@classytic/arc 2.20.0 → 2.22.0

package/dist/{init-YH_nslQR.mjs → init-DleK3p9f.mjs}

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -17,7 +18,7 @@ function createAdapterTemplate(config) {
 
 import { createMongooseAdapter } from '@classytic/mongokit/adapter';
 import { buildCrudSchemasFromModel } from '@classytic/mongokit';
-${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
+${ts ? "import type { DataAdapter } from '@classytic/repo-core/adapter';\nimport type { Model } from 'mongoose';\nimport type { Repository } from '@classytic/mongokit';" : ""}
 
 /**
  * Create a MongoKit-powered adapter for a resource.
@@ -30,7 +31,10 @@ ${ts ? "import type { Model } from 'mongoose';\nimport type { Repository } from
 export function createAdapter${ts ? "<TDoc = unknown>" : ""}(
   model${ts ? ": Model<TDoc>" : ""},
   repository${ts ? ": Repository<TDoc>" : ""}
-) {
+)${ts ? ": DataAdapter<TDoc>" : ""} {
+  // Explicit return type keeps the declaration portable — under pnpm's
+  // non-hoisted layout the inferred type references mongokit's internal
+  // paths and tsc fails with TS2742/TS2883.
   return createMongooseAdapter({
     model,
     repository,
@@ -73,6 +77,60 @@ export function createAdapter${ts ? "<TDoc = unknown>" : ""}(
 `;
 }
 //#endregion
+//#region src/cli/commands/init/templates/agents.ts
+function agentsGuideTemplate(config) {
+	return `# CLAUDE.md — agent guide for this app
+
+> This file doubles as AGENTS.md — copy or symlink if your tool reads that name.
+
+**This is an \`@classytic/arc\` application.** Resources are DECLARED, not hand-rolled:
+one \`defineResource()\` = REST + validation + auth + permissions + events + caching +
+OpenAPI + MCP tools. Data layer: ${config.adapter === "mongokit" ? "@classytic/mongokit (Mongoose)" : "a custom DataAdapter kit"}.
+
+## The one rule
+
+**Hand-rolling is a bug.** Before writing ANY route, validation, pagination, auth check,
+cron, counter, or audit code by hand, prove arc lacks it — check the table below, then
+\`node_modules/@classytic/arc/skills/arc/SKILL.md\` (full framework guide + references).
+
+## About to write X? Arc already has Y
+
+| If you're about to write… | Use instead |
+|---|---|
+| \`fastify.get/post/...\` CRUD routes for an entity | \`defineResource({ name, adapter, permissions })\` |
+| \`if (req.user.role !== 'admin') return 403\` | \`permissions: { update: requireRoles(['admin']) }\` |
+| Reading \`req.user._id\` / org id directly | \`getUserId(scope)\` / \`requireOrgId(scope)\` from \`@classytic/arc/scope\` |
+| Hand-written \`schema: { body }\` / JSON Schema | \`schemaOptions.fieldRules\` (or \`customSchemas\` for wire≠model) |
+| toJSON transforms hiding \`password\`/internals | \`fieldRules: { password: { hidden: true } }\` |
+| Manual \`req.query\` filter/sort/pagination parsing | the resource's \`queryParser\` (allow-listed fields) |
+| Soft delete / slug lookup / tree / bulk / file upload | \`presets: ['softDelete', 'slugLookup', ...]\` |
+| \`setInterval\` sweeps + hand-rolled leader lock | \`schedulesPlugin\` (\`@classytic/arc/plugins\`) |
+| A background/queue worker entrypoint | \`createWorker(sameOptions)\` (\`@classytic/arc/factory\`) |
+| Usage counters / quotas / plan rate limits | \`usagePlugin\` + \`requireQuota\` + \`rateLimit.plan\` |
+| Audit log rows / "who changed what" endpoints | \`audit: true\` + \`history: true\` on the resource |
+| Manual idempotency keys / dedupe | \`idempotencyPlugin\` |
+| Event emitters / webhooks plumbing | \`eventPlugin\` + resource \`events:\` (+ outbox for guarantees) |
+| Custom MCP/AI tool handlers | generated automatically from every resource |
+
+## Load-bearing conventions
+
+- \`request.user\` is \`undefined\` on public routes — always guard.
+- Never read \`scope.organizationId\` directly — use \`@classytic/arc/scope\` accessors.
+- The DB connection belongs in \`createApp({ beforeBoot })\` — not before \`createApp\`.
+- Custom endpoints: \`routes:\`/\`actions:\` on the resource (they inherit auth/permissions/
+  OpenAPI/MCP) — a bare \`fastify.get()\` gets none of that.
+
+## Commands
+
+\`\`\`bash
+npm run dev        # watch mode
+npm test           # vitest
+npx arc generate resource <name>   # scaffold a resource (model/repo/resource files)
+npx arc describe   # list registered resources + routes
+\`\`\`
+`;
+}
+//#endregion
 //#region src/cli/commands/init/templates/app.ts
 function indexTemplate(config) {
 	const ts = config.typescript;
@@ -439,8 +497,8 @@ function betterAuthSetupTemplate(config) {
 import { mongodbAdapter } from '@better-auth/mongo-adapter';` : "";
 	const stubsImport = useStubs ? `import { registerBetterAuthStubs } from '@classytic/mongokit/better-auth';` : "";
 	const pluginImports = [
-		useOrg ? `import { organization } from 'better-auth/plugins';` : "",
-		useBearer ? `import { bearer } from 'better-auth/plugins';` : "",
+		useOrg ? `import { organization } from 'better-auth/plugins/organization';` : "",
+		useBearer ? `import { bearer } from 'better-auth/plugins/bearer';` : "",
 		useApiKey ? `import { apiKey } from '@better-auth/api-key';` : ""
 	].filter(Boolean).join("\n");
 	const dbAdapter = useMongo ? config.typescript ? `database: mongodbAdapter(mongoose.connection.getClient().db() as unknown as never),` : `database: mongodbAdapter(mongoose.connection.getClient().db()),` : `// Configure your database adapter here
@@ -484,20 +542,13 @@ ${[
 	].filter(Boolean).join("\n")}
 import config from '#config/index.js';
 
