any) => Promise<void>)[];
-  update: ((request: any, reply: any) => Promise<void>)[];
-  delete: ((request: any, reply: any) => Promise<void>)[];
-}
-
-interface Preset {
-  [key: string]: unknown;
-  name: string;
-  middlewares: PresetMiddlewares;
-}
 ` : `
-const { getOrgId, isElevated, isMember } = require('@classytic/arc/scope');
+const { multiTenantPreset } = require('@classytic/arc/presets/tenant');
 `}
-/**
- * Create flexible tenant filter middleware.
- * Only filters when org context is present.
- */
-function createFlexibleTenantFilter(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-
-    // Elevated scope — platform admin sees all, no filter
-    if (isElevated(scope)) {
-      request.log?.debug?.({ msg: 'Elevated scope — no tenant filter' });
-      return;
-    }
-
-    // Member scope — filter by org
-    if (isMember(scope)) {
-      request.query = request.query ?? {};
-      request.query._policyFilters = {
-        ...(request.query._policyFilters ?? {}),
-        [tenantField]: scope.organizationId,
-      };
-      request.log?.debug?.({ msg: 'Tenant filter applied', orgId: scope.organizationId, tenantField });
-      return;
-    }
-
-    // Public / authenticated — no org context, show all data (public routes)
-    request.log?.debug?.({ msg: 'No org context — showing all data' });
-  };
-}
-
-/**
- * Create tenant injection middleware.
- * Injects tenant ID into request body on create.
- */
-function createTenantInjection(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-    const orgId = getOrgId(scope);
-
-    // Fail-closed: Require orgId for create operations
-    if (!orgId) {
-      return reply.code(403).send({
-        error: 'Organization context required to create resources',
-        code: 'arc.org_required',
-      });
-    }
-
-    if (request.body) {
-      request.body[tenantField] = orgId;
-    }
-  };
-}
-
-/**
- * Flexible Multi-Tenant Preset
- *
- * @param options.tenantField - Field name in database (default: 'organizationId')
- */
-export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"})${ts ? ": Preset" : ""} {
+export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"}) {
   const { tenantField = 'organizationId' } = options;
-
-  const tenantFilter = createFlexibleTenantFilter(tenantField);
-  const tenantInjection = createTenantInjection(tenantField);
-
-  return {
-    name: 'flexibleMultiTenant',
-    middlewares: {
-      list: [tenantFilter],
-      get: [tenantFilter],
-      create: [tenantInjection],
-      update: [tenantFilter],
-      delete: [tenantFilter],
-    },
-  };
+  return multiTenantPreset({ tenantField, allowPublic: ['list', 'get'] });
 }
 
 export default flexibleMultiTenantPreset;

package/dist/integrations/event-gateway.d.mts

@@ -1,7 +1,6 @@
-import { n as DomainEvent } from "../EventTransport-IEn7Tn-Q.mjs";
-import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-MlYlrYq0.mjs";
+import { n as DomainEvent } from "../EventTransport-QmY7A258.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-uuWqM6UY.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
 //#region src/integrations/event-gateway.d.ts
 interface EventGatewayOptions {
   /** Require auth for all real-time connections (default: true) */

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
-import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
+import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-uuWqM6UY.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-C9b2HR5W.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-DRj-Ut4n.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/jobs.d.mts

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/integrations/jobs.d.ts
 /** Repeat schedule — cron pattern or fixed interval. Explicit timezone is required. */
 interface JobRepeatOptions {

package/dist/integrations/mcp/index.d.mts

@@ -1,11 +1,10 @@
-import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-_--GyzcO.mjs";
-import { i as RequestScope } from "../../types-LNebCoJx.mjs";
-import { c as PermissionCheck } from "../../fields-C7ahdGYf.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-C9b2HR5W.mjs";
+import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-Dtrj6XZk.mjs";
+import { i as RequestScope } from "../../types-DH0GupI7.mjs";
+import { c as PermissionCheck } from "../../fields-BGqrAa_u.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-DRj-Ut4n.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
-
 //#region src/integrations/mcp/aiSdkBridge.d.ts
 /** Minimal AI SDK tool shape we need to invoke. */
 interface AiSdkExecutable {
@@ -170,7 +169,7 @@ interface DefinePromptConfig<TArgs extends Record<string, z.ZodTypeAny>> {
   title?: string;
   /** Flat Zod shape for prompt arguments */
   args?: TArgs;
-  handler: (args: { [K in keyof TArgs]: z.infer<TArgs[K]> }) => PromptResult;
+  handler: (args: { [K in keyof TArgs]: z.infer<TArgs[K]>; }) => PromptResult;
 }
 /**
  * Define a type-safe MCP prompt.
@@ -197,7 +196,7 @@ interface DefineToolConfig<TInput extends Record<string, z.ZodTypeAny>, TSession
   /** Flat Zod shape for structured output */
   output?: Record<string, z.ZodTypeAny>;
   annotations?: ToolAnnotations;
-  handler: (input: { [K in keyof TInput]: z.infer<TInput[K]> }, ctx: ToolContext<TSession>) => Promise<CallToolResult>;
+  handler: (input: { [K in keyof TInput]: z.infer<TInput[K]>; }, ctx: ToolContext<TSession>) => Promise<CallToolResult>;
 }
 /**
  * Define a type-safe MCP tool.

