@classytic/arc 2.41.0 → 2.43.0

package/dist/resourceRateLimit-dSjVr1pk.mjs

@@ -0,0 +1,180 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as createTenantKeyGenerator } from "./rateLimitKey-C4O-kPm0.mjs";
+//#region src/permissions/resourceRateLimit.ts
+function decision(allowed, max, remaining, ttlSeconds) {
+	const reset = Math.max(1, ttlSeconds);
+	return {
+		allowed,
+		retryAfterSeconds: reset,
+		headers: {
+			"x-ratelimit-limit": max,
+			"x-ratelimit-remaining": remaining,
+			"x-ratelimit-reset": reset,
+			...!allowed ? { "retry-after": reset } : {}
+		}
+	};
+}
+/** Policy namespacing must reach the store key, not merely the local limiter cache. */
+function policyIdentity(resource, policy) {
+	if (!Number.isSafeInteger(policy.max) || policy.max <= 0) throw new Error("rateLimit.max must be a positive safe integer.");
+	return JSON.stringify([
+		"arc-resource",
+		resource,
+		policy.bucket ?? "resource",
+		policy.max,
+		resourceRateLimitWindowMs(policy.timeWindow)
+	]);
+}
+const RESOURCE_RATE_LIMITER = Symbol.for("arc.resourceRateLimiter");
+const tenantKey = createTenantKeyGenerator();
+function resourceRateLimitKey(resource, context) {
+	const actor = tenantKey({
+		scope: context.scope,
+		ip: context.ip ?? "anonymous"
+	});
+	const dimension = context.scope && context.scope.kind !== "public" && "organizationId" in context.scope && context.scope.organizationId ? "tenant" : context.scope?.kind ?? "public";
+	return JSON.stringify([
+		resource,
+		dimension,
+		actor
+	]);
+}
+const RATE_LIMITING_DISABLED = Symbol.for("arc.rateLimitingDisabled");
+/**
+* The host said `rateLimit: false`. A resource's declared limit is then a recorded no-op, and
+* the resources are named once at ready. Absent this mark, a declared limit with no limiter
+* refuses to boot: nobody decided, so nothing would enforce it.
+*/
+function markRateLimitingDisabled(app) {
+	if (Reflect.get(app, RATE_LIMITING_DISABLED)) return;
+	const unenforced = /* @__PURE__ */ new Set();
+	Reflect.set(app, RATE_LIMITING_DISABLED, unenforced);
+	app.addHook("onReady", async () => {
+		if (unenforced.size === 0) return;
+		app.log.info({ resources: [...unenforced] }, `[arc] rate limiting is disabled for this app: declared rateLimit not enforced on ${[...unenforced].join(", ")}`);
+	});
+}
+/** Record a resource whose declared limit the host disabled; `false` when the host never decided. */
+function recordUnenforcedRateLimit(app, resource) {
+	let owner = app;
+	while (owner) {
+		const unenforced = Reflect.get(owner, RATE_LIMITING_DISABLED);
+		if (unenforced instanceof Set) {
+			unenforced.add(resource);
+			return true;
+		}
+		owner = Object.getPrototypeOf(owner);
+	}
+	return false;
+}
+/** Uses createRateLimit's store factory, preserving Redis/custom-store configuration. */
+function resolveResourceRateLimiter(app, durability = "memory") {
+	if (!app.hasDecorator("createRateLimit")) return void 0;
+	let owner = app;
+	while (!Object.hasOwn(owner, "createRateLimit")) {
+		const parent = Object.getPrototypeOf(owner);
+		if (!parent || typeof parent !== "object" || !("createRateLimit" in parent)) break;
+		owner = parent;
+	}
+	const existing = Reflect.get(owner, RESOURCE_RATE_LIMITER);
+	if (existing) return existing;
+	const limiters = /* @__PURE__ */ new Map();
+	const limiter = {
+		durability,
+		async consume(resource, policy, context) {
