@classytic/arc 2.37.1 → 2.40.0

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-97HuFA46.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-D-3OLxNz.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,6 +1,26 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-rzNprqbE.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-9rvxn5Ym.mjs";
+import { n as McpServerInstance } from "../../createMcpServer-BVTs2S5G.mjs";
+import { Client } from "@modelcontextprotocol/client";
 //#region src/integrations/mcp/testing.d.ts
+/** An MCP client bound to a live loopback server, plus its teardown. */
+interface ConnectedMcpTestClient {
+  /** The connected SDK client — full `listTools` / `callTool` / `listPrompts` surface. */
+  client: Client;
+  /** Closes the client and the HTTP server. Always await it. */
+  close: () => Promise<void>;
+}
+/**
+ * Serve an already-built `McpServer` on an ephemeral loopback port and connect
+ * a client to it.
+ *
+ * Split out from {@link createTestMcpClient} because arc's own MCP suites build
+ * a server directly and only need the connection — five of them had each grown a
+ * private copy of the same connect helper against the v1 in-memory transport.
+ * One implementation, two entry points: this for a server you built, that for
+ * one built from resources.
+ */
+declare function connectMcpTestClient(server: McpServerInstance | unknown): Promise<ConnectedMcpTestClient>;
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */
   pluginOptions?: Pick<McpPluginOptions, "resources" | "overrides" | "expose" | "exclude" | "toolNamePrefix" | "extraTools" | "extraPrompts" | "instructions">;
@@ -50,4 +70,4 @@ interface TestMcpClient {
  */
 declare function createTestMcpClient(options?: TestMcpClientOptions): Promise<TestMcpClient>;
 //#endregion
-export { TestMcpClient, TestMcpClientOptions, createTestMcpClient };
+export { ConnectedMcpTestClient, TestMcpClient, TestMcpClientOptions, connectMcpTestClient, createTestMcpClient };

package/dist/integrations/mcp/testing.mjs

@@ -1,26 +1,58 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-97HuFA46.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-D-3OLxNz.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
-* @classytic/arc/mcp/testing — MCP Test Utilities
+* Serve an already-built `McpServer` on an ephemeral loopback port and connect
+* a client to it.
 *
-* Helpers for testing MCP tool integration without raw JSON-RPC parsing.
-* Uses the MCP SDK's InMemoryTransport for fast, in-process testing.
-*
-* @example
-* ```typescript
-* import { createTestMcpClient } from '@classytic/arc/mcp/testing';
-*
-* const client = await createTestMcpClient({
-*   pluginOptions: { resources: [productResource] },
-*   auth: { userId: 'test-user', organizationId: 'org-1' },
-* });
-*
-* const tools = await client.listTools();
-* const result = await client.callTool('list_products', { limit: 5 });
-* await client.close();
-* ```
+* Split out from {@link createTestMcpClient} because arc's own MCP suites build
+* a server directly and only need the connection — five of them had each grown a
+* private copy of the same connect helper against the v1 in-memory transport.
+* One implementation, two entry points: this for a server you built, that for
+* one built from resources.
 */
+async function connectMcpTestClient(server) {
+	const { randomUUID } = await import("node:crypto");
+	const { createServer } = await import("node:http");
+	const { NodeStreamableHTTPServerTransport } = await import("@modelcontextprotocol/node");
+	const { Client, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+	const serverTransport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+	await server.connect(serverTransport);
+	const httpServer = createServer((req, res) => {
+		serverTransport.handleRequest(req, res);
+	});
+	await new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(0, "127.0.0.1", resolve);
+	});
+	const address = httpServer.address();
+	if (address === null || typeof address === "string") {
+		httpServer.close();
+		throw new Error("[arc] MCP test harness: HTTP server did not bind a TCP port");
+	}
+	const client = new Client({
+		name: "test-client",
+		version: "1.0"
+	});
+	await client.connect(new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${address.port}/`)));
+	return {
+		client,
+		/**
+		* Client first, THEN the socket. Reversed, the client's in-flight request
+		* hangs on a dead server until its own timeout — which reads as a slow test
+		* rather than a teardown bug. `httpServer.close()` only stops NEW
+		* connections, so keep-alive sockets are destroyed explicitly; without that
+		* vitest hangs at end-of-file with no failing assertion.
+		*/
+		async close() {
+			await client.close();
+			httpServer.closeAllConnections?.();
+			await new Promise((resolve, reject) => {
+				httpServer.close((err) => err ? reject(err) : resolve());
+			});
+		}
+	};
+}
 /**
 * Create an in-process MCP test client connected to an Arc MCP server.
