@classytic/arc 2.37.1 → 2.40.0

package/dist/utils/index.mjs

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-CbxCF9M0.mjs";
-import { n as requireSingleHeaderValue, t as getHeader } from "../headers-DivLPMHe.mjs";
-import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-Bi97zMEl.mjs";
-import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-Cr1F8jKZ.mjs";
-import { A as scheduleBackground, C as paginationSchema, D as createQueryParser, E as ArcQueryParser, O as MONGO_DIALECT, S as offsetListResponse, T as responses, _ as errorDetailSchema, a as defineCompensation, b as keysetListResponse, c as CircuitBreakerError, d as createCircuitBreaker, f as createCircuitBreakerRegistry, g as errorContractSchema, h as deleteResponse, i as defineErrorMapper, k as NEUTRAL_DIALECT, l as CircuitBreakerRegistry, m as bareListResponse, n as handleRaw, o as withCompensation, p as aggregateListResponse, r as defineGuard, s as CircuitBreaker, t as createStateMachine, u as CircuitState, v as getDefaultCrudSchemas, w as queryParams, x as listResponse, y as getListQueryParams } from "../utils-WlLDIKuw.mjs";
-import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-cXTayNOW.mjs";
-import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-BxZDlH01.mjs";
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-OrGatf7r.mjs";
-import { t as openSseStream } from "../sseStream-nNPqvOeK.mjs";
-import { t as hasEvents } from "../typeGuards-BrXgbFi-.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue, t as getHeader } from "../headers-BFEEshDS.mjs";
+import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-DLueLQdQ.mjs";
+import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-Cldubvul.mjs";
+import { A as scheduleBackground, C as paginationSchema, D as createQueryParser, E as ArcQueryParser, O as MONGO_DIALECT, S as offsetListResponse, T as responses, _ as errorDetailSchema, a as defineCompensation, b as keysetListResponse, c as CircuitBreakerError, d as createCircuitBreaker, f as createCircuitBreakerRegistry, g as errorContractSchema, h as deleteResponse, i as defineErrorMapper, k as NEUTRAL_DIALECT, l as CircuitBreakerRegistry, m as bareListResponse, n as handleRaw, o as withCompensation, p as aggregateListResponse, r as defineGuard, s as CircuitBreaker, t as createStateMachine, u as CircuitState, v as getDefaultCrudSchemas, w as queryParams, x as listResponse, y as getListQueryParams } from "../utils-CUFBrhq-.mjs";
+import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-DENbixyA.mjs";
+import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-CFwCzEvU.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-Bo7rSKjm.mjs";
+import { t as openSseStream } from "../sseStream-BfZtL5-m.mjs";
+import { t as hasEvents } from "../typeGuards-t_CVgRXN.mjs";
 export { ArcError, ArcQueryParser, CircuitBreaker, CircuitBreakerError, CircuitBreakerRegistry, CircuitState, ConflictError, ForbiddenError, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, declareRuntimeCapability, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };

package/dist/{utils-WlLDIKuw.mjs → utils-CUFBrhq-.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { m as RESERVED_QUERY_PARAMS } from "./constants-DDKf25s4.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { m as RESERVED_QUERY_PARAMS } from "./constants-BQ2FbhPB.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError, u as ValidationError } from "./errors-CbxCF9M0.mjs";
+import { t as ArcError, u as ValidationError } from "./errors-BHD3L8of.mjs";
 import { scheduleBackground } from "@classytic/repo-core/cache";
 import { errorContractSchema as errorContractSchema$1, errorDetailSchema as errorDetailSchema$1 } from "@classytic/repo-core/errors";
 //#region src/utils/filter-dialect.ts
@@ -561,8 +561,8 @@ const paginationSchema = {
 * validation PER RESPONSE to pick the branch, on the hottest route of
 * every arc app. The merge keeps the exact bytes (pinned by
 * `tests/utils/list-response-serialization.test.ts`) and drops the
-* per-response branch validation. Only `data` is required — the one field
-* all four variants share.
+* per-response branch validation. The list route also serves count, exists
+* and distinct dispatch verbs, so no field is common to every valid shape.
 */
 function listResponse(itemSchema) {
 	return {
@@ -577,6 +577,15 @@ function listResponse(itemSchema) {
 				type: "array",
 				items: itemSchema
 			},
+			count: {
+				type: "integer",
+				minimum: 0
+			},
+			exists: { type: "boolean" },
+			values: {
+				type: "array",
+				items: {}
+			},
 			page: {
 				type: "integer",
 				example: 1
@@ -607,7 +616,6 @@ function listResponse(itemSchema) {
 				description: "Cursor token for the next page, or null."
 			}
 		},
-		required: ["data"],
 		additionalProperties: true
 	};
 }

