@classytic/arc 2.38.0 → 2.40.0

package/dist/{headers-DeXNifVj.mjs → headers-BFEEshDS.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-2ExmOgIJ.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-BHD3L8of.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-Bh0N_FLk.mjs → health-BlGHjkqZ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts

package/dist/hooks/index.d.mts

@@ -1,3 +1,3 @@
 
-import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-B78WZom8.mjs";
+import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-D3sIPcD4.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-C0ikzqQf.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-96nzZLmk.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-DeXNifVj.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-CIF4RG8s.mjs";
-import { t as createIdempotencyResult } from "../interface-DYPVscCU.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-BFEEshDS.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-BfyOd5i6.mjs";
+import { t as createIdempotencyResult } from "../interface-DjtFnZxH.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-B78WZom8.d.mts → index-D3sIPcD4.d.mts}

@@ -5,7 +5,7 @@ import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
 import "./elevation-BXCfVcNG.mjs";
 import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";
 import { n as EncryptionDirective } from "./types-ByHn9rEO.mjs";
-import { n as DomainEvent } from "./EventTransport-Cx60_s-6.mjs";
+import { n as DomainEvent } from "./EventTransport-BPOQsEer.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { AggDateBucket, AggMeasure, AggTopN, QueryOptions, StandardRepo, TenantPurgeStrategy, TransactionHandle } from "@classytic/repo-core/repository";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
@@ -516,6 +516,17 @@ type ArcControllerLike = {
   update: (...args: never[]) => unknown;
   delete: (...args: never[]) => unknown;
 };
+/**
+ * Constructor constraint for the four preset mixins (`BulkMixin`, `SlugMixin`,
+ * `SoftDeleteMixin`, `TreeMixin`).
+ *
+ * This is the ONE place `any[]` is unavoidable: TypeScript requires a mixin's
+ * base-class constraint to be `new (...args: any[]) => T` — `unknown[]` and
+ * `never[]` are both rejected with "A mixin class must have a constructor with
+ * a single rest parameter of type 'any[]'". Each mixin used to carry its own
+ * copy of this line and its own lint waiver; one definition, one waiver.
+ */
+type MixinConstructor<T> = new (...args: any[]) => T;
 /**
  * Return type of the controller's `list` method.
  *
@@ -1104,6 +1115,33 @@ declare class QueryResolver {
    * doesn't gate visibility — see `core/fieldRulePredicates.ts`.
    */
   private getBlockedFields;
+  /**
+   * Is this projection path blocked — by its own name, or by a hidden ANCESTOR?
+   *
+   * `hidden: { secret: true }` hides the object, and an exact-name match left its children
+   * reachable: `?select=secret.value` projected the very field the rule exists to withhold.
+   * A rule on a parent covers everything under it, which is what "hidden" already means to
+   * whoever wrote it.
+   */
+  private isBlockedProjection;
+  /**
+   * Refuse a read that FILTERS or SORTS on a `hidden` field.
+   *
+   * `hidden` was enforced on the surfaces that RETURN a value — the response, `select=`,
+   * `_distinct`, aggregations — but a filter key never returns the field, it INTERROGATES it:
+   * `?passwordHash[like]=^ab` narrows the result set, so the row count answers a question about
+   * a value the caller may not read. A resource with no `allowedFilterFields` was a blind
+   * existence oracle over every hidden field it declared.
+   *
+   * Rejected rather than dropped, unlike `select`. Dropping a projection narrows what comes
+   * back; dropping a filter WIDENS the rows, which is the silent-permissive shape this
+   * framework fails loudly on everywhere else.
