@classytic/arc 2.21.0 → 2.22.0

package/dist/{index-B5PoNbfu.d.mts → index-ogIHvOjo.d.mts}

@@ -1,6 +1,6 @@
 import { r as CacheStore, t as CacheLogger } from "./interface-C1_WLTMK.mjs";
 import { i as RequestScope, n as Mandate } from "./types-DH0GupI7.mjs";
-import { c as PermissionCheck, l as PermissionContext, u as PermissionResult } from "./fields-BGqrAa_u.mjs";
+import { n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-Csxga7d3.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
 /**

package/dist/index.d.mts

@@ -1,8 +1,9 @@
-import { $t as UserOrganization, A as RequestIdOptions, An as ArcCreateResult, At as AggregationMaterializedResult, B as defineResource, C as RequestContext, Ct as AggMeasureInput, D as HealthCheck, Dt as AggregationDateRangeRequirement, E as GracefulShutdownOptions, Et as AggregationConfig, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ht as AuthPluginOptions, In as ControllerConfigurableOptions, J as CrudRouteKey, Jt as ApiResponse, L as RequestWithExtras, Ln as ControllerConstructionOptions, Mn as ArcGetResult, Mt as AggregationsMap, N as FastifyRequestExtras, Nn as ArcListResult, O as HealthOptions, Ot as AggregationIndexHint, P as FastifyWithAuth, Pn as ArcUpdateResult, Q as MiddlewareConfig, Rn as ListResult, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, Tt as AggregationCacheConfig, V as ResourceDefinition, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, _t as ControllerLike, a as InferAdapterDoc, an as SlugExt, bt as IControllerResponse, c as TypedController, cn as BulkMixin, d as PaginationResult, en as BaseController, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, in as TreeMixin, it as RateLimitConfig, jn as ArcDeleteResult, jt as AggregationRateLimit, k as IntrospectionPluginOptions, kt as AggregationMaterializedContext, l as TypedRepository, ln as BaseCrudController, m as RegistryStats, n as ConfigError, nn as SoftDeleteMixin, o as InferDocType, on as SlugMixin, p as RegistryEntry, q as CrudController, qt as AnyRecord, r as ValidateOptions, rn as TreeExt, rt as PresetResult, s as InferResourceDoc, sn as BulkExt, st as ResourceConfig, t as RouteHandlerMethod, tn as SoftDeleteExt, tt as PresetFunction, u as TypedResourceConfig, w as ServiceContext, wt as AggMeasureShorthand, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "./index-Dtrj6XZk.mjs";
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, t as FieldPermission, u as PermissionResult } from "./fields-BGqrAa_u.mjs";
-import "./fastify-augmentation-DafigGQp.mjs";
-import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, m as ResourceSeams, p as AdapterLike, s as getControllerScope, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, z as RESERVED_QUERY_PARAMS } from "./index-B5N-NaHs.mjs";
-import { A as requireOwnership, C as createOrgPermissions, D as denyAll, E as anyOf, N as when, S as createDynamicPermissionMatrix, T as allowPublic, b as DynamicPermissionMatrixConfig, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as requireRoles, k as requireAuth, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, w as allOf, y as DynamicPermissionMatrix } from "./index-B5PoNbfu.mjs";
+import { $t as UserOrganization, A as RequestIdOptions, An as ArcCreateResult, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ft as ControllerLike, H as CrudController, Ht as AuthPluginOptions, In as ControllerConfigurableOptions, Jt as ApiResponse, L as RequestWithExtras, Ln as ControllerConstructionOptions, Lt as IController, Mn as ArcGetResult, N as FastifyRequestExtras, Nn as ArcListResult, Nt as RateLimitConfig, O as HealthOptions, P as FastifyWithAuth, Pn as ArcUpdateResult, Q as MiddlewareConfig, Rn as ListResult, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, X as CrudRouteKey, Xt as JWTPayload, Y as PresetResult, Yt as ArcRequest, Z as CrudSchemas, a as InferAdapterDoc, an as SlugExt, c as TypedController, cn as BulkMixin, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as BaseController, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, in as TreeMixin, jn as ArcDeleteResult, k as IntrospectionPluginOptions, l as TypedRepository, ln as BaseCrudController, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as SoftDeleteMixin, nt as FieldRule, o as InferDocType, on as SlugMixin, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as AnyRecord, r as ValidateOptions, rn as TreeExt, s as InferResourceDoc, sn as BulkExt, st as AggMeasureInput, t as RouteHandlerMethod, tn as SoftDeleteExt, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, y as OwnershipCheck, zt as IRequestContext } from "./index-DbtgCOCj.mjs";
+import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-Csxga7d3.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-D3lhgzhD.mjs";
+import "./fastify-augmentation-9_fuetB4.mjs";
+import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, m as ResourceSeams, p as AdapterLike, s as getControllerScope, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, z as RESERVED_QUERY_PARAMS } from "./index-D8MKYGDa.mjs";
+import { A as requireOwnership, C as createOrgPermissions, D as denyAll, E as anyOf, N as when, S as createDynamicPermissionMatrix, T as allowPublic, b as DynamicPermissionMatrixConfig, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as requireRoles, k as requireAuth, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, w as allOf, y as DynamicPermissionMatrix } from "./index-ogIHvOjo.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DHcHVAgk.mjs";
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DNre0wRg.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-BnLYgE9A.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-C6FlRWxF.mjs";
 import { E as requireRoles, F as applyFieldReadPermissions, I as applyFieldWritePermissions, L as fields, O as when, S as denyAll, T as requireOwnership, _ as requireServiceScope, b as allowPublic, c as publicReadAdminWrite, d as createDynamicPermissionMatrix, f as createOrgPermissions, g as requireScopeContext, h as requireOrgRole, i as ownerWithAdminBypass, l as readOnly, m as requireOrgMembership, n as authenticated, o as presets_exports, p as requireOrgInScope, r as fullPublic, s as publicRead, t as adminOnly, v as requireTeamMembership, w as requireAuth, x as anyOf, y as allOf } from "./permissions-BJMuKMl7.mjs";
-import { a as mergeResourceConfig, c as defineAction, d as defineAggregation, i as defineResourceVariants, o as defineResource, s as ResourceDefinition } from "./core-DZ6Xe1jR.mjs";
+import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, o as ResourceDefinition, s as mergeResourceConfig } from "./core-b6fgFgnd.mjs";
 import { l as getControllerScope } from "./actionPermissions-ze70xXJi.mjs";
 //#region src/index.ts
-const version = "2.21.0";
+const version = "2.22.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-0YhHkXGk.mjs → init-DleK3p9f.mjs}

