@classytic/arc 2.23.0 → 2.28.0

package/dist/{redis-stream-iVR2l7aS.d.mts → redis-stream-uIaauNpZ.d.mts}

@@ -59,6 +59,20 @@ interface RedisStreamTransportOptions {
    * @default 10
    */
   batchSize?: number;
+  /**
+   * Bounded concurrency for processing a batch's ENTRIES (default: 1 —
+   * strict stream order, the safe default). With one slow handler,
+   * throughput per consumer is ~`1 / total handler latency`; raising this
+   * processes up to N entries of a batch concurrently.
+   *
+   * Trade-off: entries within a batch may complete OUT OF ORDER — only
+   * raise it when handlers are order-independent (idempotent, keyed
+   * upserts). Handlers on this transport should be short and I/O-bound
+   * regardless; heavy work belongs in jobs. Matching handlers for a single
+   * event always run sequentially.
+   * @default 1
+   */
+  processingConcurrency?: number;
   /**
    * Max delivery attempts before moving to dead letter stream.
    * @default 5
@@ -133,6 +147,7 @@ declare class RedisStreamTransport implements EventTransport {
   private consumer;
   private blockTimeMs;
   private batchSize;
+  private processingConcurrency;
   private maxRetries;
   private claimTimeoutMs;
   private deadLetterStream;
@@ -207,6 +222,13 @@ declare class RedisStreamTransport implements EventTransport {
   private ensureGroup;
   private pollLoop;
   private readNewMessages;
+  /**
+   * Process a batch's entries with bounded concurrency
+   * (`processingConcurrency`, default 1 = strict order). Worker-pool over a
+   * shared index — at most N entries in flight, each entry's own handlers
+   * still sequential inside `processEntry`.
+   */
+  private processEntries;
   private claimPending;
   private processEntry;
   private getMatchingHandlers;

package/dist/registerRoute-DTp18Ah_.mjs

@@ -0,0 +1,108 @@
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { n as evaluateAndApplyPermission } from "./applyPermissionResult-BnyVE9eD.mjs";
+//#region src/core/middlewares/permissions.ts
+/**
+* Build a PermissionContext from a Fastify request. Extracted so the CRUD
+* permission middleware and the dynamic action-permission check use the same
+* field layout — divergence here silently broke policy filters for actions.
+*/
+function buildPermissionContext(req, opts) {
+	const reqWithExtras = req;
+	const params = req.params;
+	return {
+		user: reqWithExtras.user ?? null,
+		request: req,
+		resource: opts.resource,
+		action: opts.action,
+		resourceId: opts.resourceId ?? params?.id,
+		params,
+		data: opts.data ?? req.body
+	};
+}
+/**
+* Static per-route CRUD permission gate. The permission and action are known
+* at route-registration time, so the gate is a plain preHandler.
+*
+* Actions use the dynamic counterpart `buildActionPermissionMw` — their
+* permission is resolved from `body.action` at request time.
+*/
+function buildCrudPermissionMw(permissionCheck, resourceName, action) {
+	if (!permissionCheck) return null;
+	return async (req, reply) => {
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action
+		}), req, reply);
+	};
+}
+/**
+* Dynamic per-action permission gate for the action router.
+*
+* Resolves the permission from `body.action` at request time and runs
+* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
+* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
+* (idempotency) and `routeGuards` run. Previously this check lived inside
+* the main action handler, which meant idempotency recorded unauthorized
+* requests and route guards saw unfiltered scope — the very divergence
+* routerShared exists to prevent.
+*
+* Also acts as a defensive fallback for invalid action names — the
+* `oneOf` body schema normally rejects these at AJV validation, but
+* hosts that disable schema validation still get a 400 here.
+*/
+function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
+	const enumSet = new Set(actionEnum);
+	const validActions = [...actionEnum];
+	return async (req, reply) => {
+		const body = req.body ?? {};
+		const action = body.action;
+		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
+		const permissionCheck = actionPermissions[action] ?? globalAuth;
+		if (!permissionCheck) return;
+		const { action: _discard, ...data } = body;
+		const params = req.params;
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action,
+			resourceId: params?.id,
+			data
+		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+	};
+}
+//#endregion
+//#region src/core/middlewares/registerRoute.ts
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
+//#endregion
+export { buildActionPermissionMw as n, buildCrudPermissionMw as r, tryRegisterRoute as t };

package/dist/registry/index.d.mts

@@ -1,5 +1,5 @@
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-BBsvQt7U.mjs";
-import "../fastify-augmentation-g_f9omSc.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DPRH0Cme.mjs";
+import "../fastify-augmentation-OzYGIiU1.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-vcOCtPij.mjs";
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-9km_w1aP.mjs";
 import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-vcOCtPij.mjs → registry-9km_w1aP.mjs}