package/dist/{validate-pMke_boy.mjs → validate-DV3hRbsz.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 //#region src/core/aggregation/normalize.ts
 /**
 * Framework cap on URL-driven aggregation limits when the host opts

package/dist/{versioning-CFK3c04-.mjs → versioning-BXwmj5SD.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
-import { d as createDomainError } from "./errors-CbxCF9M0.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+import { d as createDomainError } from "./errors-BHD3L8of.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/versioning.ts
 var versioning_exports = /* @__PURE__ */ __exportAll({

package/dist/{versioning-DEs-_hFi.d.mts → versioning-P3V6ATyC.d.mts}

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "./EventTransport-BEVP50ka.mjs";
+import { n as DomainEvent } from "./EventTransport-BPOQsEer.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/caching.d.ts
 interface CachingRule {

package/dist/workScope-CoGpuzDX.mjs

@@ -0,0 +1,42 @@
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as requestContext } from "./requestContext-D4PuGhEw.mjs";
+//#region src/context/workScope.ts
+/** Enter a scope for `fn`, or run it inside the active one. */
+function runWorkScope(seed, fn) {
+	if (requestContext.get()) return fn();
+	const store = {
+		kind: seed.kind,
+		requestId: seed.id,
+		startTime: performance.now(),
+		...seed.organizationId !== void 0 ? { organizationId: seed.organizationId } : {}
+	};
+	return requestContext.run(store, fn);
+}
+/**
+* A per-scope memo slot: created once on first use, the same instance after.
+* `undefined` outside a scope.
+*/
+function scopedValue(slot, create) {
+	const store = requestContext.get();
+	if (!store) return void 0;
+	const slots = store;
+	const existing = slots[slot];
+	if (existing !== void 0) return existing;
+	const created = create();
+	slots[slot] = created;
+	return created;
+}
+/**
+* The scope an event dispatch runs in. The correlation id is the scope id so a
+* child event published from a handler chains to the same correlation; the
+* tenant rides `meta`, never the payload.
+*/
+function workSeedFromEvent(event) {
+	return {
+		kind: "event",
+		id: event.meta.correlationId ?? event.meta.id,
+		...event.meta.organizationId !== void 0 ? { organizationId: event.meta.organizationId } : {}
+	};
+}
+//#endregion
+export { scopedValue as n, workSeedFromEvent as r, runWorkScope as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.37.1",
+  "version": "2.40.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -353,20 +353,22 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.25.0",
-    "@classytic/repo-core": ">=0.25.0",
+    "@classytic/primitives": ">=0.27.0",
+    "@classytic/repo-core": ">=0.27.0",
     "@classytic/streamline": ">=2.8.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
     "@fastify/jwt": ">=10.0.0",
-    "@fastify/multipart": ">=9.0.0",
-    "@fastify/rate-limit": ">=10.0.0",
+    "@fastify/multipart": ">=10.0.0",
+    "@fastify/rate-limit": ">=11.0.0",
     "@fastify/sensible": ">=6.0.0",
-    "@fastify/static": ">=8.0.0",
+    "@fastify/static": ">=10.0.0",
     "@fastify/type-provider-typebox": ">=6.0.0",
     "@fastify/under-pressure": ">=9.0.0",
     "@fastify/websocket": ">=11.0.0",
-    "@modelcontextprotocol/sdk": ">=1.28.0",
+    "@modelcontextprotocol/client": ">=2.0.0",
+    "@modelcontextprotocol/node": ">=2.0.0",
+    "@modelcontextprotocol/server": ">=2.0.0",
     "@opentelemetry/api": ">=1.9.0",
     "@opentelemetry/auto-instrumentations-node": ">=0.40.0",
     "@opentelemetry/exporter-trace-otlp-http": ">=0.50.0",
@@ -374,19 +376,18 @@
     "@opentelemetry/instrumentation-mongodb": ">=0.40.0",
     "@opentelemetry/sdk-node": ">=0.50.0",
     "better-auth": ">=1.7.0",
-    "bullmq": ">=5.0.0",
+    "bullmq": ">=6.0.0",
     "fastify": ">=5.12.0",
     "fastify-raw-body": ">=5.0.0",
