@classytic/arc 2.38.0 → 2.40.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.38.0",
+  "version": "2.40.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -353,20 +353,22 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.26.4",
-    "@classytic/repo-core": ">=0.26.0",
+    "@classytic/primitives": ">=0.27.0",
+    "@classytic/repo-core": ">=0.27.0",
     "@classytic/streamline": ">=2.8.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
     "@fastify/jwt": ">=10.0.0",
-    "@fastify/multipart": ">=9.0.0",
-    "@fastify/rate-limit": ">=10.0.0",
+    "@fastify/multipart": ">=10.0.0",
+    "@fastify/rate-limit": ">=11.0.0",
     "@fastify/sensible": ">=6.0.0",
-    "@fastify/static": ">=8.0.0",
+    "@fastify/static": ">=10.0.0",
     "@fastify/type-provider-typebox": ">=6.0.0",
     "@fastify/under-pressure": ">=9.0.0",
     "@fastify/websocket": ">=11.0.0",
-    "@modelcontextprotocol/sdk": ">=1.28.0",
+    "@modelcontextprotocol/client": ">=2.0.0",
+    "@modelcontextprotocol/node": ">=2.0.0",
+    "@modelcontextprotocol/server": ">=2.0.0",
     "@opentelemetry/api": ">=1.9.0",
     "@opentelemetry/auto-instrumentations-node": ">=0.40.0",
     "@opentelemetry/exporter-trace-otlp-http": ">=0.50.0",
@@ -374,19 +376,18 @@
     "@opentelemetry/instrumentation-mongodb": ">=0.40.0",
     "@opentelemetry/sdk-node": ">=0.50.0",
     "better-auth": ">=1.7.0",
-    "bullmq": ">=5.0.0",
+    "bullmq": ">=6.0.0",
     "fastify": ">=5.12.0",
     "fastify-raw-body": ">=5.0.0",
     "h3-js": ">=4.0.0",
-    "ioredis": ">=5.0.0",
-    "jose": ">=5.0.0",
+    "ioredis": ">=6.0.0",
+    "jose": ">=6.0.0",
     "pino-pretty": ">=13.0.0",
     "typebox": ">=1.0.0",
-    "vitest": ">=3.0.0",
     "zod": ">=4.4.0"
   },
   "peerDependenciesMeta": {
-    "better-auth": {
+    "@classytic/streamline": {
       "optional": true
     },
     "@fastify/cors": {
@@ -398,34 +399,40 @@
     "@fastify/jwt": {
       "optional": true
     },
+    "@fastify/multipart": {
+      "optional": true
+    },
     "@fastify/rate-limit": {
       "optional": true
     },
     "@fastify/sensible": {
       "optional": true
     },
-    "@fastify/under-pressure": {
+    "@fastify/static": {
       "optional": true
     },
-    "@fastify/multipart": {
+    "@fastify/type-provider-typebox": {
+      "optional": true
+    },
+    "@fastify/under-pressure": {
       "optional": true
     },
     "@fastify/websocket": {
       "optional": true
     },
-    "fastify-raw-body": {
+    "@modelcontextprotocol/client": {
       "optional": true
     },
-    "h3-js": {
+    "@modelcontextprotocol/node": {
       "optional": true
     },
-    "pino-pretty": {
+    "@modelcontextprotocol/server": {
