@classytic/arc 2.41.0 → 2.43.0

package/dist/subscriberIdentity-CW39uA8G.mjs

@@ -0,0 +1,28 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+//#region src/events/subscriberIdentity.ts
+const SUBSCRIBER_ID = Symbol.for("@classytic/arc/subscriber-id");
+/** Assign a deployment-stable identity for durable per-handler progress; never use an index. */
+function withSubscriberId(id, handler) {
+	if (typeof id !== "string" || !id.trim()) throw new Error("[Arc Events] subscriber id must be non-empty");
+	const wrapped = async (event) => {
+		await handler(event);
+	};
+	Object.defineProperty(wrapped, SUBSCRIBER_ID, { value: id });
+	return wrapped;
+}
+function getSubscriberId(handler) {
+	const id = Reflect.get(handler, SUBSCRIBER_ID);
+	return typeof id === "string" ? id : void 0;
+}
+/** Preserve explicit IDs and the implicit function name through framework wrappers. */
+function preserveSubscriberIdentity(original, wrapper) {
+	const id = getSubscriberId(original);
+	if (id !== void 0) Object.defineProperty(wrapper, SUBSCRIBER_ID, { value: id });
+	Object.defineProperty(wrapper, "name", {
+		value: original.name,
+		configurable: true
+	});
+	return wrapper;
+}
+//#endregion
+export { preserveSubscriberIdentity as n, withSubscriberId as r, getSubscriberId as t };

package/dist/tenancy--ed9eH_z.mjs

@@ -0,0 +1,43 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { b as isElevated, c as getOrgId } from "./types-Bk9NOgOC.mjs";
+//#region src/core/tenancy.ts
+function eventAudienceOf(scope) {
+	const tenancy = resolveTenancy({ _scope: scope }, "organizationId");
+	return tenancy.mode === "scoped" ? {
+		orgId: tenancy.orgId,
+		platformView: false
+	} : { platformView: tenancy.reason === "platform" };
+}
+/**
+* Whether an event tagged `eventOrgId` may reach `audience`. Untenanted events
+* reach everyone; a tenant's event reaches that tenant and the platform view,
+* and nobody else — including a caller with no org at all (fail-closed).
+*/
+function isEventVisible(eventOrgId, audience) {
+	if (eventOrgId === void 0 || eventOrgId === null || eventOrgId === "") return true;
+	if (audience.platformView) return true;
+	return audience.orgId !== void 0 && String(eventOrgId) === audience.orgId;
+}
+function resolveTenancy(input, tenantField) {
+	if (!tenantField) return {
+		mode: "unscoped",
+		reason: "untenanted-resource"
+	};
+	if (input?._crossTenantRead === true) return {
+		mode: "unscoped",
+		reason: "cross-tenant"
+	};
+	const scope = input?._scope;
+	const orgId = scope ? getOrgId(scope) : void 0;
+	if (orgId) return {
+		mode: "scoped",
+		field: tenantField,
+		orgId
+	};
+	return {
+		mode: "unscoped",
+		reason: scope && isElevated(scope) ? "platform" : "no-org"
+	};
+}
+//#endregion
+export { isEventVisible as n, resolveTenancy as r, eventAudienceOf as t };