-let _auth${ts ? ": ReturnType<typeof betterAuth> | null" : ""} = null;
-
-/**
- * Get the Better Auth instance (lazy singleton)
- *
- * Must be called AFTER database connection is established.
- */
-export function getAuth()${ts ? ": ReturnType<typeof betterAuth>" : ""} {
-  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
-    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
-  }
-
-  if (!_auth) {
-    _auth = betterAuth({
+// Factory keeps the CONCRETE betterAuth({...}) instantiation as the source
+// of truth for the instance type — annotating with the wide
+// \`Auth<BetterAuthOptions>\` (aka \`ReturnType<typeof betterAuth>\`) does not
+// typecheck because Better Auth's \`Auth<T>\` is generic over the exact
+// options object.
+function createAuth() {
+  return betterAuth({
       secret: config.betterAuth.secret,
       baseURL: process.env.BETTER_AUTH_URL || \`http://localhost:\${config.server.port}\`,
       basePath: '/api/auth',
@@ -545,6 +596,26 @@ ${orgPluginUsage}
         enabled: process.env.NODE_ENV === 'production',
       },
     });
+}
+
+let _auth${ts ? ": ReturnType<typeof createAuth> | null" : ""} = null;
+
+/**
+ * Get the Better Auth instance (lazy singleton)
+ *
+ * Must be called AFTER database connection is established.
+ */
+export function getAuth()${ts ? ": ReturnType<typeof createAuth>" : ""} {
+  if (process.env.NODE_ENV === 'production' && !process.env.BETTER_AUTH_SECRET) {
+    throw new Error('BETTER_AUTH_SECRET is required in production (min 32 chars)');
+  }
+
+  // Narrow through a local — assigning the module-level \`_auth\` directly
+  // would lose the non-null narrowing across the calls below.
+  let auth = _auth;
+  if (!auth) {
+    auth = createAuth();
+    _auth = auth;
 ${useStubs ? `
     // Register stub Mongoose models for Better Auth's collections so
     // \`.populate('user')\` / \`ref: 'organization'\` resolve against BA-owned
@@ -552,7 +623,7 @@ ${useStubs ? `
     registerBetterAuthStubs(mongoose, {${stubPluginsList ? ` plugins: [${stubPluginsList}]` : ""}${stubExtras} });
 ` : ""}  }
 