+   *
+   * Compound keys (`$or`, `$and`) are walked, because the offending key can be nested inside
+   * one. A dotted path is blocked by its own name or by a hidden ancestor, so a rule on
+   * `secret` also covers `secret.value`.
+   */
+  private assertNoBlockedReadKeys;
 }
 //#endregion
 //#region src/core/BaseCrudController.d.ts
@@ -1392,7 +1430,9 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
     count: number;
   }>>;
   /** `?_distinct=field` → `repo.distinct(field, filter)` */
-  protected dispatchDistinct(req: IRequestContext, field: string): Promise<IControllerResponse<unknown[]>>;
+  protected dispatchDistinct(req: IRequestContext, field: string): Promise<IControllerResponse<{
+    values: unknown[];
+  }>>;
   /** `?_exists=true` → `repo.exists(filter)` */
   protected dispatchExists(req: IRequestContext): Promise<IControllerResponse<{
     exists: boolean;
@@ -1425,7 +1465,6 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
 }
 //#endregion
 //#region src/core/mixins/bulk.d.ts
-type Constructor$3<T> = new (...args: any[]) => T;
 /** Public surface contributed by BulkMixin. */
 interface BulkExt {
   bulkCreate(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
@@ -1437,33 +1476,30 @@ interface BulkExt {
     deletedCount: number;
   }>>;
 }
-declare function BulkMixin<TBase extends Constructor$3<BaseCrudController>>(Base: TBase): TBase & Constructor$3<BulkExt>;
+declare function BulkMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<BulkExt>;
 //#endregion
 //#region src/core/mixins/slug.d.ts
-type Constructor$2<T> = new (...args: any[]) => T;
 /** Public surface contributed by SlugMixin. */
 interface SlugExt {
   getBySlug(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
 }
-declare function SlugMixin<TBase extends Constructor$2<BaseCrudController>>(Base: TBase): TBase & Constructor$2<SlugExt>;
+declare function SlugMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SlugExt>;
 //#endregion
 //#region src/core/mixins/tree.d.ts
-type Constructor$1<T> = new (...args: any[]) => T;
 /** Public surface contributed by TreeMixin. */
 interface TreeExt {
   getTree(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
   getChildren(req: IRequestContext): Promise<IControllerResponse<AnyRecord[]>>;
 }
-declare function TreeMixin<TBase extends Constructor$1<BaseCrudController>>(Base: TBase): TBase & Constructor$1<TreeExt>;
+declare function TreeMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<TreeExt>;
 //#endregion
 //#region src/core/mixins/softDelete.d.ts
-type Constructor<T> = new (...args: any[]) => T;
 /** Public surface contributed by SoftDeleteMixin. */
 interface SoftDeleteExt {
   getDeleted(req: IRequestContext): Promise<IControllerResponse<PaginationResult<AnyRecord>>>;
   restore(req: IRequestContext): Promise<IControllerResponse<AnyRecord>>;
 }
-declare function SoftDeleteMixin<TBase extends Constructor<BaseCrudController>>(Base: TBase): TBase & Constructor<SoftDeleteExt>;
+declare function SoftDeleteMixin<TBase extends MixinConstructor<BaseCrudController>>(Base: TBase): TBase & MixinConstructor<SoftDeleteExt>;
 //#endregion
 //#region src/core/BaseController.d.ts
 /**
@@ -1531,7 +1567,7 @@ interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extend
     deletedCount: number;
   }>>;
 }
-declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & (new (...args: any[]) => BulkExt) & (new (...args: any[]) => SlugExt) & (new (...args: any[]) => TreeExt) & (new (...args: any[]) => SoftDeleteExt);
+declare const BaseController_base: (new (repository: any, options?: BaseControllerOptions) => BaseCrudController<AnyRecord, any>) & MixinConstructor<BulkExt> & MixinConstructor<SlugExt> & MixinConstructor<TreeExt> & MixinConstructor<SoftDeleteExt>;
 /**
  * Fully-composed controller: `BaseCrudController` + SoftDelete + Tree +
  * Slug + Bulk. Drop-in replacement for the pre-2.11 god class. The

