@classytic/arc 2.28.0 → 2.31.0

package/dist/{realtime-DEuDu9io.mjs → realtime-C5NoxWFY.mjs}

@@ -1,14 +1,17 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { c as getOrgId } from "./types-CSyCxl2V.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
-import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-ChvUQGG1.mjs";
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
+import { c as getOrgId } from "./types-Cys0ko9Z.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DjQJ7FKA.mjs";
+import { t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-PSZwi8JV.mjs";
+import { t as openSseStream } from "./sseStream-B_5XcVVd.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_MAX_CONNECTION_MS: () => DEFAULT_MAX_CONNECTION_MS,
 	buildChangeFrame: () => buildChangeFrame,
 	connectionDeadlineMs: () => connectionDeadlineMs,
 	default: () => realtime_default,
@@ -37,6 +40,15 @@ const MAX_MULTIPLEX_RESOURCES = 20;
 /** Node's `setTimeout` ceiling (~24.8 days); larger delays fire immediately. */
 const MAX_TIMER_MS = 2147483647;
 /**
+* Secure default lease when no other bound applies (session/cookie auth with no
+* token `exp`, and no explicit `maxConnectionMs`). A change feed snapshots its
+* permission filters at connect, so without ANY ceiling a revoked caller would
+* keep their old view forever. 30 minutes bounds that staleness while not
+* churning connections. A host that truly wants a longer-lived feed sets
+* `maxConnectionMs` explicitly (up to `MAX_TIMER_MS`).
+*/
+const DEFAULT_MAX_CONNECTION_MS = 30 * 6e4;
+/**
 * Milliseconds from `now` until the feed should force-close to bound
 * permission staleness — `min(auth-token exp, maxConnectionMs)`. Returns
 * `undefined` when neither bound applies (no `exp` claim, no cap → the feed
@@ -146,7 +158,7 @@ function buildChangeFrame(event, resourceName, data) {
 	});
 }
 const realtimePlugin = async (fastify, opts = {}) => {
-	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs } = opts;
+	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs = DEFAULT_MAX_CONNECTION_MS } = opts;
 	if (!fastify.hasDecorator("events")) {
 		log.warn("Events plugin (arc-events) not registered. Realtime plugin will not function. Register eventPlugin before realtimePlugin.");
 		return;

package/dist/{redis-UDtLaNj6.d.mts → redis-CduhKsJi.d.mts}

@@ -1,4 +1,5 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-Uk8ONJv7.mjs";
+
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {
   get(key: string): Promise<string | null>;

package/dist/{redis-stream-uIaauNpZ.d.mts → redis-stream-qN6A-RFv.d.mts}

@@ -1,4 +1,5 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-QmY7A258.mjs";
+
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-2uVV34WU.mjs";
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {
   xadd(key: string, id: string, ...fieldValues: string[]): Promise<string | null>;

package/dist/{registerRoute-DTp18Ah_.mjs → registerRoute-CBN84fc7.mjs}

@@ -1,5 +1,7 @@
-import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { n as evaluateAndApplyPermission } from "./applyPermissionResult-BnyVE9eD.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-ChvUQGG1.mjs";
+import { f as createError } from "./errors-Cj42AntO.mjs";
+import { u as getRequestScope } from "./types-Cys0ko9Z.mjs";
 //#region src/core/middlewares/permissions.ts
 /**
 * Build a PermissionContext from a Fastify request. Extracted so the CRUD
@@ -11,6 +13,7 @@ function buildPermissionContext(req, opts) {
 	const params = req.params;
 	return {
 		user: reqWithExtras.user ?? null,
+		scope: getRequestScope(req),
 		request: req,
 		resource: opts.resource,
 		action: opts.action,

package/dist/registry/index.d.mts

@@ -1,5 +1,6 @@
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DPRH0Cme.mjs";
-import "../fastify-augmentation-OzYGIiU1.mjs";
+
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-CpzxqePp.mjs";
+import "../fastify-augmentation-zh0_AYHa.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,4 @@
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-9km_w1aP.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-4213U4zb.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-qq0mn2s9.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-9km_w1aP.mjs → registry-4213U4zb.mjs}

@@ -1,4 +1,5 @@
-import { t as CRUD_OPERATIONS } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-D3Dv4LAV.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**
@@ -440,7 +441,7 @@ var introspectionPlugin_default = fp(introspectionPlugin, { name: "arc-introspec
 //#endregion
 //#region src/registry/manifest.ts
 /**
-* Resource manifest for frontend code generators (v2.15.5).
+* Resource manifest for frontend code generators.
 *
 * Every host that hand-rolls a `createCrudApi('foo')` helper on the frontend
 * ends up rewriting the same shim for declarative actions: `postAction(id,

package/dist/{renewingLease-3cuQH7h8.mjs → renewingLease-Dll8mGgc.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the

package/dist/{replyHelpers-67tRawQZ.mjs → replyHelpers-DIiZKGUt.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/repositoryFilter-f9eAfq_l.mjs