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -76,6 +77,60 @@ export function createAdapter${ts ? "<TDoc = unknown>" : ""}(
 `;
 }
 //#endregion
+//#region src/cli/commands/init/templates/agents.ts
+function agentsGuideTemplate(config) {
+	return `# CLAUDE.md — agent guide for this app
+
+> This file doubles as AGENTS.md — copy or symlink if your tool reads that name.
+
+**This is an \`@classytic/arc\` application.** Resources are DECLARED, not hand-rolled:
+one \`defineResource()\` = REST + validation + auth + permissions + events + caching +
+OpenAPI + MCP tools. Data layer: ${config.adapter === "mongokit" ? "@classytic/mongokit (Mongoose)" : "a custom DataAdapter kit"}.
+
+## The one rule
+
+**Hand-rolling is a bug.** Before writing ANY route, validation, pagination, auth check,
+cron, counter, or audit code by hand, prove arc lacks it — check the table below, then
+\`node_modules/@classytic/arc/skills/arc/SKILL.md\` (full framework guide + references).
+
+## About to write X? Arc already has Y
+
+| If you're about to write… | Use instead |
+|---|---|
+| \`fastify.get/post/...\` CRUD routes for an entity | \`defineResource({ name, adapter, permissions })\` |
+| \`if (req.user.role !== 'admin') return 403\` | \`permissions: { update: requireRoles(['admin']) }\` |
+| Reading \`req.user._id\` / org id directly | \`getUserId(scope)\` / \`requireOrgId(scope)\` from \`@classytic/arc/scope\` |
+| Hand-written \`schema: { body }\` / JSON Schema | \`schemaOptions.fieldRules\` (or \`customSchemas\` for wire≠model) |
+| toJSON transforms hiding \`password\`/internals | \`fieldRules: { password: { hidden: true } }\` |
+| Manual \`req.query\` filter/sort/pagination parsing | the resource's \`queryParser\` (allow-listed fields) |
+| Soft delete / slug lookup / tree / bulk / file upload | \`presets: ['softDelete', 'slugLookup', ...]\` |
+| \`setInterval\` sweeps + hand-rolled leader lock | \`schedulesPlugin\` (\`@classytic/arc/plugins\`) |
+| A background/queue worker entrypoint | \`createWorker(sameOptions)\` (\`@classytic/arc/factory\`) |
+| Usage counters / quotas / plan rate limits | \`usagePlugin\` + \`requireQuota\` + \`rateLimit.plan\` |
+| Audit log rows / "who changed what" endpoints | \`audit: true\` + \`history: true\` on the resource |
+| Manual idempotency keys / dedupe | \`idempotencyPlugin\` |
+| Event emitters / webhooks plumbing | \`eventPlugin\` + resource \`events:\` (+ outbox for guarantees) |
+| Custom MCP/AI tool handlers | generated automatically from every resource |
+
+## Load-bearing conventions
+
+- \`request.user\` is \`undefined\` on public routes — always guard.
+- Never read \`scope.organizationId\` directly — use \`@classytic/arc/scope\` accessors.
+- The DB connection belongs in \`createApp({ beforeBoot })\` — not before \`createApp\`.
+- Custom endpoints: \`routes:\`/\`actions:\` on the resource (they inherit auth/permissions/
+  OpenAPI/MCP) — a bare \`fastify.get()\` gets none of that.
+
+## Commands
+
+\`\`\`bash
+npm run dev        # watch mode
+npm test           # vitest
+npx arc generate resource <name>   # scaffold a resource (model/repo/resource files)
+npx arc describe   # list registered resources + routes
+\`\`\`
+`;
+}
+//#endregion
 //#region src/cli/commands/init/templates/app.ts
 function indexTemplate(config) {
 	const ts = config.typescript;
@@ -442,8 +497,8 @@ function betterAuthSetupTemplate(config) {
 import { mongodbAdapter } from '@better-auth/mongo-adapter';` : "";
 	const stubsImport = useStubs ? `import { registerBetterAuthStubs } from '@classytic/mongokit/better-auth';` : "";
 	const pluginImports = [
-		useOrg ? `import { organization } from 'better-auth/plugins';` : "",
-		useBearer ? `import { bearer } from 'better-auth/plugins';` : "",
+		useOrg ? `import { organization } from 'better-auth/plugins/organization';` : "",
+		useBearer ? `import { bearer } from 'better-auth/plugins/bearer';` : "",
 		useApiKey ? `import { apiKey } from '@better-auth/api-key';` : ""
 	].filter(Boolean).join("\n");
 	const dbAdapter = useMongo ? config.typescript ? `database: mongodbAdapter(mongoose.connection.getClient().db() as unknown as never),` : `database: mongodbAdapter(mongoose.connection.getClient().db()),` : `// Configure your database adapter here
