@classytic/arc 2.34.0 → 2.36.0

package/dist/{rateLimit-D4-ASwsI.mjs → registerRoute-BTgORTlR.mjs}

@@ -1,5 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as requestContext } from "./requestContext-uYE35JxI.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-EsiY3nUu.mjs";
+import { f as createError } from "./errors-DDKni6Tz.mjs";
+import { u as getRequestScope } from "./types-B8lwJv9Q.mjs";
+import { n as requestContext } from "./requestContext-B93dmpf0.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -178,6 +181,79 @@ function describeValue(v) {
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
 //#endregion
+//#region src/core/middlewares/permissions.ts
+/**
+* Build a PermissionContext from a Fastify request. Extracted so the CRUD
+* permission middleware and the dynamic action-permission check use the same
+* field layout — divergence here silently broke policy filters for actions.
+*/
+function buildPermissionContext(req, opts) {
+	const reqWithExtras = req;
+	const params = req.params;
+	return {
+		user: reqWithExtras.user ?? null,
+		scope: getRequestScope(req),
+		request: req,
+		resource: opts.resource,
+		action: opts.action,
+		resourceId: opts.resourceId ?? params?.id,
+		params,
+		data: opts.data ?? req.body
+	};
+}
+/**
+* Static per-route CRUD permission gate. The permission and action are known
+* at route-registration time, so the gate is a plain preHandler.
+*
+* Actions use the dynamic counterpart `buildActionPermissionMw` — their
+* permission is resolved from `body.action` at request time.
+*/
+function buildCrudPermissionMw(permissionCheck, resourceName, action) {
+	if (!permissionCheck) return null;
+	return async (req, reply) => {
+		const context = buildPermissionContext(req, {
+			resource: resourceName,
+			action
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
+	};
+}
+/**
+* Dynamic per-action permission gate for the action router.
+*
+* Resolves the permission from `body.action` at request time and runs
+* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
+* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
+* (idempotency) and `routeGuards` run. Previously this check lived inside
+* the main action handler, which meant idempotency recorded unauthorized
+* requests and route guards saw unfiltered scope — the very divergence
+* routerShared exists to prevent.
+*
+* Also acts as a defensive fallback for invalid action names — the
+* `oneOf` body schema normally rejects these at AJV validation, but
+* hosts that disable schema validation still get a 400 here.
+*/
+function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
+	const enumSet = new Set(actionEnum);
+	const validActions = [...actionEnum];
+	return async (req, reply) => {
+		const body = req.body ?? {};
+		const action = body.action;
+		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
+		const permissionCheck = actionPermissions[action] ?? globalAuth;
+		if (!permissionCheck) return;
+		const { action: _discard, ...data } = body;
+		const params = req.params;
+		const context = buildPermissionContext(req, {
+			resource: resourceName,
+			action,
+			resourceId: params?.id,
+			data
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+	};
+}
+//#endregion
 //#region src/core/middlewares/pluginMw.ts
 /**
 * Pick the request-lifecycle plugin middleware for an HTTP method:
@@ -246,4 +322,39 @@ function buildRateLimitConfig(rateLimit) {
 	} };
 }
 //#endregion
-export { buildRouteHooks as a, buildAuthMiddleware as c, selectPluginMw as i, buildAuthMiddlewareForPermissions as l, buildRouteConfig as n, resolveRoutePreHandlers as o, resolveRouterPluginMw as r, routeHookOptions as s, buildRateLimitConfig as t, buildArcDecorator as u };
+//#region src/core/middlewares/registerRoute.ts
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
+//#endregion
+export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };

package/dist/registry/index.d.mts

@@ -1,6 +1,6 @@
 
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-BcR2bFZQ.mjs";
-import "../fastify-augmentation-DVsTAy6X.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-C01wWGJt.mjs";
+import "../fastify-augmentation-Bk_9PoiV.mjs";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 import { FastifyPluginAsync } from "fastify";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-CLxCR5LF.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-DoALUlOO.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-BzvRCYS6.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-DNuYVbmv.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-CLxCR5LF.mjs → registry-BzvRCYS6.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-DUoKAGYD.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**
@@ -441,64 +441,23 @@ var introspectionPlugin_default = fp(introspectionPlugin, { name: "arc-introspec
 //#endregion
 //#region src/registry/manifest.ts
 /**
-* Resource manifest for frontend code generators.
+* Resource metadata for frontend code generators — `{ name, prefix, idField,
+* crudOps, actions[] }`, where each action carries its `mount` and
+* `requiresId`.
 *
-* Every host that hand-rolls a `createCrudApi('foo')` helper on the frontend
-* ends up rewriting the same shim for declarative actions: `postAction(id,
-* name, body)` — and forgets to add a method for every NEW action declared
-* on the resource. The OpenAI-team report flagged this in fajr's
-* `invoices.js`, and now matches needs the same.
+* A hand-rolled FE client needs a method per declarative action and drifts the
+* moment a new one is declared. Arc owns the resource definition, so it can
+* emit the list instead of the host maintaining a parallel one.
 *
-* Arc owns the resource definition, so arc can ship the metadata FE codegen
-* needs in one canonical shape:
+* BE-side only — arc ships no FE runtime. The host decides whether this powers
+* a fetch helper, a TanStack Query factory, an RPC client, or `.d.ts` codegen.
 *
-*   {
-*     name: 'invoice',
-*     prefix: '/invoices',
-*     idField: '_id',
-*     crudOps: ['list', 'get', 'create', 'update', 'delete'],
-*     actions: [
-*       { name: 'recordPayment', mount: '/:id/action', requiresId: true,  description: '...' },
-*       { name: 'propose',       mount: '/action',     requiresId: false, description: '...' },
-*     ],
-*   }
-*
-* Hosts feed this into their FE generator (or a runtime `createActionsApi`
-* shim) and every action is wired automatically. New actions land on the FE
-* the same moment they're declared on the resource — no parallel list to
-* keep in sync.
-*
-* The helper is BE-side only (lives under `@classytic/arc/registry`) — arc
-* stays a backend framework and doesn't ship FE runtime code. The host
-* decides whether the manifest powers a fetch-based helper, a TanStack
-* Query factory, an RPC client, or static `.d.ts` generation.
-*
-* @example BE → emit JSON at build time / on a route
+* @example
 * ```ts
-* // Build-time codegen
-* import { buildResourceManifest } from '@classytic/arc/registry';
-* import { invoiceResource } from './invoice.resource.js';
-* writeFileSync('./fe-gen/invoice.manifest.json',
-*   JSON.stringify(buildResourceManifest(invoiceResource)));
-*
-* // Runtime introspection endpoint
-* fastify.get('/manifest/:name', async (req) => {
-*   const r = arc.registry.get(req.params.name);
-*   return r ? buildResourceManifestFromRegistry(r) : reply.code(404);
-* });
-* ```
-*
-* @example FE → generate fetch methods from the manifest
-* ```ts
-* import manifest from './fe-gen/invoice.manifest.json';
-* import { createActionsApi } from './my-fe-shim.js';  // host-owned
-*
-* export const invoicesApi = {
-*   ...createCrudApi(manifest.prefix),
-*   ...createActionsApi(manifest.prefix, manifest.actions),
-*   // → invoicesApi.recordPayment(id, body)
-*   // → invoicesApi.propose(body)        // id-less
-* };
+* // build time
+* writeFileSync('invoice.manifest.json', JSON.stringify(buildResourceManifest(r)));
+* // or at runtime, from the live registry
+* buildResourceManifestFromRegistry(arc.registry.get(name));
 * ```
 */
 /**

package/dist/{renewingLease-BnWtbA2U.mjs → renewingLease-CgIGh0Ab.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the
@@ -8,14 +8,23 @@
 function startRenewingLease(options) {
 	const { lock, name, holderId, leaseMs, onLost, onError } = options;
 	const renewEveryMs = options.renewEveryMs ?? Math.max(10, Math.floor(leaseMs / 2));
+	const fenced = typeof lock.tryAcquireFenced === "function" && options.token !== void 0;
 	let stopped = false;
 	let lost = false;
+	let token = options.token;
 	let timer;
 	let inFlight;
 	const scheduleNext = () => {
 		if (stopped) return;
 		timer = setTimeout(() => {
-			inFlight = Promise.resolve(lock.tryAcquire(name, holderId, leaseMs)).then((renewed) => {
+			inFlight = (fenced ? Promise.resolve(lock.tryAcquireFenced?.(name, holderId, leaseMs)).then((result) => {
+				if (result === null || result === void 0) return false;
+				if (result.token !== token) {
+					token = result.token;
+					return false;
+				}
+				return true;
+			}) : Promise.resolve(lock.tryAcquire(name, holderId, leaseMs))).then((renewed) => {
 				if (!renewed && !lost) {
 					lost = true;
 					onLost?.();
@@ -34,6 +43,9 @@ function startRenewingLease(options) {
 		get lost() {
 			return lost;
 		},
+		get token() {
+			return token;
+		},
 		async stop() {
 			stopped = true;
 			if (timer) clearTimeout(timer);

package/dist/{replyHelpers-BSBVCwL3.mjs → replyHelpers-BN16KPHr.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{requestContext-uYE35JxI.mjs → requestContext-B93dmpf0.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**

package/dist/{rolldown-runtime-DNg-KNCk.mjs → rolldown-runtime-JJWfp8rp.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{runtimeCapabilities-Dm88DaTW.mjs → runtimeCapabilities-jK99Ciw_.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/utils/runtimeCapabilities.ts
 /**
 * `Symbol.for` so declarations from two arc copies in one dependency graph

