@classytic/arc 2.38.0 → 2.41.0

package/dist/{mcpPlugin-KWsezMx7.mjs → mcpPlugin-xF3Gw-HW.mjs}

@@ -1,18 +1,18 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-BP8GHtjc.mjs";
-import { p as isArcError, t as ArcError } from "./errors-2ExmOgIJ.mjs";
-import { n as requireSingleHeaderValue } from "./headers-DeXNifVj.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-BqLyyH0o.mjs";
-import { t as BaseController } from "./BaseController-CYaDvmOB.mjs";
-import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-jlFZ1it4.mjs";
-import { t as executePipeline } from "./pipe-SunhEaZ6.mjs";
-import { t as pluralize } from "./pluralize-Da7IT_qJ.mjs";
-import { t as createIdempotencyResult } from "./interface-DYPVscCU.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CIXShch7.mjs";
-import { n as validateAggregations } from "./validate-CidSeUrx.mjs";
-import { n as executeAggregation } from "./buildHandler-DjXOqIvX.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { p as isArcError, t as ArcError } from "./errors-C_YhELhe.mjs";
+import { n as requireSingleHeaderValue } from "./headers-CNECDE6q.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CDy3-zw1.mjs";
+import { t as BaseController } from "./BaseController-DYJRZ0EJ.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-DPwPWPOV.mjs";
+import { t as executePipeline } from "./pipe-CBVmUJ-j.mjs";
+import { t as pluralize } from "./pluralize-2_U6QZQg.mjs";
+import { t as createIdempotencyResult } from "./interface-BIpgzbZl.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-K16Bb5BX.mjs";
+import { n as validateAggregations } from "./validate-R0G_JrnK.mjs";
+import { n as executeAggregation } from "./buildHandler-CUhjGHGZ.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -50,7 +50,7 @@ import { z } from "zod";
 * @returns McpServer instance (not yet connected to a transport)
 */
 async function createMcpServer(config, authRef) {
-	const { McpServer } = await import("@modelcontextprotocol/sdk/server/mcp.js");
+	const { McpServer } = await import("@modelcontextprotocol/server");
 	const server = new McpServer({
 		name: config.name,
 		version: config.version ?? "1.0.0"
@@ -130,25 +130,39 @@ function registerTool(server, tool, authRef) {
 	const config = {};
 	if (tool.title) config.title = tool.title;
 	if (tool.description) config.description = tool.description;
+	/**
+	* Flat SHAPES are passed straight through. v2's `registerTool` carries a
+	* `ZodRawShape` overload and auto-wraps it in `z.object()` itself, so arc's
+	* host-facing ergonomic (`{ name: z.string() }`) needs no adaptation layer.
+	*
+	* arc's own MIGRATION-V2 notes claimed v2 "requires z.object(), raw shapes no
+	* longer accepted" and a wrap was written here on that basis. That was true of
+	* the PRE-ALPHA and is not true of 2.0.0 — checked against the shipped
+	* overloads. Wrapping anyway would have been arc maintaining an adapter for a
+	* conversion the SDK already owns.
+	*/
 	if (tool.inputSchema) config.inputSchema = tool.inputSchema;
 	if (tool.outputSchema) config.outputSchema = tool.outputSchema;
 	if (tool.annotations) config.annotations = tool.annotations;
-	srv.registerTool(tool.name, config, (input, extra) => {
+	srv.registerTool(tool.name, config, (input, mcpCtx) => {
 		const ctx = {
 			session: authRef?.current ?? null,
+			/**
+			* v2 exposes logging as `ctx.mcpReq.log(level, message)` — the SDK builds
+			* the `notifications/message` envelope and correlates it to the in-flight
+			* request. v1 handed over a raw `sendNotification` that arc had to frame
+			* itself; that hand-framed envelope carried no request id, so a log line
+			* from a tool arrived uncorrelated.
+			*
+			* Still best-effort: a transport that has already closed must not turn a
+			* successful tool call into a failed one.
+			*/
 			log: async (level, message) => {
 				try {
-					const notify = extra?.sendNotification;
-					if (notify) await notify({
-						method: "notifications/message",
