@classytic/arc 2.37.1 → 2.40.0

package/dist/rateLimitKey-umrS6-vu.mjs

@@ -0,0 +1,41 @@
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+//#region src/scope/rateLimitKey.ts
+/**
+* Marks a key generator as SCOPE-AWARE, so `buildRateLimitOpts` can place the rate-limit
+* hook after authentication instead of before it.
+*
+* Without this, the degradation is invisible: `@fastify/rate-limit` runs at `onRequest`,
+* arc authenticates in a `preHandler`, so a scope-keyed generator sees `PUBLIC_SCOPE`,
+* returns the IP for every caller, and — behind a proxy — buckets an entire deployment
+* together. Nothing throws; the limiter simply answers a question nobody asked.
+*
+* `Symbol.for` so the marker survives two copies of arc in one tree.
+*/
+const SCOPE_AWARE_KEY_GENERATOR = Symbol.for("arc.rateLimit.scopeAwareKeyGenerator");
+/** True when this generator needs a resolved scope (see the symbol's docblock). */
+function isScopeAwareKeyGenerator(fn) {
+	return typeof fn === "function" && fn[SCOPE_AWARE_KEY_GENERATOR] === true;
+}
+function createTenantKeyGenerator(opts) {
+	const generator = opts?.strategy ?? defaultTenantStrategy;
+	/**
+	* Wrapped rather than tagged in place: a host's `strategy` is its own function, and
+	* stamping a symbol onto it would mutate a value it may reuse elsewhere.
+	*/
+	const tagged = (ctx) => generator(ctx);
+	Object.defineProperty(tagged, SCOPE_AWARE_KEY_GENERATOR, {
+		value: true,
+		enumerable: false
+	});
+	return tagged;
+}
+function defaultTenantStrategy(ctx) {
+	const scope = ctx.scope;
+	if (!scope || scope.kind === "public") return ctx.ip;
+	if (scope.kind === "member") return scope.organizationId;
+	if (scope.kind === "service") return scope.organizationId;
+	if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
+	return scope.userId ?? ctx.ip;
+}
+//#endregion
+export { isScopeAwareKeyGenerator as n, createTenantKeyGenerator as t };

package/dist/{realtime-BWuHi-UI.mjs → realtime-zzoNLDtj.mjs}

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-BzZi2bsf.mjs";
-import { n as getUserRoles } from "./userHelpers-Bi97zMEl.mjs";
-import { c as getOrgId } from "./types-khJmBErP.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cr1F8jKZ.mjs";
-import { t as applyFieldReadPermissions } from "./fields-f_MdWDl_.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-BxZDlH01.mjs";
-import { t as openSseStream } from "./sseStream-nNPqvOeK.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-D_LFvMlm.mjs";
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
+import { c as getOrgId } from "./types-CNQyOrLk.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cldubvul.mjs";
+import { t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-CFwCzEvU.mjs";
+import { t as openSseStream } from "./sseStream-BfZtL5-m.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({

package/dist/{redis-stream-mwLWlfHG.d.mts → redis-stream-DSsPyYzd.d.mts}

@@ -1,5 +1,5 @@
 
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-BEVP50ka.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-BPOQsEer.mjs";
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {
   xadd(key: string, id: string, ...fieldValues: string[]): Promise<string | null>;
@@ -232,8 +232,13 @@ declare class RedisStreamTransport implements EventTransport {
   private processEntries;
   private claimPending;
   private processEntry;
+  /**
+   * The canonical matcher from primitives — the SAME glob rules the memory
+   * transport speaks. A private matcher here once accepted `prefix.*` but not
+   * `prefix:*`, so an `order:*` subscription that worked in-process received
+   * nothing after a move to the stream, with no error.
+   */
   private getMatchingHandlers;
-  private matchesPattern;
   private moveToDlq;
   /**
    * Reconstruct a `DeadLetteredEvent` for a message id. Reads the original