-  return _auth;
+  return auth;
 }
 
 export default getAuth;
@@ -692,6 +763,9 @@ export async function getUserProfile(request${ts ? ": FastifyRequest" : ""}, rep
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const user = await userRepository.getById(userId);
 
     if (!user) {
@@ -712,6 +786,9 @@ export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""},
   try {
     const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
+    if (!userId) {
+      return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
+    }
     const updates${ts ? ": Record<string, unknown>" : ""} = { ...request.body${ts ? " as Record<string, unknown>" : ""} };
 
     // Prevent updating protected fields — auth-managed only
@@ -840,20 +917,29 @@ function authTestTemplate(config) {
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\n" : ""}import { createAppInstance } from '../src/app.js';
+${config.adapter === "mongokit" ? "import mongoose from 'mongoose';\nimport { MongoMemoryServer } from 'mongodb-memory-server';\n" : ""}import { createAppInstance } from '../src/app.js';
 ${ts ? "import type { FastifyInstance } from 'fastify';\n" : ""}
+// Resources mount under the app's resourcePrefix (see src/app.${ts ? "ts" : "js"}).
+const API = '/api';
+
 describe('Auth', () => {
   let app${ts ? ": FastifyInstance" : ""};
-  const testUser = {
+${config.adapter === "mongokit" ? `  let mongo${ts ? ": MongoMemoryServer | undefined" : ""};\n` : ""}  const testUser = {
     name: 'Test User',
     email: 'test@example.com',
     password: 'password123',
   };
 
   beforeAll(async () => {
-${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI || 'mongodb://localhost:27017/${config.name}-test';
-    await mongoose.connect(testDbUri);
-    // Clean up test data
+${config.adapter === "mongokit" ? `    // In-memory MongoDB — no local mongod required. Set MONGODB_URI to use
+    // a real instance instead (e.g. a CI service container).
+    let uri = process.env.MONGODB_URI;
+    if (!uri) {
+      mongo = await MongoMemoryServer.create();
+      uri = mongo.getUri();
+    }
+    await mongoose.connect(uri);
+    // Clean up test data (matters when MONGODB_URI points at a shared DB)
     await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
 ` : ""}
     app = await createAppInstance();
@@ -862,27 +948,29 @@ ${config.adapter === "mongokit" ? `    const testDbUri = process.env.MONGODB_URI
 
   afterAll(async () => {
 ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('users').deleteMany({ email: testUser.email });
+    await app.close();
     await mongoose.connection.close();
-` : ""}    await app.close();
-  });
+    await mongo?.stop();
+` : `    await app.close();
+`}  });
 
   describe('POST /auth/register', () => {
     it('should register a new user', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
       expect(response.statusCode).toBe(201);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.message).toBeDefined();
     });
 
     it('should reject duplicate email', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/register',
+        url: \`\${API}/auth/register\`,
         payload: testUser,
       });
 
@@ -894,13 +982,13 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should login with valid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: testUser.password },
       });
 
       expect(response.statusCode).toBe(200);
       const body = JSON.parse(response.body);
-      expect(body.success).toBe(true);
+      expect(body.user).toBeDefined();
       expect(body.accessToken).toBeDefined();
       expect(body.refreshToken).toBeDefined();
     });
@@ -908,7 +996,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should reject invalid credentials', async () => {
       const response = await app.inject({
         method: 'POST',
-        url: '/auth/login',
+        url: \`\${API}/auth/login\`,
         payload: { email: testUser.email, password: 'wrongpassword' },
       });
 