+			const identity = policyIdentity(resource, policy);
+			let consume = limiters.get(identity);
+			if (!consume) {
+				consume = owner.createRateLimit({
+					max: policy.max,
+					timeWindow: resourceRateLimitWindowMs(policy.timeWindow),
+					allowList: [],
+					skipOnError: false,
+					keyGenerator: (req) => req.ip
+				});
+				limiters.set(identity, consume);
+			}
+			const req = {
+				ip: JSON.stringify([identity, resourceRateLimitKey(resource, context)]),
+				routeOptions: { config: {} }
+			};
+			const result = await consume(req);
+			return result.isAllowed ? decision(true, policy.max, policy.max, Math.ceil(resourceRateLimitWindowMs(policy.timeWindow) / 1e3)) : decision(!result.isExceeded, result.max, result.remaining, result.ttlInSeconds);
+		}
+	};
+	Reflect.set(owner, RESOURCE_RATE_LIMITER, limiter);
+	return limiter;
+}
+/** Standalone tools may use memory; wired distributed apps use the host's shared store. */
+function createMemoryResourceRateLimiter(capacity = 1e4) {
+	if (!Number.isSafeInteger(capacity) || capacity <= 0) throw new Error("rateLimit memory capacity must be a positive safe integer.");
+	const windows = /* @__PURE__ */ new Map();
+	return {
+		durability: "memory",
+		async consume(resource, policy, context) {
+			const now = Date.now();
+			const windowMs = resourceRateLimitWindowMs(policy.timeWindow);
+			const key = JSON.stringify([policyIdentity(resource, policy), resourceRateLimitKey(resource, context)]);
+			let slot = windows.get(key);
+			if (!slot || slot.expires <= now) {
+				if (windows.size >= capacity) {
+					for (const [entry, window] of windows) if (window.expires <= now) windows.delete(entry);
+					if (!windows.has(key) && windows.size >= capacity) {
+						let retryMs = Number.POSITIVE_INFINITY;
+						for (const entry of windows.values()) retryMs = Math.min(retryMs, entry.expires - now);
+						return decision(false, policy.max, 0, Math.ceil(retryMs / 1e3));
+					}
+				}
+				slot = {
+					expires: now + windowMs,
+					count: 0
+				};
+				windows.set(key, slot);
+			}
+			slot.count++;
+			return decision(slot.count <= policy.max, policy.max, Math.max(0, policy.max - slot.count), Math.ceil((slot.expires - now) / 1e3));
+		}
+	};
+}
+function resourceRateLimitWindowMs(window) {
+	const match = /^\s*((?:\d+(?:\.\d+)?|\.\d+))\s*(ms|milliseconds?|msecs?|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?|d|days?|w|wks?|weeks?|y|yrs?|years?)?\s*$/i.exec(window);
+	const value = Number(match?.[1]) * ({
+		ms: 1,
+		millisecond: 1,
+		milliseconds: 1,
+		msec: 1,
+		msecs: 1,
+		s: 1e3,
+		sec: 1e3,
+		secs: 1e3,
+		second: 1e3,
+		seconds: 1e3,
+		m: 6e4,
+		min: 6e4,
+		mins: 6e4,
+		minute: 6e4,
+		minutes: 6e4,
+		h: 36e5,
+		hr: 36e5,
+		hrs: 36e5,
+		hour: 36e5,
+		hours: 36e5,
+		d: 864e5,
+		day: 864e5,
+		days: 864e5,
+		w: 6048e5,
+		wk: 6048e5,
+		wks: 6048e5,
+		week: 6048e5,
+		weeks: 6048e5,
+		y: 315576e5,
+		yr: 315576e5,
+		yrs: 315576e5,
+		year: 315576e5,
+		years: 315576e5
+	}[match?.[2]?.toLowerCase() ?? "ms"] ?? 0);
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`rateLimit.timeWindow '${window}' must be a positive duration in milliseconds.`);
+	return value;
+}
+//#endregion
+export { resourceRateLimitWindowMs as a, resolveResourceRateLimiter as i, markRateLimitingDisabled as n, recordUnenforcedRateLimit as r, createMemoryResourceRateLimiter as t };

