@classytic/arc 2.20.0 → 2.22.0

package/dist/{presets-DWsYQdbV.mjs → presets-gw0ciIUD.mjs}

@@ -1,5 +1,5 @@
 import { b as isElevated, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
-import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-CgbOLJZG.mjs";
+import { E as requireRoles, b as allowPublic, w as requireAuth } from "./permissions-BJMuKMl7.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{pushref-registry-DnCqL3aa.d.mts → pushref-registry-BbcnpNTm.d.mts}

@@ -244,8 +244,10 @@ interface PushRefStore {
    * pre-compute it without re-introducing the very race we're closing.
    */
   stageIfInactive(args: {
-    pushRef: string; /** Raw payload (NOT pre-wrapped). The store assigns seq + wraps atomically. */
-    payload: unknown; /** Server timestamp (ms) — passed in so tests can pin the clock. */
+    pushRef: string;
+    /** Raw payload (NOT pre-wrapped). The store assigns seq + wraps atomically. */
+    payload: unknown;
+    /** Server timestamp (ms) — passed in so tests can pin the clock. */
     timestamp: number;
     expiresAt: number;
   }): Promise<"ok" | "missing" | "active" | "raw">;

package/dist/{queryCachePlugin-xzFyKAjT.d.mts → queryCachePlugin-CfYWq-Ak.d.mts}

@@ -1,7 +1,6 @@
 import { r as CacheStore } from "./interface-C1_WLTMK.mjs";
-import { i as QueryCache } from "./QueryCache-TRfXau3W.mjs";
+import { i as QueryCache } from "./QueryCache-Z1B38koh.mjs";
 import { FastifyPluginAsync } from "fastify";
-
 //#region src/cache/queryCachePlugin.d.ts
 interface QueryCachePluginOptions {
   /** CacheStore instance. Default: MemoryCacheStore with default options. */

package/dist/rateLimitKey-BoWRH3e7.mjs

@@ -0,0 +1,14 @@
+//#region src/scope/rateLimitKey.ts
+function createTenantKeyGenerator(opts) {
+	if (opts?.strategy) return opts.strategy;
+	return (ctx) => {
+		const scope = ctx.scope;
+		if (!scope || scope.kind === "public") return ctx.ip;
+		if (scope.kind === "member") return scope.organizationId;
+		if (scope.kind === "service") return scope.organizationId;
+		if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
+		return scope.userId ?? ctx.ip;
+	};
+}
+//#endregion
+export { createTenantKeyGenerator as t };

package/dist/{redis-C3W0qbz8.d.mts → redis-UDtLaNj6.d.mts}

@@ -1,5 +1,4 @@
 import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
-
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {
   get(key: string): Promise<string | null>;

package/dist/{redis-stream-DsP1vqZB.d.mts → redis-stream-iVR2l7aS.d.mts}

@@ -1,5 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-IEn7Tn-Q.mjs";
-
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-QmY7A258.mjs";
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {
   xadd(key: string, id: string, ...fieldValues: string[]): Promise<string | null>;

