@classytic/arc 2.32.0 → 2.34.0

package/dist/{index-ZWhLTp_s.d.mts → index-C5NnMEKF.d.mts}

@@ -1,5 +1,5 @@
 
-import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-CT5vu6M0.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BcTumAz_.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**

package/dist/{index-DXlHwvuE.d.mts → index-CFAJEWCX.d.mts}

@@ -1,12 +1,13 @@
 
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, H as CrudController, L as RequestWithExtras, Lt as IController, Rt as IControllerResponse, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig, zt as IRequestContext } from "./index-CpzxqePp.mjs";
 import { i as RequestScope } from "./types-ChuShpCP.mjs";
-import { l as AnyRecord, r as PermissionCheck } from "./types-B7XeLEgK.mjs";
-import "./fastify-augmentation-BppG5bMT.mjs";
+import { l as PermissionCheck, t as AnyRecord } from "./base-Csjc2oF-.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-BcR2bFZQ.mjs";
+import "./fastify-augmentation-DVsTAy6X.mjs";
+import { Filter } from "@classytic/repo-core/filter";
+import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";
 import { DataAdapter } from "@classytic/repo-core/adapter";
-import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { LookupSpec } from "@classytic/repo-core/lookup";
 //#region src/constants.d.ts
 /**
@@ -426,6 +427,18 @@ declare function isFieldReadable(rule: ArcFieldRule | undefined): boolean;
  */
 declare function collectReadBlockedFields(schemaOptions: RouteSchemaOptions | undefined): Set<string> | null;
 //#endregion
+//#region src/core/repositoryFilter.d.ts
+declare const NATIVE_FILTER_DIALECT: unique symbol;
+type NativePolicyFilter<Dialect extends string = string> = AnyRecord & {
+  readonly [NATIVE_FILTER_DIALECT]: Dialect;
+};
+/**
+ * Mark a server-owned policy as intentionally adapter-native. This is an
+ * explicit escape hatch for semantics absent from repo-core's universal IR
+ * (for example MongoDB `$elemMatch`). Never apply it to client input.
+ */
+declare function nativePolicyFilter<const Dialect extends string>(dialect: Dialect, record: AnyRecord): NativePolicyFilter<Dialect>;
+//#endregion
 //#region src/core/validateResourceConfig.d.ts
 interface ConfigError {
   field: string;
@@ -458,4 +471,4 @@ declare function formatValidationErrors(resourceName: string, result: Validation
  */
 declare function assertValidConfig(config: ResourceConfig, options?: ValidateOptions): void;
 //#endregion
-export { DEFAULT_ID_FIELD as A, MAX_FILTER_DEPTH as B, DefineActionConfig as C, defineAggregation as D, createPermissionMiddleware as E, DEFAULT_UPDATE_METHOD as F, RESERVED_QUERY_PARAMS as G, MAX_SEARCH_LENGTH as H, HOOK_OPERATIONS as I, SYSTEM_FIELDS as K, HOOK_PHASES as L, DEFAULT_MAX_LIMIT as M, DEFAULT_SORT as N, CRUD_OPERATIONS as O, DEFAULT_TENANT_FIELD as P, HookOperation as R, mergeResourceConfig as S, createCrudRouter as T, MUTATION_OPERATIONS as U, MAX_REGEX_LENGTH as V, MutationOperation as W, getEntityQuery as _, formatValidationErrors as a, ResourceSeams as b, isFieldReadable as c, createRequestContext as d, getControllerContext as f, getEntityIdField as g, getEntityId as h, assertValidConfig as i, DEFAULT_LIMIT as j, CrudOperation as k, createCrudHandlers as l, sendControllerResponse as m, ValidateOptions as n, validateResourceConfig as o, getControllerScope as p, ValidationResult as r, collectReadBlockedFields as s, ConfigError as t, createFastifyHandler as u, defineResourceVariants as v, defineAction as w, SeamedResourceConfig as x, AdapterLike as y, HookPhase as z };
+export { CRUD_OPERATIONS as A, HookOperation as B, SeamedResourceConfig as C, createCrudRouter as D, defineAction as E, DEFAULT_SORT as F, MUTATION_OPERATIONS as G, MAX_FILTER_DEPTH as H, DEFAULT_TENANT_FIELD as I, SYSTEM_FIELDS as J, MutationOperation as K, DEFAULT_UPDATE_METHOD as L, DEFAULT_ID_FIELD as M, DEFAULT_LIMIT as N, createPermissionMiddleware as O, DEFAULT_MAX_LIMIT as P, HOOK_OPERATIONS as R, ResourceSeams as S, DefineActionConfig as T, MAX_REGEX_LENGTH as U, HookPhase as V, MAX_SEARCH_LENGTH as W, getEntityId as _, formatValidationErrors as a, defineResourceVariants as b, nativePolicyFilter as c, createCrudHandlers as d, createFastifyHandler as f, sendControllerResponse as g, getControllerScope as h, assertValidConfig as i, CrudOperation as j, defineAggregation as k, collectReadBlockedFields as l, getControllerContext as m, ValidateOptions as n, validateResourceConfig as o, createRequestContext as p, RESERVED_QUERY_PARAMS as q, ValidationResult as r, NativePolicyFilter as s, ConfigError as t, isFieldReadable as u, getEntityIdField as v, mergeResourceConfig as w, AdapterLike as x, getEntityQuery as y, HOOK_PHASES as z };