package/dist/{rolldown-runtime-DjDuyglE.mjs → rolldown-runtime-D1w9Y1VJ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;

package/dist/routeValidator-D36SW8qt.mjs

@@ -0,0 +1,70 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { AjvCompiler } from "@fastify/ajv-compiler";
+//#region src/core/routeValidator.ts
+/**
+* Arc's request validator — the AJV settings every route arc builds is validated with, on ANY host.
+*
+* Fastify's stock AJV runs `removeAdditional: true`, which turns `additionalProperties: false`
+* into a silent STRIP: an unknown key in a strict action body or filter querystring reaches the
+* handler as if it were never sent, and a dropped filter is a WIDER read. Arc's routes therefore
+* carry their own `validatorCompiler` unless the instance was built by `createApp`, whose root
+* AJV already runs these options (plus the host's `ajv.keywords`).
+* Pinned by `tests/core/route-validator-bare-host.test.ts`.
+*/
+/** The AJV options `createApp` configures and arc's own routes are compiled with. */
+function arcAjvCustomOptions(extraKeywords = []) {
+	return {
+		coerceTypes: true,
+		useDefaults: true,
+		removeAdditional: false,
+		strictTypes: false,
+		keywords: ["example", ...extraKeywords]
+	};
+}
+/** Mark an instance whose ROOT AJV was configured with `arcAjvCustomOptions` (createApp only). */
+function markArcRootValidator(fastify) {
+	fastify.decorate("arcRootValidator", true);
+}
+/** One pool for the process: `@fastify/ajv-compiler` caches an AJV per (shared schemas, options). */
+const buildFromPool = AjvCompiler();
+/**
+* The `validatorCompiler` an arc-built route registers with — `undefined` under `createApp`
+* (the root already validates this way). Schemas added with `fastify.addSchema` stay
+* `$ref`-able: the shared pool is read when Fastify compiles the route.
+*/
+function arcRouteValidatorCompiler(fastify) {
+	if (fastify.arcRootValidator === true) return void 0;
+	return ({ schema, httpPart }) => {
+		return buildFromPool(sharedSchemas(fastify), { customOptions: arcAjvCustomOptions() })({ schema: httpPart === "headers" ? lowerCaseHeaderSchema(schema) : schema });
+	};
+}
+/** The instance's `addSchema` pool, in the shape AJV accepts (a schema is an object or boolean). */
+function sharedSchemas(fastify) {
+	const out = {};
+	for (const [id, schema] of Object.entries(fastify.getSchemas())) if (isSchemaValue(schema)) out[id] = schema;
+	return out;
+}
+function isSchemaValue(value) {
+	return typeof value === "boolean" || typeof value === "object" && value !== null;
+}
+/**
+* Fastify lower-cases a headers schema's keys before compiling it with its OWN compiler and
+* skips that for a custom one — so a route-level compiler must do it, or `Authorization` in a
+* schema never matches the `authorization` header Node delivers.
+*/
+function lowerCaseHeaderSchema(schema) {
+	if (!isPlainObject(schema)) return schema;
+	const out = { ...schema };
+	if (Array.isArray(schema.required)) out.required = schema.required.map((h) => typeof h === "string" ? h.toLowerCase() : h);
+	if (isPlainObject(schema.properties)) {
+		const properties = {};
+		for (const [key, value] of Object.entries(schema.properties)) properties[key.toLowerCase()] = value;
+		out.properties = properties;
+	}
+	return out;
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && Object.getPrototypeOf(value) === Object.prototype;
+}
+//#endregion
+export { arcRouteValidatorCompiler as n, markArcRootValidator as r, arcAjvCustomOptions as t };

package/dist/{runtimeCapabilities-DSA_dH1_.mjs → runtimeCapabilities-0tccjRlj.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/utils/runtimeCapabilities.ts
 /**
 * `Symbol.for` so declarations from two arc copies in one dependency graph

