@classytic/arc 2.31.0 → 2.32.0

package/dist/{rolldown-runtime-CUsjNX9R.mjs → rolldown-runtime-BhflRrBs.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{schedules-DdtlICTf.mjs → schedules-C2Q3uv2d.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
-import { t as startRenewingLease } from "./renewingLease-Dll8mGgc.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+import { t as startRenewingLease } from "./renewingLease-BpP9wwj7.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({

package/dist/{schemaConverter-D--wdJM-.mjs → schemaConverter-Crjvczi_.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 //#region src/utils/schemaConverter.ts
 /**

package/dist/{schemaIR-Bm2enbnh.mjs → schemaIR-CnyKK_1j.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { o as toJsonSchema } from "./schemaConverter-D--wdJM-.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { o as toJsonSchema } from "./schemaConverter-Crjvczi_.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts

package/dist/scim/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as parseJsonBody } from "../jsonBody-BYbLDi5D.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-DDSR2HFl.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-Cys0ko9Z.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-D2l1mh4g.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-Dn5JNmkj.mjs";
-import { t as resolveOrgFromHeader } from "../scope-DHx5Fous.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-DXYX7dIR.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-DNXXxgjl.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-CccEFBfk.mjs";
+import { t as resolveOrgFromHeader } from "../scope-afz_Ieek.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-DHx5Fous.mjs → scope-afz_Ieek.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-Cj42AntO.mjs";
-import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-Bh1KK5ps.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BXjQYbeC.mjs";
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/{simpleEqualityMatcher-DjQJ7FKA.mjs → simpleEqualityMatcher-C4KiMWUa.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/utils/simpleEqualityMatcher.ts
 /**
 * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality

package/dist/{sse-CUTo9y0X.mjs → sse-B9P4Y-UI.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-Cys0ko9Z.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-PSZwi8JV.mjs";
-import { t as openSseStream } from "./sseStream-B_5XcVVd.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-DXYX7dIR.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-DPZdQmDz.mjs";
+import { t as openSseStream } from "./sseStream-B3zb_d1h.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({
@@ -33,7 +33,8 @@ const ssePlugin = async (fastify, opts = {}) => {
 		handler: async (request, reply) => {
 			const stream = openSseStream(request, reply, { heartbeatMs: heartbeat });
 			stream.onCleanup(() => activeConnections.delete(stream.close));
-			const requestOrgId = getOrgId(request.scope ?? PUBLIC_SCOPE);
+			const scope = request.scope ?? PUBLIC_SCOPE;
+			const requestOrgId = getOrgId(scope);
 			const dropOrgEvents = orgScoped && !requestOrgId;
 			for (const pattern of patterns) {
 				const unsub = await fastify.events.subscribe(pattern, async (event) => {

package/dist/{sseStream-B_5XcVVd.mjs → sseStream-B3zb_d1h.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as forwardedStreamHeaders } from "./streaming-PSZwi8JV.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-DPZdQmDz.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{store-helpers-D1MP_gRG.mjs → store-helpers-DmEMHlPQ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-PSZwi8JV.mjs → streaming-DPZdQmDz.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**

package/dist/{subscribe-helpers-C0Tb2aUp.mjs → subscribe-helpers-sp5xTDVA.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as createEvent } from "./EventTransport-9mlTgqzE.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as createEvent } from "./EventTransport-BV10D0oG.mjs";
 //#region src/events/defineEvent.ts
 /**
 * defineEvent — Typed Event Definitions with Optional Schema Validation

package/dist/sync/changelog.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { CursorExpiredError, MemoryChangeLogStore } from "@classytic/repo-core/sync";
 export { CursorExpiredError, MemoryChangeLogStore };