package/dist/{index-C-481Zf2.d.mts → index-ugr1tQlW.d.mts}

@@ -1,5 +1,5 @@
 
-import { r as PermissionCheck } from "./types-B7XeLEgK.mjs";
+import { l as PermissionCheck } from "./base-Csjc2oF-.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/integrations/jobs/execution.d.ts
 /**
@@ -165,6 +165,22 @@ interface JobsPluginOptions {
   } | unknown;
   /** Job definitions to register */
   jobs: JobDefinition[];
+  /**
+   * Which HALF of the queue this process owns. Phase 2 of the topology plan:
+   * an API replica that merely registered the plugin should not consume jobs.
+   *
+   * - `'both'` (default) — queues AND workers; the single-process case.
+   * - `'producer'` — queues only: `dispatch()` works, NO worker is
+   *   constructed, handlers never run here. For API fleets.
+   * - `'worker'` — workers AND queues (a worker needs its queue for DLQ +
+   *   dispatch-from-handler), HTTP dispatch still possible but the point is
+   *   consumption. For dedicated worker fleets.
+   *
+   * Repeatable schedules are registered by whichever side constructs
+   * WORKERS — a producer-only process must not own schedule reconciliation
+   * it cannot execute.
+   */
+  mode?: "both" | "producer" | "worker";
   /** URL prefix for job management endpoints (default: '/jobs') */
   prefix?: string;
   /**