package/dist/{schedules-BktJb3Y3.mjs → schedules-C-OpmHBq.mjs}

@@ -1,7 +1,8 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
-import { t as runWorkScope } from "./workScope-BhsWde4k.mjs";
-import { t as startRenewingLease } from "./renewingLease-B3VYh5aU.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+import { a as runShutdown, i as runAdmittedWork, r as registerShutdownParticipant } from "./shutdown-MqA81z_P.mjs";
+import { t as runWorkScope } from "./workScope-zpPyge4t.mjs";
+import { t as startRenewingLease } from "./renewingLease-qODa7KJQ.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/schedules.ts
 var schedules_exports = /* @__PURE__ */ __exportAll({
@@ -61,10 +62,10 @@ const schedulesPlugin = async (fastify, opts) => {
 			}
 			stat.runs++;
 			stat.lastRunAt = (/* @__PURE__ */ new Date()).toISOString();
-			await runWorkScope({
+			await runAdmittedWork(() => runWorkScope({
 				kind: "job",
 				id: s.name
-			}, () => s.handler(fastify));
+			}, () => s.handler(fastify)));
 			stat.lastError = null;
 		} catch (err) {
 			stat.failures++;
@@ -105,37 +106,45 @@ const schedulesPlugin = async (fastify, opts) => {
 		}
 		if (stats.size > 0) fastify.log.debug(`[arc-schedules] ${stats.size} schedule(s) armed${lock ? ` (leader-safe, holder ${holderId})` : ""}`);
 	});
+	registerShutdownParticipant(fastify, {
+		name: "schedules",
+		stop: () => {
+			closing = true;
+			for (const timer of timers.values()) clearTimeout(timer);
+			timers.clear();
+		},
+		drain: async () => {
+			/**
+			* Let in-flight runs settle so shutdown never truncates a sweep mid-write —
+			* but BOUNDED, because a tick has no cancellation contract and its duration
+			* is not this plugin's to predict. An outbox relay whose subscriber retries
+			* on a backoff ladder holds one tick for minutes, and an unbounded await
+			* here contradicts the `unref` two functions up: pending scheduled work is
+			* already declared as something that must not hold the process.
+			*
+			* Waiting longer than the orchestrator's grace period buys nothing anyway —
+			* SIGKILL truncates the same write, without the log line naming what was
+			* still running.
+			*/
+			const pending = [...inFlight.entries()];
+			if (pending.length === 0) return;
+			let timeout;
+			const expired = Symbol("drain-timeout");
+			const budget = new Promise((resolve) => {
+				timeout = setTimeout(() => resolve(expired), drainTimeoutMs);
+				timeout.unref?.();
+			});
+			const settled = Promise.allSettled(pending.map(([, run]) => run)).then(() => void 0);
+			const outcome = await Promise.race([settled, budget]);
+			if (timeout) clearTimeout(timeout);
+			if (outcome === expired) fastify.log.warn({
+				schedules: pending.map(([name]) => name),
+				drainTimeoutMs
+			}, "[arc-schedules] shutdown drain budget exceeded — abandoning in-flight run(s). Durable work (outbox rows, leased sweeps) is retried on the next boot; raise `drainTimeoutMs` only if a listed job is genuinely non-resumable.");
+		}
+	});
 	fastify.addHook("onClose", async () => {
-		closing = true;
-		for (const timer of timers.values()) clearTimeout(timer);
-		timers.clear();
-		/**
-		* Let in-flight runs settle so shutdown never truncates a sweep mid-write —
-		* but BOUNDED, because a tick has no cancellation contract and its duration
-		* is not this plugin's to predict. An outbox relay whose subscriber retries
-		* on a backoff ladder holds one tick for minutes, and an unbounded await
-		* here contradicts the `unref` two functions up: pending scheduled work is
-		* already declared as something that must not hold the process.
-		*
-		* Waiting longer than the orchestrator's grace period buys nothing anyway —
-		* SIGKILL truncates the same write, without the log line naming what was
-		* still running.
-		*/
-		const pending = [...inFlight.entries()];
-		if (pending.length === 0) return;
-		let timeout;
-		const expired = Symbol("drain-timeout");
-		const budget = new Promise((resolve) => {
-			timeout = setTimeout(() => resolve(expired), drainTimeoutMs);
-			timeout.unref?.();
-		});
-		const settled = Promise.allSettled(pending.map(([, run]) => run)).then(() => void 0);
-		const outcome = await Promise.race([settled, budget]);
-		if (timeout) clearTimeout(timeout);
-		if (outcome === expired) fastify.log.warn({
-			schedules: pending.map(([name]) => name),
-			drainTimeoutMs
-		}, "[arc-schedules] shutdown drain budget exceeded — abandoning in-flight run(s). Durable work (outbox rows, leased sweeps) is retried on the next boot; raise `drainTimeoutMs` only if a listed job is genuinely non-resumable.");
+		await runShutdown(fastify);
 	});
 };
 var schedules_default = fp(schedulesPlugin, {
@@ -143,4 +152,4 @@ var schedules_default = fp(schedulesPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { schedules_default as n, schedules_exports as r, schedulesPlugin as t };
+export { schedules_exports as n, schedules_default as t };