package/dist/testing/cleanupStoreContract.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/cleanupStoreContract.ts
 /**
@@ -152,10 +152,11 @@ function runCleanupRunStoreContract(name, setup) {
 					expiresAt: future()
 				});
 				await store.compareAndTransition(run.id, ["queued"], "running");
-				expect(await store.claim(run.id, {
+				const stolen = await store.claim(run.id, {
 					token: uid("thief"),
 					expiresAt: future()
-				})).toBeNull();
+				});
+				expect(stolen).toBeNull();
 			});
 			it("recovers a running run whose lease EXPIRED (crash recovery)", async () => {
 				const run = makeRun(uid("crashed"), { concurrencyKey: void 0 });
@@ -234,9 +235,11 @@ function runCleanupRunStoreContract(name, setup) {
 					token: live,
 					expiresAt: future()
 				});
-				expect(await store.compareAndTransition(run.id, ["running"], "completed", { completedAt: /* @__PURE__ */ new Date() }, "a-stale-token")).toBeNull();
+				const clobbered = await store.compareAndTransition(run.id, ["running"], "completed", { completedAt: /* @__PURE__ */ new Date() }, "a-stale-token");
+				expect(clobbered).toBeNull();
 				expect((await store.get(run.id))?.status).toBe("running");
-				expect((await store.compareAndTransition(run.id, ["running"], "completed", void 0, live))?.status).toBe("completed");
+				const ok = await store.compareAndTransition(run.id, ["running"], "completed", void 0, live);
+				expect(ok?.status).toBe("completed");
 			});
 		});
 		describe("requestCancel — durable cancellation flag", () => {
@@ -353,7 +356,8 @@ function runCleanupRunStoreContract(name, setup) {
 				const run = makeRun(uid("rearm-cancelled"), { concurrencyKey: void 0 });
 				await store.createIfPermitted(run);
 				await store.compareAndTransition(run.id, ["queued"], "cancelled");
-				expect((await store.reArmIfPermitted(run.id, { queuedAt: /* @__PURE__ */ new Date() }))?.status).toBe("queued");
+				const requeued = await store.reArmIfPermitted(run.id, { queuedAt: /* @__PURE__ */ new Date() });
+				expect(requeued?.status).toBe("queued");
 			});
 			it("refuses a run that is not in a terminal status", async () => {
 				const run = makeRun(uid("rearm-live"), { concurrencyKey: void 0 });

package/dist/testing/index.d.mts

@@ -2,9 +2,9 @@
 import { V as ResourceDefinition } from "../index-CpzxqePp.mjs";
 import { i as RequestScope } from "../types-ChuShpCP.mjs";
 import { l as AnyRecord, r as PermissionCheck } from "../types-B7XeLEgK.mjs";
-import { n as ArcModuleInput } from "../types-CBgvkp8O.mjs";
-import "../index-CFThn1K9.mjs";
-import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-CyoJMSiO.mjs";
+import { n as ArcModuleInput, o as ModuleDisposer, s as ModuleSetupContext } from "../types-CT5vu6M0.mjs";
+import "../index-ZWhLTp_s.mjs";
+import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-T1hmlTEZ.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";
@@ -91,6 +91,11 @@ interface AuthorizationConformance {
    * `buildIdFilter` output (route id AND policy AND tenant), so a policy that
    * tried to redirect/widen the target would show here — the surface the
    * filter-overwrite class of bug lives on.
+   *
+   * `filter` is `undefined` when the permission carries NO policy: `fetchDetailed`
+   * only builds a compound filter when there is something to compound, and takes a
+   * plain by-id read otherwise. `status` is meaningful on both paths — assert the
+   * filter only when the permission under test emits a policy.
    */
   get: SurfaceObservation;
   /** `GET /confs/aggregations/tally` — the aggregation surface. */
@@ -675,6 +680,28 @@ declare function createTestTimer(): {
   reset: () => void;
 };
 //#endregion
+//#region src/testing/moduleSetup.d.ts
+interface TestModuleSetup {
+  /** Pass this as the second argument to `bootstrap` / `plugins` / `afterResources`. */
+  readonly context: ModuleSetupContext;
+  /**
+   * Disposers the module registered, in REGISTRATION order (`dispose()` runs
+   * them backwards). Assert on `.length` to prove a phase registered teardown
+   * at all — the check a no-op `defer` can never fail.
+   */
+  readonly deferred: readonly ModuleDisposer[];
+  /**
+   * Run every collected disposer LIFO, then clear them.
+   *
+   * Best-effort like arc's teardown: one throwing disposer never blocks the
+   * ones behind it. Any errors are collected and thrown together at the end, so
+   * a test still fails loudly instead of a rejection vanishing into a floating
+   * promise.
+   */
+  dispose(): Promise<void>;
+}
+declare function createTestModuleSetup(): TestModuleSetup;
+//#endregion
 //#region src/testing/scopeRoleGate.d.ts
 /**
  * Grants iff the caller is an org member holding one of `allowed` as an ORG role.
@@ -777,4 +804,4 @@ declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppC
  */
 declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestModuleSetup, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };

package/dist/testing/index.mjs

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
-import { g as getUserId } from "../types-Cys0ko9Z.mjs";
-import { t as BaseController } from "../BaseController-De7GqHck.mjs";
-import { t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
-import { t as defineAggregation } from "../defineAggregation-DbPPS8RI.mjs";
-import { S as requireOrgRole } from "../permissions-L--QDAir.mjs";
-import { n as createApp } from "../createApp-Df89BEni.mjs";
-import { n as getModuleExports } from "../module-0pFJA6YW.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-Dz6BjzM6.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-J99LGTJI.mjs";
+import { g as getUserId } from "../types-DXYX7dIR.mjs";
+import { t as BaseController } from "../BaseController-Dk34dxhI.mjs";
+import { t as defineResource } from "../defineResource-XFPPUu2c.mjs";
+import { t as defineAggregation } from "../defineAggregation-gX4No1gt.mjs";
+import { E as requireOrgRole } from "../permissions-Dl_m0NCe.mjs";
+import { n as createApp } from "../createApp-Bv0m-Q6_.mjs";
+import { n as getModuleExports } from "../module-Br81am6m.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CDs87fTw.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -64,7 +64,8 @@ function expectArc(response) {
 		failed(status) {
 			if (status !== void 0) expect(response.statusCode).toBe(status);
 			else expect(response.statusCode).toBeGreaterThanOrEqual(400);
-			expect(getBody().code, "expected ErrorContract.code on failed response").toBeDefined();
+			const body = getBody();
+			expect(body.code, "expected ErrorContract.code on failed response").toBeDefined();
 			return assertion;
 		},
 		unauthorized() {
@@ -84,7 +85,8 @@ function expectArc(response) {
 		},
 		hasData() {
 			const body = getBody();
-			expect(Object.keys(body).length > 0, "expected response body to be defined").toBe(true);
+			const hasContent = Object.keys(body).length > 0;
+			expect(hasContent, "expected response body to be defined").toBe(true);
 			return assertion;
 		},
 		hasStatus(status) {
@@ -92,11 +94,13 @@ function expectArc(response) {
 			return assertion;
 		},
 		hidesField(field) {
-			expect(getBody(), `expected field '${field}' to be hidden from response`).not.toHaveProperty(field);
+			const body = getBody();
+			expect(body, `expected field '${field}' to be hidden from response`).not.toHaveProperty(field);
 			return assertion;
 		},
 		showsField(field) {
-			expect(getBody(), `expected field '${field}' on response`).toHaveProperty(field);
+			const body = getBody();
+			expect(body, `expected field '${field}' on response`).toHaveProperty(field);
 			return assertion;
 		},
 		paginated(expected) {
@@ -398,6 +402,21 @@ async function runAuthorizationConformance(opts) {
 			getFilter = filter;
 			return rows[0] ?? null;
 		}),
+		/**
+		* The single-record read has TWO paths, and the harness must be able to observe both.
+		*
+		* `fetchDetailed` only builds a compound filter and calls `getOne` when there is something to
+		* compound — a row policy, a tenant field, or a non-default id field. A permission that simply
+		* ALLOWS (no policy) leaves `{ _id }` alone and takes the plain `getById` path instead. The base
+		* mock stubs that as `null`, so before this stub the `get` surface reported **404 on every
+		* policy-free allow** while `list` and `aggregation` reported 200.
+		*
+		* That reads as partial enforcement and it is not: it is the harness failing to answer. A host
+		* asserting `get.status === 200` for its own allow-gate — the obvious falsification case to pair
+		* with a deny-parity suite — was told its gate broke the single-record surface. Found from