     "h3-js": ">=4.0.0",
-    "ioredis": ">=5.0.0",
-    "jose": ">=5.0.0",
+    "ioredis": ">=6.0.0",
+    "jose": ">=6.0.0",
     "pino-pretty": ">=13.0.0",
     "typebox": ">=1.0.0",
-    "vitest": ">=3.0.0",
     "zod": ">=4.4.0"
   },
   "peerDependenciesMeta": {
-    "better-auth": {
+    "@classytic/streamline": {
       "optional": true
     },
     "@fastify/cors": {
@@ -398,34 +399,40 @@
     "@fastify/jwt": {
       "optional": true
     },
+    "@fastify/multipart": {
+      "optional": true
+    },
     "@fastify/rate-limit": {
       "optional": true
     },
     "@fastify/sensible": {
       "optional": true
     },
-    "@fastify/under-pressure": {
+    "@fastify/static": {
       "optional": true
     },
-    "@fastify/multipart": {
+    "@fastify/type-provider-typebox": {
+      "optional": true
+    },
+    "@fastify/under-pressure": {
       "optional": true
     },
     "@fastify/websocket": {
       "optional": true
     },
-    "fastify-raw-body": {
+    "@modelcontextprotocol/client": {
       "optional": true
     },
-    "h3-js": {
+    "@modelcontextprotocol/node": {
       "optional": true
     },
-    "pino-pretty": {
+    "@modelcontextprotocol/server": {
       "optional": true
     },
     "@opentelemetry/api": {
       "optional": true
     },
-    "@opentelemetry/sdk-node": {
+    "@opentelemetry/auto-instrumentations-node": {
       "optional": true
     },
     "@opentelemetry/exporter-trace-otlp-http": {
@@ -437,43 +444,40 @@
     "@opentelemetry/instrumentation-mongodb": {
       "optional": true
     },
-    "@opentelemetry/auto-instrumentations-node": {
-      "optional": true
-    },
-    "ioredis": {
+    "@opentelemetry/sdk-node": {
       "optional": true
     },
-    "jose": {
+    "better-auth": {
       "optional": true
     },
-    "typebox": {
+    "bullmq": {
       "optional": true
     },
-    "@fastify/type-provider-typebox": {
+    "fastify-raw-body": {
       "optional": true
     },
-    "bullmq": {
+    "h3-js": {
       "optional": true
     },
-    "@classytic/streamline": {
+    "ioredis": {
       "optional": true
     },
-    "zod": {
+    "jose": {
       "optional": true
     },
-    "@modelcontextprotocol/sdk": {
+    "pino-pretty": {
       "optional": true
     },
-    "@fastify/static": {
+    "typebox": {
       "optional": true
     },
-    "vitest": {
+    "zod": {
       "optional": true
     }
   },
   "dependencies": {
     "fastify-plugin": "^6.0.0",
-    "qs": "^6.15.2",
+    "qs": "^6.16.0",
     "secure-json-parse": "^4.1.0"
   },
   "devDependencies": {
@@ -485,8 +489,8 @@
     "@classytic/gitkit": ">=0.1.0",
     "@classytic/mongokit": "^3.33.0",
     "@classytic/pgkit": "^0.1.0",
-    "@classytic/primitives": "^0.25.0",
-    "@classytic/repo-core": "^0.25.0",
+    "@classytic/primitives": "^0.27.0",
+    "@classytic/repo-core": "^0.27.0",
     "@classytic/sqlitekit": "^0.9.0",
     "@classytic/streamline": "^2.8.2",
     "@electric-sql/pglite": "^0.5.4",
@@ -500,13 +504,15 @@
     "@fastify/type-provider-typebox": "^6.1.0",
     "@fastify/under-pressure": "^9.0.3",
     "@fastify/websocket": "^11.2.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@types/node": "^22.19.21",
     "@types/qs": "^6.15.1",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^5.0.0",
     "ajv": "^8.20.0",
-    "better-auth": "^1.7.2",
+    "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
     "bullmq": "^6.1.2",
     "dotenv": "^17.4.2",
@@ -526,7 +532,7 @@
     "tsdown": "^0.22.14",
     "typebox": "^1.3.6",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10",
+    "vitest": "^5.0.0",
     "ws": "^8.21.0",
     "zod": "^4.4.3"
   },
@@ -560,6 +566,9 @@
     "url": "git+https://github.com/classytic/arc.git"
   },
   "overrides": {
-    "better-sqlite3": "$better-sqlite3"
+    "better-sqlite3": "$better-sqlite3",
+    "better-auth": {
+      "vitest": "$vitest"
+    }
   }
 }