@@ -79,6 +79,9 @@ async function assertNoTenantData(registry, options) {
 *
 * - `skip` strategy: returns `path: 'skipped'` without touching the repo.
 * - `purgeByField` present: routes through it (chunked, progress, abort).
+* - `purgeByField` absent + `requireChunked`: returns `path: 'unsupported'`
+*   (`arc.purge.chunked_required`) — authoritative cleanup never runs the
+*   unbounded fallback.
 * - `purgeByField` absent + hard strategy: legacy `deleteMany` fallback.
 * - `purgeByField` absent + non-hard strategy: returns `path: 'unsupported'`
 *   with a clear error — soft/anonymize require the new primitive.
@@ -111,6 +114,18 @@ async function purgeResource(resourceName, tenantField, organizationId, resolved
 			...result.error ? { error: result.error } : {}
 		};
 	}
+	if (options.requireChunked) return {
+		resource: resourceName,
+		tenantField,
+		strategy,
+		processed: 0,
+		ok: false,
+		path: "unsupported",
+		error: {
+			code: "arc.purge.chunked_required",
+			message: `Resource '${resourceName}' requires chunked purge for authoritative cleanup, but its adapter repository does not implement \`purgeByField\`. The legacy unbounded \`deleteMany\` fallback is disabled here (no chunking / progress / abort). Upgrade the adapter (@classytic/mongokit ≥ 3.13.4 / @classytic/sqlitekit ≥ 0.3.4).`
+		}
+	};
 	if (strategy.type !== "hard") return {
 		resource: resourceName,
 		tenantField,

package/dist/renewingLease-3cuQH7h8.mjs

@@ -0,0 +1,44 @@
+//#region src/lock/renewingLease.ts
+/**
+* Start renewing an ALREADY-ACQUIRED lease. The caller performed the
+* initial `tryAcquire` (its contention policy differs per consumer); this
+* keeps the lease alive until `stop()`.
+*/
+function startRenewingLease(options) {
+	const { lock, name, holderId, leaseMs, onLost, onError } = options;
+	const renewEveryMs = options.renewEveryMs ?? Math.max(10, Math.floor(leaseMs / 2));
+	let stopped = false;
+	let lost = false;
+	let timer;
+	let inFlight;
+	const scheduleNext = () => {
+		if (stopped) return;
+		timer = setTimeout(() => {
+			inFlight = Promise.resolve(lock.tryAcquire(name, holderId, leaseMs)).then((renewed) => {
+				if (!renewed && !lost) {
+					lost = true;
+					onLost?.();
+				}
+			}).catch((error) => {
+				onError?.(error);
+			}).finally(() => {
+				inFlight = void 0;
+				scheduleNext();
+			});
+		}, renewEveryMs);
+		timer.unref?.();
+	};
+	scheduleNext();
+	return {
+		get lost() {
+			return lost;
+		},
+		async stop() {
+			stopped = true;
+			if (timer) clearTimeout(timer);
+			await inFlight;
+		}
+	};
+}
+//#endregion
+export { startRenewingLease as t };

package/dist/{requestContext-BZKOr13H.mjs → requestContext-MrlJwECf.mjs}

@@ -85,8 +85,8 @@ function getTraceHeaders() {
 	const store = requestContext.get();
 	if (!store) return void 0;
 	const headers = {};
-	if (store.traceparent) headers["traceparent"] = store.traceparent;
-	if (store.tracestate) headers["tracestate"] = store.tracestate;
+	if (store.traceparent) headers.traceparent = store.traceparent;
+	if (store.tracestate) headers.tracestate = store.tracestate;
 	return Object.keys(headers).length > 0 ? headers : void 0;
 }
 //#endregion