 *
@@ -44,8 +76,6 @@ import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp
 * ```
 */
 async function createTestMcpClient(options = {}) {
-	const { InMemoryTransport } = await import("@modelcontextprotocol/sdk/inMemory.js");
-	const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
 	const pluginOpts = {
 		resources: [],
 		...options.pluginOptions
@@ -65,19 +95,13 @@ async function createTestMcpClient(options = {}) {
 	});
 	if (pluginOpts.extraTools) tools.push(...pluginOpts.extraTools);
 	const authRef = { current: auth };
-	const server = await createMcpServer({
+	const { client, close } = await connectMcpTestClient(await createMcpServer({
 		name: serverName,
 		version: "1.0.0",
 		instructions: pluginOpts.instructions,
 		tools,
 		prompts: pluginOpts.extraPrompts
-	}, authRef);
-	const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
-	const client = new Client({
-		name: "test-client",
-		version: "1.0"
-	});
-	await Promise.all([client.connect(clientTransport), server.connect(serverTransport)]);
+	}, authRef));
 	return {
 		async listTools() {
 			return (await client.listTools()).tools.map((t) => ({
@@ -91,10 +115,8 @@ async function createTestMcpClient(options = {}) {
 				arguments: args ?? {}
 			});
 		},
-		async close() {
-			await client.close();
-		}
+		close
 	};
 }
 //#endregion
-export { createTestMcpClient };
+export { connectMcpTestClient, createTestMcpClient };

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-CbxCF9M0.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-BxZDlH01.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-BHD3L8of.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-CFwCzEvU.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
-import { a as EventTransport, n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-BbdaMyqy.mjs";
+import { a as EventTransport, n as DomainEvent } from "../EventTransport-BPOQsEer.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-CzsKRBvO.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-OrGatf7r.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-DOAmyXOb.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-Bo7rSKjm.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-6DMC_WNu.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent } from "@classytic/primitives/events";

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";
@@ -968,7 +968,7 @@ async function handleConnection(ctx, socket, request) {
 			socket.close(4003, "Session expired");
 		}
 	}, options.reauthInterval);
-	socket.on("message", async (raw) => {
+	socket.on("message", (raw) => safeAsync((async () => {
 		if ((typeof raw === "string" ? Buffer.byteLength(raw) : raw.length) > options.maxMessageBytes) {
 			socket.send(JSON.stringify({
 				type: "error",
@@ -1057,12 +1057,19 @@ async function handleConnection(ctx, socket, request) {
 			}
 			default: await options.onMessage?.(client, msg);
 		}
-	});
-	socket.on("close", async () => {
+	})(), fastify.log, "ws.message", { clientId }));
+	socket.on("close", () => safeAsync((async () => {
 		if (heartbeatTimer) clearInterval(heartbeatTimer);
 		if (reauthTimer) clearInterval(reauthTimer);
 		if (rooms.getClient(clientId)?.socket === socket) {
-			await options.onDisconnect?.(client);
+			try {
+				await options.onDisconnect?.(client);
+			} catch (err) {
+				fastify.log.warn({
+					err,
+					clientId
+				}, "[arc] websocket onDisconnect threw");
+			}
 			rooms.removeClient(clientId);
 		}
 		queue.dispose();
@@ -1070,7 +1077,7 @@ async function handleConnection(ctx, socket, request) {
 			pushRef,
 			generation
 		});
-	});
+	})(), fastify.log, "ws.close", { clientId }));
 	socket.on("error", () => {
 		if (heartbeatTimer) clearInterval(heartbeatTimer);
 		if (reauthTimer) clearInterval(reauthTimer);

package/dist/{interface-DeLndJ8G.mjs → interface-DjtFnZxH.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-kApktjTc.mjs → jsonBody-Dx6jH_Nb.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-CbxCF9M0.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-BHD3L8of.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-B1MgfDWi.mjs → keys-Ds3ekBiu.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-ma-Aaxp1.mjs → loadResources-E5UFlRrT.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-xszlyXTs.mjs → loadResourcesFromEntry-C2jrJbWG.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-OQA13slI.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-B9WnuG2Q.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger/index.ts