-						params: {
-							level,
-							data: message
-						}
-					});
+					await (mcpCtx?.mcpReq)?.log?.(level, message);
 				} catch {}
 			},
-			extra
+			extra: mcpCtx
 		};
 		return tool.handler(input, ctx);
 	});
@@ -2035,7 +2049,7 @@ function resourceToTools(resource, config = {}) {
 */
 function registerSchemaResources(server, resources, overrides) {
 	const srv = server;
-	srv.resource("schemas", "arc://schemas", {
+	srv.registerResource("schemas", "arc://schemas", {
 		title: "Arc Resource Schemas",
 		description: "All available resources",
 		mimeType: "application/json"
@@ -2053,7 +2067,7 @@ function registerSchemaResources(server, resources, overrides) {
 	for (const r of resources) {
 		const uri = `arc://schemas/${r.name}`;
 		const schemaOpts = r.schemaOptions;
-		srv.resource(`schema-${r.name}`, uri, {
+		srv.registerResource(`schema-${r.name}`, uri, {
 			title: `${r.displayName} Schema`,
 			description: `Schema for ${r.displayName}`,
 			mimeType: "application/json"
@@ -2181,7 +2195,7 @@ var McpSessionCache = class {
 	closeTransport(entry) {
 		try {
 			const transport = entry.transport;
-			if (transport && typeof transport.close === "function") transport.close();
+			if (transport && typeof transport.close === "function") Promise.resolve(transport.close()).catch(() => {});
 		} catch {}
 	}
 };
@@ -2219,9 +2233,9 @@ var McpSessionCache = class {
 const mcpPluginImpl = async (fastify, options) => {
 	let StreamableHTTPServerTransport;
 	try {
-		StreamableHTTPServerTransport = (await import("@modelcontextprotocol/sdk/server/streamableHttp.js")).StreamableHTTPServerTransport;
+		StreamableHTTPServerTransport = (await import("@modelcontextprotocol/node")).NodeStreamableHTTPServerTransport;
 	} catch {
-		throw new Error("@modelcontextprotocol/sdk is required for MCP support. Install it: npm install @modelcontextprotocol/sdk");
+		throw new Error("@modelcontextprotocol/server and @modelcontextprotocol/node are required for MCP support. Install them: npm install @modelcontextprotocol/server @modelcontextprotocol/node");
 	}
 	try {
 		await import("zod");
@@ -2286,6 +2300,36 @@ const mcpPluginImpl = async (fastify, options) => {
 		const more = allTools.length > 5 ? ` (+${allTools.length - 5} more)` : "";
 		fastify.log.warn(`[arc/mcp] MCP server registered at "${prefix}" with auth DISABLED. Anyone who can reach this URL has full access to ${allTools.length} tools across ${enabledResources.length} resources: ${toolList}${more}. Pass \`auth: betterAuthInstance\` or \`auth: async (headers) => ...\` to gate access. Safe only for stdio transports, local development, or explicitly-public read-only APIs.`);
 	}
+	const rebindOption = options.dnsRebindingProtection;
+	if (rebindOption === void 0 ? options.auth === false : rebindOption !== false) {
+		const { validateHostHeader, validateOriginHeader, localhostAllowedHostnames } = await import("@modelcontextprotocol/server");
+		const cfg = rebindOption === void 0 || rebindOption === false ? {} : rebindOption;
+		const allowedHosts = cfg.allowedHosts ?? localhostAllowedHostnames();
+		const allowedOrigins = cfg.allowedOrigins ?? allowedHosts;
+		const healthPath = `${prefix}/health`;
+		fastify.addHook("onRequest", async (request, reply) => {
+			if (!request.url.startsWith(prefix)) return;
+			if (request.url.split("?")[0] === healthPath) return;
+			const host = validateHostHeader(request.headers.host, allowedHosts);
+			if (!host.ok) return reply.code(403).send({
+				jsonrpc: "2.0",
+				error: {
+					code: -32e3,
+					message: host.message
+				},
+				id: null
+			});
+			const origin = validateOriginHeader(request.headers.origin, allowedOrigins);
+			if (!origin.ok) return reply.code(403).send({
+				jsonrpc: "2.0",
+				error: {
+					code: -32e3,
+					message: origin.message
+				},
+				id: null
+			});
+		});
+	}
 	fastify.get(`${prefix}/health`, async (request, reply) => {
 		const liveness = {
 			status: "ok",