package/dist/{index-D2uIUSQk.d.mts → index-DbMglURO.d.mts}

@@ -1,5 +1,5 @@
 
-import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BRU-Kd3t.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BVlowlm7.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**
@@ -201,7 +201,7 @@ declare function getModuleExports<TExports = unknown>(fastify: FastifyInstance,
  * spelling that question as
  *
  * ```ts
- * (fastify as unknown as { arc?: { modules?: Record<string, unknown> } })
+ * (fastify as { arc?: { modules?: Record<string, unknown> } })
  *   .arc?.modules?.inventory;
  * ```
  *

package/dist/{index-BRoDtjek.d.mts → index-SCsOJxWB.d.mts}

@@ -1,8 +1,8 @@
 
 import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
 import { l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-B78WZom8.mjs";
-import "./fastify-augmentation-jYA2oHyL.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-D3sIPcD4.mjs";
+import "./fastify-augmentation-HncZMmze.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 import { z } from "zod";

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 
 import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-C-NL2fTi.mjs";
-import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-B78WZom8.mjs";
+import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-D3sIPcD4.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-jYA2oHyL.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-BRoDtjek.mjs";
+import "./fastify-augmentation-HncZMmze.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-SCsOJxWB.mjs";
 import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-BtYoMip1.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BONghE1Y.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-2ExmOgIJ.mjs";
-import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CYaDvmOB.mjs";
-import { t as defineAggregation } from "./defineAggregation-0KBvqEEC.mjs";
-import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { l as getControllerScope } from "./actionPermissions-jlFZ1it4.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-BMdyRelW.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-8She7FgF.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BQ2FbhPB.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-BHD3L8of.mjs";
+import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-BqJtbiUA.mjs";
+import { t as defineAggregation } from "./defineAggregation-BDA2Tw7v.mjs";
+import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { l as getControllerScope } from "./actionPermissions-4OGbe3Hf.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-DaIySrQr.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-CsZR037F.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-C0GpDsB_.mjs";
 //#region src/index.ts
-const version = "2.38.0";
+const version = "2.40.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-Dg_Am2o_.mjs → init-pl88PHzb.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -605,7 +605,7 @@ export const authResource = defineResource({
   tag: 'Authentication',
   prefix: '/auth',
 
-  adapter: createAdapter(User${ts ? " as unknown as never" : ""}, userRepository${ts ? " as unknown as never" : ""}),
+  adapter: createAdapter(User${ts ? " as never" : ""}, userRepository${ts ? " as never" : ""}),
   disableDefaultRoutes: true,
 
   routes: [
@@ -661,7 +661,7 @@ export const userProfileResource = defineResource({
   tag: 'User Profile',
   prefix: '/users',
 
-  adapter: createAdapter(User${ts ? " as unknown as never" : ""}, userRepository${ts ? " as unknown as never" : ""}),
+  adapter: createAdapter(User${ts ? " as never" : ""}, userRepository${ts ? " as never" : ""}),
   disableDefaultRoutes: true,
 