package/dist/schedules-CjOd2MG9.mjs

@@ -0,0 +1,113 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { t as startRenewingLease } from "./renewingLease-3cuQH7h8.mjs";
+import fp from "fastify-plugin";
+//#region src/plugins/schedules.ts
+var schedules_exports = /* @__PURE__ */ __exportAll({
+	default: () => schedules_default,
+	schedulesPlugin: () => schedulesPlugin
+});
+const MIN_SAFE_INTERVAL_MS = 1e3;
+const MAX_DEFAULT_LEASE_MS = 3e5;
+const schedulesPlugin = async (fastify, opts) => {
+	const { schedules, lock, enabled = true } = opts;
+	const holderId = opts.holderId ?? `arc-${process.pid}-${Math.random().toString(36).slice(2, 10)}`;
+	const stats = /* @__PURE__ */ new Map();
+	fastify.decorate("getScheduleStats", () => [...stats.values()].map((s) => ({ ...s })));
+	if (!enabled) {
+		fastify.log.debug("schedulesPlugin disabled — registered as no-op");
+		return;
+	}
+	const seen = /* @__PURE__ */ new Set();
+	for (const s of schedules) {
+		if (!s.name.trim()) throw new TypeError("[arc-schedules] every schedule needs a name");
+		if (seen.has(s.name)) throw new TypeError(`[arc-schedules] duplicate schedule name "${s.name}"`);
+		seen.add(s.name);
+		if (!Number.isFinite(s.every) || s.every <= 0) throw new TypeError(`[arc-schedules] "${s.name}": \`every\` must be a positive number of ms`);
+		if (typeof s.handler !== "function") throw new TypeError(`[arc-schedules] "${s.name}": \`handler\` must be a function`);
+		if (s.jitterMs !== void 0 && (!Number.isFinite(s.jitterMs) || s.jitterMs < 0)) throw new TypeError(`[arc-schedules] "${s.name}": \`jitterMs\` must be a non-negative number of ms`);
+		if (s.leaseMs !== void 0 && (!Number.isFinite(s.leaseMs) || s.leaseMs <= 0)) throw new TypeError(`[arc-schedules] "${s.name}": \`leaseMs\` must be a positive number of ms`);
+		if (s.every < MIN_SAFE_INTERVAL_MS) fastify.log.warn(`[arc-schedules] "${s.name}" runs every ${s.every}ms — sub-second schedules are almost always a bug in production (DB pressure, lock churn). Intended for tests only.`);
+	}
+	const timers = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	let closing = false;
+	async function tick(s) {
+		const stat = stats.get(s.name);
+		if (!stat) return;
+		let lease;
+		try {
+			if (lock) {
+				const lockName = `arc:schedule:${s.name}`;
+				const leaseMs = s.leaseMs ?? Math.min(Math.floor(s.every * .9), MAX_DEFAULT_LEASE_MS);
+				if (!await lock.tryAcquire(lockName, holderId, leaseMs)) {
+					stat.skippedByLock++;
+					return;
+				}
+				lease = startRenewingLease({
+					lock,
+					name: lockName,
+					holderId,
+					leaseMs,
+					onLost: () => fastify.log.warn({ schedule: s.name }, "[arc-schedules] lease renewal lost — another holder took the lock; this run may now overlap. Handlers should be idempotent."),
+					onError: (err) => fastify.log.warn({
+						err,
+						schedule: s.name
+					}, "[arc-schedules] lease renewal errored (lease may lapse mid-run)")
+				});
+			}
+			stat.runs++;
+			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
+			await s.handler(fastify);
+			stat.lastError = null;
+		} catch (err) {
+			stat.failures++;
+			stat.lastError = err instanceof Error ? err.message : String(err);
+			fastify.log.error({
+				err,
+				schedule: s.name
+			}, "[arc-schedules] schedule run failed");
+		} finally {
+			await lease?.stop();
+		}
+	}
+	function scheduleNext(s, delay) {
+		if (closing) return;
+		const timer = setTimeout(() => {
+			const run = tick(s).finally(() => {
+				inFlight.delete(s.name);
+				scheduleNext(s, s.every);
+			});
+			inFlight.set(s.name, run);
+		}, delay);
+		timer.unref?.();
+		timers.set(s.name, timer);
+	}
+	fastify.addHook("onReady", async () => {
+		for (const s of schedules) {
+			if (s.enabled === false) continue;
+			stats.set(s.name, {
+				name: s.name,
+				runs: 0,
+				failures: 0,
+				skippedByLock: 0,
+				lastRunAt: null,
+				lastError: null
+			});
+			const jitter = !s.runOnStart && s.jitterMs ? Math.floor(Math.random() * s.jitterMs) : 0;
+			scheduleNext(s, s.runOnStart ? 0 : s.every + jitter);
+		}
+		if (stats.size > 0) fastify.log.debug(`[arc-schedules] ${stats.size} schedule(s) armed${lock ? ` (leader-safe, holder ${holderId})` : ""}`);
+	});
+	fastify.addHook("onClose", async () => {
+		closing = true;
+		for (const timer of timers.values()) clearTimeout(timer);
+		timers.clear();
+		await Promise.allSettled([...inFlight.values()]);
+	});
+};
+var schedules_default = fp(schedulesPlugin, {
+	name: "arc-schedules",
+	fastify: "5.x"
+});
+//#endregion
+export { schedules_default as n, schedules_exports as r, schedulesPlugin as t };