       "optional": true
     },
     "@opentelemetry/api": {
       "optional": true
     },
-    "@opentelemetry/sdk-node": {
+    "@opentelemetry/auto-instrumentations-node": {
       "optional": true
     },
     "@opentelemetry/exporter-trace-otlp-http": {
@@ -437,43 +444,40 @@
     "@opentelemetry/instrumentation-mongodb": {
       "optional": true
     },
-    "@opentelemetry/auto-instrumentations-node": {
-      "optional": true
-    },
-    "ioredis": {
+    "@opentelemetry/sdk-node": {
       "optional": true
     },
-    "jose": {
+    "better-auth": {
       "optional": true
     },
-    "typebox": {
+    "bullmq": {
       "optional": true
     },
-    "@fastify/type-provider-typebox": {
+    "fastify-raw-body": {
       "optional": true
     },
-    "bullmq": {
+    "h3-js": {
       "optional": true
     },
-    "@classytic/streamline": {
+    "ioredis": {
       "optional": true
     },
-    "zod": {
+    "jose": {
       "optional": true
     },
-    "@modelcontextprotocol/sdk": {
+    "pino-pretty": {
       "optional": true
     },
-    "@fastify/static": {
+    "typebox": {
       "optional": true
     },
-    "vitest": {
+    "zod": {
       "optional": true
     }
   },
   "dependencies": {
     "fastify-plugin": "^6.0.0",
-    "qs": "^6.15.2",
+    "qs": "^6.16.0",
     "secure-json-parse": "^4.1.0"
   },
   "devDependencies": {
@@ -485,8 +489,8 @@
     "@classytic/gitkit": ">=0.1.0",
     "@classytic/mongokit": "^3.33.0",
     "@classytic/pgkit": "^0.1.0",
-    "@classytic/primitives": "^0.26.4",
-    "@classytic/repo-core": "^0.26.0",
+    "@classytic/primitives": "^0.27.0",
+    "@classytic/repo-core": "^0.27.0",
     "@classytic/sqlitekit": "^0.9.0",
     "@classytic/streamline": "^2.8.2",
     "@electric-sql/pglite": "^0.5.4",
@@ -500,13 +504,15 @@
     "@fastify/type-provider-typebox": "^6.1.0",
     "@fastify/under-pressure": "^9.0.3",
     "@fastify/websocket": "^11.2.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@types/node": "^22.19.21",
     "@types/qs": "^6.15.1",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^5.0.0",
     "ajv": "^8.20.0",
-    "better-auth": "^1.7.2",
+    "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
     "bullmq": "^6.1.2",
     "dotenv": "^17.4.2",
@@ -526,7 +532,7 @@
     "tsdown": "^0.22.14",
     "typebox": "^1.3.6",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10",
+    "vitest": "^5.0.0",
     "ws": "^8.21.0",
     "zod": "^4.4.3"
   },
@@ -560,6 +566,9 @@
     "url": "git+https://github.com/classytic/arc.git"
   },
   "overrides": {
-    "better-sqlite3": "$better-sqlite3"
+    "better-sqlite3": "$better-sqlite3",
+    "better-auth": {
+      "vitest": "$vitest"
+    }
   }
 }