package/dist/{schedules-CAcZgia0.mjs → schedules-CKKEL21P.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
-import { t as startRenewingLease } from "./renewingLease-BnWtbA2U.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
+import { t as startRenewingLease } from "./renewingLease-CgIGh0Ab.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({
@@ -40,7 +40,8 @@ const schedulesPlugin = async (fastify, opts) => {
 			if (lock) {
 				const lockName = `arc:schedule:${s.name}`;
 				const leaseMs = s.leaseMs ?? Math.min(Math.floor(s.every * .9), MAX_DEFAULT_LEASE_MS);
-				if (!await lock.tryAcquire(lockName, holderId, leaseMs)) {
+				const fenced = await lock.tryAcquireFenced?.(lockName, holderId, leaseMs);
+				if (!(fenced !== void 0 ? fenced !== null : await lock.tryAcquire(lockName, holderId, leaseMs))) {
 					stat.skippedByLock++;
 					return;
 				}
@@ -49,6 +50,7 @@ const schedulesPlugin = async (fastify, opts) => {
 					name: lockName,
 					holderId,
 					leaseMs,
+					...fenced ? { token: fenced.token } : {},
 					onLost: () => fastify.log.warn({ schedule: s.name }, "[arc-schedules] lease renewal lost — another holder took the lock; this run may now overlap. Handlers should be idempotent."),
 					onError: (err) => fastify.log.warn({
 						err,

package/dist/{schemaConverter-XH1RZRyu.mjs → schemaConverter-gg0_aUPF.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 //#region src/utils/schemaConverter.ts
 /**
@@ -14,44 +14,31 @@ import { arcLog } from "./logger/index.mjs";
 * boot with an actionable error; DOC paths warn and degrade — see
 * {@link UnconvertibleMode}. Hosts that never pass Zod pay nothing.
 *
-* ## Targets
+* TARGET — `draft-7` for Fastify route schemas, `openapi-3.0` for docs. Fastify
+* v5's AJV 8 is draft-07 and wants NUMERIC `exclusiveMinimum`; the
+* `openapi-3.0` target emits the draft-04 boolean form, which AJV rejects at
+* registration (`exclusiveMinimum must be number`). Using `draft-7` makes
+* `.positive()` / `.gt()` work unmodified.
 *
-* Zod v4's `toJSONSchema` supports multiple output targets; arc picks per consumer:
-*
-* - **`draft-7`** (default) — for Fastify route schemas. Fastify v5 bundles AJV 8
-*   configured for draft-07, which uses **numeric** `exclusiveMinimum`/`exclusiveMaximum`.
-*   The `openapi-3.0` target emits the **boolean** form inherited from draft-04
-*   (`exclusiveMinimum: true` alongside `minimum`), which AJV rejects at route
-*   registration with `schema is invalid: data/properties/X/exclusiveMinimum must be number`.
-*   Using `draft-7` fixes `.positive() / .negative() / .gt() / .lt()` out of the box.
-* - **`openapi-3.0`** — for OpenAPI doc generation (arc emits OpenAPI 3.0.3). Keeps
-*   the boolean exclusive form that 3.0 tooling expects.
-*
-* ## Input vs output (`io`)
-*
-* A Zod schema has TWO shapes and `z.toJSONSchema()` emits one of them. Getting
-* this wrong is not cosmetic — it rejects legal traffic:
+* IO DIRECTION — a Zod schema has two shapes and getting this wrong REJECTS
+* LEGAL TRAFFIC:
 *
 * ```ts
 * z.object({ title: z.string(), status: z.string().default("draft") })
-* // io: "output" → required: ["title", "status"]   ← a client omitting `status` is REJECTED
-* // io: "input"  → required: ["title"]             ← correct: the default fills it in
+* // io: "output" → required: ["title", "status"]  ← omitting `status` is rejected
+* // io: "input"  → required: ["title"]            ← correct; the default fills it
 * ```
 *
-* The same applies to `.transform()`: in output mode the node is unrepresentable
-* and degrades to `{}` (no validation at all), while input mode emits the real
-* input type. So arc converts by DIRECTION:
-*
-* - **request** (`body`, `querystring`, `params`, `headers`) → `io: "input"` —
-*   validates what the client SENDS, before defaults/transforms/coercion apply.
-* - **response** (and the `entity` doc shape) → `io: "output"` — describes what
-*   the server RETURNS, after they apply.
+* `.transform()` is worse in output mode: unrepresentable, so it degrades to
+* `{}` — no validation at all. Arc therefore converts by direction: REQUESTS
+* (`body`/`querystring`/`params`/`headers`) use `io: "input"`, validating what
+* the client sends before defaults and transforms; RESPONSES (and the `entity`
+* shape) use `io: "output"`, describing what the server returns.
 *
-* One deliberate consequence: a plain `z.object()` emits
-* `additionalProperties: false` in output mode but NOT in input mode, because
-* `z.object()` STRIPS unknown keys rather than rejecting them — so extra keys
-* are legal input. Use `z.strictObject()` when the wire contract must reject
-* them; it keeps `additionalProperties: false` in both modes.
+* Consequence: plain `z.object()` emits `additionalProperties: false` only in
+* output mode, because it STRIPS unknown keys rather than rejecting them — so
+* extra keys are legal input. Use `z.strictObject()` when the wire contract
+* must reject them; it holds in both modes.
 */
 const log = arcLog("schema");
 /** Default target for Fastify-consumed schemas (matches Fastify v5's default AJV draft). */