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-CuW6L_uD.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-B9XjjNVG.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,5 +1,4 @@
-import { c as McpAuthResult, l as McpPluginOptions } from "../../types-C9b2HR5W.mjs";
-
+import { c as McpAuthResult, l as McpPluginOptions } from "../../types-DRj-Ut4n.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-CuW6L_uD.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-B9XjjNVG.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/streamline.d.mts

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
 //#region src/integrations/streamline.d.ts
 /**
  * Start options — matches @classytic/streamline v2.3+ `StartOptions`.
@@ -53,7 +52,8 @@ interface WorkflowLike {
     eventBus: {
       on(event: string, listener: (...args: unknown[]) => void): void;
       off(event: string, listener: (...args: unknown[]) => void): void;
-    }; /** Repository — used by the list-runs endpoint to query workflow_runs. */
+    };
+    /** Repository — used by the list-runs endpoint to query workflow_runs. */
     repository?: {
       getAll(params: Record<string, unknown>, options?: Record<string, unknown>): Promise<unknown>;
       /**

package/dist/integrations/webhooks.d.mts

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/integrations/webhooks.d.ts
 interface WebhookSubscription {
   /** Unique subscription ID */

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -1,5 +1,4 @@
-import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-DnCqL3aa.mjs";
-
+import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-BbcnpNTm.mjs";
 //#region src/integrations/websocket-pushref-redis.d.ts
 /**
  * Minimal `ioredis` shape — typed structurally so this file doesn't

package/dist/integrations/websocket-redis.d.mts

@@ -1,5 +1,4 @@
-import { f as WebSocketAdapter } from "../websocket-MlYlrYq0.mjs";
-
+import { f as WebSocketAdapter } from "../websocket-uuWqM6UY.mjs";
 //#region src/integrations/websocket-redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/integrations/websocket.d.mts

@@ -1,3 +1,3 @@
-import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
-import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore } from "../pushref-registry-DnCqL3aa.mjs";
+import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-uuWqM6UY.mjs";
+import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore } from "../pushref-registry-BbcnpNTm.mjs";
 export { type AuthResult, type GeoPoint, type GeoPublishOpts, GeoRoom, type GeoRoomOptions, LocalWebSocketAdapter, MemoryPushRefStore, type Principal, PushRefRegistry, type PushRefRegistryOptions, type PushRefStore, RoomManager, type SerializedEntry, type WebSocketAdapter, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, websocketPlugin };

package/dist/{loadResources-B8UmpITt.mjs → loadResources-DpU8pfjV.mjs}

@@ -59,10 +59,11 @@ var loadResources_exports = /* @__PURE__ */ __exportAll({ loadResources: () => l
 * ```
 */
 async function loadResources(dir, options = {}) {
-	const { suffix = ".resource", recursive = true, exclude, include } = options;
+	const { suffix = ".resource", recursive = true, exclude, include, filter } = options;
 	const absDir = resolve(dir.startsWith("file://") ? dirname(fileURLToPath(dir)) : dir);
-	const files = await collectFiles(absDir, new RegExp(`${escapeRegex(suffix)}\\.(ts|js|mts|mjs)$`), recursive);
-	files.sort();
+	const discovered = await collectFiles(absDir, new RegExp(`${escapeRegex(suffix)}\\.(ts|js|mts|mjs)$`), recursive);
+	discovered.sort();
+	const files = filter ? discovered.filter((f) => filter(f)) : discovered;
 	const includeSet = include ? new Set(include) : null;
 	const excludeSet = exclude ? new Set(exclude) : null;
 	const skipped = [];

package/dist/{mcpPlugin-CuW6L_uD.mjs → mcpPlugin-B9XjjNVG.mjs}

@@ -1,9 +1,9 @@
 import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
 import { c as getOrgId, g as getUserId } from "./types-bHblZ9YN.mjs";
-import { t as BaseController } from "./BaseController-D-MHZ27_.mjs";
-import { N as normalizePermissionResult } from "./permissions-CgbOLJZG.mjs";
+import { t as BaseController } from "./BaseController-BnLYgE9A.mjs";
+import { P as normalizePermissionResult } from "./permissions-BJMuKMl7.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-C9RMiIpc.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { n as executeAggregation } from "./buildHandler-D_2ULWxZ.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";