   routes: [
@@ -702,7 +702,7 @@ import { mongodbAdapter } from '@better-auth/mongo-adapter';` : "";
 		useBearer ? `import { bearer } from 'better-auth/plugins/bearer';` : "",
 		useApiKey ? `import { apiKey } from '@better-auth/api-key';` : ""
 	].filter(Boolean).join("\n");
-	const dbAdapter = useMongo ? config.typescript ? `database: mongodbAdapter(mongoose.connection.getClient().db() as unknown as never),` : `database: mongodbAdapter(mongoose.connection.getClient().db()),` : `// Configure your database adapter here
+	const dbAdapter = useMongo ? config.typescript ? `database: mongodbAdapter(mongoose.connection.getClient().db() as never),` : `database: mongodbAdapter(mongoose.connection.getClient().db()),` : `// Configure your database adapter here
     // See: https://www.better-auth.com/docs/concepts/database`;
 	const pluginEntries = [
 		useBearer ? `        bearer(),` : "",
@@ -962,7 +962,7 @@ export async function resetPassword(request${ts ? ": FastifyRequest" : ""}, repl
  */
 export async function getUserProfile(request${ts ? ": FastifyRequest" : ""}, reply${ts ? ": FastifyReply" : ""}) {
   try {
-    const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
+    const requestUser = (request${ts ? " as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
     if (!userId) {
       return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
@@ -985,7 +985,7 @@ export async function getUserProfile(request${ts ? ": FastifyRequest" : ""}, rep
  */
 export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""}, reply${ts ? ": FastifyReply" : ""}) {
   try {
-    const requestUser = (request${ts ? " as unknown as { user?: { _id?: string; id?: string } }" : ""}).user;
+    const requestUser = (request${ts ? " as { user?: { _id?: string; id?: string } }" : ""}).user;
     const userId = requestUser?._id || requestUser?.id;
     if (!userId) {
       return reply.code(401).send({ error: 'Authentication required', code: 'arc.unauthorized' });
@@ -2727,7 +2727,7 @@ interface FlexibleMultiTenantOptions {
   tenantField?: string;
 }
 ` : `
-const { multiTenantPreset } = require('@classytic/arc/presets/tenant');
+import { multiTenantPreset } from '@classytic/arc/presets/tenant';
 `}
 export function flexibleMultiTenantPreset(options${ts ? ": FlexibleMultiTenantOptions = {}" : " = {}"}) {
   const { tenantField = 'organizationId' } = options;
@@ -2972,7 +2972,7 @@ ${ts ? "import type { UserDocument } from './user.model.js';\nimport type { Clie
 ${ts ? "type ID = string | Types.ObjectId;\n" : ""}
 class UserRepository extends Repository${ts ? "<UserDocument>" : ""} {
   constructor() {
-    super(User${ts ? " as unknown as never" : ""}, [
+    super(User${ts ? " as never" : ""}, [
       methodRegistryPlugin(),
       mongoOperationsPlugin(),
     ]);
@@ -3058,7 +3058,7 @@ import userRepository from './user.repository.js';
 
 class UserController extends BaseController {
   constructor() {
-    super(userRepository${config.typescript ? " as unknown as never" : ""});
+    super(userRepository${config.typescript ? " as never" : ""});
   }
 
   // Custom user operations can be added here

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "../EventTransport-Cx60_s-6.mjs";
+import { n as DomainEvent } from "../EventTransport-BPOQsEer.mjs";
 import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BOXVggMf.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-D4MYqkic.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-DbyXoQun.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -2,7 +2,7 @@
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-eyg5WEcy.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-LQFwC37d.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-9rvxn5Ym.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-BP8GHtjc.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-D_LFvMlm.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.d.mts