@@ -920,7 +1008,7 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
     it('should require authentication', async () => {
       const response = await app.inject({
         method: 'GET',
-        url: '/users/me',
+        url: \`\${API}/users/me\`,
       });
 
       expect(response.statusCode).toBe(401);
@@ -952,11 +1040,16 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 * `installDependencies` (runs the package manager's `install` against
 * the declared ranges). One source — no drift.
 */
+var dependency_plan_exports = /* @__PURE__ */ __exportAll({
+	SCAFFOLD_DEP_VERSIONS: () => SCAFFOLD_DEP_VERSIONS,
+	primeLatestScaffoldVersions: () => primeLatestScaffoldVersions,
+	resolveScaffoldDependencies: () => resolveScaffoldDependencies
+});
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
 		"@classytic/arc": "^2.20.0",
-		"@classytic/primitives": "^0.9.1",
-		"@classytic/repo-core": "^0.7.0",
+		"@classytic/primitives": "^0.11.0",
+		"@classytic/repo-core": "^0.8.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -976,7 +1069,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	},
 	authBetterAuthApiKey: { "@better-auth/api-key": "^1.6.11" },
 	adapterMongokit: {
-		"@classytic/mongokit": "^3.16.1",
+		"@classytic/mongokit": "^3.21.0",
 		mongoose: "^9.6.2"
 	},
 	devCommon: {
@@ -988,7 +1081,7 @@ const SCAFFOLD_DEP_VERSIONS = {
 	devTypescript: {
 		"@types/node": "^22.10.0",
 		tsx: "^4.22.3",
-		typescript: "^6.0.3"
+		typescript: "^7.0.2"
 	},
 	typesJwt: { "@types/bcryptjs": "^3.0.0" }
 };
@@ -1036,6 +1129,51 @@ function floorLessThan(a, b) {
 *     floor>` when the static pin's floor is BELOW the declared peer floor
 *     (never lowered — static pins may legitimately be ahead of the floor).
 */
+const latestCache = /* @__PURE__ */ new Map();
+function allScaffoldPackageNames() {
+	const names = /* @__PURE__ */ new Set();
+	for (const group of Object.values(SCAFFOLD_DEP_VERSIONS)) for (const name of Object.keys(group)) names.add(name);
+	return [...names];
+}
+async function primeLatestScaffoldVersions(options) {
+	const timeoutMs = options?.timeoutMs ?? 3500;
+	const registry = (options?.registry ?? process.env.npm_config_registry ?? "https://registry.npmjs.org").replace(/\/$/, "");
+	const names = allScaffoldPackageNames();
+	const results = await Promise.allSettled(names.map(async (name) => {
+		const res = await fetch(`${registry}/${name}/latest`, {
+			signal: AbortSignal.timeout(timeoutMs),
+			headers: { accept: "application/json" }
+		});
+		if (!res.ok) throw new Error(String(res.status));
+		const body = await res.json();
+		if (typeof body.version === "string" && /^\d+\.\d+\.\d+$/.test(body.version)) latestCache.set(name, body.version);
+	}));
+	return {
+		resolved: latestCache.size,
+		total: results.length
+	};
+}
+function parseBareVersion(v) {
+	const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v);
+	return m ? [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	] : void 0;
+}
+function applyLatestOverlay(dependencies) {
+	if (latestCache.size === 0) return;
+	for (const [name, currentRange] of Object.entries(dependencies)) {
+		const latest = latestCache.get(name);
+		if (!latest || latest.includes("-")) continue;
+		const latestV = parseBareVersion(latest);
+		const currentFloor = parseFloor(currentRange);
+		if (!latestV || !currentFloor) continue;
+		if (!floorLessThan(currentFloor, latestV)) continue;
+		if (latestV[0] !== currentFloor[0] && !name.startsWith("@classytic/")) continue;
+		dependencies[name] = `^${latest}`;
+	}
+}
 function overlayLiveArcVersions(dependencies) {
 	const own = readOwnPackageJson();
 	if (!own) return;
@@ -1061,6 +1199,7 @@ function resolveScaffoldDependencies(config) {
 	const devDependencies = { ...SCAFFOLD_DEP_VERSIONS.devCommon };
 	if (config.auth === "better-auth") {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuth);
+		devDependencies["@fastify/jwt"] = SCAFFOLD_DEP_VERSIONS.authJwt["@fastify/jwt"];
 		if (config.apiKey) Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authBetterAuthApiKey);
 	} else {
 		Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.authJwt);
@@ -1068,6 +1207,8 @@ function resolveScaffoldDependencies(config) {
 	}
 	if (config.adapter === "mongokit") Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.adapterMongokit);
 	if (config.typescript) Object.assign(devDependencies, SCAFFOLD_DEP_VERSIONS.devTypescript);
+	applyLatestOverlay(dependencies);
+	applyLatestOverlay(devDependencies);
 	overlayLiveArcVersions(dependencies);
 	return {
 		dependencies: sortByKey(dependencies),
@@ -1159,6 +1300,7 @@ function tsconfigTemplate() {
 			declarationMap: true,
 			sourceMap: true,
 			resolveJsonModule: true,
+			types: ["node"],
 			paths: {
 				"#shared/*": ["./src/shared/*"],
 				"#resources/*": ["./src/resources/*"],
@@ -2053,7 +2195,13 @@ import { describe, it, beforeAll, afterAll } from 'vitest';
 import { createTestApp, expectArc } from '@classytic/arc/testing';
 import type { TestAppContext${ts ? ", TestAuthProvider" : ""} } from '@classytic/arc/testing';
 import exampleResource from '../src/resources/example/example.resource.js';
-
+${config.tenant === "multi" ? `
+// Valid ObjectId hex — the example model types organizationId and createdBy
+// as ObjectId (createdBy is auto-stamped from the caller's user id).
+const TEST_ORG_ID = '64f000000000000000000001';
+const MANAGER_ID = '64f0000000000000000000a1';
+const STAFF_ID = '64f0000000000000000000a2';
+` : ""}
 describe('Example Resource', () => {
   let ctx${ts ? ": TestAppContext" : ""};
   // Narrowed once below — \`authMode: 'jwt'\` guarantees a provider, but
@@ -2068,17 +2216,70 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
 