package/skills/arc/references/mcp.md

@@ -133,6 +133,26 @@ await app.register(mcpPlugin, { resources: catalogResources, prefix: '/mcp/catal
 await app.register(mcpPlugin, { resources: orderResources, prefix: '/mcp/orders' });
 ```
 
+## DNS-rebinding protection (`Host` / `Origin`)
+
+An MCP endpoint on loopback is reachable from any page the developer visits: if
+an attacker-controlled DNS name resolves to `127.0.0.1`, the browser treats the
+reply as same-origin and can read every tool's output. Validating `Host` breaks
+the chain.
+
+`dnsRebindingProtection` **defaults on when `auth: false`** (the local shape the
+attack targets) and **off when auth is configured** (a real deployment's `Host`
+is its own domain — defaulting on would 403 it; credentials are the gate there).
+
+```typescript
+mcpPlugin({ resources, auth, dnsRebindingProtection: {} });                        // localhost + auth
+mcpPlugin({ resources, dnsRebindingProtection: { allowedHosts: ['mcp.example.com'] } });
+mcpPlugin({ resources, auth: false, dnsRebindingProtection: false });              // deliberately public
+```
+
+An absent `Origin` passes — non-browser MCP clients send none. A present but
+unlisted one is refused. `${prefix}/health` is exempt so probes keep working.
+
 ## Auth — Three Modes
 
 Arc doesn't enforce an auth strategy. You choose what fits.

package/skills/arc/references/testing.md

@@ -198,15 +198,3 @@ runStorageContract(async () => {
 3. **Use `ctx.fixtures.clear()` in `afterEach`** — destroyers handle dependency order.
 4. **Test permission denials explicitly** — `expectArc(res).forbidden()` beats status-code assertions.
 5. **Reach for `createHttpTestHarness` first** — 16 tests for one function call.
-
-## Migration from pre-2.11 testing APIs
-
-| Pre-2.11 | 2.11 |
-|---|---|
-| `TestHarness` / `createTestHarness` | `createHttpTestHarness(resource, ctxFn)` |
-| `TestAppResult` | `TestAppContext` |
-| `testApp.mongoUri` | `ctx.dbUri` |
-| `createJwtAuthProvider` / `createBetterAuthProvider` (as `HttpTestHarness` imports) | `ctx.auth` from `createTestApp` (or direct factory import) |
-| `withTestDb()` | `createTestApp({ db: 'in-memory' })` + `ctx.dbUri` |
-| `TestDatabase` / `TestSeeder` / `TestTransaction` | `createTestFixtures` + kit-level cleanup |
-| `setupBetterAuthOrg` | `setupBetterAuthTestApp` + `helpers.signUpWithOrg` |

package/skills/arc-code-review/references/anti-patterns.md

@@ -831,7 +831,7 @@ output_mode: content
 
 Also: adapter contract types imported from arc — `import type { DataAdapter, AdapterRepositoryInput, AdapterFactory, OpenApiSchemas, SchemaMetadata, FieldMetadata, RelationMetadata, AdapterValidationResult, AdapterSchemaContext } from '@classytic/arc'` (any subpath). And: `mergeFieldRuleConstraints` from `@classytic/arc/adapters`. Any `from '@classytic/arc/adapters'` import — the entire subpath was removed in arc 2.12.
 
-**Why critical:** This only worked in arc ≤ 2.x. Arc 2.12 moved every kit-specific adapter (Mongoose, Drizzle, Prisma) into its kit and the cross-framework adapter contract into `@classytic/repo-core/adapter`. The `@classytic/arc/adapters` subpath was removed entirely. Importing these names from arc fails to resolve on 3.x — the build breaks at install time. The new shape is **strict**: kit-specific things MUST come from the kit; the contract MUST come from repo-core.
+**Why critical:** `@classytic/arc/adapters` does not exist. Kit-specific adapters (Mongoose, Drizzle, Prisma) live in their kit; the cross-framework contract lives in `@classytic/repo-core/adapter`. Importing these names from arc fails to resolve — the build breaks at install time. The rule is **strict**: kit-specific things come from the kit, the contract comes from repo-core.
 
 **Fix:**
 ```typescript

package/skills/arc-code-review/references/migration-recipes.md

@@ -4,66 +4,6 @@ Concrete diffs for the most common transformations. Apply in the order listed in
 
