@classytic/arc 2.32.0 → 2.33.0

package/dist/integrations/webhooks.d.mts

@@ -1,5 +1,8 @@
 
+import { a as EventTransport, n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-D-VFq37T.mjs";
 import { FastifyPluginAsync } from "fastify";
+import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
 interface WebhookSubscription {
   /** Unique subscription ID */
@@ -86,6 +89,23 @@ interface WebhookPluginOptions {
    * framework.
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
+  /**
+   * DURABLE delivery — the outbox→worker composition. When set, a matching
+   * event no longer POSTs inline: each (event × subscription) pair becomes ONE
+   * durable row in the given outbox store, and `createDurableWebhookModule`'s
+   * relay claims, delivers, retries with backoff, and dead-letters — all
+   * surviving crash and deploy, which the in-process `retry` cannot.
+   *
+   * The row id is deterministic (`<event id>:wh:<subscription id>`) and the
+   * save carries it as `dedupeKey`, so an at-least-once upstream (Redis
+   * Streams, an events outbox) redelivering the same event enqueues each
+   * delivery exactly once. Mutually exclusive with `retry` — the retry axis
+   * moves to the relay's failure policy.
+   */
+  durable?: {
+    /** Outbox store the delivery rows are written to — share it with the module. */
+    store: OutboxStore;
+  };
 }
 /** `WebhookSubscription` as returned by `list()` — secret withheld. */
 type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
@@ -245,5 +265,108 @@ interface VerifySignatureOptions {
 declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
 declare const webhookPlugin: FastifyPluginAsync<WebhookPluginOptions>;
 declare const _default: FastifyPluginAsync<WebhookPluginOptions>;
+/** Event type carried by durable webhook delivery rows. */
+declare const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
+/** Payload of a {@link WEBHOOK_DELIVERY_EVENT} row. */
+interface WebhookDeliveryPayload {
+  subscriptionId: string;
+  /** The original event, verbatim — what the receiver is signed and sent. */
+  event: {
+    type: string;
+    payload: unknown;
+    meta: DomainEvent["meta"];
+  };
+}
+/**
+ * A failed webhook POST, classified for the failure policy: `transient`
+ * failures (network error, timeout, 429, 5xx) are worth retrying; the rest
+ * (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
+ * malformed row) are final for this payload and dead-letter immediately.
+ */
+declare class WebhookDeliveryError extends Error {
+  readonly status?: number;
+  readonly transient: boolean;
+  constructor(message: string, options: {
+    status?: number;
+    transient: boolean;
+    cause?: unknown;
+  });
+}
+interface WebhookDeliveryTransportOptions {
+  /**
+   * Resolve a subscription (WITH secret) at delivery time — fresh URL and
+   * secret apply to every attempt, and an unregistered id is an acknowledged
+   * no-op (the delivery is moot, not an error).
+   */
+  getSubscription: (id: string) => WebhookSubscription | undefined | Promise<WebhookSubscription | undefined>;
+  /** Custom fetch (for testing). */
+  fetch?: typeof globalThis.fetch;
+  /** Per-POST timeout in ms (default: 10000). */
+  timeout?: number;
+  /**
+   * URL policy — same seam as {@link WebhookPluginOptions.validateUrl}, but
+   * enforced at DELIVERY time (covers rows enqueued before a policy existed
+   * and out-of-band store writes). When set, `redirect: "manual"` applies so
+   * an allowed URL can't 302 into a blocked target; a rejection is permanent.
+   */
+  validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
+}
+/**
+ * Publish-only `EventTransport` whose `publish()` IS the webhook POST —
+ * plugged into an outbox relay, delivery inherits the relay's guarantees.
+ * Throws {@link WebhookDeliveryError} on failure so the relay observes it
+ * (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
+ * unregistered subscriptions (acknowledge).
+ *
+ * The wire contract is IDENTICAL to inline dispatch: v1 signing, and
+ * `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
+ * across retries, so receiver-side dedup is unchanged.