+		* be-prod, whose conformance suite does exactly that.
+		*/
+		getById: (async () => rows[0] ?? null),
 		aggregate: (async (req = {}) => {
 			aggFilter = req.filter;
 			return { rows: [{ tally: rows.length }] };
@@ -1166,12 +1185,13 @@ var HttpTestHarness = class {
 				it(`${verb} /:id with non-existent ID should return 404`, async () => {
 					const { app, fixtures } = this.getOptions();
 					const payload = fixtures.update ?? fixtures.valid;
-					expect((await app.inject({
+					const res = await app.inject({
 						method: verb,
 						url: `${this.getBaseUrl()}/000000000000000000000000`,
 						headers: this.adminHeaders(),
 						payload
-					})).statusCode).toBe(404);
+					});
+					expect(res.statusCode).toBe(404);
 				});
 			}
 			if (enabledRoutes.has("delete")) {
@@ -1188,24 +1208,29 @@ var HttpTestHarness = class {
 						deleteId = JSON.parse(createRes.body)._id;
 					}
 					if (!deleteId) return;
-					expect((await app.inject({
+					const res = await app.inject({
 						method: "DELETE",
 						url: `${this.getBaseUrl()}/${deleteId}`,
 						headers: this.adminHeaders()
-					})).statusCode).toBe(200);
-					if (enabledRoutes.has("get")) expect((await app.inject({
-						method: "GET",
-						url: `${this.getBaseUrl()}/${deleteId}`,
-						headers: this.adminHeaders()
-					})).statusCode).toBe(404);
+					});
+					expect(res.statusCode).toBe(200);
+					if (enabledRoutes.has("get")) {
+						const getRes = await app.inject({
+							method: "GET",
+							url: `${this.getBaseUrl()}/${deleteId}`,
+							headers: this.adminHeaders()
+						});
+						expect(getRes.statusCode).toBe(404);
+					}
 				});
 				it("DELETE /:id with non-existent ID should return 404", async () => {
 					const { app } = this.getOptions();
-					expect((await app.inject({
+					const res = await app.inject({
 						method: "DELETE",
 						url: `${this.getBaseUrl()}/000000000000000000000000`,
 						headers: this.adminHeaders()
-					})).statusCode).toBe(404);
+					});
+					expect(res.statusCode).toBe(404);
 				});
 			}
 		});
@@ -1224,49 +1249,55 @@ var HttpTestHarness = class {
 		describe(`${resource.displayName} HTTP Permissions`, () => {
 			if (enabledRoutes.has("list") && protectedOps.list) it("GET list without auth should return 401", async () => {
 				const { app } = this.getOptions();
-				expect((await app.inject({
+				const res = await app.inject({
 					method: "GET",
 					url: this.getBaseUrl()
-				})).statusCode).toBe(401);
+				});
+				expect(res.statusCode).toBe(401);
 			});
 			if (enabledRoutes.has("get") && protectedOps.get) it("GET /:id without auth should return 401", async () => {
 				const { app } = this.getOptions();
-				expect((await app.inject({
+				const res = await app.inject({
 					method: "GET",
 					url: `${this.getBaseUrl()}/000000000000000000000000`
-				})).statusCode).toBe(401);
+				});
+				expect(res.statusCode).toBe(401);
 			});
 			if (enabledRoutes.has("create") && protectedOps.create) it("POST without auth should return 401", async () => {
 				const { app, fixtures } = this.getOptions();
-				expect((await app.inject({
+				const res = await app.inject({
 					method: "POST",
 					url: this.getBaseUrl(),
 					payload: fixtures.valid
-				})).statusCode).toBe(401);
+				});
+				expect(res.statusCode).toBe(401);
 			});
 			if (enabledRoutes.has("update") && protectedOps.update) for (const verb of updateMethods) it(`${verb} without auth should return 401`, async () => {
 				const { app, fixtures } = this.getOptions();
 				const payload = fixtures.update ?? fixtures.valid;
-				expect((await app.inject({
+				const res = await app.inject({