 /**

package/dist/{mcpPlugin-97HuFA46.mjs → mcpPlugin-D-3OLxNz.mjs}

@@ -1,18 +1,18 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-BzZi2bsf.mjs";
-import { p as isArcError, t as ArcError } from "./errors-CbxCF9M0.mjs";
-import { n as requireSingleHeaderValue } from "./headers-DivLPMHe.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-khJmBErP.mjs";
-import { t as BaseController } from "./BaseController-Chkf0Aiw.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-f_MdWDl_.mjs";
-import { t as buildRequestScopeProjection } from "./projection-CRCM5S9T.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-DGGqqSIV.mjs";
-import { t as executePipeline } from "./pipe-BoV-z4db.mjs";
-import { t as pluralize } from "./pluralize-BiU5ocWw.mjs";
-import { t as createIdempotencyResult } from "./interface-DeLndJ8G.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Cc9ZPVs2.mjs";
-import { n as validateAggregations } from "./validate-pMke_boy.mjs";
-import { n as executeAggregation } from "./buildHandler-CIz0NsGS.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-D_LFvMlm.mjs";
+import { p as isArcError, t as ArcError } from "./errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BFEEshDS.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CNQyOrLk.mjs";
+import { t as BaseController } from "./BaseController-BqJtbiUA.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-4OGbe3Hf.mjs";
+import { t as executePipeline } from "./pipe-4_XamfxI.mjs";
+import { t as pluralize } from "./pluralize-BaQ62hOW.mjs";
+import { t as createIdempotencyResult } from "./interface-DjtFnZxH.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-C2qUNzC6.mjs";
+import { n as validateAggregations } from "./validate-DV3hRbsz.mjs";
+import { n as executeAggregation } from "./buildHandler-BG_CHXqQ.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -50,7 +50,7 @@ import { z } from "zod";
 * @returns McpServer instance (not yet connected to a transport)
 */
 async function createMcpServer(config, authRef) {
-	const { McpServer } = await import("@modelcontextprotocol/sdk/server/mcp.js");
+	const { McpServer } = await import("@modelcontextprotocol/server");
 	const server = new McpServer({
 		name: config.name,
 		version: config.version ?? "1.0.0"
@@ -130,25 +130,39 @@ function registerTool(server, tool, authRef) {
 	const config = {};
 	if (tool.title) config.title = tool.title;
 	if (tool.description) config.description = tool.description;
+	/**
+	* Flat SHAPES are passed straight through. v2's `registerTool` carries a
+	* `ZodRawShape` overload and auto-wraps it in `z.object()` itself, so arc's
+	* host-facing ergonomic (`{ name: z.string() }`) needs no adaptation layer.
+	*
+	* arc's own MIGRATION-V2 notes claimed v2 "requires z.object(), raw shapes no
+	* longer accepted" and a wrap was written here on that basis. That was true of
+	* the PRE-ALPHA and is not true of 2.0.0 — checked against the shipped
+	* overloads. Wrapping anyway would have been arc maintaining an adapter for a
+	* conversion the SDK already owns.
+	*/
 	if (tool.inputSchema) config.inputSchema = tool.inputSchema;
 	if (tool.outputSchema) config.outputSchema = tool.outputSchema;
 	if (tool.annotations) config.annotations = tool.annotations;
-	srv.registerTool(tool.name, config, (input, extra) => {
+	srv.registerTool(tool.name, config, (input, mcpCtx) => {
 		const ctx = {
 			session: authRef?.current ?? null,
+			/**
+			* v2 exposes logging as `ctx.mcpReq.log(level, message)` — the SDK builds
+			* the `notifications/message` envelope and correlates it to the in-flight
+			* request. v1 handed over a raw `sendNotification` that arc had to frame
+			* itself; that hand-framed envelope carried no request id, so a log line
+			* from a tool arrived uncorrelated.
+			*
+			* Still best-effort: a transport that has already closed must not turn a
+			* successful tool call into a failed one.