+ */
+declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
+interface WebhookDeliveryPolicyOptions {
+  /** Total attempts before dead-lettering (default: 8). */
+  maxAttempts?: number;
+  /** First retry delay in ms (default: 5000). */
+  baseMs?: number;
+  /** Backoff cap in ms (default: 900000 — 15 minutes). */
+  maxMs?: number;
+}
+/**
+ * Default failure policy for durable webhook delivery: permanent failures
+ * ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
+ * first attempt — repeating a rejected payload can't succeed; transient ones
+ * retry on exponential backoff until `maxAttempts`, then dead-letter.
+ */
+declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
+interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl"> {
+  /** Module name / `dependsOn` key. Default `'webhook-delivery'`. */
+  name?: string;
+  /** Retry/backoff tuning for the default failure policy. */
+  delivery?: WebhookDeliveryPolicyOptions;
+  /** Full policy override — replaces {@link webhookDeliveryFailurePolicy}. */
+  failurePolicy?: OutboxFailurePolicy;
+}
+/**
+ * Durable webhook delivery as a module: the outbox relay machinery pointed at
+ * webhook POSTs. Pair with `webhookPlugin`'s `durable` option sharing the
+ * same store:
+ *
+ * ```ts
+ * const store = repositoryAsOutboxStore(deliveryRepo);
+ * createApp({
+ *   modules: [createDurableWebhookModule({ store })],
+ *   plugins: async (f) => {
+ *     await f.register(webhookPlugin, { durable: { store } });
+ *   },
+ * });
+ * ```
+ *
+ * The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
+ * delivery and `role: 'api'` deployments only enqueue. The delivering process
+ * must ALSO register `webhookPlugin` (with the shared subscription store) —
+ * subscriptions resolve through `fastify.webhooks` at delivery time, which is
+ * boot-checked, not discovered on the first row.
+ */
+declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
 //#endregion
-export { VerifySignatureOptions, VerifyWebhookInput, VerifyWebhookResult, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WebhookSubscriptionPublic, _default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookPlugin };
+export { DurableWebhookModuleOptions, VerifySignatureOptions, VerifyWebhookInput, VerifyWebhookResult, WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, WebhookDeliveryPayload, WebhookDeliveryPolicyOptions, WebhookDeliveryRecord, WebhookDeliveryTransportOptions, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WebhookSubscriptionPublic, createDurableWebhookModule, createWebhookDeliveryTransport, _default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,9 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-Dm88DaTW.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-CXB79bvt.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
+import { createChildEvent } from "@classytic/primitives/events";
 //#region src/integrations/webhooks.ts
 /**
 * @classytic/arc — Webhook Outbound Integration
@@ -233,6 +236,11 @@ var MemoryWebhookStore = class {
 };
 const webhookPlugin = async (fastify, opts = {}) => {
 	const store = opts.store ?? new MemoryWebhookStore();
+	declareRuntimeCapability(fastify, {
+		subsystem: "webhooks.store",
+		durability: opts.store ? "shared" : "memory",
+		detail: "default MemoryWebhookStore: subscriptions + delivery log are replica-local"
+	});
 	const fetchFn = opts.fetch ?? globalThis.fetch;
 	const timeout = opts.timeout ?? 1e4;
 	const maxLogEntries = opts.maxLogEntries ?? 1e3;
@@ -241,6 +249,8 @@ const webhookPlugin = async (fastify, opts = {}) => {
 	const retryAttempts = opts.retry?.attempts ?? 1;
 	const retryBackoffMs = opts.retry?.backoffMs ?? 1e3;
 	if (!Number.isInteger(retryAttempts) || retryAttempts < 1) throw new Error(`webhookPlugin: retry.attempts must be an integer >= 1 (got ${String(opts.retry?.attempts)})`);
+	if (opts.durable && opts.retry) throw new Error("webhookPlugin: `durable` and `retry` are mutually exclusive — durable delivery retries via the relay's failure policy (webhookDeliveryFailurePolicy), not in-process.");
+	const durableStore = opts.durable?.store;
 	let subscriptions = [];
 	const log = [];
 	subscriptions = await store.getAll();
@@ -261,6 +271,21 @@ const webhookPlugin = async (fastify, opts = {}) => {
 	async function dispatchEvent(event) {
 		const matching = subscriptions.filter((s) => matchesPattern(s.events, event.type));
 		if (matching.length === 0) return;
+		if (durableStore) {
+			for (const sub of matching) {