package/dist/index.d.mts

@@ -1,12 +1,12 @@
 
-import { $t as TreeMixin, A as RequestIdOptions, An as BaseControllerOptions, B as defineResource, Bt as RawRouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcGetResult, E as GracefulShutdownOptions, En as ArcDeleteResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, L as RequestWithExtras, Lt as IController, Mn as ControllerConstructionOptions, N as FastifyRequestExtras, Nn as ListResult, Nt as RateLimitConfig, O as HealthOptions, On as ArcListResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeExt, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcCreateResult, U as ResourceConfig, V as ResourceDefinition, Vt as RouteHandler, Wt as AuthPluginOptions, X as CrudRouteKey, Xt as SoftDeleteExt, Y as PresetResult, Yt as BaseController, Z as CrudSchemas, Zt as SoftDeleteMixin, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugExt, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, in as BaseCrudController, jn as ControllerConfigurableOptions, k as IntrospectionPluginOptions, kn as ArcUpdateResult, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkExt, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BulkMixin, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as SlugMixin, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, y as OwnershipCheck, zt as IRequestContext } from "./index-CpzxqePp.mjs";
-import { a as UserBase, d as JWTPayload, i as PermissionContext, l as AnyRecord, m as UserOrganization, n as DataPolicy, r as PermissionCheck, t as AuthorizationDecision, u as ArcRequest } from "./types-B7XeLEgK.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-Csjc2oF-.mjs";
+import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-BcR2bFZQ.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-BppG5bMT.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-DXlHwvuE.mjs";
-import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-zq6VrjaB.mjs";
+import "./fastify-augmentation-DVsTAy6X.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-CFAJEWCX.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-B-DvUzsr.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, type MutationWriteContext, type NativePolicyFilter, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type ResourceWrites, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, type WriteContext, type WriteVerbKey, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,14 +1,15 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-J99LGTJI.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Bh1KK5ps.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-Dk34dxhI.mjs";
-import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-XFPPUu2c.mjs";
-import { c as getControllerScope } from "./pipeline-CPA-jx0M.mjs";
-import { t as defineAggregation } from "./defineAggregation-gX4No1gt.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BwwmNSp7.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-Dl_m0NCe.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BxCoxmiN.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Cd_yy7aW.mjs";
+import { t as nativePolicyFilter } from "./repositoryFilter-BANpz6BX.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CbkuhNI2.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-ZhuLonLm.mjs";
+import { c as getControllerScope } from "./pipeline-q69DZzgG.mjs";
+import { t as defineAggregation } from "./defineAggregation-Nv-DwfOf.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BYKa8wHu.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-CP47jdi7.mjs";
 //#region src/index.ts
-const version = "2.32.0";
+const version = "2.34.0";
 //#endregion
-export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-BbfP8aky.mjs → init-mdJ-v4Xp.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -30,9 +30,9 @@ import { execSync, spawn } from "node:child_process";
 */
 const SCAFFOLD_DEP_VERSIONS = {
 	core: {
-		"@classytic/arc": "^2.20.0",
-		"@classytic/primitives": "^0.11.0",
-		"@classytic/repo-core": "^0.8.0",
+		"@classytic/arc": "^2.33.0",
+		"@classytic/primitives": "^0.21.0",
+		"@classytic/repo-core": "^0.21.0",
 		"@fastify/cors": "^11.2.0",
 		"@fastify/helmet": "^13.0.2",
 		"@fastify/rate-limit": "^10.3.0",
@@ -1700,16 +1700,22 @@ function configTemplate(config) {
  * by config/env.${ts ? "ts" : "js"} (imported first in the entry points).
  */
 
+import { classifyEnv } from '@classytic/primitives/environment';
 import { z } from 'zod';
 
-// Normalize NODE_ENV to the three canonical values the rest of the app
-// reasons about (matches the env loader's prod/dev/test aliasing).
-const NodeEnv = z.preprocess((v) => {
-  const s = String(v ?? '').toLowerCase();
-  if (s === 'prod' || s === 'production') return 'production';
-  if (s === 'test' || s === 'qa') return 'test';
-  return 'development';
-}, z.enum(['development', 'production', 'test']));
+// NODE_ENV normalized to the three canonical values the rest of the app reasons about.
+//
+// \`classifyEnv\` is the SHARED classifier (a required arc peer, so it is already installed). It
+// accepts both spellings of each bucket — \`production\`/\`prod\` and \`test\`/\`qa\` — and trims
+// surrounding whitespace. Do not replace it with \`process.env.NODE_ENV === 'production'\`
+// anywhere in this app: that comparison knows only one spelling, and because almost every call
+// site asks the NEGATIVE question ("not production ⇒ relax"), the miss OPENS the relaxed path on
+// a real production deployment. That exact shape has shipped stack traces to clients, session
+// cookies without \`Secure\`, and non-transactional money writes.
+const NodeEnv = z.preprocess(
+  (v) => classifyEnv(typeof v === 'string' ? v : undefined),
+  z.enum(['development', 'production', 'test']),
+);
 
 const EnvSchema = z
   .object({

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "../EventTransport-2uVV34WU.mjs";
+import { n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
 import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BOXVggMf.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-B9P4Y-UI.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-Cf0jUHsh.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,8 +1,8 @@
 