package/dist/{registerRoute-mvm6zY2H.mjs → registerRoute-_6zHiz0x.mjs}

@@ -1,8 +1,9 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-BzZi2bsf.mjs";
-import { f as createError } from "./errors-CbxCF9M0.mjs";
-import { u as getRequestScope } from "./types-khJmBErP.mjs";
-import { n as requestContext } from "./requestContext-KzIdSmN2.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-D_LFvMlm.mjs";
+import { f as createError } from "./errors-BHD3L8of.mjs";
+import { u as getRequestScope } from "./types-CNQyOrLk.mjs";
+import { r as deriveHiddenFieldPermissions } from "./fields-fA-Dkou5.mjs";
+import { n as requestContext } from "./requestContext-D4PuGhEw.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -18,7 +19,10 @@ import { n as requestContext } from "./requestContext-KzIdSmN2.mjs";
 * formatters).
 */
 function buildArcDecorator(meta) {
-	const frozen = Object.freeze({ ...meta });
+	const frozen = Object.freeze({
+		...meta,
+		fields: deriveHiddenFieldPermissions(meta.schemaOptions, meta.fields)
+	});
 	return async (req, _reply) => {
 		req.arc = frozen;
 		const store = requestContext.get();

package/dist/registry/index.d.mts

@@ -1,6 +1,6 @@
 
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-BqRfP1kT.mjs";
-import "../fastify-augmentation-CRsNNhuo.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-D3sIPcD4.mjs";
+import "../fastify-augmentation-HncZMmze.mjs";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 import { FastifyPluginAsync } from "fastify";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-3maEt__c.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-OQA13slI.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-CEpoRpLP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-B9WnuG2Q.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-3maEt__c.mjs → registry-CEpoRpLP.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "./constants-DDKf25s4.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-BQ2FbhPB.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**

package/dist/{renewingLease-C1-GAUpr.mjs → renewingLease-B5Grm0pI.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the

package/dist/{replyHelpers-DVcUoled.mjs → replyHelpers-9h-a592u.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{requestContext-KzIdSmN2.mjs → requestContext-D4PuGhEw.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**

package/dist/{rolldown-runtime-NVzJrC-o.mjs → rolldown-runtime-DzE6ikSH.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/{runtimeCapabilities-OrGatf7r.mjs → runtimeCapabilities-Bo7rSKjm.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/runtimeCapabilities.ts
 /**
 * `Symbol.for` so declarations from two arc copies in one dependency graph

package/dist/{schedules-DeRI03eo.mjs → schedules-Dm21pqHU.mjs}

@@ -1,6 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
-import { t as startRenewingLease } from "./renewingLease-C1-GAUpr.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+import { t as runWorkScope } from "./workScope-CoGpuzDX.mjs";
+import { t as startRenewingLease } from "./renewingLease-B5Grm0pI.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({
@@ -60,7 +61,10 @@ const schedulesPlugin = async (fastify, opts) => {
 			}
 			stat.runs++;
 			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
-			await s.handler(fastify);
+			await runWorkScope({
+				kind: "job",
+				id: s.name
+			}, () => s.handler(fastify));
 			stat.lastError = null;
 		} catch (err) {
 			stat.failures++;

package/dist/{schemaConverter-cXTayNOW.mjs → schemaConverter-DENbixyA.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 //#region src/utils/schemaConverter.ts
 /**

package/dist/{schemaIR-Cc9ZPVs2.mjs → schemaIR-C2qUNzC6.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { o as toJsonSchema } from "./schemaConverter-cXTayNOW.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { o as toJsonSchema } from "./schemaConverter-DENbixyA.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts

package/dist/scim/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as parseJsonBody } from "../jsonBody-kApktjTc.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-Dx6jH_Nb.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-khJmBErP.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-9X0lGzTQ.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-D4_rjP1K.mjs";
-import { t as resolveOrgFromHeader } from "../scope-C2r7_WGs.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CNQyOrLk.mjs";
+import { n as elevation_default, t as elevationPlugin } from "../elevation-CZy6n50b.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-umrS6-vu.mjs";
+import { t as resolveOrgFromHeader } from "../scope-CdYxQVxt.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-C2r7_WGs.mjs → scope-CdYxQVxt.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-CbxCF9M0.mjs";
-import { n as requireSingleHeaderValue } from "./headers-DivLPMHe.mjs";
-import { n as getUserRoles } from "./userHelpers-Bi97zMEl.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BFEEshDS.mjs";
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/{simpleEqualityMatcher-Cr1F8jKZ.mjs → simpleEqualityMatcher-Cldubvul.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/simpleEqualityMatcher.ts
 /**
 * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality

package/dist/{sse-BmZCVRGH.mjs → sse-DbyXoQun.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-khJmBErP.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-BxZDlH01.mjs";
-import { t as openSseStream } from "./sseStream-nNPqvOeK.mjs";
+import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CNQyOrLk.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-CFwCzEvU.mjs";
+import { t as openSseStream } from "./sseStream-BfZtL5-m.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({

package/dist/{sseStream-nNPqvOeK.mjs → sseStream-BfZtL5-m.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { n as forwardedStreamHeaders } from "./streaming-BxZDlH01.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-CFwCzEvU.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{store-helpers-C1r3-6M0.mjs → store-helpers-BfyOd5i6.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-BxZDlH01.mjs → streaming-CFwCzEvU.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**

package/dist/{subscribe-helpers-Dca7Fcz2.mjs → subscribe-helpers-KgVEcn8L.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { r as createEvent } from "./EventTransport-CFdtK25P.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { r as createEvent } from "./EventTransport-BUkTwY_x.mjs";
 //#region src/events/defineEvent.ts
 /**
 * Typed event declarations, a registry for introspection, and `.create()` to

package/dist/sync/changelog.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { CursorExpiredError, MemoryChangeLogStore } from "@classytic/repo-core/sync";
 export { CursorExpiredError, MemoryChangeLogStore };

package/dist/testing/cleanupStoreContract.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/cleanupStoreContract.ts
 /**

package/dist/testing/index.d.mts

@@ -1,10 +1,10 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck, t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { V as ResourceDefinition } from "../index-BqRfP1kT.mjs";
-import { n as ArcModuleInput, o as ModuleDisposer, s as ModuleSetupContext } from "../types-BMa2EPtv.mjs";
-import "../index-DCxxRwLC.mjs";
-import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-DHkyk3QN.mjs";
+import { V as ResourceDefinition } from "../index-D3sIPcD4.mjs";
+import { n as ArcModuleInput, o as ModuleDisposer, s as ModuleSetupContext } from "../types-BVlowlm7.mjs";
+import "../index-DbMglURO.mjs";
+import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-DVgPCNcD.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { StandardRepo } from "@classytic/repo-core/repository";
 import { FastifyInstance, FastifyServerOptions } from "fastify";

package/dist/testing/index.mjs

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-DDKf25s4.mjs";
-import { g as getUserId } from "../types-khJmBErP.mjs";
-import { t as BaseController } from "../BaseController-Chkf0Aiw.mjs";
-import { t as defineAggregation } from "../defineAggregation-B1m-45Fe.mjs";
-import { t as defineResource } from "../defineResource-DS3Uj2-8.mjs";
-import { E as requireOrgRole } from "../permissions-DnAc6zoZ.mjs";
-import { a as createApp, n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-DJ7Lli0a.mjs";
-import { n as getModuleExports } from "../module-CNKk_twm.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BQ2FbhPB.mjs";
+import { g as getUserId } from "../types-CNQyOrLk.mjs";
+import { t as BaseController } from "../BaseController-BqJtbiUA.mjs";
+import { t as defineAggregation } from "../defineAggregation-BDA2Tw7v.mjs";
+import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
+import { E as requireOrgRole } from "../permissions-C0GpDsB_.mjs";
+import { a as createApp, n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BAx5s9EF.mjs";
+import { n as getModuleExports } from "../module-CNcwCKUJ.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -1504,7 +1504,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../preloadResources-DJ7Lli0a.mjs").then((n) => n.o);
+	const { createApp } = await import("../preloadResources-BAx5s9EF.mjs").then((n) => n.o);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;