package/dist/{memory-BiPVaCPg.mjs → memory-CpDZ9NPw.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-CsWaIVTa.mjs → metrics-BaKnq8ag.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-B78WZom8.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DHbyPo5j.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BONghE1Y.mjs";
-import { t as multipartBody } from "../multipartBody-u6VrS_iH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BxLgNFF7.mjs";
+import { t as multipartBody } from "../multipartBody-C92aJ8am.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-DuRGVOMe.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-B3VYh5aU.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-BQXHxMEk.mjs → module-BkQEesNQ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-u6VrS_iH.mjs → multipartBody-C92aJ8am.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-Dxc8RLy_.mjs → openapi-C3LFRzPq.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-Db-MMsH6.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-jlFZ1it4.mjs";
-import { t as pluralize } from "./pluralize-Da7IT_qJ.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-Bqi6Bhhx.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-BLCSmNbr.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-DPwPWPOV.mjs";
+import { t as pluralize } from "./pluralize-2_U6QZQg.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BBlbPs3k.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { t as ArcModule } from "../types-BRU-Kd3t.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { t as ArcModule } from "../types-DfVDvkdP.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-2ExmOgIJ.mjs";
-import { t as defineResource } from "../defineResource-BMdyRelW.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-BQXHxMEk.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-C_YhELhe.mjs";
+import { t as defineResource } from "../defineResource-DzGT-2LP.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-BkQEesNQ.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-CQXu_O6o.d.mts → outbox-module-BHdUnuuK.d.mts}

@@ -1,6 +1,6 @@
 
-import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-Cx60_s-6.mjs";
-import { t as ArcModule } from "./types-BRU-Kd3t.mjs";
+import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-CbUKDzZZ.mjs";
+import { t as ArcModule } from "./types-DfVDvkdP.mjs";
 import { FastifyInstance } from "fastify";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 import { OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";
@@ -372,6 +372,19 @@ interface OutboxModuleExports {
   store: OutboxStore;
   /** The relay, for a host that wants to drain on demand (tests, admin actions). */
   relay: EventOutbox;
+  /**
+   * Ask for a relay pass SOON, without waiting for the interval. Coalesced:
+   * any number of calls before the pass runs produce ONE pass. Never throws
+   * and returns nothing — a unit of work calls this after commit so a row it
+   * just wrote is delivered in milliseconds rather than up to `relayEveryMs`
+   * later. Safe under concurrency: the store's lease and fence token make an
+   * extra pass a no-op, not a double publish.
+   *
+   * Calling from inside a request does NOT put the pass in that request's
+   * scope: a pass drains whatever is pending, which is other requests' rows.
+   * The pass runs scope-free, so each event opens its own (see `runWorkScope`).
+   */
+  requestDrain: () => void;
 }
 /**
  * Compose the outbox as a module.