package/dist/schemas/index.d.mts

@@ -1,6 +1,6 @@
 import { ErrorContract, ErrorDetail } from "@classytic/repo-core/errors";
-import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider, TypeBoxValidatorCompiler } from "@fastify/type-provider-typebox";
-import { Static, TObject, TSchema, TSchema as TSchema$1, Type } from "@sinclair/typebox";
+import { Static, TObject, TSchema, TSchema as TSchema$1, Type, Type as Type$1 } from "typebox";
+import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider } from "@fastify/type-provider-typebox";
 //#region src/schemas/index.d.ts
 /**
  * Paginated list response — full union of every wire shape `toCanonicalList`
@@ -16,74 +16,74 @@ import { Static, TObject, TSchema, TSchema as TSchema$1, Type } from "@sinclair/
  * variant when your endpoint never emits the others. HTTP status
  * discriminates success vs error — no `success` field.
  */
-declare function ArcListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"offset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
-}>, import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"keyset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  limit: import("@sinclair/typebox").TInteger;
-  hasMore: import("@sinclair/typebox").TBoolean;
-  next: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
-}>, import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"aggregate">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
-}>, import("@sinclair/typebox").TObject<{
-  data: import("@sinclair/typebox").TArray<T>;
+declare function ArcListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TUnion<[Type$1.TObject<{
+  method: Type$1.TLiteral<"offset">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
+}>, Type$1.TObject<{
+  method: Type$1.TLiteral<"keyset">;
+  data: Type$1.TArray<T>;
+  limit: Type$1.TInteger;
+  hasMore: Type$1.TBoolean;
+  next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
+}>, Type$1.TObject<{
+  method: Type$1.TLiteral<"aggregate">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
+}>, Type$1.TObject<{
+  data: Type$1.TArray<T>;
 }>]>;
 /** Offset variant — `{ method: 'offset', data, page, limit, total, pages, hasNext, hasPrev }`. */
-declare function ArcOffsetListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"offset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
+declare function ArcOffsetListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"offset">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
 }>;
 /** Keyset variant — `{ method: 'keyset', data, limit, hasMore, next: string | null }`. */
-declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"keyset">;
-  data: import("@sinclair/typebox").TArray<T>;
-  limit: import("@sinclair/typebox").TInteger;
-  hasMore: import("@sinclair/typebox").TBoolean;
-  next: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"keyset">;
+  data: Type$1.TArray<T>;
+  limit: Type$1.TInteger;
+  hasMore: Type$1.TBoolean;
+  next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
 }>;
 /** Aggregate variant — `{ method: 'aggregate', ...same as offset }`. */
-declare function ArcAggregateListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  method: import("@sinclair/typebox").TLiteral<"aggregate">;
-  data: import("@sinclair/typebox").TArray<T>;
-  page: import("@sinclair/typebox").TInteger;
-  limit: import("@sinclair/typebox").TInteger;
-  total: import("@sinclair/typebox").TInteger;
-  pages: import("@sinclair/typebox").TInteger;
-  hasNext: import("@sinclair/typebox").TBoolean;
-  hasPrev: import("@sinclair/typebox").TBoolean;
+declare function ArcAggregateListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  method: Type$1.TLiteral<"aggregate">;