 ---
 
-## §0. arc 2.x → 3.0 — every kit-specific adapter moves to its kit
-
-**Why:** Through arc 2.12, kit-specific adapter factories (`createMongooseAdapter`, `createDrizzleAdapter`, `createPrismaAdapter`) shipped from `@classytic/arc` and arc had a peer dep on `@classytic/mongokit`. This coupled arc's release cadence to every kit's, dragged mongoose into every arc consumer's resolution graph (even Drizzle/Prisma users), and double-published the adapter contract types.
-
-In arc 2.12:
-- Adapter contract → `@classytic/repo-core/adapter` (new subpath in repo-core 0.4.0).
-- Mongoose adapter → `@classytic/mongokit/adapter` (3.13.0).
-- Drizzle adapter → `@classytic/sqlitekit/adapter` (0.3.0).
-- Prisma adapter → `@classytic/prismakit/adapter` (0.1.0 — new kit).
-- `mergeFieldRuleConstraints` + `applyNullable` → `@classytic/repo-core/schema`.
-- `@classytic/mongokit`, `@prisma/client`, `mongoose` all dropped from arc's `peerDependencies`. Arc 2.12 has zero kit- or driver-bound peers.
-- The `@classytic/arc/adapters` subpath was removed entirely. The `src/adapters/` directory inside arc is gone.
-- `RepositoryLike` is still re-exported from `@classytic/arc` for convenience.
-- Custom kits implementing `DataAdapter<TDoc>` plug in identically — same contract, no special-casing.
-
-### Coordinated versions
-
-These are the floors the adapter SPLIT requires — fixed history, safe to rely on:
-
-| Package | Min (adapter split) |
-|---|---|
-| `@classytic/arc` | 2.12.0 |
-| `@classytic/repo-core` | 0.4.0 |
-| `@classytic/mongokit` | 3.13.0 |
-| `@classytic/sqlitekit` | 0.3.0 |
-| `@classytic/prismakit` | 0.1.0 (not published to npm — build from source) |
-
-A second "current best-practice floor" column used to sit here and is gone: it named
-arc 2.21.0 while arc shipped 2.37, and sqlitekit 0.7.0 against a published 0.9.0. A
-version restated in a skill is wrong within a release and teaches nothing (CLAUDE.md,
-"no rotting metrics") — worse, it reads as researched. **For current floors read
-`peerDependencies` in arc's `package.json` and each kit's own README**; for what a
-given arc version added, [CHANGELOG.md](../../../CHANGELOG.md) is the index.
-
-### Import migration table
-
-| Old (arc 2.11.x) | New (arc 2.12+) |
-|---|---|
-| `import { createMongooseAdapter } from '@classytic/arc'` | `import { createMongooseAdapter } from '@classytic/mongokit/adapter'` |
-| `import { createMongooseAdapter } from '@classytic/arc/adapters'` | `import { createMongooseAdapter } from '@classytic/mongokit/adapter'` |
-| `import { createDrizzleAdapter } from '@classytic/arc/adapters'` | `import { createDrizzleAdapter } from '@classytic/sqlitekit/adapter'` |
-| `import { createPrismaAdapter } from '@classytic/arc/adapters'` | `import { createPrismaAdapter } from '@classytic/prismakit/adapter'` |
-| `import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/arc'` | `import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/repo-core/adapter'` |
-| `import type { ... } from '@classytic/arc/adapters'` (any contract type) | `import type { ... } from '@classytic/repo-core/adapter'` |
-| `import type { InferMongooseDoc } from '@classytic/arc/adapters'` | `import type { InferMongooseDoc } from '@classytic/mongokit/adapter'` |
-| `import { mergeFieldRuleConstraints } from '@classytic/arc/adapters'` | `import { mergeFieldRuleConstraints } from '@classytic/repo-core/schema'` |
-| `MongooseAdapter`, `DrizzleAdapter`, `PrismaAdapter` (classes) | Same path moves: `@classytic/mongokit/adapter` / `@classytic/sqlitekit/adapter` / `@classytic/prismakit/adapter` |
-| Any `from '@classytic/arc/adapters'` import | The subpath was removed in arc 2.12 — re-route to the kit or repo-core per the rows above. |
-
-### Mechanical steps
-
-1. Bump versions in `package.json` to the matrix above. Drop `mongoose` from explicit deps if you only used it for the adapter — mongokit will pull it as its own peer.
-2. Run a project-wide find/replace using the table above. Detection regex: see anti-patterns.md §32g.
-3. `npx tsc --noEmit` — zero errors.
-4. Smoke test the resource OpenAPI endpoint and one MCP tool — confirm the schema is non-empty (still requires `schemaGenerator`).
-
-No runtime behavior change — the symbols are identical, only their package paths moved.
-
----
-
 ## §1. Manual CRUD module → `defineResource()`
 