package/dist/{outbox-module-DyIqA5vo.mjs → outbox-module-dsCyLxXH.mjs}

@@ -1,7 +1,8 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "./transactionContext-DMmvcfdo.mjs";
-import { i as resolveEventTransport } from "./EventTransport-Gq7JWbWw.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-CIF4RG8s.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-DCWMI6hV.mjs";
+import { n as requestContext } from "./requestContext-cSVKnYPk.mjs";
+import { i as resolveEventTransport } from "./EventTransport-n7qO5Cz3.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-9DX9-1j_.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
@@ -807,25 +808,46 @@ function createOutboxModule(options) {
 			* module exists to prevent, arrived at from the other side.
 			*/
 			if (transport === void 0) throw new Error(`Outbox module "${name}" could not resolve an event transport, so its relay would tick forever without publishing while the store grows. Register arc's events plugin (it is on by default — check \`arcPlugins.events !== false\`), or pass an explicit \`transport\` to \`createOutboxModule\`. Note the outbox needs the RAW EventTransport, not the \`fastify.events\` facade: the facade takes \`(type, payload, meta?)\` and fails open, which would acknowledge rows whose publish actually failed.`);
+			const relay = new EventOutbox({
+				store,
+				transport,
+				...options.batchSize !== void 0 ? { batchSize: options.batchSize } : {},
+				...options.leaseMs !== void 0 ? { leaseMs: options.leaseMs } : {},
+				consumerId: options.consumerId ?? mintConsumerId(name),
+				onError: options.onError ?? ((info) => {
+					fastify.log.error({
+						err: info.error,
+						kind: info.kind,
+						...info.event?.meta.id !== void 0 ? { eventId: info.event.meta.id } : {},
+						...info.event?.type !== void 0 ? { eventType: info.event.type } : {}
+					}, `outbox relay "${name}" failed`);
+				}),
+				...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {},
+				...options.sessionProvider === false ? {} : { sessionProvider: options.sessionProvider ?? (() => transactionContext.get()) }
+			});
+			/**
+			* One pass per burst of requests. `drainQueued` stays true from the
+			* first request until the pass STARTS, so a request landing mid-pass
+			* schedules the next one — a row written during a pass is never left
+			* waiting for the interval.
+			*/
+			let drainQueued = false;
+			const requestDrain = () => {
+				if (drainQueued) return;
+				drainQueued = true;
+				setImmediate(() => {
+					drainQueued = false;
+					requestContext.storage.exit(() => {
+						relay.relayBatch().catch((err) => {
+							fastify.log.error({ err }, `outbox relay "${name}" requested drain failed`);
+						});
+					});
+				});
+			};
 			exports = {
 				store,
-				relay: new EventOutbox({
-					store,
-					transport,
-					...options.batchSize !== void 0 ? { batchSize: options.batchSize } : {},
-					...options.leaseMs !== void 0 ? { leaseMs: options.leaseMs } : {},
-					consumerId: options.consumerId ?? mintConsumerId(name),
-					onError: options.onError ?? ((info) => {
-						fastify.log.error({
-							err: info.error,
-							kind: info.kind,
-							...info.event?.meta.id !== void 0 ? { eventId: info.event.meta.id } : {},
-							...info.event?.type !== void 0 ? { eventType: info.event.type } : {}
-						}, `outbox relay "${name}" failed`);
-					}),
-					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {},
-					...options.sessionProvider === false ? {} : { sessionProvider: options.sessionProvider ?? (() => transactionContext.get()) }
-				})
+				relay,
+				requestDrain
 			};
 			return exports;
 		},

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-C-NL2fTi.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-CxrV1LmG.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BtYoMip1.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BHdZD8zK.mjs";
 export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-BP8GHtjc.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CXySQFRg.mjs";
-import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-Cha2QCKH.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-2YY_Kaj1.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DDMOZ_Pm.mjs";
+import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-BTyPLHK0.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-DiHXy8Ck.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-H7Zcb82Z.mjs → permissions-DiHXy8Ck.mjs}

@@ -1,10 +1,11 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-BP8GHtjc.mjs";
-import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-BqLyyH0o.mjs";
-import { t as MemoryCacheStore } from "./memory-BiPVaCPg.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CDy3-zw1.mjs";
+import { n as declareRuntimeCapability } from "./runtimeCapabilities-DSA_dH1_.mjs";
+import { t as MemoryCacheStore } from "./memory-CpDZ9NPw.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**
@@ -871,6 +872,11 @@ function createDynamicPermissionMatrix(config) {
 		maxEntries: config.cache?.maxEntries ?? 1e3
 	}) : void 0;
 	const cacheStore = config.cacheStore ?? internalStore;
+	if (config.fastify && cacheStore) declareRuntimeCapability(config.fastify, {
+		subsystem: "permissions.dynamic-cache",
+		durability: internalStore ? "memory" : "shared",
+		detail: "internal MemoryCacheStore: a role change invalidates on this replica only"
+	});
 	const trackedKeys = /* @__PURE__ */ new Set();
 	const orgKeyIndex = /* @__PURE__ */ new Map();
 	const maxTrackedKeys = config.cache?.maxEntries ?? 1e4;