+  data: Type$1.TArray<T>;
+  page: Type$1.TInteger;
+  limit: Type$1.TInteger;
+  total: Type$1.TInteger;
+  pages: Type$1.TInteger;
+  hasNext: Type$1.TBoolean;
+  hasPrev: Type$1.TBoolean;
 }>;
 /** Bare variant — `{ data }`, no `method` discriminant. */
-declare function ArcBareListResponse<T extends TSchema$1>(itemSchema: T): import("@sinclair/typebox").TObject<{
-  data: import("@sinclair/typebox").TArray<T>;
+declare function ArcBareListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
+  data: Type$1.TArray<T>;
 }>;
 /**
  * Delete response — `{ message, id?, soft? }` raw at the top level.
  */
-declare function ArcDeleteResponse(): import("@sinclair/typebox").TObject<{
-  message: import("@sinclair/typebox").TString;
-  id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-  soft: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+declare function ArcDeleteResponse(): Type$1.TObject<{
+  message: Type$1.TString;
+  id: Type$1.TOptional<Type$1.TString>;
+  soft: Type$1.TOptional<Type$1.TBoolean>;
 }>;
 /**
  * Single field-scoped error detail — `Type.Unsafe<ErrorDetail>` over the
@@ -95,7 +95,7 @@ declare function ArcDeleteResponse(): import("@sinclair/typebox").TObject<{
  * Exported standalone so hosts can embed it in custom 422 / 409 response
  * schemas.
  */
-declare function ArcErrorDetail(): import("@sinclair/typebox").TUnsafe<ErrorDetail>;
+declare function ArcErrorDetail(): Type$1.TUnsafe<ErrorDetail>;
 /**
  * Error response schema — `Type.Unsafe<ErrorContract>` over the canonical
  * JSON Schema `errorContractSchema` from `@classytic/repo-core/errors`.
@@ -104,7 +104,7 @@ declare function ArcErrorDetail(): import("@sinclair/typebox").TUnsafe<ErrorDeta
  * (`errorContractSchema`) and this TypeBox helper cannot drift —
  * literally one source.
  */
-declare function ArcErrorResponse(): import("@sinclair/typebox").TUnsafe<ErrorContract>;
+declare function ArcErrorResponse(): Type$1.TUnsafe<ErrorContract>;
 /**
  * Standard pagination + sorting + filtering query parameters.
  * Matches Arc's list endpoint conventions.
@@ -120,12 +120,12 @@ declare function ArcErrorResponse(): import("@sinclair/typebox").TUnsafe<ErrorCo
  * projection forms at the request-validation gate even though arc passes
  * them through unchanged.
  */
-declare function ArcPaginationQuery(): import("@sinclair/typebox").TObject<{
-  page: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
-  limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
-  sort: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
-  select: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>, import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<0>, import("@sinclair/typebox").TLiteral<1>]>>]>>;
-  populate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TAny>;
+declare function ArcPaginationQuery(): Type$1.TObject<{
+  page: Type$1.TOptional<Type$1.TInteger>;
+  limit: Type$1.TOptional<Type$1.TInteger>;
+  sort: Type$1.TOptional<Type$1.TString>;
+  select: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TArray<Type$1.TString>, Type$1.TRecord<"^.*$", Type$1.TUnion<[Type$1.TLiteral<0>, Type$1.TLiteral<1>]>>]>>;
+  populate: Type$1.TOptional<Type$1.TAny>;
 }>;
 //#endregion
-export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, type FastifyPluginAsyncTypebox, type FastifyPluginCallbackTypebox, type Static, type TObject, type TSchema, Type, type TypeBoxTypeProvider, TypeBoxValidatorCompiler };
+export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, type FastifyPluginAsyncTypebox, type FastifyPluginCallbackTypebox, type Static, type TObject, type TSchema, Type, type TypeBoxTypeProvider };