package/skills/arc/references/mcp.md

@@ -133,6 +133,26 @@ await app.register(mcpPlugin, { resources: catalogResources, prefix: '/mcp/catal
 await app.register(mcpPlugin, { resources: orderResources, prefix: '/mcp/orders' });
 ```
 
+## DNS-rebinding protection (`Host` / `Origin`)
+
+An MCP endpoint on loopback is reachable from any page the developer visits: if
+an attacker-controlled DNS name resolves to `127.0.0.1`, the browser treats the
+reply as same-origin and can read every tool's output. Validating `Host` breaks
+the chain.
+
+`dnsRebindingProtection` **defaults on when `auth: false`** (the local shape the
+attack targets) and **off when auth is configured** (a real deployment's `Host`
+is its own domain — defaulting on would 403 it; credentials are the gate there).
+
+```typescript
+mcpPlugin({ resources, auth, dnsRebindingProtection: {} });                        // localhost + auth
+mcpPlugin({ resources, dnsRebindingProtection: { allowedHosts: ['mcp.example.com'] } });
+mcpPlugin({ resources, auth: false, dnsRebindingProtection: false });              // deliberately public
+```
+
+An absent `Origin` passes — non-browser MCP clients send none. A present but
+unlisted one is refused. `${prefix}/health` is exempt so probes keep working.
+
 ## Auth — Three Modes
 
 Arc doesn't enforce an auth strategy. You choose what fits.

package/skills/arc/references/testing.md

@@ -198,15 +198,3 @@ runStorageContract(async () => {
 3. **Use `ctx.fixtures.clear()` in `afterEach`** — destroyers handle dependency order.
 4. **Test permission denials explicitly** — `expectArc(res).forbidden()` beats status-code assertions.
 5. **Reach for `createHttpTestHarness` first** — 16 tests for one function call.
-
-## Migration from pre-2.11 testing APIs
-
-| Pre-2.11 | 2.11 |
-|---|---|
-| `TestHarness` / `createTestHarness` | `createHttpTestHarness(resource, ctxFn)` |
-| `TestAppResult` | `TestAppContext` |
-| `testApp.mongoUri` | `ctx.dbUri` |
-| `createJwtAuthProvider` / `createBetterAuthProvider` (as `HttpTestHarness` imports) | `ctx.auth` from `createTestApp` (or direct factory import) |
-| `withTestDb()` | `createTestApp({ db: 'in-memory' })` + `ctx.dbUri` |
-| `TestDatabase` / `TestSeeder` / `TestTransaction` | `createTestFixtures` + kit-level cleanup |
-| `setupBetterAuthOrg` | `setupBetterAuthTestApp` + `helpers.signUpWithOrg` |

package/skills/arc-code-review/references/anti-patterns.md

@@ -831,7 +831,7 @@ output_mode: content
 
 Also: adapter contract types imported from arc — `import type { DataAdapter, AdapterRepositoryInput, AdapterFactory, OpenApiSchemas, SchemaMetadata, FieldMetadata, RelationMetadata, AdapterValidationResult, AdapterSchemaContext } from '@classytic/arc'` (any subpath). And: `mergeFieldRuleConstraints` from `@classytic/arc/adapters`. Any `from '@classytic/arc/adapters'` import — the entire subpath was removed in arc 2.12.
 
-**Why critical:** This only worked in arc ≤ 2.x. Arc 2.12 moved every kit-specific adapter (Mongoose, Drizzle, Prisma) into its kit and the cross-framework adapter contract into `@classytic/repo-core/adapter`. The `@classytic/arc/adapters` subpath was removed entirely. Importing these names from arc fails to resolve on 3.x — the build breaks at install time. The new shape is **strict**: kit-specific things MUST come from the kit; the contract MUST come from repo-core.
+**Why critical:** `@classytic/arc/adapters` does not exist. Kit-specific adapters (Mongoose, Drizzle, Prisma) live in their kit; the cross-framework contract lives in `@classytic/repo-core/adapter`. Importing these names from arc fails to resolve — the build breaks at install time. The rule is **strict**: kit-specific things come from the kit, the contract comes from repo-core.
 
 **Fix:**
 ```typescript

package/skills/arc-code-review/references/migration-recipes.md

@@ -4,66 +4,6 @@ Concrete diffs for the most common transformations. Apply in the order listed in
 