@@ -1,9 +1,10 @@
 
 import { i as RequestScope } from "../../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck } from "../../base-C-NL2fTi.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-B78WZom8.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-D3sIPcD4.mjs";
 import { n as FieldPermissionMap } from "../../fields-I_EeRWND.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-LQFwC37d.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-9rvxn5Ym.mjs";
+import { i as resolveToolCollisions, n as McpServerInstance, r as createMcpServer, t as AuthRef } from "../../createMcpServer-BVTs2S5G.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -96,50 +97,6 @@ interface CreateMcpAuthFromBetterAuthApiKeyOptions {
  */
 declare function createMcpAuthFromBetterAuthApiKey(auth: BetterAuthHandler, options?: CreateMcpAuthFromBetterAuthApiKeyOptions): McpAuthResolver;
 //#endregion
-//#region src/integrations/mcp/createMcpServer.d.ts
-/**
- * Mutable auth ref — updated per-request by mcpPlugin.
- * Tool handlers read from this to get the current request's auth context.
- */
-interface AuthRef {
-  current: McpAuthResult | null;
-}
-/**
- * Create a configured MCP server from declarative config.
- *
- * @param config - Server name, version, tools, prompts
- * @returns McpServer instance (not yet connected to a transport)
- */
-declare function createMcpServer(config: CreateMcpServerConfig, authRef?: AuthRef): Promise<McpServerInstance>;
-/**
- * Detect and resolve duplicate MCP tool names across the assembled tool list.
- *
- * Two outcomes:
- *
- *  1. **Auto-namespace** — when one tool's `source` carries a `preset:<name>`
- *     prefix and the other doesn't, the preset tool is renamed to
- *     `<presetName>_<originalName>` (e.g. softDelete's `restore_post`
- *     becomes `softdelete_restore_post` when the user defines
- *     `actions.restore`). The user's tool wins the canonical name because
- *     it's the more-specific intent.
- *
- *  2. **Typed throw** — every other collision (two user actions, two
- *     custom routes, two presets) raises `ArcError('arc.mcp.tool_name_collision')`
- *     naming both sources so the host's stack trace points at the
- *     resource definitions, not the MCP SDK internals.
- *
- * Exported for the testing harness so collision behaviour can be exercised
- * without a full server boot.
- */
-declare function resolveToolCollisions(tools: readonly ToolDefinition[]): ToolDefinition[];
-/** Minimal interface for McpServer — avoids hard SDK type dependency */
-interface McpServerInstance {
-  connect: (transport: unknown) => Promise<void>;
-  registerTool: (name: string, config: Record<string, unknown>, handler: (input: Record<string, unknown>, extra: Record<string, unknown>) => unknown) => unknown;
-  registerPrompt: (name: string, config: Record<string, unknown>, handler: (args: Record<string, unknown>) => unknown) => void;
-  resource: (...args: unknown[]) => void;
-}
-//#endregion
 //#region src/integrations/mcp/crud-tools.d.ts
 /**
  * Default description for a CRUD tool. Enriches list descriptions with the

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-KWsezMx7.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-D-3OLxNz.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,6 +1,26 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-LQFwC37d.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-9rvxn5Ym.mjs";
+import { n as McpServerInstance } from "../../createMcpServer-BVTs2S5G.mjs";
+import { Client } from "@modelcontextprotocol/client";
 //#region src/integrations/mcp/testing.d.ts
+/** An MCP client bound to a live loopback server, plus its teardown. */
+interface ConnectedMcpTestClient {
+  /** The connected SDK client — full `listTools` / `callTool` / `listPrompts` surface. */
+  client: Client;
+  /** Closes the client and the HTTP server. Always await it. */
+  close: () => Promise<void>;
+}
+/**
+ * Serve an already-built `McpServer` on an ephemeral loopback port and connect
+ * a client to it.
+ *
+ * Split out from {@link createTestMcpClient} because arc's own MCP suites build
+ * a server directly and only need the connection — five of them had each grown a
+ * private copy of the same connect helper against the v1 in-memory transport.
+ * One implementation, two entry points: this for a server you built, that for
+ * one built from resources.
+ */
+declare function connectMcpTestClient(server: McpServerInstance | unknown): Promise<ConnectedMcpTestClient>;
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */
   pluginOptions?: Pick<McpPluginOptions, "resources" | "overrides" | "expose" | "exclude" | "toolNamePrefix" | "extraTools" | "extraPrompts" | "instructions">;
@@ -50,4 +70,4 @@ interface TestMcpClient {
  */
 declare function createTestMcpClient(options?: TestMcpClientOptions): Promise<TestMcpClient>;
 //#endregion
-export { TestMcpClient, TestMcpClientOptions, createTestMcpClient };
+export { ConnectedMcpTestClient, TestMcpClient, TestMcpClientOptions, connectMcpTestClient, createTestMcpClient };