package/dist/{registerRoute-DGSREwPw.mjs → registerRoute-xHc42fwB.mjs}

@@ -1,6 +1,6 @@
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
 import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
-import { M as evaluateAndApplyPermission } from "./permissions-CgbOLJZG.mjs";
+import { N as evaluateAndApplyPermission } from "./permissions-BJMuKMl7.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -81,24 +81,44 @@ function buildAuthMiddlewareForPermissions(fastify, permissions) {
 //#endregion
 //#region src/core/middlewares/chain.ts
 /**
-* Compose preHandler[] in the canonical order. Every null/undefined entry is
-* dropped. Keeps CRUD and Action routers from accidentally ordering the same
-* ingredients differently (regression risk: cache before auth → user-scoped
-* cache keys leak across users).
+* Compose the route-level `onRequest` + `preHandler` arrays in the canonical
+* order. Every null/undefined entry is dropped. Keeps the three routers from
+* accidentally ordering the same ingredients differently (regression risk:
+* cache before auth → user-scoped cache keys leak across users; auth after
+* body parse → anonymous schema probing).
 *
-* Canonical order:
-*   preAuth → arcDecorator → authMw → permissionMw → pluginMw → routeGuards → customMws
+* onRequest constraints (Fastify lifecycle): `request.body` is undefined —
+* everything placed there must be header/cookie/param/query-driven. arc's
+* `authenticate` / `optionalAuthenticate` qualify by contract (Bearer
+* header, session cookie, api-key header); `preAuth` handlers exist
+* precisely to promote query tokens into headers (SSE `?token=`); the arc
+* decorator stamps static route metadata.
 */
-function buildPreHandlerChain(parts) {
-	return [
-		...parts.preAuth ?? [],
-		parts.arcDecorator,
-		parts.authMw ?? null,
-		parts.permissionMw ?? null,
-		parts.pluginMw ?? null,
-		...parts.routeGuards ?? [],
-		...parts.customMws ?? []
-	].filter(Boolean);
+function buildRouteHooks(parts) {
+	return {
+		onRequest: [
+			...parts.preAuth ?? [],
+			parts.arcDecorator,
+			parts.authMw ?? null
+		].filter(Boolean),
+		preHandler: [
+			parts.permissionMw ?? null,
+			parts.pluginMw ?? null,
+			...parts.routeGuards ?? [],
+			...parts.customMws ?? []
+		].filter(Boolean)
+	};
+}
+/**
+* Spread helper — turns `RouteHookChains` into the two Fastify route-option
+* fields, omitting empty arrays so routes without middleware stay
+* option-free (Fastify skips absent hooks faster than empty arrays).
+*/
+function routeHookOptions(hooks) {
+	return {
+		...hooks.onRequest.length > 0 ? { onRequest: hooks.onRequest } : {},
+		...hooks.preHandler.length > 0 ? { preHandler: hooks.preHandler } : {}
+	};
 }
 /**
 * `RouteDefinition.preHandler` accepts two shapes:
@@ -329,4 +349,4 @@ function tryRegisterRoute(fastify, opts, context) {
 	}
 }
 //#endregion
-export { selectPluginMw as a, buildPreHandlerChain as c, buildAuthMiddlewareForPermissions as d, buildArcDecorator as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, buildAuthMiddleware as u };
+export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };

package/dist/registry/index.d.mts

@@ -1,7 +1,7 @@
-import { J as CrudRouteKey, R as RegisterOptions, V as ResourceDefinition, at as ResolvedTenantPurge, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-_--GyzcO.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DbtgCOCj.mjs";
+import "../fastify-augmentation-9_fuetB4.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
-
 //#region src/registry/assertNoTenantData.d.ts
 interface AssertNoTenantDataOptions {
   readonly organizationId: string;

package/dist/requestId-5BhTVzBv.mjs

@@ -0,0 +1,113 @@
+import { randomUUID } from "node:crypto";
+import fp from "fastify-plugin";
+//#region src/plugins/requestId.ts
+/**
+* Request ID Plugin
+*
+* Propagates request IDs for distributed tracing.
+* - Accepts incoming x-request-id header (sanitized)
+* - Generates UUID if not provided
+* - Echoes the id on the response header + W3C trace-context propagation
+*
+* ID RESOLUTION LIVES AT THE SERVER LEVEL, NOT HERE. Fastify binds
+* `request.log = logger.child({ reqId: request.id })` at request
+* construction — before any hook runs — so an id assigned inside a hook
+* never reaches the logs. `createApp` therefore wires
+* {@link createRequestIdGenerator} into Fastify's `genReqId` option, and
+* this plugin simply adopts `request.id`. Standalone registration on a
+* bare Fastify instance falls back to the legacy in-hook resolution
+* (header echo / UUID), with the documented limitation that
+* `request.log`'s `reqId` binding predates the overwrite — pass
+* `genReqId: createRequestIdGenerator()` to `Fastify()` to fix that.
+*
+* @example
+* import { requestIdPlugin, createRequestIdGenerator } from '@classytic/arc';
+*
+* const fastify = Fastify({ genReqId: createRequestIdGenerator() });
+* await fastify.register(requestIdPlugin);
+*
+* fastify.get('/', async (request) => {
+*   request.log.info('traced');   // carries the same reqId as the header
+*   return { id: request.id };
+* });
+*/
+/**
+* Sanitize an incoming request-id header value: max 128 chars, alphanumeric
+* plus dashes/underscores/dots/colons only. Returns `undefined` for anything
+* else (crafted values could pollute logs or response headers). Array values
+* (repeated headers) are rejected outright — a client sending multiple
+* request-id headers is not tracing in good faith.
+*/
+function sanitizeRequestId(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 && trimmed.length <= 128 && /^[\w.:-]+$/.test(trimmed) ? trimmed : void 0;
+}
+/**
+* Build a Fastify `genReqId` function: adopt a sanitized incoming request-id
+* header, or generate one. Wire this into the `Fastify()` constructor so
+* `request.id`, `request.log`'s `reqId` binding, and the echoed response
+* header all agree — `createApp` does this automatically.
+*/
+function createRequestIdGenerator(opts = {}) {
+	const { header = "x-request-id", generator = randomUUID } = opts;
+	const headerName = header.toLowerCase();
+	return (req) => sanitizeRequestId(req.headers[headerName]) ?? generator();
+}
+/** Fastify's default request ids are `req-<base36 counter>`. */
+const FASTIFY_DEFAULT_ID = /^req-[0-9a-z]+$/;
+/** W3C traceparent format: `version-traceid-parentid-flags` */
+const TRACEPARENT_RE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/i;
+/** W3C spec: version ff is reserved and invalid; trace/parent IDs must not be all zeros */
+const TRACEID_ZEROS = "0".repeat(32);
+const PARENTID_ZEROS = "0".repeat(16);
+/** tracestate: printable ASCII, <= 512 bytes */
+const TRACESTATE_MAX = 512;
+function isValidTraceparent(tp) {
+	const m = TRACEPARENT_RE.exec(tp);
+	if (!m) return false;
+	const version = m[1] ?? "";
+	const traceId = m[2] ?? "";
+	const parentId = m[3] ?? "";
+	if (version.toLowerCase() === "ff") return false;
+	if (traceId.toLowerCase() === TRACEID_ZEROS) return false;
+	if (parentId.toLowerCase() === PARENTID_ZEROS) return false;
+	return true;
+}
+const requestIdPlugin = async (fastify, opts = {}) => {
+	const { header = "x-request-id", generator = randomUUID, setResponseHeader = true, propagateTraceContext = true } = opts;
+	if (!fastify.hasRequestDecorator("requestId")) fastify.decorateRequest("requestId", "");
+	if (!fastify.hasRequestDecorator("traceContext")) fastify.decorateRequest("traceContext", void 0);
+	fastify.addHook("onRequest", async (request, reply) => {
+		const incoming = sanitizeRequestId(request.headers[header]);
+		let requestId = String(request.id);
+		if (incoming && incoming !== requestId) requestId = incoming;
+		else if (!incoming && FASTIFY_DEFAULT_ID.test(requestId)) requestId = generator();
+		if (requestId !== request.id) request.id = requestId;
+		request.requestId = requestId;
+		if (setResponseHeader) reply.header(header, requestId);
+		if (propagateTraceContext) {
+			const rawTraceparent = request.headers["traceparent"];
+			const rawTracestate = request.headers["tracestate"];
+			if (typeof rawTraceparent === "string") {
+				const tp = rawTraceparent.trim();
+				if (isValidTraceparent(tp)) {
+					const ts = typeof rawTracestate === "string" && rawTracestate.length > 0 && rawTracestate.length <= TRACESTATE_MAX ? rawTracestate : void 0;
+					request.traceContext = {
+						traceparent: tp,
+						...ts ? { tracestate: ts } : {}
+					};
+					reply.header("traceparent", tp);
+					if (ts) reply.header("tracestate", ts);
+				}
+			}
+		}
+	});
+	fastify.log?.debug?.("Request ID plugin registered");
+};
+var requestId_default = fp(requestIdPlugin, {
+	name: "arc-request-id",
+	fastify: "5.x"
+});
+//#endregion
+export { sanitizeRequestId as i, requestIdPlugin as n, requestId_default as r, createRequestIdGenerator as t };

package/dist/schemaConverter-Ds5reSGs.mjs

@@ -0,0 +1,168 @@
+import { arcLog } from "./logger/index.mjs";
+//#region src/utils/schemaConverter.ts
+/**
+* Schema Converter — Detect-First, Convert-Only-When-Needed
+*
+* Converts Zod v4 schemas to JSON Schema using Zod's native `z.toJSONSchema()`.
+* Plain JSON Schema objects pass through with zero overhead.
+*
+* Zod is an **optional** peer dependency — loaded lazily at module init;
+* `ensureSchemaConverter()` awaits readiness (arc's resource plugin does this
+* before converting). When a Zod schema shows up and can't be converted
+* (zod missing, zod v3, conversion throw), VALIDATION paths fail fast at
+* boot with an actionable error; DOC paths warn and degrade — see
+* {@link UnconvertibleMode}. Hosts that never pass Zod pay nothing.
+*
+* ## Targets
+*
+* Zod v4's `toJSONSchema` supports multiple output targets; arc picks per consumer:
+*
+* - **`draft-7`** (default) — for Fastify route schemas. Fastify v5 bundles AJV 8
+*   configured for draft-07, which uses **numeric** `exclusiveMinimum`/`exclusiveMaximum`.
+*   The `openapi-3.0` target emits the **boolean** form inherited from draft-04
+*   (`exclusiveMinimum: true` alongside `minimum`), which AJV rejects at route
+*   registration with `schema is invalid: data/properties/X/exclusiveMinimum must be number`.
+*   Using `draft-7` fixes `.positive() / .negative() / .gt() / .lt()` out of the box.
+* - **`openapi-3.0`** — for OpenAPI doc generation (arc emits OpenAPI 3.0.3). Keeps
+*   the boolean exclusive form that 3.0 tooling expects.
+*/
+const log = arcLog("schema");
+/** Default target for Fastify-consumed schemas (matches Fastify v5's default AJV draft). */
+const DEFAULT_FASTIFY_TARGET = "draft-7";
+/** Default target for OpenAPI document generation (matches arc's emitted OpenAPI version). */
+const DEFAULT_OPENAPI_TARGET = "openapi-3.0";
+let _toJSONSchema = null;
+const zodReady = import("zod").then(({ z }) => {
+	if (typeof z?.toJSONSchema === "function") _toJSONSchema = (schema, opts) => z.toJSONSchema(schema, opts);
+}).catch(() => {});
+/**
+* Await Zod-converter readiness. Arc's resource plugin awaits this once
+* before any schema conversion, closing the (theoretical) race between the
+* lazy `import("zod")` above and boot-time route registration. Resolves
+* immediately when zod isn't installed — absence is handled per-schema.
+*/
+function ensureSchemaConverter() {
+	return zodReady;
+}
+/**
+* Check if an object is already a plain JSON Schema.
+* Returns true if it has JSON Schema markers (`type`, `properties`, `$ref`,
+* `allOf`, `anyOf`, `oneOf`, `items`, `enum`) and does NOT have Zod markers.
+*/
+function isJsonSchema(input) {
+	if (input === null || typeof input !== "object") return false;
+	const obj = input;
+	if ("_def" in obj || "_zod" in obj) return false;
+	return "type" in obj || "properties" in obj || "$ref" in obj || "allOf" in obj || "anyOf" in obj || "oneOf" in obj || "items" in obj || "enum" in obj;
+}
+/**
+* Check if an object is a Zod schema (has `_zod` marker from Zod v4).
+*/
+function isZodSchema(input) {
+	return input !== null && typeof input === "object" && "_zod" in input;
+}
+/**
+* Zod v3 schemas carry `_def` but NOT v4's `_zod` marker. They can't be
+* converted (`z.toJSONSchema()` is v4-only) — detect them so the failure is
+* an actionable "upgrade to zod v4" instead of a cryptic AJV boot error
+* three layers away.
+*/
+function isZodV3Schema(input) {
+	if (input === null || typeof input !== "object") return false;
+	const obj = input;
+	return "_def" in obj && !("_zod" in obj);
+}
+function unconvertible(mode, message, cause) {
+	if (mode === "throw") throw new Error(`[arc/schema] ${message}`, cause ? { cause } : void 0);
+	log.warn(`${message} — degrading to permissive { type: 'object' } (validation disabled for this slot)`);
+	return { type: "object" };
+}
+/**
+* Convert any schema input to JSON Schema.
+*
+* Detection order:
+* 1. `null`/`undefined` → `undefined`