 ---
 
-## §0. arc 2.x → 3.0 — every kit-specific adapter moves to its kit
-
-**Why:** Through arc 2.12, kit-specific adapter factories (`createMongooseAdapter`, `createDrizzleAdapter`, `createPrismaAdapter`) shipped from `@classytic/arc` and arc had a peer dep on `@classytic/mongokit`. This coupled arc's release cadence to every kit's, dragged mongoose into every arc consumer's resolution graph (even Drizzle/Prisma users), and double-published the adapter contract types.
-
-In arc 2.12:
-- Adapter contract → `@classytic/repo-core/adapter` (new subpath in repo-core 0.4.0).
-- Mongoose adapter → `@classytic/mongokit/adapter` (3.13.0).
-- Drizzle adapter → `@classytic/sqlitekit/adapter` (0.3.0).
-- Prisma adapter → `@classytic/prismakit/adapter` (0.1.0 — new kit).
-- `mergeFieldRuleConstraints` + `applyNullable` → `@classytic/repo-core/schema`.
-- `@classytic/mongokit`, `@prisma/client`, `mongoose` all dropped from arc's `peerDependencies`. Arc 2.12 has zero kit- or driver-bound peers.
-- The `@classytic/arc/adapters` subpath was removed entirely. The `src/adapters/` directory inside arc is gone.
-- `RepositoryLike` is still re-exported from `@classytic/arc` for convenience.
-- Custom kits implementing `DataAdapter<TDoc>` plug in identically — same contract, no special-casing.
-
-### Coordinated versions
-
-These are the floors the adapter SPLIT requires — fixed history, safe to rely on:
-
-| Package | Min (adapter split) |
-|---|---|
-| `@classytic/arc` | 2.12.0 |
-| `@classytic/repo-core` | 0.4.0 |
-| `@classytic/mongokit` | 3.13.0 |
-| `@classytic/sqlitekit` | 0.3.0 |
-| `@classytic/prismakit` | 0.1.0 (not published to npm — build from source) |
-
-A second "current best-practice floor" column used to sit here and is gone: it named
-arc 2.21.0 while arc shipped 2.37, and sqlitekit 0.7.0 against a published 0.9.0. A
-version restated in a skill is wrong within a release and teaches nothing (CLAUDE.md,
-"no rotting metrics") — worse, it reads as researched. **For current floors read
-`peerDependencies` in arc's `package.json` and each kit's own README**; for what a
-given arc version added, [CHANGELOG.md](../../../CHANGELOG.md) is the index.
-
-### Import migration table
-
-| Old (arc 2.11.x) | New (arc 2.12+) |
-|---|---|
-| `import { createMongooseAdapter } from '@classytic/arc'` | `import { createMongooseAdapter } from '@classytic/mongokit/adapter'` |
-| `import { createMongooseAdapter } from '@classytic/arc/adapters'` | `import { createMongooseAdapter } from '@classytic/mongokit/adapter'` |
-| `import { createDrizzleAdapter } from '@classytic/arc/adapters'` | `import { createDrizzleAdapter } from '@classytic/sqlitekit/adapter'` |
-| `import { createPrismaAdapter } from '@classytic/arc/adapters'` | `import { createPrismaAdapter } from '@classytic/prismakit/adapter'` |
-| `import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/arc'` | `import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/repo-core/adapter'` |
-| `import type { ... } from '@classytic/arc/adapters'` (any contract type) | `import type { ... } from '@classytic/repo-core/adapter'` |
-| `import type { InferMongooseDoc } from '@classytic/arc/adapters'` | `import type { InferMongooseDoc } from '@classytic/mongokit/adapter'` |
-| `import { mergeFieldRuleConstraints } from '@classytic/arc/adapters'` | `import { mergeFieldRuleConstraints } from '@classytic/repo-core/schema'` |
-| `MongooseAdapter`, `DrizzleAdapter`, `PrismaAdapter` (classes) | Same path moves: `@classytic/mongokit/adapter` / `@classytic/sqlitekit/adapter` / `@classytic/prismakit/adapter` |
-| Any `from '@classytic/arc/adapters'` import | The subpath was removed in arc 2.12 — re-route to the kit or repo-core per the rows above. |
-
-### Mechanical steps
-
-1. Bump versions in `package.json` to the matrix above. Drop `mongoose` from explicit deps if you only used it for the adapter — mongokit will pull it as its own peer.
-2. Run a project-wide find/replace using the table above. Detection regex: see anti-patterns.md §32g.
-3. `npx tsc --noEmit` — zero errors.
-4. Smoke test the resource OpenAPI endpoint and one MCP tool — confirm the schema is non-empty (still requires `schemaGenerator`).
-
-No runtime behavior change — the symbols are identical, only their package paths moved.
-
----
-
 ## §1. Manual CRUD module → `defineResource()`
 