@@ -985,6 +1040,11 @@ ${config.adapter === "mongokit" ? `    await mongoose.connection.collection('use
 * `installDependencies` (runs the package manager's `install` against
 * the declared ranges). One source — no drift.
 */
+var dependency_plan_exports = /* @__PURE__ */ __exportAll({
+	SCAFFOLD_DEP_VERSIONS: () => SCAFFOLD_DEP_VERSIONS,
+	primeLatestScaffoldVersions: () => primeLatestScaffoldVersions,
+	resolveScaffoldDependencies: () => resolveScaffoldDependencies
+});
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
 		"@classytic/arc": "^2.20.0",
@@ -1069,6 +1129,51 @@ function floorLessThan(a, b) {
 *     floor>` when the static pin's floor is BELOW the declared peer floor
 *     (never lowered — static pins may legitimately be ahead of the floor).
 */
+const latestCache = /* @__PURE__ */ new Map();
+function allScaffoldPackageNames() {
+	const names = /* @__PURE__ */ new Set();
+	for (const group of Object.values(SCAFFOLD_DEP_VERSIONS)) for (const name of Object.keys(group)) names.add(name);
+	return [...names];
+}
+async function primeLatestScaffoldVersions(options) {
+	const timeoutMs = options?.timeoutMs ?? 3500;
+	const registry = (options?.registry ?? process.env.npm_config_registry ?? "https://registry.npmjs.org").replace(/\/$/, "");
+	const names = allScaffoldPackageNames();
+	const results = await Promise.allSettled(names.map(async (name) => {
+		const res = await fetch(`${registry}/${name}/latest`, {
+			signal: AbortSignal.timeout(timeoutMs),
+			headers: { accept: "application/json" }
+		});
+		if (!res.ok) throw new Error(String(res.status));
+		const body = await res.json();
+		if (typeof body.version === "string" && /^\d+\.\d+\.\d+$/.test(body.version)) latestCache.set(name, body.version);
+	}));
+	return {
+		resolved: latestCache.size,
+		total: results.length
+	};
+}
+function parseBareVersion(v) {
+	const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v);
+	return m ? [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	] : void 0;
+}
+function applyLatestOverlay(dependencies) {
+	if (latestCache.size === 0) return;
+	for (const [name, currentRange] of Object.entries(dependencies)) {
+		const latest = latestCache.get(name);
+		if (!latest || latest.includes("-")) continue;
+		const latestV = parseBareVersion(latest);
+		const currentFloor = parseFloor(currentRange);
+		if (!latestV || !currentFloor) continue;
+		if (!floorLessThan(currentFloor, latestV)) continue;
+		if (latestV[0] !== currentFloor[0] && !name.startsWith("@classytic/")) continue;
+		dependencies[name] = `^${latest}`;
+	}
+}
 function overlayLiveArcVersions(dependencies) {
 	const own = readOwnPackageJson();
 	if (!own) return;
@@ -1102,6 +1207,8 @@ function resolveScaffoldDependencies(config) {
 	}
 	if (config.adapter === "mongokit") Object.assign(dependencies, SCAFFOLD_DEP_VERSIONS.adapterMongokit);
 	if (config.typescript) Object.assign(devDependencies, SCAFFOLD_DEP_VERSIONS.devTypescript);
+	applyLatestOverlay(dependencies);
+	applyLatestOverlay(devDependencies);
 	overlayLiveArcVersions(dependencies);
 	return {
 		dependencies: sortByKey(dependencies),
@@ -3030,6 +3137,7 @@ async function createProjectStructure(projectPath, config) {
 		files["docker-compose.yml"] = dockerComposeTemplate(config);
 	}
 	if (config.edge) files["wrangler.toml"] = wranglerTemplate(config);
+	files["CLAUDE.md"] = agentsGuideTemplate(config);
 	files[".arcrc"] = `${JSON.stringify({
 		adapter: config.adapter,
 		auth: config.auth,
@@ -3329,6 +3437,14 @@ async function init(options = {}) {
 	}
 	const packageManager = detectPackageManager();
 	console.log(`Using package manager: ${packageManager}\n`);
+	if (!process.env.VITEST && process.env.ARC_INIT_OFFLINE !== "1") {
+		const { primeLatestScaffoldVersions } = await Promise.resolve().then(() => dependency_plan_exports);
+		const { resolved, total } = await primeLatestScaffoldVersions().catch(() => ({
+			resolved: 0,
+			total: 0
+		}));
+		console.log(resolved > 0 ? `Resolved ${resolved}/${total} dependency versions from npm (latest stable)\n` : "Registry unreachable — using pinned fallback versions\n");
+	}
 	await createProjectStructure(projectPath, config);
 	if (!options.skipInstall) {
 		console.log("\n📥 Installing dependencies...\n");