package/dist/testing/outboxStoreContract.mjs

@@ -1,9 +1,20 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { OutboxOwnershipError } from "@classytic/primitives/outbox";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 //#region src/testing/outboxStoreContract.ts
 let seq = 0;
-/** A minimal well-formed event. Ids are unique per call. */
+/**
+* A minimal well-formed event. Ids are unique per call.
+*
+* It was NOT well-formed until 2.40: `meta` carried `occurredAt: string`, which
+* is not a field of `EventMeta`, and omitted the REQUIRED `timestamp: Date`.
+* An `as unknown as DomainEvent` made it compile — a total override that hid the
+* mismatch, so every third party running this shipped suite conformance-tested
+* their store against an event shape the transports never produce. `createEvent`
+* in `@classytic/primitives` is the reference: `{ id, timestamp: new Date() }`.
+*
+* No cast now — if `EventMeta` changes, this stops compiling, which is the point.
+*/
 function event(type = "test.event") {
 	seq += 1;
 	return {
@@ -11,7 +22,7 @@ function event(type = "test.event") {
 		payload: { n: seq },
 		meta: {
 			id: `evt-${Date.now()}-${seq}`,
-			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
+			timestamp: /* @__PURE__ */ new Date()
 		}
 	};
 }

package/dist/testing/storageContract.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/storageContract.ts
 /**

package/dist/{transactionContext-6F7Gkbxg.mjs → transactionContext-46KyUADP.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/transactionContext.ts
 /**

package/dist/{typeGuards-BrXgbFi-.mjs → typeGuards-t_CVgRXN.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/typeGuards.ts
 /** Check if fastify has the events plugin registered */
 function hasEvents(instance) {

package/dist/types/index.d.mts

@@ -1,6 +1,6 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { a as UserLike, c as DataPolicy, d as UserBase, i as ObjectId, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "../base-C-NL2fTi.mjs";
-import { $ as OpenApiSchemas, A as RequestIdOptions, An as WriteVerbKey, At as RouteDefinition, C as RequestContext, D as HealthCheck, Dn as MutationWriteContext, Dt as ActionEntry, E as GracefulShutdownOptions, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, G as OnTenantDeleteConfig, H as CrudController, I as MiddlewareHandler, In as IRequestContext, It as Authenticator, J as PresetHook, K as ResolvedTenantPurge, L as RequestWithExtras, Ln as RawRouteHandler, Lt as AuthenticatorContext, M as EventsDecorator, Mn as ControllerLike, Mt as RouteMethod, N as FastifyRequestExtras, Nn as FastifyHandler, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, Ot as ActionHandlerFn, P as FastifyWithAuth, Pn as IController, Pt as AuthHelpers, Q as MiddlewareConfig, Rn as RouteHandler, Rt as JwtContext, S as QueryParserInterface, T as CrudRouterOptions, Tt as ResourceCacheConfig, U as ResourceConfig, W as ResourcePermissions, X as CrudRouteKey, Y as PresetResult, Z as CrudSchemas, _ as ControllerQueryOptions, a as InferAdapterDoc, at as ResourceExtensions, b as ParsedQuery, c as TypedController, d as PaginationResult, et as RouteSchemaOptions, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, i as ValidationResult, it as ResourceHooks, j as ArcDecorator, jn as ControllerHandler, jt as RouteMcpConfig, k as IntrospectionPluginOptions, kn as WriteContext, kt as ActionsMap, l as TypedRepository, m as RegistryStats, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, q as PresetFunction, r as ValidateOptions, rt as ResourceHookContext, s as InferResourceDoc, t as RouteHandlerMethod, tt as ArcFieldRule, u as TypedResourceConfig, v as LookupOption, w as ServiceContext, x as PopulateOption, xn as BaseControllerOptions, y as OwnershipCheck, zt as TokenPair } from "../index-BqRfP1kT.mjs";
+import { $ as OpenApiSchemas, A as RequestIdOptions, An as WriteVerbKey, At as RouteDefinition, C as RequestContext, D as HealthCheck, Dn as MutationWriteContext, Dt as ActionEntry, E as GracefulShutdownOptions, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, G as OnTenantDeleteConfig, H as CrudController, I as MiddlewareHandler, In as IRequestContext, It as Authenticator, J as PresetHook, K as ResolvedTenantPurge, L as RequestWithExtras, Ln as RawRouteHandler, Lt as AuthenticatorContext, M as EventsDecorator, Mn as ControllerLike, Mt as RouteMethod, N as FastifyRequestExtras, Nn as FastifyHandler, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, Ot as ActionHandlerFn, P as FastifyWithAuth, Pn as IController, Pt as AuthHelpers, Q as MiddlewareConfig, Rn as RouteHandler, Rt as JwtContext, S as QueryParserInterface, T as CrudRouterOptions, Tt as ResourceCacheConfig, U as ResourceConfig, W as ResourcePermissions, X as CrudRouteKey, Y as PresetResult, Z as CrudSchemas, _ as ControllerQueryOptions, a as InferAdapterDoc, at as ResourceExtensions, b as ParsedQuery, c as TypedController, d as PaginationResult, et as RouteSchemaOptions, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, i as ValidationResult, it as ResourceHooks, j as ArcDecorator, jn as ControllerHandler, jt as RouteMcpConfig, k as IntrospectionPluginOptions, kn as WriteContext, kt as ActionsMap, l as TypedRepository, m as RegistryStats, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, q as PresetFunction, r as ValidateOptions, rt as ResourceHookContext, s as InferResourceDoc, t as RouteHandlerMethod, tt as ArcFieldRule, u as TypedResourceConfig, v as LookupOption, w as ServiceContext, x as PopulateOption, xn as BaseControllerOptions, y as OwnershipCheck, zt as TokenPair } from "../index-D3sIPcD4.mjs";
 import { n as ElevationOptions, t as ElevationEvent } from "../elevation-BXCfVcNG.mjs";
 export type { ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ArcDecorator, ArcFieldRule, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, AuthorizationDecision, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRouteKey, CrudRouterOptions, CrudSchemas, DataPolicy, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, MutationWriteContext, ObjectId, OnTenantDeleteConfig, OpenApiSchemas, OwnershipCheck, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryParserInterface, RateLimitConfig, RawRouteHandler, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResolvedTenantPurge, ResourceCacheConfig, ResourceConfig, ResourceExtensions, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, ResourceWrites, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult, WriteContext, WriteVerbKey };