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
-import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-C-481Zf2.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-CwcUQ610.mjs";
+import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-ugr1tQlW.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-BfC83KsP.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.d.mts

@@ -1,3 +1,3 @@
 
-import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-C-481Zf2.mjs";
+import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-ugr1tQlW.mjs";
 export { type ExecuteTimedHandlerOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobRepeatOptions, type JobStatus, type JobsPluginOptions, type QueueStats, type TimedHandlerLogger, defineJob, executeTimedHandler, jobsPlugin };

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-__T3EJDA.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-CMMLWmuZ.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {
@@ -134,7 +134,7 @@ var Semaphore = class {
 	}
 };
 const jobsPluginImpl = async (fastify, options) => {
-	const { connection, jobs, prefix = "/jobs", bridgeEvents = true, defaults = {} } = options;
+	const { connection, jobs, prefix = "/jobs", bridgeEvents = true, defaults = {}, mode = "both" } = options;
 	let Queue;
 	let Worker;
 	try {
@@ -205,7 +205,7 @@ const jobsPluginImpl = async (fastify, options) => {
 		const queueName = job.name;
 		const queue = new Queue(queueName, { connection });
 		queues.set(queueName, queue);
-		if (job.repeat) {
+		if (job.repeat && mode !== "producer") {
 			const repeatOpts = {
 				...job.repeat.pattern ? {
 					pattern: job.repeat.pattern,
@@ -227,103 +227,105 @@ const jobsPluginImpl = async (fastify, options) => {
 			dlqQueue = new Queue(dlqName, { connection });
 			dlqQueues.set(dlqName, dlqQueue);
 		}
-		const jobTimeout = job.timeout ?? defaults.timeout;
-		const semaphore = job.maxConcurrent != null ? new Semaphore(job.maxConcurrent) : null;
-		const throttledSet = /* @__PURE__ */ new Set();
-		throttledJobs.set(queueName, throttledSet);
-		const worker = new Worker(queueName, async (bullJob) => {
-			if (semaphore) {
-				if (semaphore.isFull) throttledSet.add(bullJob.id ?? "");
-				try {
-					await semaphore.acquire();
-				} finally {
-					throttledSet.delete(bullJob.id ?? "");
+		if (mode !== "producer") {
+			const jobTimeout = job.timeout ?? defaults.timeout;
+			const semaphore = job.maxConcurrent != null ? new Semaphore(job.maxConcurrent) : null;
+			const throttledSet = /* @__PURE__ */ new Set();
+			throttledJobs.set(queueName, throttledSet);
+			const worker = new Worker(queueName, async (bullJob) => {
+				if (semaphore) {
+					if (semaphore.isFull) throttledSet.add(bullJob.id ?? "");
+					try {
+						await semaphore.acquire();
+					} finally {
+						throttledSet.delete(bullJob.id ?? "");
+					}
 				}
-			}
-			const result = await executeTimedHandler({
-				label: queueName,
-				...bullJob.id !== void 0 ? { jobId: bullJob.id } : {},
-				...jobTimeout !== void 0 ? { timeoutMs: jobTimeout } : {},
-				...job.cancelGraceMs !== void 0 ? { cancelGraceMs: job.cancelGraceMs } : {},
-				...semaphore ? { releaseSlot: () => semaphore.release() } : {},
-				logger: fastify.log,
-				run: (signal) => {
-					const meta = {
-						jobId: bullJob.id ?? "",
-						attemptsMade: bullJob.attemptsMade ?? 0,
-						timestamp: Date.now(),
-						signal
-					};
-					return job.handler(bullJob.data, meta);
+				const result = await executeTimedHandler({
+					label: queueName,
+					...bullJob.id !== void 0 ? { jobId: bullJob.id } : {},
+					...jobTimeout !== void 0 ? { timeoutMs: jobTimeout } : {},
+					...job.cancelGraceMs !== void 0 ? { cancelGraceMs: job.cancelGraceMs } : {},
+					...semaphore ? { releaseSlot: () => semaphore.release() } : {},
+					logger: fastify.log,
+					run: (signal) => {
+						const meta = {
+							jobId: bullJob.id ?? "",
+							attemptsMade: bullJob.attemptsMade ?? 0,
+							timestamp: Date.now(),
+							signal
+						};
+						return job.handler(bullJob.data, meta);
+					}
+				});
+				if (bridgeEvents && fastify.events?.publish) try {