+				const deliveryId = `${event.meta.id}:wh:${sub.id}`;
+				const delivery = createChildEvent(event, WEBHOOK_DELIVERY_EVENT, {
+					subscriptionId: sub.id,
+					event: {
+						type: event.type,
+						payload: event.payload,
+						meta: event.meta
+					}
+				}, { id: deliveryId });
+				await durableStore.save(delivery, { dedupeKey: deliveryId });
+			}
+			return;
+		}
 		const body = JSON.stringify({
 			type: event.type,
 			payload: event.payload,
@@ -361,5 +386,158 @@ var webhooks_default = fp(webhookPlugin, {
 	fastify: "5.x",
 	dependencies: ["arc-events"]
 });
+/** Event type carried by durable webhook delivery rows. */
+const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
+/**
+* A failed webhook POST, classified for the failure policy: `transient`
+* failures (network error, timeout, 429, 5xx) are worth retrying; the rest
+* (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
+* malformed row) are final for this payload and dead-letter immediately.
+*/
+var WebhookDeliveryError = class extends Error {
+	status;
+	transient;
+	constructor(message, options) {
+		super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
+		this.name = "WebhookDeliveryError";
+		if (options.status !== void 0) this.status = options.status;
+		this.transient = options.transient;
+	}
+};
+/**
+* Publish-only `EventTransport` whose `publish()` IS the webhook POST —
+* plugged into an outbox relay, delivery inherits the relay's guarantees.
+* Throws {@link WebhookDeliveryError} on failure so the relay observes it
+* (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
+* unregistered subscriptions (acknowledge).
+*
+* The wire contract is IDENTICAL to inline dispatch: v1 signing, and
+* `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
+* across retries, so receiver-side dedup is unchanged.
+*/
+function createWebhookDeliveryTransport(options) {
+	const fetchFn = options.fetch ?? globalThis.fetch;
+	const timeout = options.timeout ?? 1e4;
+	return {
+		name: "webhook-delivery",
+		async publish(event) {
+			if (event.type !== "arc.webhook.delivery") throw new WebhookDeliveryError(`webhook-delivery transport received event type '${event.type}' — this store must contain only ${WEBHOOK_DELIVERY_EVENT} rows (wiring bug: wrong store or transport)`, { transient: false });
+			const payload = event.payload;
+			if (!payload?.subscriptionId || !payload.event?.meta?.id) throw new WebhookDeliveryError("webhook-delivery row is malformed: payload.subscriptionId and payload.event required", { transient: false });
+			const sub = await options.getSubscription(payload.subscriptionId);
+			if (!sub) return;
+			let url;
+			try {
+				url = new URL(sub.url);
+				if (options.validateUrl) await options.validateUrl(url, sub);
+			} catch (err) {
+				throw new WebhookDeliveryError(`webhook URL rejected for subscription '${sub.id}': ${err instanceof Error ? err.message : String(err)}`, {
+					transient: false,
+					cause: err
+				});
+			}
+			const body = JSON.stringify(payload.event);
+			const timestamp = Date.now();
+			const v1Signature = signWebhook(body, sub.secret, {
+				timestamp,
+				deliveryId: payload.event.meta.id
+			});
+			const ac = new AbortController();
+			const timer = setTimeout(() => ac.abort(), timeout);
+			let response;
+			try {
+				response = await fetchFn(sub.url, {
+					method: "POST",
+					headers: {
+						"content-type": "application/json",
+						"x-arc-webhook-signature": v1Signature,
+						"x-arc-webhook-timestamp": String(timestamp),
+						"x-arc-webhook-delivery": payload.event.meta.id
+					},
+					body,
+					signal: ac.signal,
+					...options.validateUrl ? { redirect: "manual" } : {}
+				});
+			} catch (err) {
+				throw new WebhookDeliveryError(`webhook POST to subscription '${sub.id}' failed: ${err instanceof Error ? err.message : String(err)}`, {
+					transient: true,
+					cause: err
+				});
+			} finally {
+				clearTimeout(timer);
+			}
+			if (!response.ok) throw new WebhookDeliveryError(`webhook POST to subscription '${sub.id}' returned ${response.status}`, {
+				status: response.status,
+				transient: response.status === 429 || response.status >= 500
+			});
+		}
+	};
+}
+/**
+* Default failure policy for durable webhook delivery: permanent failures
+* ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
+* first attempt — repeating a rejected payload can't succeed; transient ones
+* retry on exponential backoff until `maxAttempts`, then dead-letter.