package/dist/types/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 export {};

package/dist/types/storage.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 export {};

package/dist/{types-rzNprqbE.d.mts → types-9rvxn5Ym.d.mts}

@@ -1,5 +1,5 @@
 
-import { V as ResourceDefinition } from "./index-BqRfP1kT.mjs";
+import { V as ResourceDefinition } from "./index-D3sIPcD4.mjs";
 import { z } from "zod";
 //#region src/integrations/mcp/types.d.ts
 /** Behavioral hints for MCP clients (tool annotations per MCP spec) */
@@ -275,6 +275,51 @@ interface McpPluginOptions {
    * - `McpAuthResolver` — custom function that resolves identity from headers
    */
   auth?: BetterAuthHandler | McpAuthResolver | false;
+  /**
+   * DNS-rebinding protection for the MCP routes — `Host` / `Origin` validation.
+   *
+   * The attack this closes: a page the developer visits can POST to
+   * `127.0.0.1:<port>`. If a DNS name the attacker controls resolves to
+   * loopback, the browser treats the response as same-origin and the page can
+   * READ it — every registered tool, from any website. Validating that `Host`
+   * names a host you expect is what breaks it, which is why the MCP SDK ships
+   * this as a default for localhost servers.
+   *
+   * **Default: on when `auth: false`, off otherwise.** Not a guess — it follows
+   * the threat:
+   * - `auth: false` is the local/dev shape the attack targets, and nothing else
+   *   is standing in the way. Defaults to the SDK's localhost set
+   *   (`localhost`, `127.0.0.1`, `[::1]`).
+   * - With auth configured, the endpoint is normally a real domain whose `Host`
+   *   is not localhost — defaulting protection ON would 403 every production
+   *   deployment. There, credentials are the gate.
+   *
+   * Set explicitly whenever the default's assumption is wrong for you: a
+   * localhost server that DOES use auth, or a deliberately-public `auth: false`
+   * endpoint that must keep answering (`false` to disable).
+   *
+   * Validation itself is `@modelcontextprotocol/server`'s `validateHostHeader` /
+   * `validateOriginHeader` — arc does not reimplement the matching rules.
+   * Hostnames only, no scheme or port; IPv6 in brackets (`[::1]`). A request
+   * with no `Origin` header passes (non-browser MCP clients send none); a
+   * present-but-unlisted `Origin` is rejected.
+   *
+   * @example
+   * ```ts
+   * // localhost server that uses auth — opt in explicitly
+   * mcpPlugin({ resources, auth, dnsRebindingProtection: {} });
+   * // reachable under a known public name
+   * mcpPlugin({ resources, dnsRebindingProtection: { allowedHosts: ['mcp.example.com'] } });
+   * // deliberately public, no Host constraint
+   * mcpPlugin({ resources, auth: false, dnsRebindingProtection: false });
+   * ```
+   */
+  dnsRebindingProtection?: false | {
+    /** Allowed `Host` hostnames. Default: `localhost`, `127.0.0.1`, `[::1]`. */
+    allowedHosts?: string[];
+    /** Allowed `Origin` hostnames. Default: same localhost set. */
+    allowedOrigins?: string[];
+  };
   /** MCP endpoint path (default: '/mcp') */
   prefix?: string;
   /** Server identity */