package/dist/{schemaConverter-BLCSmNbr.mjs → schemaConverter-BORek3O-.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { arcLog } from "./logger/index.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as arcLog } from "./logger-DXjfIqjV.mjs";
 //#region src/utils/schemaConverter.ts
 /**
 * Schema Converter — Detect-First, Convert-Only-When-Needed

package/dist/{schemaIR-K16Bb5BX.mjs → schemaIR-C7Vbp71I.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { o as toJsonSchema } from "./schemaConverter-BLCSmNbr.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { o as toJsonSchema } from "./schemaConverter-BORek3O-.mjs";
 //#region src/core/schemaIR.ts
 /**
 * Schema IR — one canonical representation, two adapters.

package/dist/schemas/index.d.mts

@@ -26,12 +26,17 @@ declare function ArcListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TUn
   pages: Type$1.TInteger;
   hasNext: Type$1.TBoolean;
   hasPrev: Type$1.TBoolean;
+  totalIsEstimate: Type$1.TOptional<Type$1.TBoolean>;
+  countedAt: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
 }>, Type$1.TObject<{
   method: Type$1.TLiteral<"keyset">;
   data: Type$1.TArray<T>;
   limit: Type$1.TInteger;
   hasMore: Type$1.TBoolean;
   next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
+  prev: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  hasPrev: Type$1.TOptional<Type$1.TBoolean>;
+  end: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
 }>, Type$1.TObject<{
   method: Type$1.TLiteral<"aggregate">;
   data: Type$1.TArray<T>;
@@ -54,6 +59,8 @@ declare function ArcOffsetListResponse<T extends TSchema$1>(itemSchema: T): Type
   pages: Type$1.TInteger;
   hasNext: Type$1.TBoolean;
   hasPrev: Type$1.TBoolean;
+  totalIsEstimate: Type$1.TOptional<Type$1.TBoolean>;
+  countedAt: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
 }>;
 /** Keyset variant — `{ method: 'keyset', data, limit, hasMore, next: string | null }`. */
 declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{
@@ -62,6 +69,9 @@ declare function ArcKeysetListResponse<T extends TSchema$1>(itemSchema: T): Type
   limit: Type$1.TInteger;
   hasMore: Type$1.TBoolean;
   next: Type$1.TUnion<[Type$1.TString, Type$1.TNull]>;
+  prev: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  hasPrev: Type$1.TOptional<Type$1.TBoolean>;
+  end: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
 }>;
 /** Aggregate variant — `{ method: 'aggregate', ...same as offset }`. */
 declare function ArcAggregateListResponse<T extends TSchema$1>(itemSchema: T): Type$1.TObject<{

package/dist/schemas/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { Type, Type as Type$1 } from "typebox";
 //#region src/schemas/index.ts
@@ -34,7 +34,9 @@ function ArcOffsetListResponse(itemSchema) {
 		total: Type$1.Integer(),
 		pages: Type$1.Integer(),
 		hasNext: Type$1.Boolean(),
-		hasPrev: Type$1.Boolean()
+		hasPrev: Type$1.Boolean(),
+		totalIsEstimate: Type$1.Optional(Type$1.Boolean()),
+		countedAt: Type$1.Optional(Type$1.Union([Type$1.String({ format: "date-time" }), Type$1.Null()]))
 	});
 }
 /** Keyset variant — `{ method: 'keyset', data, limit, hasMore, next: string | null }`. */
@@ -44,7 +46,10 @@ function ArcKeysetListResponse(itemSchema) {
 		data: Type$1.Array(itemSchema),
 		limit: Type$1.Integer(),
 		hasMore: Type$1.Boolean(),
-		next: Type$1.Union([Type$1.String(), Type$1.Null()])
+		next: Type$1.Union([Type$1.String(), Type$1.Null()]),
+		prev: Type$1.Optional(Type$1.Union([Type$1.String(), Type$1.Null()])),
+		hasPrev: Type$1.Optional(Type$1.Boolean()),
+		end: Type$1.Optional(Type$1.Union([Type$1.String(), Type$1.Null()]))
 	});
 }
 /** Aggregate variant — `{ method: 'aggregate', ...same as offset }`. */

package/dist/scim/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as parseJsonBody } from "../jsonBody-Cq9KYl2Z.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-B4YVGcql.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.d.mts