package/dist/schemas/index.mjs

@@ -1,6 +1,5 @@
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
-import { TypeBoxValidatorCompiler } from "@fastify/type-provider-typebox";
-import { Type, Type as Type$1 } from "@sinclair/typebox";
+import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts
 /**
 * Paginated list response — full union of every wire shape `toCanonicalList`
@@ -134,4 +133,4 @@ function ArcPaginationQuery() {
 	}, { additionalProperties: true });
 }
 //#endregion
-export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, Type, TypeBoxValidatorCompiler };
+export { ArcAggregateListResponse, ArcBareListResponse, ArcDeleteResponse, ArcErrorDetail, ArcErrorResponse, ArcKeysetListResponse, ArcListResponse, ArcOffsetListResponse, ArcPaginationQuery, Type };

package/dist/scim/index.mjs

@@ -533,8 +533,7 @@ var Parser = class {
 	parseNot() {
 		if (this.peek()?.kind === "op" && this.peek().value === "not") {
 			this.consume();
-			const next = this.peek();
-			if (!next || next.kind !== "lparen") throw new ScimError(400, "invalidFilter", "Expected '(' after 'not'");
+			if (this.peek()?.kind !== "lparen") throw new ScimError(400, "invalidFilter", "Expected '(' after 'not'");
 			this.consume();
 			const child = this.parseOr();
 			if (this.consume().kind !== "rparen") throw new ScimError(400, "invalidFilter", "Expected ')' after 'not(...)'");

package/dist/scope/index.d.mts

@@ -1,4 +1,4 @@
-import { C as isMember, D as requireOrgId, E as requireClientId, O as requireTeamId, S as isElevated, T as isService, _ as getTenantFromRequest, a as getAncestorOrgIds, b as hasOrgAccess, c as getMandate, d as getOrgRoles, f as getRequestScope, g as getTeamId, h as getServiceScopes, i as RequestScope, k as requireUserId, l as getOrgContext, m as getScopeContextMap, n as Mandate, o as getClientId, p as getScopeContext, r as PUBLIC_SCOPE, s as getDPoPJkt, t as AUTHENTICATED_SCOPE, u as getOrgId, v as getUserId, w as isOrgInScope, x as isAuthenticated, y as getUserRoles } from "../types-DH0GupI7.mjs";
+import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-DjC-KUCz.mjs";
 import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/scope/rateLimitKey.d.ts
@@ -29,4 +29,4 @@ interface ResolveOrgFromHeaderOptions {
  */
 declare function resolveOrgFromHeader(options: ResolveOrgFromHeaderOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
 //#endregion
-export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };
+export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/scope/index.mjs

@@ -1,5 +1,5 @@
-import { C as isService, D as requireUserId, E as requireTeamId, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-bHblZ9YN.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-COpYKt2h.mjs";
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CSyCxl2V.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-CIz1GjGm.mjs";
 import { t as createTenantKeyGenerator } from "../rateLimitKey-BoWRH3e7.mjs";
-import { t as resolveOrgFromHeader } from "../scope-LONQ3mfZ.mjs";
-export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader };
+import { t as resolveOrgFromHeader } from "../scope-DfaPntpo.mjs";
+export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-LONQ3mfZ.mjs → scope-DfaPntpo.mjs}

@@ -1,5 +1,6 @@
-import { a as OrgAccessDeniedError, l as UnauthorizedError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-DkO8Nk6-.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.
@@ -10,9 +11,7 @@ import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 function resolveOrgFromHeader(options) {
 	const { header = "x-organization-id", resolveMembership } = options;
 	return async (request, _reply) => {
-		const raw = request.headers[header.toLowerCase()];
-		if (Array.isArray(raw)) throw new ValidationError(`Duplicate '${header}' header`);
-		const orgId = raw;
+		const orgId = requireSingleHeaderValue(request.headers, header);
 		if (!orgId) return;
 		const scope = request.scope;
 		if (!scope || scope.kind === "public") throw new UnauthorizedError("Authentication required for organization access");

package/dist/{sse-0u4P4-OI.mjs → sse-BQ1w0dfl.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-bHblZ9YN.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
 import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
 import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
 import fp from "fastify-plugin";