 **Scope:** typically 5 routes (`GET`, `GET /:id`, `POST`, `PATCH /:id`, `DELETE /:id`) + ~150 LOC of pagination/validation/permission glue per resource.

package/skills/arc-code-review/references/mongokit-migration.md

@@ -347,33 +347,6 @@ If consumers see `as unknown as RepositoryLike<T>` casts when wiring a repo into
 
 In the client project, prefer `createMongooseAdapter({ model, repository })` from `@classytic/mongokit/adapter` over manual `RepositoryLike` shaping — it accepts mongokit-native repos with no casts, and since mongokit 3.21 `schemaGenerator` defaults to `buildCrudSchemasFromModel` (`schemaGenerator: false` opts out — see anti-patterns §32f before recommending that).
 
-## arc 2.12 / mongokit 3.13.0 — adapter split
-
-Through mongokit 3.12 / arc 2.11, `createMongooseAdapter` shipped from `@classytic/arc`. In mongokit 3.13.0 + arc 2.12, the adapter lives in mongokit at `@classytic/mongokit/adapter`. Coordinated minimums:
-
-| Package | Min |
-|---|---|
-| `@classytic/arc` | 2.12.0 |
-| `@classytic/mongokit` | 3.13.0 |
-| `@classytic/repo-core` | 0.4.0 |
-
-Migration shape:
-
-```typescript
-// arc 2.x
-import { createMongooseAdapter } from '@classytic/arc';
-import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/arc';
-import type { InferMongooseDoc, MongooseAdapterOptions } from '@classytic/arc/adapters';
-
-// arc 2.12+
-import { createMongooseAdapter } from '@classytic/mongokit/adapter';
-import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/repo-core/adapter';
-import type { InferMongooseDoc, MongooseAdapterOptions } from '@classytic/mongokit/adapter';
-```
-
-The kit owns mongoose as its peer dep; arc dropped both `@classytic/mongokit` and `mongoose` from its `peerDependencies`. Hosts depend on `@classytic/mongokit` directly, which transitively pulls mongoose. Detection regex for stragglers: see `references/anti-patterns.md` §32g.
-
----
 
 ## What mongokit does NOT do
 

package/skills/arc-module-publishing/references/package-manifest.md

@@ -46,7 +46,9 @@ optional-peer typing pattern. Values below are the real shapes shipped by
   },
 
   // Optional peers: declared here AND marked optional below. Host installs only if used.
-  // "peerDependencies": { ..., "zod": ">=3.23.0", "ioredis": ">=5.0.0" },
+  // The floor is the major YOUR suite runs — never one below it. A floor you never test
+  // is a compatibility claim, not a fact (arc shipped seven of those until 2.40).
+  // "peerDependencies": { ..., "zod": ">=4.4.0", "ioredis": ">=6.0.0" },
   // "peerDependenciesMeta": {
   //   "zod": { "optional": true },
   //   "ioredis": { "optional": true }

package/dist/rateLimitKey-D4_rjP1K.mjs

@@ -1,15 +0,0 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-//#region src/scope/rateLimitKey.ts
-function createTenantKeyGenerator(opts) {
-	if (opts?.strategy) return opts.strategy;
-	return (ctx) => {
-		const scope = ctx.scope;
-		if (!scope || scope.kind === "public") return ctx.ip;
-		if (scope.kind === "member") return scope.organizationId;
-		if (scope.kind === "service") return scope.organizationId;
-		if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
-		return scope.userId ?? ctx.ip;
-	};
-}
-//#endregion
-export { createTenantKeyGenerator as t };