@@ -0,0 +1,45 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { arcLog } from "./logger/index.mjs";
+import { policyRecordToFilter } from "@classytic/repo-core/filter";
+//#region src/core/repositoryFilter.ts
+const log = arcLog("repository-filter");
+let warnedUnconvertible = false;
+/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
+function isOperatorObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value) || value instanceof Date) return false;
+	const keys = Object.keys(value);
+	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
+}
+/**
+* Does this compound filter contain any `$`-operator (top-level logical like
+* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
+* pure flat equality and portable as-is.
+*/
+function filterHasDollarOperator(record) {
+	for (const [key, value] of Object.entries(record)) {
+		if (key.startsWith("$")) return true;
+		if (isOperatorObject(value)) return true;
+	}
+	return false;
+}
+/**
+* Normalize a compound query/policy filter for the repository layer. Flat
+* equality records pass through unchanged; anything carrying `$`-operators is
+* converted to the portable repo-core {@link Filter} IR so it compiles
+* identically on Mongo, SQLite, Postgres, and custom adapters.
+*/
+function toRepositoryFilter(record) {
+	if (!filterHasDollarOperator(record)) return record;
+	try {
+		return policyRecordToFilter(record);
+	} catch (err) {
+		if (!warnedUnconvertible) {
+			warnedUnconvertible = true;
+			log.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
+		}
+		return record;
+	}
+}
+//#endregion
+export { toRepositoryFilter as t };

package/dist/{requestContext-MrlJwECf.mjs → requestContext-2TxXOJ7T.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**

package/dist/{rolldown-runtime-8H4AJuhK.mjs → rolldown-runtime-CUsjNX9R.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{schedules-CjOd2MG9.mjs → schedules-DdtlICTf.mjs}

@@ -1,5 +1,6 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { t as startRenewingLease } from "./renewingLease-3cuQH7h8.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+import { t as startRenewingLease } from "./renewingLease-Dll8mGgc.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({