package/dist/integrations/mcp/testing.mjs

@@ -1,26 +1,58 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-KWsezMx7.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-D-3OLxNz.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
-* @classytic/arc/mcp/testing — MCP Test Utilities
+* Serve an already-built `McpServer` on an ephemeral loopback port and connect
+* a client to it.
 *
-* Helpers for testing MCP tool integration without raw JSON-RPC parsing.
-* Uses the MCP SDK's InMemoryTransport for fast, in-process testing.
-*
-* @example
-* ```typescript
-* import { createTestMcpClient } from '@classytic/arc/mcp/testing';
-*
-* const client = await createTestMcpClient({
-*   pluginOptions: { resources: [productResource] },
-*   auth: { userId: 'test-user', organizationId: 'org-1' },
-* });
-*
-* const tools = await client.listTools();
-* const result = await client.callTool('list_products', { limit: 5 });
-* await client.close();
-* ```
+* Split out from {@link createTestMcpClient} because arc's own MCP suites build
+* a server directly and only need the connection — five of them had each grown a
+* private copy of the same connect helper against the v1 in-memory transport.
+* One implementation, two entry points: this for a server you built, that for
+* one built from resources.
 */
+async function connectMcpTestClient(server) {
+	const { randomUUID } = await import("node:crypto");
+	const { createServer } = await import("node:http");
+	const { NodeStreamableHTTPServerTransport } = await import("@modelcontextprotocol/node");
+	const { Client, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+	const serverTransport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+	await server.connect(serverTransport);
+	const httpServer = createServer((req, res) => {
+		serverTransport.handleRequest(req, res);
+	});
+	await new Promise((resolve, reject) => {
+		httpServer.once("error", reject);
+		httpServer.listen(0, "127.0.0.1", resolve);
+	});
+	const address = httpServer.address();
+	if (address === null || typeof address === "string") {
+		httpServer.close();
+		throw new Error("[arc] MCP test harness: HTTP server did not bind a TCP port");
+	}
+	const client = new Client({
+		name: "test-client",
+		version: "1.0"
+	});
+	await client.connect(new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${address.port}/`)));
+	return {
+		client,
+		/**
+		* Client first, THEN the socket. Reversed, the client's in-flight request
+		* hangs on a dead server until its own timeout — which reads as a slow test
+		* rather than a teardown bug. `httpServer.close()` only stops NEW
+		* connections, so keep-alive sockets are destroyed explicitly; without that
+		* vitest hangs at end-of-file with no failing assertion.
+		*/
+		async close() {
+			await client.close();
+			httpServer.closeAllConnections?.();
+			await new Promise((resolve, reject) => {
+				httpServer.close((err) => err ? reject(err) : resolve());
+			});
+		}
+	};
+}
 /**
 * Create an in-process MCP test client connected to an Arc MCP server.
 *
@@ -44,8 +76,6 @@ import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp
 * ```
 */
 async function createTestMcpClient(options = {}) {
-	const { InMemoryTransport } = await import("@modelcontextprotocol/sdk/inMemory.js");
-	const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
 	const pluginOpts = {
 		resources: [],
 		...options.pluginOptions
@@ -65,19 +95,13 @@ async function createTestMcpClient(options = {}) {
 	});
 	if (pluginOpts.extraTools) tools.push(...pluginOpts.extraTools);
 	const authRef = { current: auth };
-	const server = await createMcpServer({
+	const { client, close } = await connectMcpTestClient(await createMcpServer({
 		name: serverName,
 		version: "1.0.0",
 		instructions: pluginOpts.instructions,
 		tools,
 		prompts: pluginOpts.extraPrompts
-	}, authRef);
-	const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
-	const client = new Client({
-		name: "test-client",
-		version: "1.0"
-	});
-	await Promise.all([client.connect(clientTransport), server.connect(serverTransport)]);
+	}, authRef));
 	return {
 		async listTools() {
 			return (await client.listTools()).tools.map((t) => ({
@@ -91,10 +115,8 @@ async function createTestMcpClient(options = {}) {
 				arguments: args ?? {}
 			});
 		},
-		async close() {
-			await client.close();
-		}
+		close
 	};
 }
 //#endregion
-export { createTestMcpClient };
+export { connectMcpTestClient, createTestMcpClient };