package/dist/{schemaIR-CDvclAew.mjs → schemaIR-CngYvpCF.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { o as toJsonSchema } from "./schemaConverter-XH1RZRyu.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { o as toJsonSchema } from "./schemaConverter-gg0_aUPF.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts

package/dist/scim/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as parseJsonBody } from "../jsonBody-CfGH-GxO.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-CiHih3ZU.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.d.mts

@@ -1,5 +1,5 @@
 
-import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-ChuShpCP.mjs";
+import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-Ddl9OjmE.mjs";
 import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-BXCfVcNG.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/scope/rateLimitKey.d.ts

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CoqIRrkY.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-B0tlY8y1.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-XngqVNEV.mjs";
-import { t as resolveOrgFromHeader } from "../scope-BaWcqBvr.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-B8lwJv9Q.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-D_cmo80j.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-Bma8VXDO.mjs";
+import { t as resolveOrgFromHeader } from "../scope-B1RsHdjF.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-BaWcqBvr.mjs → scope-B1RsHdjF.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-DDKni6Tz.mjs";
+import { n as requireSingleHeaderValue } from "./headers-DKslnhey.mjs";
+import { n as getUserRoles } from "./userHelpers-xQAi5bPF.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/simpleEqualityMatcher-_9NAMHUD.mjs

@@ -0,0 +1,43 @@
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+//#region src/utils/simpleEqualityMatcher.ts
+/**
+* `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
+* matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
+*
+* Compares `item[key]` to each filter value by string coercion, so a Mongo
+* `ObjectId` matches its string form; array values match by contains. ALL
+* entries must match.
+*
+* NOT an operator engine: no `$in`/`$ne`/`$gt`/`$regex`/`$exists`, no
+* `$and`/`$or`, no dot paths, no schema coercion. Most `_policyFilters` from
+* arc's built-in permission helpers are flat equality (`{ ownerId }`,
+* `{ organizationId }`), and this covers exactly that — defense-in-depth for
+* hosts on minimal repos with no `getOne(compoundFilter)` path.
+*
+* Do NOT use it with operator-shaped filters — supply a native matcher instead
+* (a kit's predicate engine). Kit users need neither: the DB-level filter in
+* `getOne(compoundFilter)` already applies.
+*
+* @example
+* ```ts
+* const adapter: DataAdapter = { repository, type: 'custom', name: 'in-memory',
+*                                matchesFilter: simpleEqualityMatcher };
+* ```
+*/
+function simpleEqualityMatcher(item, filters) {
+	if (!item || typeof item !== "object") return false;
+	const obj = item;
+	for (const [key, expected] of Object.entries(filters)) {
+		if (expected && typeof expected === "object" && !Array.isArray(expected) && Object.getPrototypeOf(expected) === Object.prototype && Object.keys(expected).some((k) => k.startsWith("$"))) return false;
+		const actual = obj[key];
+		if (Array.isArray(actual)) {
+			const expectedStr = String(expected);
+			if (!actual.some((v) => String(v) === expectedStr)) return false;
+			continue;
+		}
+		if (String(actual) !== String(expected)) return false;
+	}
+	return true;
+}
+//#endregion
+export { simpleEqualityMatcher as t };

package/dist/{sse-Cf0jUHsh.mjs → sse-Bxt03Hk5.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CoqIRrkY.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-DsT1B5zJ.mjs";
-import { t as openSseStream } from "./sseStream-Bvpi-UXQ.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-B8lwJv9Q.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-CiTJW8kZ.mjs";
+import { t as openSseStream } from "./sseStream-BMHTLlhR.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({

package/dist/{sseStream-Bvpi-UXQ.mjs → sseStream-BMHTLlhR.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as forwardedStreamHeaders } from "./streaming-DsT1B5zJ.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-CiTJW8kZ.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{store-helpers-B88p99Z2.mjs → store-helpers-Brt8OxWZ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-DsT1B5zJ.mjs → streaming-CiTJW8kZ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**