     if (!ctx.auth) throw new Error('Test auth provider was not configured');
     auth = ctx.auth;
-
+${config.tenant === "multi" ? `
+    // Arc's JWT auth builds a MEMBER scope straight from token claims —
+    // \`organizationId\` + \`orgRoles\` land on \`request.scope\`. The org-staff
+    // permission set reads those org roles; the tenant preset filters and
+    // stamps rows by the org id.
+    auth.register('manager', {
+      user: { id: MANAGER_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['manager'] },
+      orgId: TEST_ORG_ID,
+    });
+    auth.register('staff', {
+      user: { id: STAFF_ID, role: 'user', organizationId: TEST_ORG_ID, orgRoles: ['staff'] },
+      orgId: TEST_ORG_ID,
+    });
+` : `
     // Arc's permission engine reads singular user.role — string,
     // comma-separated string, or array all normalise via getUserRoles().
+    // The id must be ObjectId-shaped: the example model's createdBy is an
+    // ObjectId, auto-stamped from the caller's user id.
     auth.register('admin', {
-      user: { id: '1', role: 'admin' },
-      orgId: 'org-1',
+      user: { id: '64f0000000000000000000ad', role: 'admin' },
     });
-  });
+`}  });
 
   afterAll(() => ctx.close());
+${config.tenant === "multi" ? `
+  describe('GET /examples', () => {
+    it('should reject unauthenticated listing (org-staff gated)', async () => {
+      const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
+      expectArc(res).unauthorized();
+    });
+
+    it('should list for an org member (rows scoped to their org)', async () => {
+      const res = await ctx.app.inject({
+        method: 'GET',
+        url: '/examples',
+        headers: auth.as('staff').headers,
+      });
+      expectArc(res).ok().paginated();
+    });
+  });
+
+  describe('POST /examples', () => {
+    it('should require authentication', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).unauthorized();
+    });
 