package/dist/{schemaConverter-DJvodiHj.mjs → schemaConverter-D--wdJM-.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 //#region src/utils/schemaConverter.ts
 /**
@@ -25,12 +26,53 @@ import { arcLog } from "./logger/index.mjs";
 *   Using `draft-7` fixes `.positive() / .negative() / .gt() / .lt()` out of the box.
 * - **`openapi-3.0`** — for OpenAPI doc generation (arc emits OpenAPI 3.0.3). Keeps
 *   the boolean exclusive form that 3.0 tooling expects.
+*
+* ## Input vs output (`io`)
+*
+* A Zod schema has TWO shapes and `z.toJSONSchema()` emits one of them. Getting
+* this wrong is not cosmetic — it rejects legal traffic:
+*
+* ```ts
+* z.object({ title: z.string(), status: z.string().default("draft") })
+* // io: "output" → required: ["title", "status"]   ← a client omitting `status` is REJECTED
+* // io: "input"  → required: ["title"]             ← correct: the default fills it in
+* ```
+*
+* The same applies to `.transform()`: in output mode the node is unrepresentable
+* and degrades to `{}` (no validation at all), while input mode emits the real
+* input type. So arc converts by DIRECTION:
+*
+* - **request** (`body`, `querystring`, `params`, `headers`) → `io: "input"` —
+*   validates what the client SENDS, before defaults/transforms/coercion apply.
+* - **response** (and the `entity` doc shape) → `io: "output"` — describes what
+*   the server RETURNS, after they apply.
+*
+* One deliberate consequence: a plain `z.object()` emits
+* `additionalProperties: false` in output mode but NOT in input mode, because
+* `z.object()` STRIPS unknown keys rather than rejecting them — so extra keys
+* are legal input. Use `z.strictObject()` when the wire contract must reject
+* them; it keeps `additionalProperties: false` in both modes.
 */
 const log = arcLog("schema");
 /** Default target for Fastify-consumed schemas (matches Fastify v5's default AJV draft). */
 const DEFAULT_FASTIFY_TARGET = "draft-7";
 /** Default target for OpenAPI document generation (matches arc's emitted OpenAPI version). */
 const DEFAULT_OPENAPI_TARGET = "openapi-3.0";
+/**
+* Map arc's target onto one Zod actually branches on.
+*
+* Zod's `target` is typed `"draft-04" | "draft-07" | "draft-2020-12" |
+* "openapi-3.0" | ({} & string)` — that last member accepts ANY string without
+* narrowing, so an unrecognized value is not rejected, it just matches none of
+* the internal `target === ...` branches and silently gets draft-2020-12
+* behaviour. `"draft-7"` is safe (Zod normalizes the alias to `"draft-07"`),
+* but `"openapi-3.1"` is neither official nor normalized. Mapping it explicitly
+* keeps the fallback intentional rather than accidental — and it is the right
+* dialect, since OpenAPI 3.1 aligned its Schema Object with JSON Schema 2020-12.
+*/
+function zodTarget(target) {
+	return target === "openapi-3.1" ? "draft-2020-12" : target;
+}
 let _toJSONSchema = null;
 const zodReady = import("zod").then(({ z }) => {
 	if (typeof z?.toJSONSchema === "function") _toJSONSchema = (schema, opts) => z.toJSONSchema(schema, opts);
@@ -92,22 +134,33 @@ function unconvertible(mode, message, cause) {
 *               Pass `openapi-3.0`/`openapi-3.1` for OpenAPI document generation.
 * @param mode   Failure policy for unconvertible Zod schemas — see
 *               {@link UnconvertibleMode}. Defaults to `'warn'`.
+* @param io     Which shape to emit — see {@link SchemaIo} and the module
+*               docblock. Defaults to `'output'`, matching Zod's own default;
+*               arc's request-side call sites pass `'input'` explicitly.
 */
-function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn") {
+function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn", io = "output") {
 	if (input == null) return void 0;
 	if (typeof input !== "object") return void 0;
-	if (isJsonSchema(input)) return input;
+	if (isJsonSchema(input)) {
+		const plain = input;
+		if ("$schema" in plain) {
+			const { $schema: _dropped, ...rest } = plain;
+			return rest;
+		}
+		return plain;
+	}
 	if (isZodSchema(input)) {
 		if (!_toJSONSchema) return unconvertible(mode, "A Zod schema was passed but zod v4 is not installed (or not yet loaded). Install zod >=4 — arc converts via zod's native z.toJSONSchema().");
 		try {
 			const converted = _toJSONSchema(input, {
-				target,
+				target: zodTarget(target),
+				io,
 				unrepresentable: mode === "throw" ? "throw" : "any"
 			});
 			if ("$schema" in converted) delete converted.$schema;
 			return converted;
 		} catch (cause) {
-			return unconvertible(mode, `z.toJSONSchema() failed for a Zod schema (target: ${target}): ${cause instanceof Error ? cause.message : String(cause)}. Zod-only features with no JSON Schema equivalent (.refine/.transform/custom checks) cannot express wire validation — enforce those in the handler or a pipeline step.`, cause);
+			return unconvertible(mode, `z.toJSONSchema() failed for a Zod schema (target: ${target}, io: ${io}): ${cause instanceof Error ? cause.message : String(cause)}. Types with no JSON Schema equivalent cannot express wire validation. For \`z.date()\` / \`z.bigint()\` on a REQUEST schema, use the wire-shaped form (\`z.iso.datetime()\` / \`z.string()\`) and convert in a hook — JSON has no date or bigint. For \`.refine()\` / \`.transform()\` / custom checks, enforce them in the handler or a pipeline step.`, cause);
 		}
 	}
 	if (isZodV3Schema(input)) return unconvertible(mode, "A Zod v3 schema was passed (has `_def` but no v4 `_zod` marker). arc requires zod >=4 for schema conversion — upgrade zod, or pass plain JSON Schema.");
@@ -122,19 +175,19 @@ function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET, mode = "warn") {
 */
 function convertOpenApiSchemas(schemas, target = DEFAULT_OPENAPI_TARGET) {
 	const result = {};
-	const schemaFields = [
-		"entity",
-		"createBody",
-		"updateBody",
-		"params",
-		"listQuery",
-		"response"
-	];
-	for (const field of schemaFields) {
+	const schemaFields = {
+		entity: "output",
+		createBody: "input",
+		updateBody: "input",
+		params: "input",
+		listQuery: "input",
+		response: "output"
+	};
+	for (const [field, io] of Object.entries(schemaFields)) {
 		const value = schemas[field];
-		if (value !== void 0) result[field] = toJsonSchema(value, target) ?? value;
+		if (value !== void 0) result[field] = toJsonSchema(value, target, "warn", io) ?? value;
 	}
-	for (const [key, value] of Object.entries(schemas)) if (!schemaFields.includes(key)) result[key] = value;
+	for (const [key, value] of Object.entries(schemas)) if (!(key in schemaFields)) result[key] = value;
 	return result;
 }
 /**
@@ -158,11 +211,11 @@ function convertRouteSchema(schema, target = DEFAULT_FASTIFY_TARGET) {
 		"querystring",
 		"params",
 		"headers"
-	]) if (result[field] !== void 0) result[field] = toJsonSchema(result[field], target, mode) ?? result[field];
+	]) if (result[field] !== void 0) result[field] = toJsonSchema(result[field], target, mode, "input") ?? result[field];
 	if (result.response !== void 0 && typeof result.response === "object" && result.response !== null) {
 		const responseObj = result.response;
 		const convertedResponse = {};
-		for (const [statusCode, responseSchema] of Object.entries(responseObj)) convertedResponse[statusCode] = toJsonSchema(responseSchema, target, mode) ?? responseSchema;
+		for (const [statusCode, responseSchema] of Object.entries(responseObj)) convertedResponse[statusCode] = toJsonSchema(responseSchema, target, mode, "output") ?? responseSchema;
 		result.response = convertedResponse;
 	}
 	return result;