+			*/
 			log: async (level, message) => {
 				try {
-					const notify = extra?.sendNotification;
-					if (notify) await notify({
-						method: "notifications/message",
-						params: {
-							level,
-							data: message
-						}
-					});
+					await (mcpCtx?.mcpReq)?.log?.(level, message);
 				} catch {}
 			},
-			extra
+			extra: mcpCtx
 		};
 		return tool.handler(input, ctx);
 	});
@@ -2035,7 +2049,7 @@ function resourceToTools(resource, config = {}) {
 */
 function registerSchemaResources(server, resources, overrides) {
 	const srv = server;
-	srv.resource("schemas", "arc://schemas", {
+	srv.registerResource("schemas", "arc://schemas", {
 		title: "Arc Resource Schemas",
 		description: "All available resources",
 		mimeType: "application/json"
@@ -2053,7 +2067,7 @@ function registerSchemaResources(server, resources, overrides) {
 	for (const r of resources) {
 		const uri = `arc://schemas/${r.name}`;
 		const schemaOpts = r.schemaOptions;
-		srv.resource(`schema-${r.name}`, uri, {
+		srv.registerResource(`schema-${r.name}`, uri, {
 			title: `${r.displayName} Schema`,
 			description: `Schema for ${r.displayName}`,
 			mimeType: "application/json"
@@ -2181,7 +2195,7 @@ var McpSessionCache = class {
 	closeTransport(entry) {
 		try {
 			const transport = entry.transport;
-			if (transport && typeof transport.close === "function") transport.close();
+			if (transport && typeof transport.close === "function") Promise.resolve(transport.close()).catch(() => {});
 		} catch {}
 	}
 };
@@ -2219,9 +2233,9 @@ var McpSessionCache = class {
 const mcpPluginImpl = async (fastify, options) => {
 	let StreamableHTTPServerTransport;
 	try {
-		StreamableHTTPServerTransport = (await import("@modelcontextprotocol/sdk/server/streamableHttp.js")).StreamableHTTPServerTransport;
+		StreamableHTTPServerTransport = (await import("@modelcontextprotocol/node")).NodeStreamableHTTPServerTransport;
 	} catch {
-		throw new Error("@modelcontextprotocol/sdk is required for MCP support. Install it: npm install @modelcontextprotocol/sdk");
+		throw new Error("@modelcontextprotocol/server and @modelcontextprotocol/node are required for MCP support. Install them: npm install @modelcontextprotocol/server @modelcontextprotocol/node");
 	}
 	try {
 		await import("zod");
@@ -2286,6 +2300,36 @@ const mcpPluginImpl = async (fastify, options) => {
 		const more = allTools.length > 5 ? ` (+${allTools.length - 5} more)` : "";
 		fastify.log.warn(`[arc/mcp] MCP server registered at "${prefix}" with auth DISABLED. Anyone who can reach this URL has full access to ${allTools.length} tools across ${enabledResources.length} resources: ${toolList}${more}. Pass \`auth: betterAuthInstance\` or \`auth: async (headers) => ...\` to gate access. Safe only for stdio transports, local development, or explicitly-public read-only APIs.`);
 	}
+	const rebindOption = options.dnsRebindingProtection;
+	if (rebindOption === void 0 ? options.auth === false : rebindOption !== false) {
+		const { validateHostHeader, validateOriginHeader, localhostAllowedHostnames } = await import("@modelcontextprotocol/server");
+		const cfg = rebindOption === void 0 || rebindOption === false ? {} : rebindOption;
+		const allowedHosts = cfg.allowedHosts ?? localhostAllowedHostnames();
+		const allowedOrigins = cfg.allowedOrigins ?? allowedHosts;
+		const healthPath = `${prefix}/health`;
+		fastify.addHook("onRequest", async (request, reply) => {
+			if (!request.url.startsWith(prefix)) return;
+			if (request.url.split("?")[0] === healthPath) return;
+			const host = validateHostHeader(request.headers.host, allowedHosts);
+			if (!host.ok) return reply.code(403).send({
+				jsonrpc: "2.0",
+				error: {
+					code: -32e3,
+					message: host.message
+				},
+				id: null
+			});
+			const origin = validateOriginHeader(request.headers.origin, allowedOrigins);
+			if (!origin.ok) return reply.code(403).send({
+				jsonrpc: "2.0",
+				error: {
+					code: -32e3,
+					message: origin.message
+				},
+				id: null
+			});
+		});
+	}
 	fastify.get(`${prefix}/health`, async (request, reply) => {
 		const liveness = {
 			status: "ok",

package/dist/{memory-DvASzOn3.mjs → memory-CNvjxzB2.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-Dx-nkDE5.mjs → metrics-P37sNV5H.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BqRfP1kT.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-D3sIPcD4.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-DDKf25s4.mjs";
-import { t as multipartBody } from "../multipartBody-TDaYOHGZ.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BQ2FbhPB.mjs";
+import { t as multipartBody } from "../multipartBody-Bl_gU3Wg.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-C1-GAUpr.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-B5Grm0pI.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-CNKk_twm.mjs → module-CNcwCKUJ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-TDaYOHGZ.mjs → multipartBody-Bl_gU3Wg.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-473gZ-8x.mjs → openapi-BYrL8zvY.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-Bi97zMEl.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-cXTayNOW.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-DGGqqSIV.mjs";
-import { t as pluralize } from "./pluralize-BiU5ocWw.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-C22Xn11N.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-DENbixyA.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-4OGbe3Hf.mjs";
+import { t as pluralize } from "./pluralize-BaQ62hOW.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BR93gCKg.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { t as ArcModule } from "../types-BMa2EPtv.mjs";
+import { t as ArcModule } from "../types-BVlowlm7.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-CbxCF9M0.mjs";
-import { t as defineResource } from "../defineResource-DS3Uj2-8.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-CNKk_twm.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-BHD3L8of.mjs";
+import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-CNcwCKUJ.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.