+    it('should create for an org manager — organizationId stamped server-side', async () => {
+      const res = await ctx.app.inject({
+        method: 'POST',
+        url: '/examples',
+        headers: auth.as('manager').headers,
+        // No organizationId in the body — the tenant preset injects it from
+        // the caller's scope (the field is systemManaged in the schema).
+        payload: { name: 'Test Example' },
+      });
+      expectArc(res).ok(201);
+    });
+  });
+` : `
   describe('GET /examples', () => {
     it('should return a list of examples (public)', async () => {
       const res = await ctx.app.inject({ method: 'GET', url: '/examples' });
@@ -2103,9 +2304,10 @@ ${config.adapter === "mongokit" ? "      connectMongoose: true,\n" : ""}    });
         headers: auth.as('admin').headers,
         payload: { name: 'Test Example' },
       });
-      expectArc(res).ok();
+      expectArc(res).ok(201);
     });
   });
+`}
 
   // Add more tests as needed:
   // - GET /examples/:id         (expectArc(res).ok().hasData({ name: '...' }))
@@ -2495,113 +2697,35 @@ function flexibleMultiTenantPresetTemplate(config) {
 	return `/**
  * Flexible Multi-Tenant Preset
  *
- * Smarter tenant filtering that works with public + authenticated routes.
+ * Thin wrapper around arc's built-in 'multiTenantPreset' with public reads:
+ *
+ * - list/get WITHOUT org context → allowed through unfiltered (public data)
+ * - org context present → rows filtered + stamped to the caller's org
+ * - elevated (platform admin) → unfiltered, cross-tenant
+ * - create/update fail closed without org context, and update overwrites any
+ *   client-supplied tenant field (no cross-tenant document hops)
  *
- * Philosophy:
- * - No org scope → No filtering (public data, all orgs)
- * - Org scope present → Filter by org
- * - Elevated scope → No filter (platform admin sees all)
+ * The built-in preset also registers 'systemManaged' field rules for the
+ * tenant field, so generated request schemas never demand it in the body —
+ * the server stamps it from the caller's scope instead. Don't hand-roll
+ * tenant middleware: without those field rules Fastify's validation rejects
+ * creates before injection can run.
  *
- * Uses request.scope (RequestScope) from Arc's scope system.
+ * Want members-only reads? Drop 'allowPublic' below, or use
+ * 'multiTenantPreset({ tenantField })' directly on the resource.
  */
 ${ts ? `
-import { getOrgId, isElevated, isMember } from '@classytic/arc/scope';
-import type { RequestScope } from '@classytic/arc/scope';
+import { multiTenantPreset } from '@classytic/arc/presets/tenant';
 