+					await fastify.events.publish(`job.${queueName}.completed`, {
+						jobId: bullJob.id,
+						data: bullJob.data,
+						result
+					});
+				} catch (err) {
+					fastify.log.warn({
+						err,
+						jobId: bullJob.id
+					}, `Failed to publish job.${queueName}.completed event`);
 				}
+				return result;
+			}, {
+				connection,
+				concurrency: job.concurrency ?? 1,
+				limiter: job.rateLimit ? {
+					max: job.rateLimit.max,
+					duration: job.rateLimit.duration
+				} : void 0
 			});
-			if (bridgeEvents && fastify.events?.publish) try {
-				await fastify.events.publish(`job.${queueName}.completed`, {
-					jobId: bullJob.id,
-					data: bullJob.data,
-					result
-				});
-			} catch (err) {
-				fastify.log.warn({
-					err,
-					jobId: bullJob.id
-				}, `Failed to publish job.${queueName}.completed event`);
-			}
-			return result;
-		}, {
-			connection,
-			concurrency: job.concurrency ?? 1,
-			limiter: job.rateLimit ? {
-				max: job.rateLimit.max,
-				duration: job.rateLimit.duration
-			} : void 0
-		});
-		worker.on("failed", async (bullJob, error) => {
-			const maxAttempts = job.retries ?? defaults.retries ?? 3;
-			if (dlqQueue && bullJob && (bullJob.attemptsMade ?? 0) >= maxAttempts) try {
-				await dlqQueue.add(`${queueName}:dead`, bullJob.data, {
-					jobId: `${bullJob.id}:dlq`,
-					removeOnComplete: false
-				});
-				fastify.log.warn({
-					jobId: bullJob.id,
-					dlq: job.deadLetterQueue ?? `${queueName}:dead`
-				}, `Job moved to dead-letter queue`);
-			} catch (dlqErr) {
-				fastify.log.error({
-					err: dlqErr,
-					jobId: bullJob.id
-				}, `Failed to move job to DLQ`);
-			}
-			if (bridgeEvents && fastify.events?.publish) try {
-				await fastify.events.publish(`job.${queueName}.failed`, {
-					jobId: bullJob?.id,
-					data: bullJob?.data,
-					error: error.message,
-					attemptsMade: bullJob?.attemptsMade
-				});
-			} catch (err) {
-				fastify.log.warn({
-					err,
-					jobId: bullJob?.id
-				}, `Failed to publish job.${queueName}.failed event`);
-			}
-		});
-		worker.on("stalled", async (jobId) => {
-			fastify.log.warn({
-				jobId,
-				queue: queueName
-			}, "Job stalled — worker may have crashed");
-			if (bridgeEvents && fastify.events?.publish) try {
-				await fastify.events.publish(`job.${queueName}.stalled`, { jobId });
-			} catch (err) {
+			worker.on("failed", async (bullJob, error) => {
+				const maxAttempts = job.retries ?? defaults.retries ?? 3;
+				if (dlqQueue && bullJob && (bullJob.attemptsMade ?? 0) >= maxAttempts) try {
+					await dlqQueue.add(`${queueName}:dead`, bullJob.data, {
+						jobId: `${bullJob.id}:dlq`,
+						removeOnComplete: false
+					});
+					fastify.log.warn({
+						jobId: bullJob.id,
+						dlq: job.deadLetterQueue ?? `${queueName}:dead`
+					}, `Job moved to dead-letter queue`);
+				} catch (dlqErr) {
+					fastify.log.error({
+						err: dlqErr,
+						jobId: bullJob.id
+					}, `Failed to move job to DLQ`);
+				}
+				if (bridgeEvents && fastify.events?.publish) try {
+					await fastify.events.publish(`job.${queueName}.failed`, {
+						jobId: bullJob?.id,
+						data: bullJob?.data,
+						error: error.message,
+						attemptsMade: bullJob?.attemptsMade
+					});
+				} catch (err) {
+					fastify.log.warn({
+						err,
+						jobId: bullJob?.id
+					}, `Failed to publish job.${queueName}.failed event`);
+				}
+			});
+			worker.on("stalled", async (jobId) => {
 				fastify.log.warn({
-					err,
-					jobId
-				}, `Failed to publish job.${queueName}.stalled event`);
-			}
-		});
-		workers.set(queueName, worker);
+					jobId,
+					queue: queueName
+				}, "Job stalled — worker may have crashed");
+				if (bridgeEvents && fastify.events?.publish) try {
+					await fastify.events.publish(`job.${queueName}.stalled`, { jobId });
+				} catch (err) {
+					fastify.log.warn({
+						err,
+						jobId
+					}, `Failed to publish job.${queueName}.stalled event`);
+				}
+			});
+			workers.set(queueName, worker);
+		}
 	}
 	const JOB_PAYLOAD_WARN_BYTES = 102400;
 	const jobDefsByName = /* @__PURE__ */ new Map();