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-uuWqM6UY.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-DRj-Ut4n.mjs";
+import { c as McpAuthResult, d as PromptDefinition, g as ToolDefinition, h as ToolContext, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpResourceConfig } from "../types-Bc42CUyk.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,7 +1,7 @@
-import { V as ResourceDefinition, bt as IControllerResponse, xt as IRequestContext } from "../../index-Dtrj6XZk.mjs";
+import { Rt as IControllerResponse, V as ResourceDefinition, zt as IRequestContext } from "../../index-DbtgCOCj.mjs";
 import { i as RequestScope } from "../../types-DH0GupI7.mjs";
-import { c as PermissionCheck } from "../../fields-BGqrAa_u.mjs";
-import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-DRj-Ut4n.mjs";
+import { t as PermissionCheck } from "../../types-Csxga7d3.mjs";
+import { a as CrudDescriptionOverride, c as McpAuthResult, d as PromptDefinition, f as PromptResult, g as ToolDefinition, h as ToolContext, i as CrudDescriptionMeta, l as McpPluginOptions, m as ToolAnnotations, n as CallToolResult, o as CrudOperation, p as SessionEntry, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpResourceConfig } from "../../types-Bc42CUyk.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-B9XjjNVG.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-ByA2tf6D.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { c as McpAuthResult, l as McpPluginOptions } from "../../types-DRj-Ut4n.mjs";
+import { c as McpAuthResult, l as McpPluginOptions } from "../../types-Bc42CUyk.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-B9XjjNVG.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-ByA2tf6D.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/webhooks.d.mts