+* 2. Already JSON Schema → pass through as-is (zero overhead)
+* 3. Zod v4 schema → `z.toJSONSchema(schema, { target })`
+* 4. Zod v3 schema → unconvertible (actionable "upgrade to v4" error/warn)
+* 5. Unrecognized object → return as-is (treat as opaque schema)
+*
+* @param input  Schema (Zod, plain JSON Schema, or opaque object)
+* @param target Output target — defaults to `draft-7` for Fastify compatibility.
+*               Pass `openapi-3.0`/`openapi-3.1` for OpenAPI document generation.
+* @param mode   Failure policy for unconvertible Zod schemas — see
+*               {@link UnconvertibleMode}. Defaults to `'warn'`.
+*/
+function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn") {
+	if (input == null) return void 0;
+	if (typeof input !== "object") return void 0;
+	if (isJsonSchema(input)) return input;
+	if (isZodSchema(input)) {
+		if (!_toJSONSchema) return unconvertible(mode, "A Zod schema was passed but zod v4 is not installed (or not yet loaded). Install zod >=4 — arc converts via zod's native z.toJSONSchema().");
+		try {
+			const converted = _toJSONSchema(input, { target });
+			if ("$schema" in converted) delete converted.$schema;
+			return converted;
+		} catch (cause) {
+			return unconvertible(mode, `z.toJSONSchema() failed for a Zod schema (target: ${target}): ${cause instanceof Error ? cause.message : String(cause)}. Zod-only features with no JSON Schema equivalent (.refine/.transform/custom checks) cannot express wire validation — enforce those in the handler or a pipeline step.`, cause);
+		}
+	}
+	if (isZodV3Schema(input)) return unconvertible(mode, "A Zod v3 schema was passed (has `_def` but no v4 `_zod` marker). arc requires zod >=4 for schema conversion — upgrade zod, or pass plain JSON Schema.");
+	return input;
+}
+/**
+* Convert all schema fields in an OpenApiSchemas object.
+* JSON Schema values pass through unchanged. Only Zod schemas are converted.
+*
+* Defaults to the `openapi-3.0` target since this function feeds OpenAPI doc
+* generation, not Fastify route validation.
+*/
+function convertOpenApiSchemas(schemas, target = DEFAULT_OPENAPI_TARGET) {
+	const result = {};
+	const schemaFields = [
+		"entity",
+		"createBody",
+		"updateBody",
+		"params",
+		"listQuery",
+		"response"
+	];
+	for (const field of schemaFields) {
+		const value = schemas[field];
+		if (value !== void 0) result[field] = toJsonSchema(value, target) ?? value;
+	}
+	for (const [key, value] of Object.entries(schemas)) if (!schemaFields.includes(key)) result[key] = value;
+	return result;
+}
+/**
+* Convert schema values in a Fastify route schema record.
+*
+* Handles `body`, `querystring`, `params`, `headers` (top-level conversion)
+* and `response` (iterates by status code — each value converted individually).
+*
+* JSON Schema values pass through unchanged. Only Zod schemas are converted.
+*
+* Used for both custom routes and customSchemas (CRUD overrides).
+*
+* Defaults to `draft-7` so Fastify v5's bundled AJV 8 accepts the output.
+* Pass `openapi-3.0` (or `openapi-3.1`) when generating OpenAPI documents.
+*/
+function convertRouteSchema(schema, target = DEFAULT_FASTIFY_TARGET) {
+	const result = { ...schema };
+	const mode = target === DEFAULT_FASTIFY_TARGET ? "throw" : "warn";
+	for (const field of [
+		"body",
+		"querystring",
+		"params",
+		"headers"
+	]) if (result[field] !== void 0) result[field] = toJsonSchema(result[field], target, mode) ?? result[field];
+	if (result.response !== void 0 && typeof result.response === "object" && result.response !== null) {
+		const responseObj = result.response;
+		const convertedResponse = {};
+		for (const [statusCode, responseSchema] of Object.entries(responseObj)) convertedResponse[statusCode] = toJsonSchema(responseSchema, target, mode) ?? responseSchema;
+		result.response = convertedResponse;
+	}
+	return result;
+}
+//#endregion
+export { isZodSchema as a, isJsonSchema as i, convertRouteSchema as n, toJsonSchema as o, ensureSchemaConverter as r, convertOpenApiSchemas as t };