+*/
+function webhookDeliveryFailurePolicy(options = {}) {
+	const maxAttempts = options.maxAttempts ?? 8;
+	const baseMs = options.baseMs ?? 5e3;
+	const maxMs = options.maxMs ?? 9e5;
+	return ({ error, attempts }) => {
+		if (error instanceof WebhookDeliveryError && !error.transient) return { deadLetter: true };
+		if (attempts >= maxAttempts) return { deadLetter: true };
+		return { retryAt: exponentialBackoff({
+			attempt: attempts,
+			baseMs,
+			maxMs
+		}) };
+	};
+}
+/**
+* Durable webhook delivery as a module: the outbox relay machinery pointed at
+* webhook POSTs. Pair with `webhookPlugin`'s `durable` option sharing the
+* same store:
+*
+* ```ts
+* const store = repositoryAsOutboxStore(deliveryRepo);
+* createApp({
+*   modules: [createDurableWebhookModule({ store })],
+*   plugins: async (f) => {
+*     await f.register(webhookPlugin, { durable: { store } });
+*   },
+* });
+* ```
+*
+* The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
+* delivery and `role: 'api'` deployments only enqueue. The delivering process
+* must ALSO register `webhookPlugin` (with the shared subscription store) —
+* subscriptions resolve through `fastify.webhooks` at delivery time, which is
+* boot-checked, not discovered on the first row.
+*/
+function createDurableWebhookModule(options) {
+	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, ...outboxOptions } = options;
+	return createOutboxModule({
+		...outboxOptions,
+		name: name ?? "webhook-delivery",
+		transport: (fastify) => {
+			if (!fastify.hasDecorator("webhooks")) throw new Error(`Durable webhook module "${name ?? "webhook-delivery"}" requires webhookPlugin — subscriptions resolve through fastify.webhooks at delivery time. Register it in plugins() (with the SHARED subscription store in multi-process topologies).`);
+			return createWebhookDeliveryTransport({
+				getSubscription: (id) => {
+					const pub = fastify.webhooks.list().find((s) => s.id === id);
+					if (!pub) return void 0;
+					const secret = fastify.webhooks.getSecret(id);
+					return secret === void 0 ? void 0 : {
+						...pub,
+						secret
+					};
+				},
+				...fetch !== void 0 ? { fetch } : {},
+				...timeout !== void 0 ? { timeout } : {},
+				...validateUrl !== void 0 ? { validateUrl } : {}
+			});
+		},
+		failurePolicy: failurePolicy ?? webhookDeliveryFailurePolicy(delivery)
+	});
+}
 //#endregion
-export { webhooks_default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookPlugin };
+export { WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, createDurableWebhookModule, createWebhookDeliveryTransport, webhooks_default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";

package/dist/{interface-BP4IJCBO.mjs → interface-DznJrm9R.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-DDSR2HFl.mjs → jsonBody-CfGH-GxO.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-B-HBTGXl.mjs → keys-WeKvY1dE.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-DisEAmkm.mjs → loadResources-Bj-aSsXi.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-D1MJp13f.mjs → loadResourcesFromEntry-DwaxNcE2.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-BVr7PgA0.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-DoALUlOO.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/logger/index.ts
 let globalOptions = {};
 /**

package/dist/{mcpPlugin-CpfVpKHE.mjs → mcpPlugin-aJg5TqHi.mjs}

@@ -1,19 +1,19 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-__T3EJDA.mjs";
-import { p as isArcError, t as ArcError } from "./errors-Bh1KK5ps.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BXjQYbeC.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-DXYX7dIR.mjs";