 					method: verb,
 					url: `${this.getBaseUrl()}/000000000000000000000000`,
 					payload
-				})).statusCode).toBe(401);
+				});
+				expect(res.statusCode).toBe(401);
 			});
 			if (enabledRoutes.has("delete") && protectedOps.delete) it("DELETE without auth should return 401", async () => {
 				const { app } = this.getOptions();
-				expect((await app.inject({
+				const res = await app.inject({
 					method: "DELETE",
 					url: `${this.getBaseUrl()}/000000000000000000000000`
-				})).statusCode).toBe(401);
+				});
+				expect(res.statusCode).toBe(401);
 			});
 			if (enabledRoutes.has("list")) it("admin should access list endpoint", async () => {
 				const { app } = this.getOptions();
-				expect((await app.inject({
+				const res = await app.inject({
 					method: "GET",
 					url: this.getBaseUrl(),
 					headers: this.adminHeaders()
-				})).statusCode).toBeLessThan(400);
+				});
+				expect(res.statusCode).toBeLessThan(400);
 			});
 			if (enabledRoutes.has("create")) it("admin should access create endpoint", async () => {
 				const { app, fixtures } = this.getOptions();
@@ -1313,6 +1344,33 @@ function createHttpTestHarness(resource, optionsOrGetter) {
 	return new HttpTestHarness(resource, optionsOrGetter);
 }
 //#endregion
+//#region src/testing/moduleSetup.ts
+function createTestModuleSetup() {
+	const deferred = [];
+	return {
+		context: { defer(disposer) {
+			if (typeof disposer !== "function") throw new TypeError(`[arc/testing] defer() expected a function, received ${typeof disposer}.`);
+			deferred.push(disposer);
+		} },
+		deferred,
+		async dispose() {
+			const errors = [];
+			for (let i = deferred.length - 1; i >= 0; i--) {
+				const dispose = deferred[i];
+				if (!dispose) continue;
+				try {
+					await dispose();
+				} catch (err) {
+					errors.push(err);
+				}
+			}
+			deferred.length = 0;
+			if (errors.length === 1) throw errors[0];
+			if (errors.length > 1) throw new AggregateError(errors, `[arc/testing] ${errors.length} disposers threw`);
+		}
+	};
+}
+//#endregion
 //#region src/testing/scopeRoleGate.ts
 /**
 * `scopeRoleGate` — the ONE role gate for package tests.
@@ -1435,7 +1493,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-Df89BEni.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-Bv0m-Q6_.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;
@@ -1505,4 +1563,4 @@ function createMinimalTestApp(options = {}) {
 	});
 }
 //#endregion
-export { HttpTestHarness, TEST_ACTOR_HEADER, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };
+export { HttpTestHarness, TEST_ACTOR_HEADER, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };

package/dist/testing/outboxStoreContract.d.mts

@@ -5,8 +5,17 @@ interface OutboxStoreContractSetupResult {
   store: OutboxStore;
   /** Called once after the suite. */
   teardown?: () => Promise<void>;
-  /** Empty the store between tests. Strongly recommended for isolation. */
-  reset?: () => Promise<void>;
+  /**
+   * Empty the store. REQUIRED, and run before every test.
+   *
+   * Not a recommendation: several assertions are absolute rather than relative —
+   * "exactly zero pending", "exactly two", "`oldestPendingAgeMs()` is null on an
+   * empty queue". Without a reset those read whatever the previous test left, so the
+   * suite passes on ORDER rather than on behaviour, and inserting one unrelated case
+   * turns a conforming store red. A store that cannot empty itself cannot be
+   * conformance-tested.
+   */
+  reset: () => Promise<void>;
 }
 type OutboxStoreContractSetup = () => Promise<OutboxStoreContractSetupResult>;
 declare function runOutboxStoreContract(name: string, setup: OutboxStoreContractSetup): void;