package/dist/{schemaIR-ajetw3Fv.mjs → schemaIR-B-6SPe7g.mjs}

@@ -1,4 +1,4 @@
-import { a as toJsonSchema } from "./schemaConverter-U0MnO9vd.mjs";
+import { o as toJsonSchema } from "./schemaConverter-Ds5reSGs.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.
@@ -49,7 +49,7 @@ function normalizeSchemaIR(raw) {
 		properties: {},
 		required: []
 	};
-	const converted = toJsonSchema(raw);
+	const converted = toJsonSchema(raw, "draft-7", "throw");
 	if (!converted || typeof converted !== "object" || converted.type !== "object" && !("properties" in converted)) return {
 		properties: {},
 		required: []

package/dist/schemas/index.d.mts

@@ -1,7 +1,6 @@
 import { ErrorContract, ErrorDetail } from "@classytic/repo-core/errors";
 import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider, TypeBoxValidatorCompiler } from "@fastify/type-provider-typebox";
 import { Static, TObject, TSchema, TSchema as TSchema$1, Type } from "@sinclair/typebox";
-
 //#region src/schemas/index.d.ts
 /**
  * Paginated list response — full union of every wire shape `toCanonicalList`

package/dist/scim/index.d.mts

@@ -1,6 +1,5 @@
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
-
 //#region src/scim/mapping.d.ts
 /**
  * SCIM 2.0 ↔ arc resource mapping

package/dist/scim/index.mjs

@@ -1,3 +1,4 @@
+import { t as parseJsonBody } from "../jsonBody-BlzAoGCe.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {
@@ -93,18 +94,16 @@ function asRecord(doc) {
 /**
 * Register the `application/scim+json` Fastify content-type parser. Idempotent
 * — second registration in the same scope is a no-op. Empty bodies (DELETE,
-* GET) yield `undefined` rather than crashing on `JSON.parse("")`.
+* GET) yield `undefined` rather than crashing on `JSON.parse("")`. Parsing
+* flows through `parseJsonBody`, so malformed SCIM payloads surface as 400
+* `arc.bad_request` (not 500) and prototype-poisoning bodies are rejected —
+* same contract as arc's main `application/json` parser.
 */
 function ensureScimContentTypeParser(fastify) {
 	if (fastify.hasContentTypeParser("application/scim+json")) return;
 	fastify.addContentTypeParser("application/scim+json", { parseAs: "string" }, (_req, body, done) => {
-		const raw = body;
-		if (!raw || raw.length === 0) {
-			done(null, void 0);
-			return;
-		}
 		try {
-			done(null, JSON.parse(raw));
+			done(null, parseJsonBody(body, "Invalid SCIM JSON payload"));
 		} catch (err) {
 			done(err, void 0);
 		}

package/dist/scope/index.d.mts

@@ -1,7 +1,6 @@
-import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-LNebCoJx.mjs";
-import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-xGUBq6p_.mjs";
+import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-DH0GupI7.mjs";
+import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
-
 //#region src/scope/rateLimitKey.d.ts
 interface RateLimitKeyContext {
   ip: string;