@@ -1,6 +1,6 @@
 
 import { A as requireOrgId, C as hasOrgAccess, D as isOrgInScope, E as isMember, M as requireUserId, N as scopeFirstCtx, O as isService, S as getUserRoles, T as isElevated, _ as getScopeContextMap, a as ScopeFirstCtx, b as getTenantFromRequest, c as getAncestorOrgIds, d as getMandate, f as getOrgContext, g as getScopeContext, h as getRequestScope, i as RequestScope, j as requireTeamId, k as requireClientId, l as getClientId, m as getOrgRoles, n as Mandate, o as ScopeFirstCtxOptions, p as getOrgId, r as PUBLIC_SCOPE, s as ScopeFirstCtxRequest, t as AUTHENTICATED_SCOPE, u as getDPoPJkt, v as getServiceScopes, w as isAuthenticated, x as getUserId, y as getTeamId } from "../types-Ddl9OjmE.mjs";
-import { i as elevationPlugin, n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-BXCfVcNG.mjs";
+import { n as ElevationOptions, r as _default, t as ElevationEvent } from "../elevation-BW2J3tNj.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/scope/rateLimitKey.d.ts
 interface RateLimitKeyContext {
@@ -30,4 +30,4 @@ interface ResolveOrgFromHeaderOptions {
  */
 declare function resolveOrgFromHeader(options: ResolveOrgFromHeaderOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
 //#endregion
-export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };
+export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-CDy3-zw1.mjs";
-import { n as elevation_default, t as elevationPlugin } from "../elevation-BF-vhGxY.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-CK-EU2L8.mjs";
-import { t as resolveOrgFromHeader } from "../scope-jSxuBTFM.mjs";
-export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, elevationPlugin as elevationPluginFn, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-Bk9NOgOC.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-C4O-kPm0.mjs";
+import { t as elevation_default } from "../elevation-DG8SrLN-.mjs";
+import { t as resolveOrgFromHeader } from "../scope-DQthe88b.mjs";
+export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-jSxuBTFM.mjs → scope-DQthe88b.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-C_YhELhe.mjs";
-import { n as requireSingleHeaderValue } from "./headers-CNECDE6q.mjs";
-import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-CtrywMHP.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BbkIF6vA.mjs";
+import { n as getUserRoles } from "./userHelpers-aklawRaK.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/shutdown-MqA81z_P.mjs

@@ -0,0 +1,59 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/utils/shutdown.ts
+/** Stop admissions across every runtime before draining work and disposing domain engines. */
+const SHUTDOWN = Symbol.for("arc.shutdown");
+const admittedWork = new AsyncLocalStorage();
+/** Descendants of admitted work may finish their causal publications during shutdown. */
+async function runAdmittedWork(work) {
+	if (isAdmittedWork()) return await work();
+	const scope = { active: true };
+	return admittedWork.run(scope, async () => {
+		try {
+			return await work();
+		} finally {
+			scope.active = false;
+		}
+	});
+}
+function isAdmittedWork() {
+	return admittedWork.getStore()?.active === true;
+}
+/** Seed on the root before plugins register, so encapsulated plugins share one coordinator. */
+function initShutdownRegistry(fastify) {
+	const holder = fastify;
+	if (holder[SHUTDOWN]) return;
+	holder[SHUTDOWN] = { participants: [] };
+	fastify.addHook("onClose", async () => {
+		const errors = await runShutdown(fastify);
+		for (const err of errors) fastify.log.error({ err }, "[arc] runtime shutdown failed");
+	});
+}
+/** A participant's stop must prevent new work; drain waits for work already admitted. */
+function registerShutdownParticipant(fastify, participant) {
+	initShutdownRegistry(fastify);
+	const registry = fastify[SHUTDOWN];
+	if (!registry) throw new Error("[arc] shutdown coordinator is unavailable");
+	if (registry.completion) throw new Error(`[arc] cannot register ${participant.name} during shutdown`);
+	registry.participants.push(participant);
+}
+/** Once-guarded, best effort; callers dispose engines only after this completes. */
+function runShutdown(fastify) {
+	const registry = fastify[SHUTDOWN];
+	if (!registry) return Promise.resolve([]);
+	registry.completion ??= Promise.resolve().then(async () => {
+		const errors = [];
+		for (const phase of ["stop", "drain"]) {
+			const participants = phase === "drain" ? [...registry.participants.filter((p) => p.kind !== "consumer"), ...registry.participants.filter((p) => p.kind === "consumer")] : registry.participants;
+			for (const participant of participants) try {
+				await participant[phase]?.();
+			} catch (cause) {
+				errors.push(new Error(`[arc] ${participant.name} shutdown ${phase} failed`, { cause }));
+			}
+		}
+		return errors;
+	});
+	return registry.completion;
+}
+//#endregion
+export { runShutdown as a, runAdmittedWork as i, isAdmittedWork as n, registerShutdownParticipant as r, initShutdownRegistry as t };

