@classytic/arc 2.21.0 → 2.22.0

package/dist/schemaConverter-Ds5reSGs.mjs

@@ -0,0 +1,168 @@
+import { arcLog } from "./logger/index.mjs";
+//#region src/utils/schemaConverter.ts
+/**
+* Schema Converter — Detect-First, Convert-Only-When-Needed
+*
+* Converts Zod v4 schemas to JSON Schema using Zod's native `z.toJSONSchema()`.
+* Plain JSON Schema objects pass through with zero overhead.
+*
+* Zod is an **optional** peer dependency — loaded lazily at module init;
+* `ensureSchemaConverter()` awaits readiness (arc's resource plugin does this
+* before converting). When a Zod schema shows up and can't be converted
+* (zod missing, zod v3, conversion throw), VALIDATION paths fail fast at
+* boot with an actionable error; DOC paths warn and degrade — see
+* {@link UnconvertibleMode}. Hosts that never pass Zod pay nothing.
+*
+* ## Targets
+*
+* Zod v4's `toJSONSchema` supports multiple output targets; arc picks per consumer:
+*
+* - **`draft-7`** (default) — for Fastify route schemas. Fastify v5 bundles AJV 8
+*   configured for draft-07, which uses **numeric** `exclusiveMinimum`/`exclusiveMaximum`.
+*   The `openapi-3.0` target emits the **boolean** form inherited from draft-04
+*   (`exclusiveMinimum: true` alongside `minimum`), which AJV rejects at route
+*   registration with `schema is invalid: data/properties/X/exclusiveMinimum must be number`.
+*   Using `draft-7` fixes `.positive() / .negative() / .gt() / .lt()` out of the box.
+* - **`openapi-3.0`** — for OpenAPI doc generation (arc emits OpenAPI 3.0.3). Keeps
+*   the boolean exclusive form that 3.0 tooling expects.
+*/
+const log = arcLog("schema");
+/** Default target for Fastify-consumed schemas (matches Fastify v5's default AJV draft). */
+const DEFAULT_FASTIFY_TARGET = "draft-7";
+/** Default target for OpenAPI document generation (matches arc's emitted OpenAPI version). */
+const DEFAULT_OPENAPI_TARGET = "openapi-3.0";
+let _toJSONSchema = null;
+const zodReady = import("zod").then(({ z }) => {
+	if (typeof z?.toJSONSchema === "function") _toJSONSchema = (schema, opts) => z.toJSONSchema(schema, opts);
+}).catch(() => {});
+/**
+* Await Zod-converter readiness. Arc's resource plugin awaits this once
+* before any schema conversion, closing the (theoretical) race between the
+* lazy `import("zod")` above and boot-time route registration. Resolves
+* immediately when zod isn't installed — absence is handled per-schema.
+*/
+function ensureSchemaConverter() {
+	return zodReady;
+}
+/**
+* Check if an object is already a plain JSON Schema.
+* Returns true if it has JSON Schema markers (`type`, `properties`, `$ref`,
+* `allOf`, `anyOf`, `oneOf`, `items`, `enum`) and does NOT have Zod markers.
+*/
+function isJsonSchema(input) {
+	if (input === null || typeof input !== "object") return false;
+	const obj = input;
+	if ("_def" in obj || "_zod" in obj) return false;
+	return "type" in obj || "properties" in obj || "$ref" in obj || "allOf" in obj || "anyOf" in obj || "oneOf" in obj || "items" in obj || "enum" in obj;
+}
+/**
+* Check if an object is a Zod schema (has `_zod` marker from Zod v4).
+*/
+function isZodSchema(input) {
+	return input !== null && typeof input === "object" && "_zod" in input;
+}
+/**
+* Zod v3 schemas carry `_def` but NOT v4's `_zod` marker. They can't be
+* converted (`z.toJSONSchema()` is v4-only) — detect them so the failure is
+* an actionable "upgrade to zod v4" instead of a cryptic AJV boot error
+* three layers away.
+*/
+function isZodV3Schema(input) {
+	if (input === null || typeof input !== "object") return false;
+	const obj = input;
+	return "_def" in obj && !("_zod" in obj);
+}
+function unconvertible(mode, message, cause) {
+	if (mode === "throw") throw new Error(`[arc/schema] ${message}`, cause ? { cause } : void 0);
+	log.warn(`${message} — degrading to permissive { type: 'object' } (validation disabled for this slot)`);
+	return { type: "object" };
+}
+/**
+* Convert any schema input to JSON Schema.
+*
+* Detection order:
+* 1. `null`/`undefined` → `undefined`
+* 2. Already JSON Schema → pass through as-is (zero overhead)
+* 3. Zod v4 schema → `z.toJSONSchema(schema, { target })`
+* 4. Zod v3 schema → unconvertible (actionable "upgrade to v4" error/warn)
+* 5. Unrecognized object → return as-is (treat as opaque schema)
+*
+* @param input  Schema (Zod, plain JSON Schema, or opaque object)
+* @param target Output target — defaults to `draft-7` for Fastify compatibility.
+*               Pass `openapi-3.0`/`openapi-3.1` for OpenAPI document generation.
+* @param mode   Failure policy for unconvertible Zod schemas — see
+*               {@link UnconvertibleMode}. Defaults to `'warn'`.
+*/
+function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn") {
+	if (input == null) return void 0;
+	if (typeof input !== "object") return void 0;
+	if (isJsonSchema(input)) return input;
+	if (isZodSchema(input)) {
+		if (!_toJSONSchema) return unconvertible(mode, "A Zod schema was passed but zod v4 is not installed (or not yet loaded). Install zod >=4 — arc converts via zod's native z.toJSONSchema().");
+		try {
+			const converted = _toJSONSchema(input, { target });
+			if ("$schema" in converted) delete converted.$schema;
+			return converted;
+		} catch (cause) {
+			return unconvertible(mode, `z.toJSONSchema() failed for a Zod schema (target: ${target}): ${cause instanceof Error ? cause.message : String(cause)}. Zod-only features with no JSON Schema equivalent (.refine/.transform/custom checks) cannot express wire validation — enforce those in the handler or a pipeline step.`, cause);
+		}
+	}
+	if (isZodV3Schema(input)) return unconvertible(mode, "A Zod v3 schema was passed (has `_def` but no v4 `_zod` marker). arc requires zod >=4 for schema conversion — upgrade zod, or pass plain JSON Schema.");
+	return input;
+}
+/**
+* Convert all schema fields in an OpenApiSchemas object.
+* JSON Schema values pass through unchanged. Only Zod schemas are converted.
+*
+* Defaults to the `openapi-3.0` target since this function feeds OpenAPI doc
+* generation, not Fastify route validation.
+*/
+function convertOpenApiSchemas(schemas, target = DEFAULT_OPENAPI_TARGET) {
+	const result = {};
+	const schemaFields = [
+		"entity",
+		"createBody",
+		"updateBody",
+		"params",
+		"listQuery",
+		"response"
+	];
+	for (const field of schemaFields) {
+		const value = schemas[field];
+		if (value !== void 0) result[field] = toJsonSchema(value, target) ?? value;
+	}
+	for (const [key, value] of Object.entries(schemas)) if (!schemaFields.includes(key)) result[key] = value;
+	return result;
+}
+/**
+* Convert schema values in a Fastify route schema record.
+*
+* Handles `body`, `querystring`, `params`, `headers` (top-level conversion)
+* and `response` (iterates by status code — each value converted individually).
+*
+* JSON Schema values pass through unchanged. Only Zod schemas are converted.
+*
+* Used for both custom routes and customSchemas (CRUD overrides).
+*
+* Defaults to `draft-7` so Fastify v5's bundled AJV 8 accepts the output.
+* Pass `openapi-3.0` (or `openapi-3.1`) when generating OpenAPI documents.
+*/
+function convertRouteSchema(schema, target = DEFAULT_FASTIFY_TARGET) {
+	const result = { ...schema };
+	const mode = target === DEFAULT_FASTIFY_TARGET ? "throw" : "warn";
+	for (const field of [
+		"body",
+		"querystring",
+		"params",
+		"headers"
+	]) if (result[field] !== void 0) result[field] = toJsonSchema(result[field], target, mode) ?? result[field];
+	if (result.response !== void 0 && typeof result.response === "object" && result.response !== null) {
+		const responseObj = result.response;
+		const convertedResponse = {};
+		for (const [statusCode, responseSchema] of Object.entries(responseObj)) convertedResponse[statusCode] = toJsonSchema(responseSchema, target, mode) ?? responseSchema;
+		result.response = convertedResponse;
+	}
+	return result;
+}
+//#endregion
+export { isZodSchema as a, isJsonSchema as i, convertRouteSchema as n, toJsonSchema as o, ensureSchemaConverter as r, convertOpenApiSchemas as t };

package/dist/{schemaIR-ajetw3Fv.mjs → schemaIR-B-6SPe7g.mjs}

@@ -1,4 +1,4 @@
-import { a as toJsonSchema } from "./schemaConverter-U0MnO9vd.mjs";
+import { o as toJsonSchema } from "./schemaConverter-Ds5reSGs.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.
@@ -49,7 +49,7 @@ function normalizeSchemaIR(raw) {
 		properties: {},
 		required: []
 	};
-	const converted = toJsonSchema(raw);
+	const converted = toJsonSchema(raw, "draft-7", "throw");
 	if (!converted || typeof converted !== "object" || converted.type !== "object" && !("properties" in converted)) return {
 		properties: {},
 		required: []

package/dist/scim/index.mjs

@@ -1,3 +1,4 @@
+import { t as parseJsonBody } from "../jsonBody-BlzAoGCe.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {
@@ -93,18 +94,16 @@ function asRecord(doc) {
 /**
 * Register the `application/scim+json` Fastify content-type parser. Idempotent
 * — second registration in the same scope is a no-op. Empty bodies (DELETE,
-* GET) yield `undefined` rather than crashing on `JSON.parse("")`.
+* GET) yield `undefined` rather than crashing on `JSON.parse("")`. Parsing
+* flows through `parseJsonBody`, so malformed SCIM payloads surface as 400
+* `arc.bad_request` (not 500) and prototype-poisoning bodies are rejected —
+* same contract as arc's main `application/json` parser.
 */
 function ensureScimContentTypeParser(fastify) {
 	if (fastify.hasContentTypeParser("application/scim+json")) return;
 	fastify.addContentTypeParser("application/scim+json", { parseAs: "string" }, (_req, body, done) => {
-		const raw = body;
-		if (!raw || raw.length === 0) {
-			done(null, void 0);
-			return;
-		}
 		try {
-			done(null, JSON.parse(raw));
+			done(null, parseJsonBody(body, "Invalid SCIM JSON payload"));
 		} catch (err) {
 			done(err, void 0);
 		}

package/dist/scope/index.mjs

@@ -1,79 +1,5 @@
 import { C as isService, D as requireUserId, E as requireTeamId, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-bHblZ9YN.mjs";
-import { n as normalizeRoles } from "../types-XTApa8b6.mjs";
 import { n as elevation_default, t as elevationPlugin } from "../elevation-COpYKt2h.mjs";
-//#region src/scope/rateLimitKey.ts
-function createTenantKeyGenerator(opts) {
-	if (opts?.strategy) return opts.strategy;
-	return (ctx) => {
-		const scope = ctx.scope;
-		if (!scope || scope.kind === "public") return ctx.ip;
-		if (scope.kind === "member") return scope.organizationId;
-		if (scope.kind === "service") return scope.organizationId;
-		if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
-		return scope.userId ?? ctx.ip;
-	};
-}
-//#endregion
-//#region src/scope/resolveOrgFromHeader.ts
-/**
-* Create a preHandler hook that resolves org scope from a header.
-* Must run AFTER authentication so `request.user` is populated.
-* If the header is present and user is a member, sets `request.scope` to `member`.
-* If the header is absent, scope stays as-is (typically `authenticated`).
-*/
-function resolveOrgFromHeader(options) {
-	const { header = "x-organization-id", resolveMembership } = options;
-	return async (request, reply) => {
-		const orgId = request.headers[header];
-		if (!orgId) return;
-		const scope = request.scope;
-		if (!scope || scope.kind === "public") {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		if (scope.kind === "elevated") return;
-		const user = request.user;
-		if (!user) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "Authentication required for organization access",
-				code: "ORG_AUTH_REQUIRED"
-			});
-			return;
-		}
-		const userId = String(user.id ?? user._id ?? "");
-		if (!userId) {
-			reply.code(401).send({
-				success: false,
-				error: "Unauthorized",
-				message: "User identity required for organization access"
-			});
-			return;
-		}
-		const membership = await resolveMembership(userId, orgId);
-		if (!membership) {
-			reply.code(403).send({
-				success: false,
-				error: "Forbidden",
-				message: "Not a member of this organization",
-				code: "ORG_ACCESS_DENIED"
-			});
-			return;
-		}
-		request.scope = {
-			kind: "member",
-			userId: userId || void 0,
-			userRoles: normalizeRoles(user.role),
-			organizationId: orgId,
-			orgRoles: membership.roles
-		};
-	};
-}
-//#endregion
+import { t as createTenantKeyGenerator } from "../rateLimitKey-BoWRH3e7.mjs";
+import { t as resolveOrgFromHeader } from "../scope-k15RXfcq.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };

package/dist/scope-k15RXfcq.mjs

@@ -0,0 +1,64 @@
+import { n as normalizeRoles } from "./types-XTApa8b6.mjs";
+//#region src/scope/resolveOrgFromHeader.ts
+/**
+* Create a preHandler hook that resolves org scope from a header.
+* Must run AFTER authentication so `request.user` is populated.
+* If the header is present and user is a member, sets `request.scope` to `member`.
+* If the header is absent, scope stays as-is (typically `authenticated`).
+*/
+function resolveOrgFromHeader(options) {
+	const { header = "x-organization-id", resolveMembership } = options;
+	return async (request, reply) => {
+		const orgId = request.headers[header];
+		if (!orgId) return;
+		const scope = request.scope;
+		if (!scope || scope.kind === "public") {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "Authentication required for organization access",
+				code: "ORG_AUTH_REQUIRED"
+			});
+			return;
+		}
+		if (scope.kind === "elevated") return;
+		const user = request.user;
+		if (!user) {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "Authentication required for organization access",
+				code: "ORG_AUTH_REQUIRED"
+			});
+			return;
+		}
+		const userId = String(user.id ?? user._id ?? "");
+		if (!userId) {
+			reply.code(401).send({
+				success: false,
+				error: "Unauthorized",
+				message: "User identity required for organization access"
+			});
+			return;
+		}
+		const membership = await resolveMembership(userId, orgId);
+		if (!membership) {
+			reply.code(403).send({
+				success: false,
+				error: "Forbidden",
+				message: "Not a member of this organization",
+				code: "ORG_ACCESS_DENIED"
+			});
+			return;
+		}
+		request.scope = {
+			kind: "member",
+			userId: userId || void 0,
+			userRoles: normalizeRoles(user.role),
+			organizationId: orgId,
+			orgRoles: membership.roles
+		};
+	};
+}
+//#endregion
+export { resolveOrgFromHeader as t };

package/dist/testing/index.d.mts

@@ -1,5 +1,6 @@
-import { V as ResourceDefinition, qt as AnyRecord } from "../index-Dtrj6XZk.mjs";
-import { d as preloadResourcesAsync, r as CreateAppOptions, u as preloadResources } from "../types-DpxoNX5v.mjs";
+import { V as ResourceDefinition, qt as AnyRecord } from "../index-DbtgCOCj.mjs";
+import { n as ArcModuleInput } from "../module-B4u10iOJ.mjs";
+import { d as preloadResourcesAsync, t as CreateAppOptions, u as preloadResources } from "../index-BEu4wjbL.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";
@@ -296,6 +297,85 @@ declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOpti
  */
 declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
 //#endregion
+//#region src/testing/bootModuleApp.d.ts
+/** Handed to a modules factory — the in-memory DB is live at call time. */
+/**
+ * A provisioned test database — what the `database` seam yields. Arc
+ * core never names a driver: kits ship factories (`mongoMemoryDatabase`
+ * is the built-in default; a sqlitekit/pgkit testkit ships its own) and
+ * the connection flows through as an opaque generic.
+ */
+interface TestDatabase<TConn = unknown> {
+  /** Connection string, when the backend has one (informational). */
+  uri: string;
+  /** Driver connection handle passed to the modules factory. */
+  connection: TConn;
+  /** Stop/disconnect everything this factory started. MUST be idempotent-safe to call once. */
+  teardown(): Promise<void>;
+}
+/** The DB-provisioning seam — `bootModuleApp({ database })`. */
+type TestDatabaseFactory<TConn = unknown> = (opts: {
+  replset?: boolean;
+}) => Promise<TestDatabase<TConn>>;
+interface TestkitContext<TConn = unknown> {
+  /** The provisioned database's connection string. */
+  uri: string;
+  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
+  mongoUri: string;
+  /**
+   * Driver connection handle (the default factory yields mongoose's
+   * DEFAULT connection). Generic so DB-typed wrappers assert the driver
+   * type ONCE: `bootModuleApp<Connection>(...)`. Arc core stays DB-agnostic.
+   */
+  connection: TConn;
+}
+type BootModulesInput<TConn = unknown> = ArcModuleInput | readonly ArcModuleInput[] | ((ctx: TestkitContext<TConn>) => ArcModuleInput | readonly ArcModuleInput[] | Promise<ArcModuleInput | readonly ArcModuleInput[]>);
+interface BootModuleAppOptions<TConn = unknown> {
+  /**
+   * DB provisioner. Default: `mongoMemoryDatabase` (in-memory MongoDB —
+   * lazy devDep imports, nothing Mongo touches arc's runtime). Kits for
+   * other stores inject their own factory here; the rest of the harness
+   * (module resolution, app boot, teardown ordering) is DB-agnostic.
+   */
+  database?: TestDatabaseFactory<TConn>;
+  /** Single-node replica set (transactions). Default: standalone. Passed to the database factory. */
+  replset?: boolean;
+  /**
+   * Extra `createApp` options merged over the testing defaults
+   * (`preset: 'testing'`, `auth: false`, `sensible: false` — utility
+   * plugins stay off so the testkit is dependency-light; re-enable per
+   * boot when a module genuinely exercises one).
+   */
+  app?: Partial<CreateAppOptions>;
+}
+interface ModuleTestApp<TConn = unknown> {
+  app: FastifyInstance;
+  /** The provisioned database's connection string. */
+  uri: string;
+  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
+  mongoUri: string;
+  /** The mongoose `Connection` handed to the modules factory. */
+  connection: TConn;
+  /**
+   * Typed module-export accessor — `t.exports<CatalogEngine>('catalog')`
+   * instead of reaching through `(t.app as ...).arc.modules.catalog`.
+   * Delegates to `getModuleExports` (throws with the registered-module
+   * list when the name is unknown — same contract hosts get).
+   */
+  exports<TExports = unknown>(name: string): TExports;
+  /** Close app → disconnect mongoose → stop the in-memory server. Idempotent. */
+  close(): Promise<void>;