@@ -77,8 +77,9 @@ interface VerifySignatureOptions {
  *
  * ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
  * parses JSON bodies by default and the re-serialised object will NOT match
- * the original signature. Register `@fastify/raw-body` or use `preParsing`
- * to capture `req.rawBody`, then pass that here.
+ * the original signature. Register `fastify-raw-body` (arc's createApp does
+ * this automatically with `global: false`) and opt the route in via
+ * `config: { rawBody: true }`, then pass `req.rawBody` here.
  *
  * @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
  * @param secret    - Shared secret between sender and receiver
@@ -90,8 +91,11 @@ interface VerifySignatureOptions {
  * ```typescript
  * import { verifySignature } from '@classytic/arc/integrations/webhooks';
  *
- * // Arc-to-Arc (default headers + format)
- * fastify.post('/webhooks/incoming', async (req, reply) => {
+ * // Arc-to-Arc (default headers + format). `config: { rawBody: true }` is
+ * // REQUIRED — arc registers fastify-raw-body with `global: false`, so
+ * // routes opt in per-route; without it `req.rawBody` is undefined and
+ * // verifySignature throws a TypeError.
+ * fastify.post('/webhooks/incoming', { config: { rawBody: true } }, async (req, reply) => {
  *   const sig = req.headers['x-webhook-signature'] as string;
  *   if (!verifySignature(req.rawBody, secret, sig)) {
  *     return reply.status(401).send({ error: 'Invalid signature' });

package/dist/integrations/webhooks.mjs

@@ -48,8 +48,9 @@ function signPayload(payload, secret) {
 *
 * ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
 * parses JSON bodies by default and the re-serialised object will NOT match
-* the original signature. Register `@fastify/raw-body` or use `preParsing`
-* to capture `req.rawBody`, then pass that here.
+* the original signature. Register `fastify-raw-body` (arc's createApp does
+* this automatically with `global: false`) and opt the route in via
+* `config: { rawBody: true }`, then pass `req.rawBody` here.
 *
 * @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
 * @param secret    - Shared secret between sender and receiver
@@ -61,8 +62,11 @@ function signPayload(payload, secret) {
 * ```typescript
 * import { verifySignature } from '@classytic/arc/integrations/webhooks';
 *
-* // Arc-to-Arc (default headers + format)
-* fastify.post('/webhooks/incoming', async (req, reply) => {
+* // Arc-to-Arc (default headers + format). `config: { rawBody: true }` is
+* // REQUIRED — arc registers fastify-raw-body with `global: false`, so
+* // routes opt in per-route; without it `req.rawBody` is undefined and
+* // verifySignature throws a TypeError.
+* fastify.post('/webhooks/incoming', { config: { rawBody: true } }, async (req, reply) => {
 *   const sig = req.headers['x-webhook-signature'] as string;
 *   if (!verifySignature(req.rawBody, secret, sig)) {
 *     return reply.status(401).send({ error: 'Invalid signature' });
@@ -82,7 +86,7 @@ function signPayload(payload, secret) {
 * ```
 */
 function verifySignature(body, secret, signature, options) {
-	if (typeof body !== "string" && !Buffer.isBuffer(body)) throw new TypeError("verifySignature: body must be a string or Buffer (the exact bytes the sender signed). Register @fastify/raw-body and pass req.rawBody — not req.body.");
+	if (typeof body !== "string" && !Buffer.isBuffer(body)) throw new TypeError("verifySignature: body must be a string or Buffer (the exact bytes the sender signed). Add `config: { rawBody: true }` to the route (arc registers fastify-raw-body with global: false) and pass req.rawBody — not req.body.");
 	if (!signature) return false;
 	const prefix = options?.prefix ?? "sha256=";
 	const algorithm = options?.algorithm ?? "sha256";

package/dist/jsonBody-BlzAoGCe.mjs

@@ -0,0 +1,43 @@
+import { t as ArcError } from "./errors-DkO8Nk6-.mjs";
+import sjson from "secure-json-parse";
+//#region src/utils/jsonBody.ts
+/**
+* Shared JSON request-body parsing for every arc content-type parser
+* (`application/json`, `application/scim+json`, decrypted `application/jose`).
+*
+* One primitive, one contract:
+*   - empty body → `undefined` (DELETE/GET with `Content-Type: application/json`
+*     must not crash — the original reason arc replaces Fastify's parser)
+*   - prototype-poisoning payloads (`__proto__`, `constructor.prototype`)
+*     rejected via `secure-json-parse`, same protection Fastify's stock
+*     parser has
+*   - ANY parse failure → `ArcError` with `statusCode: 400` /
+*     `code: 'arc.bad_request'`. Client-sent bytes can never produce a 500:
+*     Fastify forwards parser errors to the error handler as-is, so an
+*     undecorated `SyntaxError` would fall through to the
+*     `arc.internal_error` fallback. The raw parser message stays on
+*     `cause` (logged, never on the wire).
+*/
+/**
+* Parse a JSON request body with prototype-poisoning protection and the
+* arc 400 error contract.
+*
+* @param raw     - Body text (string or Buffer). Empty/absent → `undefined`.
+* @param message - Wire-safe error message for parse failures
+*                  (default: `"Invalid JSON payload"`).
+*/
+function parseJsonBody(raw, message = "Invalid JSON payload") {
+	const text = typeof raw === "string" ? raw : raw ? raw.toString("utf8") : "";
+	if (text.length === 0) return void 0;
+	try {
+		return sjson.parse(text);
+	} catch (cause) {
+		throw new ArcError(message, {
+			code: "arc.bad_request",
+			statusCode: 400,
+			cause
+		});
+	}
+}
+//#endregion
+export { parseJsonBody as t };

package/dist/logger/index.d.mts

@@ -77,5 +77,30 @@ declare function configureArcLogger(options: ArcLoggerOptions): void;
  * ```
  */
 declare function arcLog(module: string): ArcLogger;
+/**
+ * Minimal structural slice of a pino-style logger (`fastify.log`). Each
+ * level accepts `(msg)` or `(mergeObject, msg)` — the pino calling
+ * convention, which differs from console's variadic `(...args)`.
+ */
+interface PinoLike {
+  debug: (obj: unknown, msg?: string) => void;
+  info: (obj: unknown, msg?: string) => void;
+  warn: (obj: unknown, msg?: string) => void;
+  error: (obj: unknown, msg?: string) => void;
+}
+/**
+ * Bridge an `ArcLogWriter` onto a pino-style logger (`fastify.log`).
+ *
+ * arcLog call sites use the console convention — positional args like
+ * `log.warn("message", { userId })` — which pino would silently drop
+ * (extra args are printf interpolation values there). The bridge folds
+ * string args into the message, merges object args into the pino merge
+ * object, and maps `Error` instances to `{ err }` so pino's error
+ * serializer applies.
+ *
+ * `createApp` installs this automatically so arc-internal warnings flow
+ * through the host's transports, level, and redaction config.
+ */
+declare function createPinoWriter(logger: PinoLike): ArcLogWriter;
 //#endregion
-export { ArcLogWriter, ArcLogger, ArcLoggerOptions, arcLog, configureArcLogger };
+export { ArcLogWriter, ArcLogger, ArcLoggerOptions, PinoLike, arcLog, configureArcLogger, createPinoWriter };

package/dist/logger/index.mjs

@@ -44,6 +44,44 @@ function arcLog(module) {
 		}
 	};
 }
+/**
+* Bridge an `ArcLogWriter` onto a pino-style logger (`fastify.log`).
+*
+* arcLog call sites use the console convention — positional args like
+* `log.warn("message", { userId })` — which pino would silently drop
+* (extra args are printf interpolation values there). The bridge folds
+* string args into the message, merges object args into the pino merge
+* object, and maps `Error` instances to `{ err }` so pino's error
+* serializer applies.
+*
+* `createApp` installs this automatically so arc-internal warnings flow
+* through the host's transports, level, and redaction config.
+*/
+function createPinoWriter(logger) {
+	const emit = (level) => (...args) => {
+		const parts = [];
+		let merge;
+		for (const arg of args) if (typeof arg === "string") parts.push(arg);
+		else if (arg instanceof Error) merge = {
+			...merge ?? {},
+			err: arg
+		};
+		else if (arg !== null && typeof arg === "object") merge = {
+			...merge ?? {},
+			...arg
+		};
+		else parts.push(String(arg));
+		const msg = parts.join(" ");
+		if (merge) logger[level](merge, msg);
+		else logger[level](msg);
+	};
+	return {
+		debug: emit("debug"),
+		info: emit("info"),
+		warn: emit("warn"),
+		error: emit("error")
+	};
+}
 function getWriter() {
 	return globalOptions.writer ?? console;
 }
@@ -68,4 +106,4 @@ function isSuppressed() {
 	return env === "1" || env === "true";
 }
 //#endregion
-export { arcLog, configureArcLogger };
+export { arcLog, configureArcLogger, createPinoWriter };

package/dist/{mcpPlugin-B9XjjNVG.mjs → mcpPlugin-ByA2tf6D.mjs}

@@ -1,13 +1,13 @@
 import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
 import { c as getOrgId, g as getUserId } from "./types-bHblZ9YN.mjs";
-import { t as BaseController } from "./BaseController-BnLYgE9A.mjs";
+import { t as BaseController } from "./BaseController-C6FlRWxF.mjs";
 import { P as normalizePermissionResult } from "./permissions-BJMuKMl7.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { n as executeAggregation } from "./buildHandler-D_2ULWxZ.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-ajetw3Fv.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-B-6SPe7g.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";
@@ -630,6 +630,7 @@ function defaultCrudDescription(op, displayName, softDelete, queryMeta) {
 			if (queryMeta?.filterableFields?.length) parts.push(`Filterable fields: ${queryMeta.filterableFields.join(", ")}.`);
 			if (queryMeta?.allowedOperators?.length) parts.push(`Filter operators: ${queryMeta.allowedOperators.join(", ")} (use field[op]=value syntax).`);
 			if (queryMeta?.sortableFields?.length) parts.push(`Sortable fields: ${queryMeta.sortableFields.join(", ")}.`);
+			parts.push("Set _count: true for a count-only result, _exists: true for a boolean existence check, or _distinct: '<field>' for distinct values — all honor the same filters.");
 			return parts.join(" ");
 		}
 		case "get": return `Get a single ${singular} by ID`;
@@ -772,6 +773,9 @@ function buildListShape(fieldRules, options) {
 	const { filterableFields = [], hiddenFields = [], extraHideFields = [], allowedOperators } = options;
 	const allHidden = /* @__PURE__ */ new Set([...hiddenFields, ...extraHideFields]);
 	const shape = { ...PAGINATION_SHAPE };
+	shape._count = z.boolean().optional().describe("Return only { count } of records matching the filters — no documents fetched. Cheapest way to answer 'how many'.");
+	shape._exists = z.boolean().optional().describe("Return only whether ANY record matches the filters (boolean existence check).");
+	shape._distinct = z.string().optional().describe("Return the distinct values of this field across records matching the filters.");
 	if (!fieldRules) return shape;
 	for (const name of filterableFields) {
 		if (allHidden.has(name)) continue;

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-Dtrj6XZk.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DbtgCOCj.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/{module-WeuU5jfd.d.mts → module-B4u10iOJ.d.mts}

@@ -1,4 +1,4 @@
-import { n as ErrorMapper } from "./errorHandler-B0e-bq-O.mjs";
+import { n as ErrorMapper } from "./errorHandler-C6yv4ZTW.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/loadResources.d.ts
 /**
@@ -306,6 +306,31 @@ interface ArcModule<TExports = unknown> {
    * ```
    */
   bootstrap?: (fastify: FastifyInstance) => TExports | Promise<TExports>;
+  /**
+   * App-level resource NAMES this module authoritatively SUPERSEDES. When the
+   * host also lists (or `resourceDir`-discovers) a resource of the same name,
+   * arc DROPS the app copy and registers THIS module's version instead — so the
+   * host keeps NO hand-maintained "which resources did modules take over" filter
+   * set. Ownership lives on the atom that provides it (colocated, drift-proof):
+   *
+   * ```ts
+   * defineModule({ name: "order", owns: ["order", "quotation", "rfq"], resources: () => [...] })
+   * ```
+   *
+   * Semantics:
+   *   - Purely a supersede-the-app-fork switch — it filters the *app* resource
+   *     list, never the module's own `resources` (those always register).
+   *   - Static + declarative: read at compose time, so it works regardless of
+   *     whether `resources` is an array or a post-bootstrap factory (no early
+   *     factory resolution, no boot-order coupling).
+   *   - Idempotent + tolerant: an `owns` entry with no matching app resource is
+   *     a silent no-op — a module may pre-declare a name before any fork exists.
+   *   - Collected across ALL modules; the app-side supersession is their union.
+   *
+   * Contract: if you `owns` a name, PROVIDE it (in this module's `resources`).
+   * Dropping the app fork without supplying a replacement removes the route.
+   */
+  readonly owns?: readonly string[];
   /**
    * The module's resources. Array or factory — the factory form runs AFTER all
    * bootstraps, so `defineResource(...)` receives fully-booted engines. Flows

package/dist/{openapi-Kyod_di6.mjs → openapi-BRpMZD7C.mjs}

@@ -1,8 +1,8 @@
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-U0MnO9vd.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-Ds5reSGs.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-BWMDW-dL.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-h1cEEaEX.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/permissions/index.d.mts

@@ -1,3 +1,4 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-BGqrAa_u.mjs";
-import { A as requireOwnership, B as requireMandate, C as createOrgPermissions, D as denyAll, E as anyOf, F as normalizePermissionResult, I as RequireAgentScopeOptions, L as RequireMandateOptions, M as roles, N as when, O as not, P as applyPermissionResult, R as requireAgentScope, S as createDynamicPermissionMatrix, T as allowPublic, _ as createRoleHierarchy, a as permissionMatrix, b as DynamicPermissionMatrixConfig, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, j as requireRoles, k as requireAuth, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, v as ConnectEventsOptions, w as allOf, x as PermissionEventBus, y as DynamicPermissionMatrix, z as requireDPoP } from "../index-B5PoNbfu.mjs";
+import { a as getUserRoles, i as UserBase, n as PermissionContext, o as normalizeRoles, r as PermissionResult, t as PermissionCheck } from "../types-Csxga7d3.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-D3lhgzhD.mjs";
+import { A as requireOwnership, B as requireMandate, C as createOrgPermissions, D as denyAll, E as anyOf, F as normalizePermissionResult, I as RequireAgentScopeOptions, L as RequireMandateOptions, M as roles, N as when, O as not, P as applyPermissionResult, R as requireAgentScope, S as createDynamicPermissionMatrix, T as allowPublic, _ as createRoleHierarchy, a as permissionMatrix, b as DynamicPermissionMatrixConfig, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, j as requireRoles, k as requireAuth, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, v as ConnectEventsOptions, w as allOf, x as PermissionEventBus, y as DynamicPermissionMatrix, z as requireDPoP } from "../index-ogIHvOjo.mjs";
 export { type ConnectEventsOptions, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, type PermissionCheck, type PermissionContext, type PermissionEventBus, type PermissionResult, type RequireAgentScopeOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Bt as Transform, Ft as NextFunction, It as OperationFilter, Lt as PipelineConfig, Nt as Guard, Pt as Interceptor, Rt as PipelineContext, bt as IControllerResponse, zt as PipelineStep } from "../index-Dtrj6XZk.mjs";
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DbtgCOCj.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;