 interface FlexibleMultiTenantOptions {
   tenantField?: string;
 }
-
-interface PresetMiddlewares {
-  list: ((request: any, reply: any) => Promise<void>)[];
-  get: ((request: any, reply: any) => Promise<void>)[];
-  create: ((request: any, reply: any) => Promise<void>)[];
-  update: ((request: any, reply: any) => Promise<void>)[];
-  delete: ((request: any, reply: any) => Promise<void>)[];
-}
-
-interface Preset {
-  [key: string]: unknown;
-  name: string;
-  middlewares: PresetMiddlewares;
-}
 ` : `
-const { getOrgId, isElevated, isMember } = require('@classytic/arc/scope');
+const { multiTenantPreset } = require('@classytic/arc/presets/tenant');
 `}
-/**
- * Create flexible tenant filter middleware.
- * Only filters when org context is present.
- */
-function createFlexibleTenantFilter(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-
-    // Elevated scope — platform admin sees all, no filter
-    if (isElevated(scope)) {
-      request.log?.debug?.({ msg: 'Elevated scope — no tenant filter' });
-      return;
-    }
-
-    // Member scope — filter by org
-    if (isMember(scope)) {
-      request.query = request.query ?? {};
-      request.query._policyFilters = {
-        ...(request.query._policyFilters ?? {}),
-        [tenantField]: scope.organizationId,
-      };
-      request.log?.debug?.({ msg: 'Tenant filter applied', orgId: scope.organizationId, tenantField });
-      return;
-    }
-
-    // Public / authenticated — no org context, show all data (public routes)
-    request.log?.debug?.({ msg: 'No org context — showing all data' });
-  };
-}
-
-/**
- * Create tenant injection middleware.
- * Injects tenant ID into request body on create.
- */
-function createTenantInjection(tenantField${ts ? ": string" : ""}) {
-  return async (request${ts ? ": any" : ""}, reply${ts ? ": any" : ""}) => {
-    const scope${ts ? ": RequestScope" : ""} = request.scope ?? { kind: 'public' };
-    const orgId = getOrgId(scope);
-
-    // Fail-closed: Require orgId for create operations
-    if (!orgId) {
-      return reply.code(403).send({
-        error: 'Organization context required to create resources',
-        code: 'arc.org_required',
-      });
-    }
-
-    if (request.body) {
-      request.body[tenantField] = orgId;
-    }
-  };
-}
-
-/**
- * Flexible Multi-Tenant Preset
- *
- * @param options.tenantField - Field name in database (default: 'organizationId')
- */
-export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"})${ts ? ": Preset" : ""} {
+export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"}) {
   const { tenantField = 'organizationId' } = options;
-
-  const tenantFilter = createFlexibleTenantFilter(tenantField);
-  const tenantInjection = createTenantInjection(tenantField);
-
-  return {
-    name: 'flexibleMultiTenant',
-    middlewares: {
-      list: [tenantFilter],
-      get: [tenantFilter],
-      create: [tenantInjection],
-      update: [tenantFilter],
-      delete: [tenantFilter],
-    },
-  };
+  return multiTenantPreset({ tenantField, allowPublic: ['list', 'get'] });
 }
 
 export default flexibleMultiTenantPreset;
@@ -3013,6 +3137,7 @@ async function createProjectStructure(projectPath, config) {
 		files["docker-compose.yml"] = dockerComposeTemplate(config);
 	}
 	if (config.edge) files["wrangler.toml"] = wranglerTemplate(config);
+	files["CLAUDE.md"] = agentsGuideTemplate(config);
 	files[".arcrc"] = `${JSON.stringify({
 		adapter: config.adapter,
 		auth: config.auth,
@@ -3312,6 +3437,14 @@ async function init(options = {}) {
 	}
 	const packageManager = detectPackageManager();
 	console.log(`Using package manager: ${packageManager}\n`);
+	if (!process.env.VITEST && process.env.ARC_INIT_OFFLINE !== "1") {
+		const { primeLatestScaffoldVersions } = await Promise.resolve().then(() => dependency_plan_exports);
+		const { resolved, total } = await primeLatestScaffoldVersions().catch(() => ({
+			resolved: 0,
+			total: 0
+		}));
+		console.log(resolved > 0 ? `Resolved ${resolved}/${total} dependency versions from npm (latest stable)\n` : "Registry unreachable — using pinned fallback versions\n");
+	}
 	await createProjectStructure(projectPath, config);
 	if (!options.skipInstall) {
 		console.log("\n📥 Installing dependencies...\n");

package/dist/integrations/event-gateway.d.mts

@@ -1,7 +1,6 @@
-import { n as DomainEvent } from "../EventTransport-IEn7Tn-Q.mjs";
-import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-MlYlrYq0.mjs";
+import { n as DomainEvent } from "../EventTransport-QmY7A258.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-uuWqM6UY.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
-
 //#region src/integrations/event-gateway.d.ts
 interface EventGatewayOptions {
   /** Require auth for all real-time connections (default: true) */

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
-import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-MlYlrYq0.mjs";
+import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-uuWqM6UY.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-C9b2HR5W.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-Bc42CUyk.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };