@classytic/arc 2.22.0 → 2.25.0

package/dist/renewingLease-3cuQH7h8.mjs

@@ -0,0 +1,44 @@
+//#region src/lock/renewingLease.ts
+/**
+* Start renewing an ALREADY-ACQUIRED lease. The caller performed the
+* initial `tryAcquire` (its contention policy differs per consumer); this
+* keeps the lease alive until `stop()`.
+*/
+function startRenewingLease(options) {
+	const { lock, name, holderId, leaseMs, onLost, onError } = options;
+	const renewEveryMs = options.renewEveryMs ?? Math.max(10, Math.floor(leaseMs / 2));
+	let stopped = false;
+	let lost = false;
+	let timer;
+	let inFlight;
+	const scheduleNext = () => {
+		if (stopped) return;
+		timer = setTimeout(() => {
+			inFlight = Promise.resolve(lock.tryAcquire(name, holderId, leaseMs)).then((renewed) => {
+				if (!renewed && !lost) {
+					lost = true;
+					onLost?.();
+				}
+			}).catch((error) => {
+				onError?.(error);
+			}).finally(() => {
+				inFlight = void 0;
+				scheduleNext();
+			});
+		}, renewEveryMs);
+		timer.unref?.();
+	};
+	scheduleNext();
+	return {
+		get lost() {
+			return lost;
+		},
+		async stop() {
+			stopped = true;
+			if (timer) clearTimeout(timer);
+			await inFlight;
+		}
+	};
+}
+//#endregion
+export { startRenewingLease as t };

package/dist/{requestContext-BZKOr13H.mjs → requestContext-MrlJwECf.mjs}

@@ -85,8 +85,8 @@ function getTraceHeaders() {
 	const store = requestContext.get();
 	if (!store) return void 0;
 	const headers = {};
-	if (store.traceparent) headers["traceparent"] = store.traceparent;
-	if (store.tracestate) headers["tracestate"] = store.tracestate;
+	if (store.traceparent) headers.traceparent = store.traceparent;
+	if (store.tracestate) headers.tracestate = store.tracestate;
 	return Object.keys(headers).length > 0 ? headers : void 0;
 }
 //#endregion

package/dist/schedules-CjOd2MG9.mjs

@@ -0,0 +1,113 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as startRenewingLease } from "./renewingLease-3cuQH7h8.mjs";
+import fp from "fastify-plugin";
+//#region src/plugins/schedules.ts
+var schedules_exports = /* @__PURE__ */ __exportAll({
+	default: () => schedules_default,
+	schedulesPlugin: () => schedulesPlugin
+});
+const MIN_SAFE_INTERVAL_MS = 1e3;
+const MAX_DEFAULT_LEASE_MS = 3e5;
+const schedulesPlugin = async (fastify, opts) => {
+	const { schedules, lock, enabled = true } = opts;
+	const holderId = opts.holderId ?? `arc-${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
+	const stats = /* @__PURE__ */ new Map();
+	fastify.decorate("getScheduleStats", () => [...stats.values()].map((s) => ({ ...s })));
+	if (!enabled) {
+		fastify.log.debug("schedulesPlugin disabled — registered as no-op");
+		return;
+	}
+	const seen = /* @__PURE__ */ new Set();
+	for (const s of schedules) {
+		if (!s.name.trim()) throw new TypeError("[arc-schedules] every schedule needs a name");
+		if (seen.has(s.name)) throw new TypeError(`[arc-schedules] duplicate schedule name "${s.name}"`);
+		seen.add(s.name);
+		if (!Number.isFinite(s.every) || s.every <= 0) throw new TypeError(`[arc-schedules] "${s.name}": \`every\` must be a positive number of ms`);
+		if (typeof s.handler !== "function") throw new TypeError(`[arc-schedules] "${s.name}": \`handler\` must be a function`);
+		if (s.jitterMs !== void 0 && (!Number.isFinite(s.jitterMs) || s.jitterMs < 0)) throw new TypeError(`[arc-schedules] "${s.name}": \`jitterMs\` must be a non-negative number of ms`);
+		if (s.leaseMs !== void 0 && (!Number.isFinite(s.leaseMs) || s.leaseMs <= 0)) throw new TypeError(`[arc-schedules] "${s.name}": \`leaseMs\` must be a positive number of ms`);
+		if (s.every < MIN_SAFE_INTERVAL_MS) fastify.log.warn(`[arc-schedules] "${s.name}" runs every ${s.every}ms — sub-second schedules are almost always a bug in production (DB pressure, lock churn). Intended for tests only.`);
+	}
+	const timers = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	let closing = false;
+	async function tick(s) {
+		const stat = stats.get(s.name);
+		if (!stat) return;
+		let lease;
+		try {
+			if (lock) {
+				const lockName = `arc:schedule:${s.name}`;
+				const leaseMs = s.leaseMs ?? Math.min(Math.floor(s.every * .9), MAX_DEFAULT_LEASE_MS);
+				if (!await lock.tryAcquire(lockName, holderId, leaseMs)) {
+					stat.skippedByLock++;
+					return;
+				}
+				lease = startRenewingLease({
+					lock,
+					name: lockName,
+					holderId,
+					leaseMs,
+					onLost: () => fastify.log.warn({ schedule: s.name }, "[arc-schedules] lease renewal lost — another holder took the lock; this run may now overlap. Handlers should be idempotent."),
+					onError: (err) => fastify.log.warn({
+						err,
+						schedule: s.name
+					}, "[arc-schedules] lease renewal errored (lease may lapse mid-run)")
+				});
+			}
+			stat.runs++;
+			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
+			await s.handler(fastify);
+			stat.lastError = null;
+		} catch (err) {
+			stat.failures++;
+			stat.lastError = err instanceof Error ? err.message : String(err);
+			fastify.log.error({
+				err,
+				schedule: s.name
+			}, "[arc-schedules] schedule run failed");
+		} finally {
+			await lease?.stop();
+		}
+	}
+	function scheduleNext(s, delay) {
+		if (closing) return;
+		const timer = setTimeout(() => {
+			const run = tick(s).finally(() => {
+				inFlight.delete(s.name);
+				scheduleNext(s, s.every);
+			});
+			inFlight.set(s.name, run);
+		}, delay);
+		timer.unref?.();
+		timers.set(s.name, timer);
+	}
+	fastify.addHook("onReady", async () => {
+		for (const s of schedules) {
+			if (s.enabled === false) continue;
+			stats.set(s.name, {
+				name: s.name,
+				runs: 0,
+				failures: 0,
+				skippedByLock: 0,
+				lastRunAt: null,
+				lastError: null
+			});
+			const jitter = !s.runOnStart && s.jitterMs ? Math.floor(Math.random() * s.jitterMs) : 0;
+			scheduleNext(s, s.runOnStart ? 0 : s.every + jitter);
+		}
+		if (stats.size > 0) fastify.log.debug(`[arc-schedules] ${stats.size} schedule(s) armed${lock ? ` (leader-safe, holder ${holderId})` : ""}`);
+	});
+	fastify.addHook("onClose", async () => {
+		closing = true;
+		for (const timer of timers.values()) clearTimeout(timer);
+		timers.clear();
+		await Promise.allSettled([...inFlight.values()]);
+	});
+};
+var schedules_default = fp(schedulesPlugin, {
+	name: "arc-schedules",
+	fastify: "5.x"
+});
+//#endregion
+export { schedules_default as n, schedules_exports as r, schedulesPlugin as t };

package/dist/{schemaConverter-Ds5reSGs.mjs → schemaConverter-DJvodiHj.mjs}

@@ -100,7 +100,10 @@ function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn") {
 	if (isZodSchema(input)) {
 		if (!_toJSONSchema) return unconvertible(mode, "A Zod schema was passed but zod v4 is not installed (or not yet loaded). Install zod >=4 — arc converts via zod's native z.toJSONSchema().");
 		try {
-			const converted = _toJSONSchema(input, { target });
+			const converted = _toJSONSchema(input, {
+				target,
+				unrepresentable: mode === "throw" ? "throw" : "any"
+			});
 			if ("$schema" in converted) delete converted.$schema;
 			return converted;
 		} catch (cause) {

package/dist/{schemaIR-B-6SPe7g.mjs → schemaIR-Ca7ySNPx.mjs}

@@ -1,4 +1,4 @@
-import { o as toJsonSchema } from "./schemaConverter-Ds5reSGs.mjs";
+import { o as toJsonSchema } from "./schemaConverter-DJvodiHj.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.d.mts

@@ -1,6 +1,6 @@
 import { ErrorContract, ErrorDetail } from "@classytic/repo-core/errors";
-import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider, TypeBoxValidatorCompiler } from "@fastify/type-provider-typebox";
-import { Static, TObject, TSchema, TSchema as TSchema$1, Type } from "@sinclair/typebox";
+import { Static, TObject, TSchema, TSchema as TSchema$1, Type, Type as Type$1 } from "typebox";
+import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider } from "@fastify/type-provider-typebox";
 //#region src/schemas/index.d.ts
 /**
  * Paginated list response — full union of every wire shape `toCanonicalList`
@@ -16,74 +16,74 @@ import { Static, TObject, TSchema, TSchema as TSchema$1, Type } from "@sinclair/
  * variant when your endpoint never emits the others. HTTP status
  * discriminates success vs error — no `success` field.
  */
-declare function ArcListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"offset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
-}>, import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"keyset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  limit: import("@sinclair/typebox").TInteger;
-  hasMore: import("@sinclair/typebox").TBoolean;
-  next: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
-}>, import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"aggregate">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
-}>, import("@sinclair/typebox").TObject<{
-  data: import("@sinclair/typebox").TArray<T>;
+declare function ArcListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TUnion<[Type$1.TObject<{
+  method: Type$1.TLiteral<"offset">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
+}>, Type$1.TObject<{
+  method: Type$1.TLiteral<"keyset">;
+  data: Type$1.TArray<T>;
+  limit: Type$1.TInteger;
+  hasMore: Type$1.TBoolean;
+  next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
+}>, Type$1.TObject<{
+  method: Type$1.TLiteral<"aggregate">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
+}>, Type$1.TObject<{
+  data: Type$1.TArray<T>;
 }>]>;
 /** Offset variant — `{ method: 'offset', data, page, limit, total, pages, hasNext, hasPrev }`. */
-declare function ArcOffsetListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"offset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
+declare function ArcOffsetListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"offset">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
 }>;
 /** Keyset variant — `{ method: 'keyset', data, limit, hasMore, next: string | null }`. */
-declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"keyset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  limit: import("@sinclair/typebox").TInteger;
-  hasMore: import("@sinclair/typebox").TBoolean;
-  next: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"keyset">;
+  data: Type$1.TArray<T>;
+  limit: Type$1.TInteger;
+  hasMore: Type$1.TBoolean;
+  next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
 }>;
 /** Aggregate variant — `{ method: 'aggregate', ...same as offset }`. */
-declare function ArcAggregateListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"aggregate">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
+declare function ArcAggregateListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"aggregate">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
 }>;
 /** Bare variant — `{ data }`, no `method` discriminant. */
-declare function ArcBareListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  data: import("@sinclair/typebox").TArray<T>;
+declare function ArcBareListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  data: Type$1.TArray<T>;
 }>;
 /**
  * Delete response — `{ message, id?, soft? }` raw at the top level.
  */
-declare function ArcDeleteResponse(): import("@sinclair/typebox").TObject<{
-  message: import("@sinclair/typebox").TString;
-  id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-  soft: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+declare function ArcDeleteResponse(): Type$1.TObject<{
+  message: Type$1.TString;
+  id: Type$1.TOptional<Type$1.TString>;
+  soft: Type$1.TOptional<Type$1.TBoolean>;
 }>;
 /**
  * Single field-scoped error detail — `Type.Unsafe<ErrorDetail>` over the
@@ -95,7 +95,7 @@ declare function ArcDeleteResponse(): import("@sinclair/typebox").TObject<{
  * Exported standalone so hosts can embed it in custom 422 / 409 response
  * schemas.
  */
-declare function ArcErrorDetail(): import("@sinclair/typebox").TUnsafe<ErrorDetail>;
+declare function ArcErrorDetail(): Type$1.TUnsafe<ErrorDetail>;
 /**
  * Error response schema — `Type.Unsafe<ErrorContract>` over the canonical
  * JSON Schema `errorContractSchema` from `@classytic/repo-core/errors`.
@@ -104,7 +104,7 @@ declare function ArcErrorDetail(): import("@sinclair/typebox").TUnsafe<ErrorDeta
  * (`errorContractSchema`) and this TypeBox helper cannot drift —
  * literally one source.
  */
-declare function ArcErrorResponse(): import("@sinclair/typebox").TUnsafe<ErrorContract>;
+declare function ArcErrorResponse(): Type$1.TUnsafe<ErrorContract>;
 /**
  * Standard pagination + sorting + filtering query parameters.
  * Matches Arc's list endpoint conventions.
@@ -120,12 +120,12 @@ declare function ArcErrorResponse(): import("@sinclair/typebox").TUnsafe<ErrorCo
  * projection forms at the request-validation gate even though arc passes
  * them through unchanged.
  */
-declare function ArcPaginationQuery(): import("@sinclair/typebox").TObject<{
-  page: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
-  limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
-  sort: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-  select: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>, import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<0>, import("@sinclair/typebox").TLiteral<1>]>>]>>;
-  populate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TAny>;
+declare function ArcPaginationQuery(): Type$1.TObject<{
+  page: Type$1.TOptional<Type$1.TInteger>;
+  limit: Type$1.TOptional<Type$1.TInteger>;
+  sort: Type$1.TOptional<Type$1.TString>;
+  select: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TArray<Type$1.TString>, Type$1.TRecord<"^.*$", Type$1.TUnion<[Type$1.TLiteral<0>, Type$1.TLiteral<1>]>>]>>;
+  populate: Type$1.TOptional<Type$1.TAny>;
 }>;
 //#endregion
-export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, type FastifyPluginAsyncTypebox, type FastifyPluginCallbackTypebox, type Static, type TObject, type TSchema, Type, type TypeBoxTypeProvider, TypeBoxValidatorCompiler };
+export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, type FastifyPluginAsyncTypebox, type FastifyPluginCallbackTypebox, type Static, type TObject, type TSchema, Type, type TypeBoxTypeProvider };

package/dist/schemas/index.mjs

@@ -1,6 +1,5 @@
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
-import { TypeBoxValidatorCompiler } from "@fastify/type-provider-typebox";
-import { Type, Type as Type$1 } from "@sinclair/typebox";
+import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts
 /**
 * Paginated list response — full union of every wire shape `toCanonicalList`
@@ -134,4 +133,4 @@ function ArcPaginationQuery() {
 	}, { additionalProperties: true });
 }
 //#endregion
-export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, Type, TypeBoxValidatorCompiler };
+export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, Type };

package/dist/scim/index.mjs

@@ -533,8 +533,7 @@ var Parser = class {
 	parseNot() {
 		if (this.peek()?.kind === "op" && this.peek().value === "not") {
 			this.consume();
-			const next = this.peek();
-			if (!next || next.kind !== "lparen") throw new ScimError(400, "invalidFilter", "Expected '(' after 'not'");
+			if (this.peek()?.kind !== "lparen") throw new ScimError(400, "invalidFilter", "Expected '(' after 'not'");
 			this.consume();
 			const child = this.parseOr();
 			if (this.consume().kind !== "rparen") throw new ScimError(400, "invalidFilter", "Expected ')' after 'not(...)'");

package/dist/scope/index.d.mts

@@ -1,4 +1,4 @@
-import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-DH0GupI7.mjs";
+import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-DjC-KUCz.mjs";
 import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/scope/rateLimitKey.d.ts
@@ -29,4 +29,4 @@ interface ResolveOrgFromHeaderOptions {
  */
 declare function resolveOrgFromHeader(options: ResolveOrgFromHeaderOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
 //#endregion
-export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };
+export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/scope/index.mjs

@@ -1,5 +1,5 @@
-import { C as isService, D as requireUserId, E as requireTeamId, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-bHblZ9YN.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-COpYKt2h.mjs";
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CSyCxl2V.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-CIz1GjGm.mjs";
 import { t as createTenantKeyGenerator } from "../rateLimitKey-BoWRH3e7.mjs";
-import { t as resolveOrgFromHeader } from "../scope-k15RXfcq.mjs";
-export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };
+import { t as resolveOrgFromHeader } from "../scope-DfaPntpo.mjs";
+export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/scope-DfaPntpo.mjs

@@ -0,0 +1,36 @@
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-DkO8Nk6-.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+//#region src/scope/resolveOrgFromHeader.ts
+/**
+* Create a preHandler hook that resolves org scope from a header.
+* Must run AFTER authentication so `request.user` is populated.
+* If the header is present and user is a member, sets `request.scope` to `member`.
+* If the header is absent, scope stays as-is (typically `authenticated`).
+*/
+function resolveOrgFromHeader(options) {
+	const { header = "x-organization-id", resolveMembership } = options;
+	return async (request, _reply) => {
+		const orgId = requireSingleHeaderValue(request.headers, header);
+		if (!orgId) return;
+		const scope = request.scope;
+		if (!scope || scope.kind === "public") throw new UnauthorizedError("Authentication required for organization access");
+		if (scope.kind === "elevated") return;
+		const user = request.user;
+		if (!user) throw new UnauthorizedError("Authentication required for organization access");
+		const userId = String(user.id ?? user._id ?? "");
+		if (!userId) throw new UnauthorizedError("User identity required for organization access");
+		const membership = await resolveMembership(userId, orgId);
+		if (!membership) throw new OrgAccessDeniedError("Not a member of this organization");
+		const carriedRoles = "userRoles" in scope && Array.isArray(scope.userRoles) ? scope.userRoles : void 0;
+		request.scope = {
+			kind: "member",
+			userId: userId || void 0,
+			userRoles: carriedRoles?.length ? carriedRoles : getUserRoles(user),
+			organizationId: orgId,
+			orgRoles: membership.roles
+		};
+	};
+}
+//#endregion
+export { resolveOrgFromHeader as t };

package/dist/simpleEqualityMatcher-Cg05HPsn.mjs

@@ -0,0 +1,68 @@
+//#region src/utils/simpleEqualityMatcher.ts
+/**
+* `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
+* matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
+*
+* **What it does:** for each `[key, expected]` in the filter, compares
+* `item[key]` to `expected` via string coercion (so Mongo `ObjectId` values
+* match their string representation) and returns `true` only if every
+* filter entry matches. Array item values are matched implicitly (contains).
+*
+* **What it does NOT do:**
+* - No `$eq` / `$ne` / `$in` / `$nin` / `$gt` / `$lt` / `$regex` / `$exists`
+* - No `$and` / `$or`
+* - No dot-path traversal (`"owner.id"`)
+* - No schema-specific coercion
+*
+* **Why it exists:** 95%+ of arc's `_policyFilters` are produced by built-in
+* permission helpers and are shaped like `{ ownerId: "u1" }` or
+* `{ organizationId: "org_x" }` — flat equality. For that common shape,
+* this helper is a safe, tested, 15-line defense-in-depth matcher that
+* hosts using minimal repos (no `getOne(compoundFilter)` DB path) can opt
+* into without arc shipping a full Mongo-syntax engine.
+*
+* **When to use:**
+* - Your adapter/repo doesn't natively filter on `getOne(compoundFilter)`
+* - Your `_policyFilters` are flat equality (from arc's built-in permission helpers)
+* - You want defense-in-depth on `validateItemAccess` / `fetchDetailed`'s `getById` fallback
+*
+* **When NOT to use:**
+* - Your `_policyFilters` use operators (`$in`, `$ne`, etc.) — supply a
+*   native matcher (mongokit's repo does the filter at the DB layer; for
+*   custom repos, wrap the kit's own predicate engine).
+* - You're a mongokit / sqlitekit / Prisma user — the DB-level filter
+*   applied by `getOne(compoundFilter)` already covers this.
+*
+* @example
+* ```ts
+* import { simpleEqualityMatcher } from '@classytic/arc/utils';
+*
+* // On a custom adapter
+* const adapter: DataAdapter = {
+*   repository,
+*   type: 'custom',
+*   name: 'in-memory',
+*   matchesFilter: simpleEqualityMatcher,
+* };
+*
+* // Or directly on BaseController for ad-hoc controllers
+* new BaseController(repo, { matchesFilter: simpleEqualityMatcher });
+* ```
+*/
+function simpleEqualityMatcher(item, filters) {
+	if (!item || typeof item !== "object") return false;
+	const obj = item;
+	for (const [key, expected] of Object.entries(filters)) {
+		if (expected && typeof expected === "object" && !Array.isArray(expected) && Object.getPrototypeOf(expected) === Object.prototype && Object.keys(expected).some((k) => k.startsWith("$"))) return false;
+		const actual = obj[key];
+		if (Array.isArray(actual)) {
+			const expectedStr = String(expected);
+			if (!actual.some((v) => String(v) === expectedStr)) return false;
+			continue;
+		}
+		if (String(actual) !== String(expected)) return false;
+	}
+	return true;
+}
+//#endregion
+export { simpleEqualityMatcher as t };

package/dist/{sse-CfUjwjDk.mjs → sse-BQ1w0dfl.mjs}

@@ -1,7 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "./streaming-BQcW6_Kq.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
+import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({
@@ -29,16 +30,8 @@ const ssePlugin = async (fastify, opts = {}) => {
 			} }
 		},
 		handler: async (request, reply) => {
-			reply.hijack();
-			reply.raw.writeHead(200, {
-				"content-type": "text/event-stream",
-				"cache-control": "no-cache",
-				connection: "keep-alive",
-				"x-accel-buffering": "no",
-				...forwardedStreamHeaders(reply)
-			});
-			reply.raw.flushHeaders();
-			const unsubscribers = [];
+			const stream = openSseStream(request, reply, { heartbeatMs: heartbeat });
+			stream.onCleanup(() => activeConnections.delete(stream.close));
 			const requestOrgId = getOrgId(request.scope ?? PUBLIC_SCOPE);
 			const dropOrgEvents = orgScoped && !requestOrgId;
 			for (const pattern of patterns) {
@@ -57,27 +50,11 @@ const ssePlugin = async (fastify, opts = {}) => {
 							timestamp: event.meta.timestamp
 						}
 					});
-					if (!reply.raw.write(`event: ${event.type}\ndata: ${data}\n\n`)) {
-						request.raw.destroy(/* @__PURE__ */ new Error("SSE connection terminated: slow client backpressure"));
-						cleanup();
-					}
+					stream.write(event.type, data);
 				});
-				unsubscribers.push(unsub);
+				stream.onCleanup(unsub);
 			}
-			const heartbeatTimer = setInterval(() => {
-				if (!reply.raw.write(": heartbeat\n\n")) {
-					request.raw.destroy(/* @__PURE__ */ new Error("SSE connection terminated: heartbeat backpressure"));
-					cleanup();
-				}
-			}, heartbeat);
-			const cleanup = () => {
-				clearInterval(heartbeatTimer);
-				for (const unsub of unsubscribers) unsub();
-				if (!reply.raw.writableEnded) reply.raw.end();
-				activeConnections.delete(cleanup);
-			};
-			activeConnections.add(cleanup);
-			request.raw.on("close", cleanup);
+			activeConnections.add(stream.close);
 		}
 	};
 	if (requireAuth) {