package/dist/scope/index.mjs

@@ -1,79 +1,5 @@
 import { C as isService, D as requireUserId, E as requireTeamId, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-bHblZ9YN.mjs";
-import { n as normalizeRoles } from "../types-XTApa8b6.mjs";
 import { n as elevation_default, t as elevationPlugin } from "../elevation-COpYKt2h.mjs";
-//#region src/scope/rateLimitKey.ts
-function createTenantKeyGenerator(opts) {
-	if (opts?.strategy) return opts.strategy;
-	return (ctx) => {
-		const scope = ctx.scope;
-		if (!scope || scope.kind === "public") return ctx.ip;
-		if (scope.kind === "member") return scope.organizationId;
-		if (scope.kind === "service") return scope.organizationId;
-		if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
-		return scope.userId ?? ctx.ip;
-	};
-}
-//#endregion
-//#region src/scope/resolveOrgFromHeader.ts
-/**
-* Create a preHandler hook that resolves org scope from a header.
-* Must run AFTER authentication so `request.user` is populated.
-* If the header is present and user is a member, sets `request.scope` to `member`.
-* If the header is absent, scope stays as-is (typically `authenticated`).
-*/
-function resolveOrgFromHeader(options) {
-	const { header = "x-organization-id", resolveMembership } = options;
-	return async (request, reply) => {
-		const orgId = request.headers[header];
-		if (!orgId) return;
-		const scope = request.scope;
-		if (!scope || scope.kind === "public") {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		if (scope.kind === "elevated") return;
-		const user = request.user;
-		if (!user) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		const userId = String(user.id ?? user._id ?? "");
-		if (!userId) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "User identity required for organization access"
-			});
-			return;
-		}
-		const membership = await resolveMembership(userId, orgId);
-		if (!membership) {
-			reply.code(403).send({
-				success: false,
-				error: "Forbidden",
-				message: "Not a member of this organization",
-				code: "ORG_ACCESS_DENIED"
-			});
-			return;
-		}
-		request.scope = {
-			kind: "member",
-			userId: userId || void 0,
-			userRoles: normalizeRoles(user.role),
-			organizationId: orgId,
-			orgRoles: membership.roles
-		};
-	};
-}
-//#endregion
+import { t as createTenantKeyGenerator } from "../rateLimitKey-BoWRH3e7.mjs";
+import { t as resolveOrgFromHeader } from "../scope-k15RXfcq.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };

package/dist/scope-k15RXfcq.mjs

@@ -0,0 +1,64 @@
+import { n as normalizeRoles } from "./types-XTApa8b6.mjs";
+//#region src/scope/resolveOrgFromHeader.ts
+/**
+* Create a preHandler hook that resolves org scope from a header.
+* Must run AFTER authentication so `request.user` is populated.
+* If the header is present and user is a member, sets `request.scope` to `member`.
+* If the header is absent, scope stays as-is (typically `authenticated`).
+*/
+function resolveOrgFromHeader(options) {
+	const { header = "x-organization-id", resolveMembership } = options;
+	return async (request, reply) => {
+		const orgId = request.headers[header];
+		if (!orgId) return;
+		const scope = request.scope;
+		if (!scope || scope.kind === "public") {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "Authentication required for organization access",
+				code: "ORG_AUTH_REQUIRED"
+			});
+			return;
+		}
+		if (scope.kind === "elevated") return;
+		const user = request.user;
+		if (!user) {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "Authentication required for organization access",
+				code: "ORG_AUTH_REQUIRED"
+			});
+			return;
+		}
+		const userId = String(user.id ?? user._id ?? "");
+		if (!userId) {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "User identity required for organization access"
+			});
+			return;
+		}
+		const membership = await resolveMembership(userId, orgId);
+		if (!membership) {
+			reply.code(403).send({
+				success: false,
+				error: "Forbidden",
+				message: "Not a member of this organization",
+				code: "ORG_ACCESS_DENIED"
+			});
+			return;
+		}
+		request.scope = {
+			kind: "member",
+			userId: userId || void 0,
+			userRoles: normalizeRoles(user.role),
+			organizationId: orgId,
+			orgRoles: membership.roles
+		};
+	};
+}
+//#endregion
+export { resolveOrgFromHeader as t };