 **Scope:** typically 5 routes (`GET`, `GET /:id`, `POST`, `PATCH /:id`, `DELETE /:id`) + ~150 LOC of pagination/validation/permission glue per resource.

package/skills/arc-code-review/references/mongokit-migration.md

@@ -347,33 +347,6 @@ If consumers see `as unknown as RepositoryLike<T>` casts when wiring a repo into
 
 In the client project, prefer `createMongooseAdapter({ model, repository })` from `@classytic/mongokit/adapter` over manual `RepositoryLike` shaping — it accepts mongokit-native repos with no casts, and since mongokit 3.21 `schemaGenerator` defaults to `buildCrudSchemasFromModel` (`schemaGenerator: false` opts out — see anti-patterns §32f before recommending that).
 
-## arc 2.12 / mongokit 3.13.0 — adapter split
-
-Through mongokit 3.12 / arc 2.11, `createMongooseAdapter` shipped from `@classytic/arc`. In mongokit 3.13.0 + arc 2.12, the adapter lives in mongokit at `@classytic/mongokit/adapter`. Coordinated minimums:
-
-| Package | Min |
-|---|---|
-| `@classytic/arc` | 2.12.0 |
-| `@classytic/mongokit` | 3.13.0 |
-| `@classytic/repo-core` | 0.4.0 |
-
-Migration shape:
-
-```typescript
-// arc 2.x
-import { createMongooseAdapter } from '@classytic/arc';
-import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/arc';
-import type { InferMongooseDoc, MongooseAdapterOptions } from '@classytic/arc/adapters';
-
-// arc 2.12+
-import { createMongooseAdapter } from '@classytic/mongokit/adapter';
-import type { DataAdapter, RepositoryLike, AdapterRepositoryInput } from '@classytic/repo-core/adapter';
-import type { InferMongooseDoc, MongooseAdapterOptions } from '@classytic/mongokit/adapter';
-```
-
-The kit owns mongoose as its peer dep; arc dropped both `@classytic/mongokit` and `mongoose` from its `peerDependencies`. Hosts depend on `@classytic/mongokit` directly, which transitively pulls mongoose. Detection regex for stragglers: see `references/anti-patterns.md` §32g.
-
----
 
 ## What mongokit does NOT do
 

package/skills/arc-module-publishing/references/package-manifest.md

@@ -46,7 +46,9 @@ optional-peer typing pattern. Values below are the real shapes shipped by
   },
 
   // Optional peers: declared here AND marked optional below. Host installs only if used.
-  // "peerDependencies": { ..., "zod": ">=3.23.0", "ioredis": ">=5.0.0" },
+  // The floor is the major YOUR suite runs — never one below it. A floor you never test
+  // is a compatibility claim, not a fact (arc shipped seven of those until 2.40).
+  // "peerDependencies": { ..., "zod": ">=4.4.0", "ioredis": ">=6.0.0" },
   // "peerDependenciesMeta": {
   //   "zod": { "optional": true },
   //   "ioredis": { "optional": true }

package/dist/rateLimitKey-CewdR-m6.mjs

@@ -1,15 +0,0 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-//#region src/scope/rateLimitKey.ts
-function createTenantKeyGenerator(opts) {
-	if (opts?.strategy) return opts.strategy;
-	return (ctx) => {
-		const scope = ctx.scope;
-		if (!scope || scope.kind === "public") return ctx.ip;
-		if (scope.kind === "member") return scope.organizationId;
-		if (scope.kind === "service") return scope.organizationId;
-		if (scope.kind === "elevated") return scope.organizationId ?? scope.userId ?? ctx.ip;
-		return scope.userId ?? ctx.ip;
-	};
-}
-//#endregion
-export { createTenantKeyGenerator as t };