package/dist/{simpleEqualityMatcher-BiOnyflP.mjs → simpleEqualityMatcher-auW8QjXN.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/utils/simpleEqualityMatcher.ts
 /**
 * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality

package/dist/{sse-CH7Slxc1.mjs → sse-CYzQBVFe.mjs}

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
-import { arcLog } from "./logger/index.mjs";
-import { c as getOrgId, n as PUBLIC_SCOPE } from "./types-CDy3-zw1.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-dvppnxsr.mjs";
-import { t as openSseStream } from "./sseStream-CN-Lh1Tu.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+import { t as arcLog } from "./logger-DXjfIqjV.mjs";
+import { n as PUBLIC_SCOPE } from "./types-Bk9NOgOC.mjs";
+import { n as isEventVisible, t as eventAudienceOf } from "./tenancy--ed9eH_z.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-DjTQhZrN.mjs";
+import { t as openSseStream } from "./sseStream-B5_Afiqn.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({
@@ -12,7 +13,7 @@ var sse_exports = /* @__PURE__ */ __exportAll({
 });
 const log = arcLog("sse");
 const ssePlugin = async (fastify, opts = {}) => {
-	const { path = "/events/stream", requireAuth = true, patterns = ["*"], heartbeat = 3e4, orgScoped = false, filter: customFilter, tokenQueryParam = "token" } = opts;
+	const { path = "/events/stream", requireAuth = true, patterns = ["*"], heartbeat = 3e4, orgScoped = true, filter: customFilter, tokenQueryParam = "token" } = opts;
 	if (!fastify.hasDecorator("events")) {
 		log.warn("Events plugin (arc-events) not registered. SSE plugin will not function. Register eventPlugin before ssePlugin.");
 		return;
@@ -34,15 +35,10 @@ const ssePlugin = async (fastify, opts = {}) => {
 			const stream = openSseStream(request, reply, { heartbeatMs: heartbeat });
 			stream.onCleanup(() => activeConnections.delete(stream.close));
 			const scope = request.scope ?? PUBLIC_SCOPE;
-			const requestOrgId = getOrgId(scope);
-			const dropOrgEvents = orgScoped && !requestOrgId;
+			const audience = eventAudienceOf(scope);
 			for (const pattern of patterns) {
 				const unsub = await fastify.events.subscribe(pattern, async (event) => {
-					if (orgScoped) {
-						const eventOrgId = event.meta?.organizationId;
-						if (dropOrgEvents && eventOrgId) return;
-						if (requestOrgId && eventOrgId && eventOrgId !== requestOrgId) return;
-					}
+					if (orgScoped && !isEventVisible(event.meta?.organizationId, audience)) return;
 					if (customFilter && !customFilter(event, request)) return;
 					const data = JSON.stringify({
 						type: event.type,
@@ -90,4 +86,4 @@ var sse_default = fp(ssePlugin, {
 	dependencies: ["arc-events"]
 });
 //#endregion
-export { sse_default as n, sse_exports as r, ssePlugin as t };
+export { sse_exports as n, sse_default as t };

package/dist/{sseStream-CN-Lh1Tu.mjs → sseStream-B5_Afiqn.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { n as forwardedStreamHeaders } from "./streaming-dvppnxsr.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-DjTQhZrN.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{store-helpers-9DX9-1j_.mjs → store-helpers-BOzk-CuX.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-dvppnxsr.mjs → streaming-DjTQhZrN.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**