+}
+/**
+ * The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+ * Everything Mongo-specific about the harness lives HERE — the harness
+ * itself is driver-blind and any kit can replace this via `database`.
+ */
+declare function mongoMemoryDatabase(opts: {
+  replset?: boolean;
+}): Promise<TestDatabase<unknown>>;
+declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
+//#endregion
 //#region src/testing/fixtures.d.ts
 type FixtureFactory<T extends AnyRecord = AnyRecord> = (data: Partial<T>) => Promise<T>;
 /** Delete hook invoked by `clear()` for records that were created through a factory. */
@@ -540,4 +620,4 @@ declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppC
  */
 declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestFixtures, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
 import { t as CRUD_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CHw3_oA_.mjs";
+import { d as getModuleExports, h as preloadResourcesAsync, m as preloadResources, n as createApp } from "../createApp-Ci7yG5gv.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -462,6 +462,73 @@ async function setupBetterAuthTestApp(input) {
 	};
 }
 //#endregion
+//#region src/testing/bootModuleApp.ts
+/**
+* The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+* Everything Mongo-specific about the harness lives HERE — the harness
+* itself is driver-blind and any kit can replace this via `database`.
+*/
+async function mongoMemoryDatabase(opts) {
+	let mms;
+	try {
+		mms = await import("mongodb-memory-server");
+	} catch {
+		throw new Error("[arc-testing] bootModuleApp's default database is in-memory MongoDB — install 'mongodb-memory-server' + 'mongoose' as devDependencies, or inject your own `database` factory for a different store");
+	}
+	const server = opts.replset ? await mms.MongoMemoryReplSet.create({ replSet: { count: 1 } }) : await mms.MongoMemoryServer.create();
+	const uri = server.getUri();
+	const mongoose = (await import("mongoose")).default;
+	if (mongoose.connection.readyState !== 0) await mongoose.disconnect();
+	await mongoose.connect(uri);
+	mongoose.connection.deleteModel(/.*/);
+	return {
+		uri,
+		connection: mongoose.connection,
+		teardown: async () => {
+			if (mongoose.connection.readyState !== 0) await mongoose.disconnect().catch(() => void 0);
+			await server.stop().catch(() => void 0);
+		}
+	};
+}
+async function bootModuleApp(modules, options = {}) {
+	const db = await (options.database ?? mongoMemoryDatabase)({ replset: options.replset ?? false });
+	const ctx = {
+		uri: db.uri,
+		mongoUri: db.uri,
+		connection: db.connection
+	};
+	const resolved = typeof modules === "function" ? await modules(ctx) : modules;
+	const list = Array.isArray(resolved) ? resolved : [resolved];
+	let app;
+	try {
+		app = await createApp({
+			preset: "testing",
+			auth: false,
+			sensible: false,
+			...options.app,
+			modules: list
+		});
+		await app.ready();
+	} catch (err) {
+		await db.teardown().catch(() => void 0);
+		throw err;
+	}
+	let closed = false;
+	return {
+		app,
+		uri: db.uri,
+		mongoUri: db.uri,
+		connection: db.connection,
+		exports: (name) => getModuleExports(app, name),
+		close: async () => {
+			if (closed) return;
+			closed = true;
+			await app.close().catch(() => void 0);
+			await db.teardown().catch(() => void 0);
+		}
+	};
+}
+//#endregion
 //#region src/testing/fixtures.ts
 function createTestFixtures() {
 	const registry = /* @__PURE__ */ new Map();
@@ -1049,7 +1116,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-Bi61XxqU.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-Ci7yG5gv.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;
@@ -1119,4 +1186,4 @@ function createMinimalTestApp(options = {}) {
 	});
 }
 //#endregion
-export { HttpTestHarness, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { HttpTestHarness, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };

package/dist/types/index.d.mts

@@ -1,5 +1,5 @@
-import { $ as OnTenantDeleteConfig, $t as UserOrganization, A as RequestIdOptions, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as BaseControllerOptions, G as ActionsMap, Gt as JwtContext, H as ActionDefinition, Ht as AuthPluginOptions, I as MiddlewareHandler, J as CrudRouteKey, Jt as ApiResponse, K as ArcFieldRule, Kt as TokenPair, L as RequestWithExtras, M as EventsDecorator, N as FastifyRequestExtras, O as HealthOptions, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserLike, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, U as ActionEntry, Ut as Authenticator, Vt as AuthHelpers, W as ActionHandlerFn, Wt as AuthenticatorContext, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, Zt as ObjectId, _ as ControllerQueryOptions, _t as ControllerLike, a as InferAdapterDoc, at as ResolvedTenantPurge, b as ParsedQuery, bt as IControllerResponse, c as TypedController, ct as ResourceExtensions, d as PaginationResult, dt as ResourcePermissions, et as OpenApiSchemas, f as IntrospectionData, ft as RouteDefinition, g as ArcInternalMetadata, gt as ControllerHandler, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, it as RateLimitConfig, j as ArcDecorator, k as IntrospectionPluginOptions, l as TypedRepository, lt as ResourceHookContext, m as RegistryStats, mt as RouteMethod, n as ConfigError, nt as PresetHook, o as InferDocType, ot as ResourceCacheConfig, p as RegistryEntry, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, r as ValidateOptions, rt as PresetResult, s as InferResourceDoc, st as ResourceConfig, t as RouteHandlerMethod, tt as PresetFunction, u as TypedResourceConfig, ut as ResourceHooks, v as LookupOption, vt as FastifyHandler, w as ServiceContext, x as PopulateOption, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "../index-Dtrj6XZk.mjs";
+import { $ as OpenApiSchemas, $t as UserOrganization, A as RequestIdOptions, At as RouteDefinition, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dt as ActionEntry, E as GracefulShutdownOptions, Et as ActionDefinition, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ft as ControllerLike, G as OnTenantDeleteConfig, Gt as JwtContext, H as CrudController, Ht as AuthPluginOptions, I as MiddlewareHandler, It as FastifyHandler, J as PresetHook, Jt as ApiResponse, K as ResolvedTenantPurge, Kt as TokenPair, L as RequestWithExtras, Lt as IController, M as EventsDecorator, Mt as RouteMethod, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, Ot as ActionHandlerFn, P as FastifyWithAuth, Pt as ControllerHandler, Q as MiddlewareConfig, Qt as UserLike, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tt as ResourceCacheConfig, U as ResourceConfig, Ut as Authenticator, Vt as AuthHelpers, W as ResourcePermissions, Wt as AuthenticatorContext, X as CrudRouteKey, Xt as JWTPayload, Y as PresetResult, Yt as ArcRequest, Z as CrudSchemas, Zt as ObjectId, _ as ControllerQueryOptions, a as InferAdapterDoc, at as ResourceExtensions, b as ParsedQuery, c as TypedController, d as PaginationResult, et as RouteSchemaOptions, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, i as ValidationResult, it as ResourceHooks, j as ArcDecorator, jt as RouteMcpConfig, k as IntrospectionPluginOptions, kt as ActionsMap, l as TypedRepository, m as RegistryStats, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, q as PresetFunction, qt as AnyRecord, r as ValidateOptions, rt as ResourceHookContext, s as InferResourceDoc, t as RouteHandlerMethod, tt as ArcFieldRule, u as TypedResourceConfig, v as LookupOption, w as ServiceContext, x as PopulateOption, y as OwnershipCheck, zt as IRequestContext } from "../index-DbtgCOCj.mjs";
 import { i as RequestScope } from "../types-DH0GupI7.mjs";
-import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-BGqrAa_u.mjs";
+import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "../types-Csxga7d3.mjs";
 import { n as ElevationOptions, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
 export type { ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ApiResponse, ArcDecorator, ArcFieldRule, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OnTenantDeleteConfig, OpenApiSchemas, OwnershipCheck, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResolvedTenantPurge, ResourceCacheConfig, ResourceConfig, ResourceExtensions, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult };

package/dist/{types-DRj-Ut4n.d.mts → types-Bc42CUyk.d.mts}

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition } from "./index-Dtrj6XZk.mjs";
+import { V as ResourceDefinition } from "./index-DbtgCOCj.mjs";
 import { z } from "zod";
 //#region src/integrations/mcp/types.d.ts
 /** Behavioral hints for MCP clients (tool annotations per MCP spec) */