-import { t as BaseController } from "./BaseController-Dk34dxhI.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
-import { t as executePipeline } from "./pipe-ELHCP3zj.mjs";
-import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-CPA-jx0M.mjs";
-import { n as validateAggregations } from "./validate-PMCPR9El.mjs";
-import { n as executeAggregation } from "./buildHandler-Dn7rzUJo.mjs";
-import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
-import { t as createIdempotencyResult } from "./interface-BP4IJCBO.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CnyKK_1j.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-B3mP_QTy.mjs";
+import { p as isArcError, t as ArcError } from "./errors-Cd_yy7aW.mjs";
+import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CoqIRrkY.mjs";
+import { t as BaseController } from "./BaseController-CaQC5EXX.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
+import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
+import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
+import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
+import { n as executeAggregation } from "./buildHandler-DLE9xX-V.mjs";
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
+import { t as createIdempotencyResult } from "./interface-DznJrm9R.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -332,18 +332,32 @@ function expandOperatorKeys(input) {
 */
 function buildScope(auth) {
 	if (!auth) return { kind: "public" };
+	/**
+	* `context` (and `teamId`, member-only) are carried through, not dropped.
+	*
+	* A resolver could already return them — `McpAuthResult` has an index
+	* signature — and this function silently discarded both, so a resource
+	* gated by `requireScopeContext('branchId')` worked over HTTP and DENIED
+	* every MCP call, because the dimension it authorises against was never
+	* populated. Fail-closed, but it made the tool permanently unusable rather
+	* than wrong, which is why nothing caught it.
+	*/
+	const context = normalizeScopeContext(auth.context);
 	if (auth.clientId && auth.organizationId) return {
 		kind: "service",
 		clientId: auth.clientId,
 		organizationId: auth.organizationId,
-		scopes: auth.scopes
+		scopes: auth.scopes,
+		...context ? { context } : {}
 	};
 	if (auth.organizationId) return {
 		kind: "member",
 		userId: auth.userId,
 		userRoles: auth.roles ?? [],
 		organizationId: auth.organizationId,
-		orgRoles: auth.orgRoles ?? []
+		orgRoles: auth.orgRoles ?? [],
+		...typeof auth.teamId === "string" ? { teamId: auth.teamId } : {},
+		...context ? { context } : {}
 	};
 	return {
 		kind: "authenticated",
@@ -351,6 +365,23 @@ function buildScope(auth) {
 		userRoles: auth.roles ?? []
 	};
 }
+/**
+* Accept a resolver's `context` only as a string→string map.
+*
+* The resolver is host code reached through an index signature, so the value
+* is `unknown`. Coercing arbitrary values (numbers, objects, null) into
+* authorisation dimensions would make `requireScopeContext('branchId')`
+* compare against something that was never a branch id; non-string entries are
+* dropped rather than stringified. Returns `undefined` for an empty result so
+* a scope reports "carries no context" rather than "carries an empty one" —
+* different facts to a caller.
+*/
+function normalizeScopeContext(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [k, v] of Object.entries(value)) if (typeof v === "string") out[k] = v;
+	return Object.keys(out).length > 0 ? Object.freeze(out) : void 0;
+}
 //#endregion
 //#region src/integrations/mcp/tool-helpers.ts
 /**
@@ -849,9 +880,12 @@ function resolveCrudDescription(override, meta) {
 * MCP agent the same field-projection it already has on list.