package/dist/{schemaIR-Ca7ySNPx.mjs → schemaIR-Bm2enbnh.mjs}

@@ -1,4 +1,5 @@
-import { o as toJsonSchema } from "./schemaConverter-DJvodiHj.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { o as toJsonSchema } from "./schemaConverter-D--wdJM-.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.d.mts

@@ -1,3 +1,4 @@
+
 import { ErrorContract, ErrorDetail } from "@classytic/repo-core/errors";
 import { Static, TObject, TSchema, TSchema as TSchema$1, Type, Type as Type$1 } from "typebox";
 import { FastifyPluginAsyncTypebox, FastifyPluginCallbackTypebox, TypeBoxTypeProvider } from "@fastify/type-provider-typebox";

package/dist/schemas/index.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts

package/dist/scim/index.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/scim/mapping.d.ts

package/dist/scim/index.mjs

@@ -1,4 +1,5 @@
-import { t as parseJsonBody } from "../jsonBody-BlzAoGCe.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-BYbLDi5D.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.d.mts

@@ -1,5 +1,6 @@
-import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-DjC-KUCz.mjs";
-import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
+
+import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-ChuShpCP.mjs";
+import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-BXCfVcNG.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/scope/rateLimitKey.d.ts
 interface RateLimitKeyContext {

package/dist/scope/index.mjs

@@ -1,5 +1,6 @@
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CSyCxl2V.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-CIz1GjGm.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-BoWRH3e7.mjs";
-import { t as resolveOrgFromHeader } from "../scope-DfaPntpo.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-Cys0ko9Z.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-D2l1mh4g.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-Dn5JNmkj.mjs";
+import { t as resolveOrgFromHeader } from "../scope-DHx5Fous.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-DfaPntpo.mjs → scope-DHx5Fous.mjs}

@@ -1,6 +1,7 @@
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-Cj42AntO.mjs";
+import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/{sessionManager-BHOM3N_0.d.mts → sessionManager-qimlKV0P.d.mts}

@@ -1,3 +1,4 @@
+
 import { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
 //#region src/auth/sessionManager.d.ts
 /**

package/dist/{simpleEqualityMatcher-Cg05HPsn.mjs → simpleEqualityMatcher-DjQJ7FKA.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/utils/simpleEqualityMatcher.ts
 /**
 * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality

package/dist/{sse-BQ1w0dfl.mjs → sse-CUTo9y0X.mjs}

@@ -1,8 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
-import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-Cys0ko9Z.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-PSZwi8JV.mjs";
+import { t as openSseStream } from "./sseStream-B_5XcVVd.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({

package/dist/{sseStream-BQ7Qaynp.mjs → sseStream-B_5XcVVd.mjs}

@@ -1,4 +1,5 @@
-import { n as forwardedStreamHeaders } from "./streaming-BQcW6_Kq.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-PSZwi8JV.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{storage-DLUZ04kK.d.mts → storage-Cx9Sz3Ou.d.mts}

@@ -1,3 +1,4 @@
+
 //#region src/types/storage.d.ts
 /**
  * Arc's minimal backend-agnostic storage contract.

package/dist/{store-helpers-DY6xq4sM.mjs → store-helpers-D1MP_gRG.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-BQcW6_Kq.mjs → streaming-PSZwi8JV.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**