package/dist/{pipe-SunhEaZ6.mjs → pipe-CBVmUJ-j.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-2ExmOgIJ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-C_YhELhe.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,5 +1,5 @@
 
-import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-B78WZom8.mjs";
+import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DHbyPo5j.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-SunhEaZ6.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-CBVmUJ-j.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,10 +1,10 @@
 
-import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-B78WZom8.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DI5AN2b5.mjs";
-import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-BRU-Kd3t.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-jYA2oHyL.mjs";
-import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-B843jOYX.mjs";
+import { t as AnyRecord } from "../base-CxrV1LmG.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DHbyPo5j.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler--4rSMMvq.mjs";
+import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-DfVDvkdP.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-Cq2nHVaW.mjs";
+import { C as gracefulShutdownPlugin, S as _default$2, _ as CachingRule, a as MetricsCollector, b as GracefulShutdownOptions, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, x as ShutdownState, y as cachingPlugin } from "../versioning-D6JIK8Tk.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -59,36 +59,6 @@ interface ArcPlugin<TRootOpts extends AnyRecord = AnyRecord, TResourceOpts exten
  */
 declare function createPlugin<TRootOpts extends AnyRecord = AnyRecord, TResourceOpts extends AnyRecord = AnyRecord>(name: string, definition: CreatePluginDefinition<TRootOpts, TResourceOpts>): ArcPlugin<TRootOpts, TResourceOpts>;
 //#endregion
-//#region src/plugins/gracefulShutdown.d.ts
-interface GracefulShutdownOptions {
-  /** Maximum time to wait for graceful shutdown in ms (default: 30000) */
-  timeout?: number;
-  /** Custom cleanup function called before exit */
-  onShutdown?: () => Promise<void> | void;
-  /** Signals to handle (default: ['SIGTERM', 'SIGINT']) */
-  signals?: NodeJS.Signals[];
-  /** Whether to log shutdown events (default: true) */
-  logEvents?: boolean;
-  /**
-   * Called when shutdown times out or encounters an error.
-   * Defaults to `process.exit(1)` — appropriate for production but dangerous in:
-   * - **Tests**: kills the test runner. Pass `() => {}` or `() => { throw … }`.
-   * - **Shared runtimes** (e.g., serverless): may kill unrelated handlers.
-   *
-   * @param reason - `'timeout'` if shutdown exceeded `timeout` ms,
-   *                 `'error'` if `onShutdown` or `fastify.close()` threw.
-   */
-  onForceExit?: (reason: "timeout" | "error") => void;
-}
-declare const gracefulShutdownPlugin: FastifyPluginAsync<GracefulShutdownOptions>;
-declare module "fastify" {
-  interface FastifyInstance {
-    /** Trigger graceful shutdown manually */
-    shutdown: () => Promise<void>;
-  }
-}
-declare const _default$2: FastifyPluginAsync<GracefulShutdownOptions>;
-//#endregion
 //#region src/plugins/pressure.d.ts
 /**
  * One measurable source of load, normalised by whoever owns it.
@@ -253,4 +223,4 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
 declare const _default$7: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as pressurePlugin, pressurePlugin as pressurePluginFn, _default$6 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$7 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$8 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$9 as ssePlugin, ssePlugin as ssePluginFn, _default$10 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type ShutdownState, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as pressurePlugin, pressurePlugin as pressurePluginFn, _default$6 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$7 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$8 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$9 as ssePlugin, ssePlugin as ssePluginFn, _default$10 as versioningPlugin, versioningPlugin as versioningPluginFn };