 */
 const PROJECTION_FIELD = z.string().optional().describe("Comma-separated field list to project (e.g. 'name,price'). Prefix with '-' to exclude (e.g. '-description').");
+/** Default page cap, used only when the resource declares none. */
+const DEFAULT_MCP_MAX_LIMIT = 100;
+/** `limit` is per-resource — see `maxLimit` on the options. */
+const limitField = (maxLimit) => z.number().int().min(1).max(maxLimit).optional().describe(`Items per page (max ${maxLimit})`);
 const PAGINATION_SHAPE = {
 	page: z.number().int().min(1).optional().describe("Page number (1-based). Ignored when `cursor` is set."),
-	limit: z.number().int().min(1).max(100).optional().describe("Items per page (max 100)"),
 	cursor: z.string().optional().describe("Opaque keyset cursor from a previous page's `next`. Pass it to fetch the following page; when set, `page` is ignored (cursor/keyset pagination — stable under concurrent inserts)."),
 	sort: z.string().optional().describe("Sort field, prefix with - for descending"),
 	search: z.string().optional().describe("Full-text search query"),
@@ -939,9 +973,12 @@ function opDescription(op, fieldName) {
 }
 /** Build list/query shape with filterable fields, operators, and pagination */
 function buildListShape(fieldRules, options) {
-	const { filterableFields = [], hiddenFields = [], extraHideFields = [], allowedOperators } = options;
+	const { filterableFields = [], hiddenFields = [], extraHideFields = [], allowedOperators, maxLimit = DEFAULT_MCP_MAX_LIMIT } = options;
 	const allHidden = /* @__PURE__ */ new Set([...hiddenFields, ...extraHideFields]);
-	const shape = { ...PAGINATION_SHAPE };
+	const shape = {
+		...PAGINATION_SHAPE,
+		limit: limitField(maxLimit)
+	};
 	shape._count = z.boolean().optional().describe("Return only { count } of records matching the filters — no documents fetched. Cheapest way to answer 'how many'.");
 	shape._exists = z.boolean().optional().describe("Return only whether ANY record matches the filters (boolean existence check).");
 	shape._distinct = z.string().optional().describe("Return the distinct values of this field across records matching the filters.");
@@ -1826,6 +1863,7 @@ function resourceToTools(resource, config = {}) {
 	const filterableFields = resource.schemaOptions?.filterableFields ?? resource.queryParser?.allowedFilterFields;
 	const sortableFields = resource.queryParser?.allowedSortFields;
 	const allowedOperators = resource.queryParser?.allowedOperators;
+	const maxLimit = resource.queryParser?.maxLimit;
 	const hasSoftDelete = resource._appliedPresets?.includes("softDelete") ?? false;
 	const tools = [];
 	const prefix = config.toolNamePrefix;
@@ -1846,6 +1884,7 @@ function resourceToTools(resource, config = {}) {
 				extraHideFields: config.hideFields,
 				filterableFields,
 				allowedOperators,
+				maxLimit,
 				adapterBodies
 			});
 			if (wiring?.idempotencyStore && op !== "list" && op !== "get") inputSchema._idempotencyKey = z.string().optional().describe("Optional idempotency key — retrying with the same key and input replays the first successful result instead of re-executing.");

package/dist/{memory-DsuWnj4T.mjs → memory-qYSB7rMQ.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-DdQL8syd.mjs → metrics-D7uchLjN.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CpzxqePp.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BcR2bFZQ.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-J99LGTJI.mjs";
-import { t as multipartBody } from "../multipartBody-BnkBLN7v.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BxCoxmiN.mjs";
+import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-BpP9wwj7.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-BnWtbA2U.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-Br81am6m.mjs → module-CwKsgZXp.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-BnkBLN7v.mjs → multipartBody-4w-S3-PU.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-DIRzvxC0.mjs → openapi-BN5cQaO2.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-Crjvczi_.mjs";
-import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-DkJZWo0m.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-XH1RZRyu.mjs";
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-DVpoA0do.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**