package/dist/integrations/mcp/index.d.mts

@@ -1,9 +1,9 @@
 
-import { Ht as ServerAccessor, Rt as IControllerResponse, V as ResourceDefinition, zt as IRequestContext } from "../../index-CpzxqePp.mjs";
 import { i as RequestScope } from "../../types-ChuShpCP.mjs";
-import { r as PermissionCheck } from "../../types-B7XeLEgK.mjs";
+import { l as PermissionCheck } from "../../base-Csjc2oF-.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-BcR2bFZQ.mjs";
 import { n as FieldPermissionMap } from "../../fields-I_EeRWND.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-CwcUQ610.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-BfC83KsP.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -222,6 +222,15 @@ interface FieldRulesToZodOptions {
   filterableFields?: readonly string[];
   /** Allowed filter operators — generates `field[op]` entries in list mode (e.g., price[gt], price[lte]) */
   allowedOperators?: readonly string[];
+  /**
+   * The resource's page-size cap, for the `limit` field's `max` AND its description.
+   *
+   * Defaults to 100 only when the resource states nothing. Hardcoding 100 here made
+   * MCP a FOURTH independent cap: a resource configured for 1000 exposed a tool that
+   * rejected `limit: 500` outright and told the agent "max 100" — so the model was
+   * misinformed about the ceiling, not merely limited by it.
+   */
+  maxLimit?: number;
 }
 /** Single field rule entry from Arc's schemaOptions.fieldRules */
 interface FieldRuleEntry {

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-CpfVpKHE.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-DX3PHD7K.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,5 +1,5 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-CwcUQ610.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-BfC83KsP.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-CpfVpKHE.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-DX3PHD7K.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-Bh1KK5ps.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DPZdQmDz.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-Cd_yy7aW.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DsT1B5zJ.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**