package/dist/{types-BMa2EPtv.d.mts → types-BVlowlm7.d.mts}

@@ -1,6 +1,6 @@
 
-import { n as DomainEvent, r as EventHandler } from "./EventTransport-BEVP50ka.mjs";
-import { n as ErrorMapper } from "./errorHandler-DI5AN2b5.mjs";
+import { n as DomainEvent, r as EventHandler } from "./EventTransport-BPOQsEer.mjs";
+import { n as ErrorMapper } from "./errorHandler--4rSMMvq.mjs";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import { LockAdapter } from "@classytic/repo-core/lock";
 //#region src/plugins/health.d.ts

package/dist/{types-khJmBErP.mjs → types-CNQyOrLk.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { l as UnauthorizedError, o as OrgRequiredError } from "./errors-CbxCF9M0.mjs";
-import { n as requireSingleHeaderValue } from "./headers-DivLPMHe.mjs";
-import { t as getUserId$1 } from "./userHelpers-Bi97zMEl.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError, o as OrgRequiredError } from "./errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BFEEshDS.mjs";
+import { t as getUserId$1 } from "./userHelpers-DLueLQdQ.mjs";
 //#region src/scope/types.ts
 /**
 * Request Scope — The One Standard

package/dist/{userHelpers-Bi97zMEl.mjs → userHelpers-DLueLQdQ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/utils/userHelpers.ts
 /**
 * Extract a user ID from a user object. Accepts `id` or `_id` — returns

package/dist/utils/index.d.mts

@@ -1,8 +1,8 @@
 
 import { F as getHeader, I as requireSingleHeaderValue, P as ArcHeaders } from "../types-Ddl9OjmE.mjs";
 import { f as getUserId, m as normalizeRoles, p as getUserRoles, t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-BqRfP1kT.mjs";
-import { n as ErrorMapper } from "../errorHandler-DI5AN2b5.mjs";
+import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-D3sIPcD4.mjs";
+import { n as ErrorMapper } from "../errorHandler--4rSMMvq.mjs";
 import { a as NotFoundError, c as RateLimitError, d as ValidationError, f as createDomainError, i as ForbiddenError, l as ServiceUnavailableError, m as isArcError, n as ConflictError, o as OrgAccessDeniedError, p as createError, r as ErrorOptions, s as OrgRequiredError, t as ArcError, u as UnauthorizedError } from "../errors-BGdVwP25.mjs";
 import { scheduleBackground } from "@classytic/repo-core/cache";
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
@@ -691,8 +691,8 @@ declare const paginationSchema: JsonSchema;
  * validation PER RESPONSE to pick the branch, on the hottest route of
  * every arc app. The merge keeps the exact bytes (pinned by
  * `tests/utils/list-response-serialization.test.ts`) and drops the
- * per-response branch validation. Only `data` is required — the one field
- * all four variants share.
+ * per-response branch validation. The list route also serves count, exists
+ * and distinct dispatch verbs, so no field is common to every valid shape.
  */
 declare function listResponse(itemSchema: JsonSchema): JsonSchema;
 /** Offset variant — `{ method: 'offset', data, page, limit, total, pages, hasNext, hasPrev }`. */