package/dist/tenantPreparation-BKon6Yox.mjs

@@ -0,0 +1,67 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
+import { d as createDomainError } from "./errors-CtrywMHP.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, v as hasOrgAccess } from "./types-Bk9NOgOC.mjs";
+//#region src/permissions/tenantPreparation.ts
+/** Tenant preparation shared by HTTP middleware and direct transport invocation. */
+const PREPARATION = Symbol.for("arc.tenantPreparation");
+function tagTenantPreparation(middleware, preparation) {
+	Object.defineProperty(middleware, PREPARATION, { value: preparation });
+	return middleware;
+}
+function isTenantPreparation(middleware) {
+	return typeof middleware === "function" && middleware[PREPARATION] !== void 0;
+}
+/**
+* The resource's tenant middlewares minus body INJECTION: an action payload is a command, not
+* the document, so it is scoped (filters, `_tenantFields`) but never written into.
+*/
+function withoutTenantInjection(middlewares) {
+	return (middlewares ?? []).filter((middleware) => {
+		if (typeof middleware !== "function") return true;
+		const preparation = Reflect.get(middleware, PREPARATION);
+		return !(typeof preparation === "object" && preparation !== null && "mode" in preparation && preparation.mode === "inject");
+	});
+}
+function prepareTenancy(scope, preparation) {
+	if (preparation.mode === "crossTenant") return { crossTenant: true };
+	const elevated = isElevated(scope);
+	if (preparation.mode === "inject" && elevated && !getOrgId(scope)) return {};
+	if (preparation.mode !== "inject" && !elevated && !hasOrgAccess(scope)) {
+		if (preparation.mode === "flexible") return {};
+		throw createDomainError(scope.kind === "public" ? "arc.unauthorized" : "arc.forbidden", scope.kind === "public" ? "Authentication required for multi-tenant resources" : "Organization context required for this operation", scope.kind === "public" ? 401 : 403);
+	}
+	const fields = {};
+	const missing = [];
+	for (const spec of preparation.specs) {
+		const value = "contextKey" in spec ? getScopeContext(scope, spec.contextKey) : spec.type === "org" ? getOrgId(scope) : getTeamId(scope);
+		if (value === void 0) missing.push(spec.field);
+		else fields[spec.field] = value;
+	}
+	if (missing.length && (preparation.mode === "inject" || !elevated)) throw createDomainError("arc.forbidden", `Tenant context incomplete — missing: ${missing.join(", ")}`, 403);
+	return {
+		fields,
+		...preparation.mode === "inject" ? { inject: true } : { policy: fields }
+	};
+}
+function applyTenantPreparation(target, body, scope, preparation) {
+	const result = prepareTenancy(scope, preparation);
+	if (result.crossTenant) target._crossTenantRead = true;
+	if (result.policy && Object.keys(result.policy).length) target._policyFilters = conjoinPolicyFilters(target._policyFilters, result.policy);
+	if (result.fields && Object.keys(result.fields).length) target._tenantFields = {
+		...target._tenantFields,
+		...result.fields
+	};
+	if (result.inject && body && typeof body === "object") Object.assign(body, result.fields);
+}
+function prepareTenantContext(ctx, middlewares) {
+	const meta = ctx.metadata;
+	for (const middleware of middlewares ?? []) {
+		if (typeof middleware !== "function") continue;
+		const preparation = middleware[PREPARATION];
+		if (preparation) applyTenantPreparation(meta, ctx.body, meta._scope ?? { kind: "public" }, preparation);
+		if (meta._tenantFields) ctx._tenantFields = meta._tenantFields;
+	}
+}
+//#endregion
+export { withoutTenantInjection as a, tagTenantPreparation as i, isTenantPreparation as n, prepareTenantContext as r, applyTenantPreparation as t };

package/dist/testing/cleanupStoreContract.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/cleanupStoreContract.ts
 /**

package/dist/testing/index.d.mts

@@ -1,10 +1,10 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
-import { l as PermissionCheck, t as AnyRecord } from "../base-CxrV1LmG.mjs";
-import { V as ResourceDefinition } from "../index-DHbyPo5j.mjs";
-import { n as ArcModuleInput, o as ModuleDisposer, s as ModuleSetupContext } from "../types-DfVDvkdP.mjs";
-import "../index-CFfLKMH4.mjs";
-import { n as preloadResourcesAsync, r as CreateAppOptions, t as preloadResources } from "../preloadResources-CjS2OfpU.mjs";
+import { l as PermissionCheck, t as AnyRecord } from "../base-CZyixEQR.mjs";
+import { F as ResourceDefinition } from "../index-mqaqZNpe.mjs";
+import { h as ModuleSetupContext, m as ModuleDisposer, o as ArcPorts, p as PortName, r as ArcModuleInput, u as ModuleName } from "../types-BJ-2XqVF.mjs";
+import "../index-JdbZAIsm.mjs";
+import { n as CreateAppOptions } from "../index-C8zVGYsk.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { StandardRepo } from "@classytic/repo-core/repository";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
@@ -74,6 +74,180 @@ interface ArcAssertion {
 }
 declare function expectArc(response: ArcResponseLike): ArcAssertion;
 //#endregion
+//#region src/testing/testActor.d.ts
+/** The header the testing harness uses to carry a request's actor. */
+declare const TEST_ACTOR_HEADER = "x-test-actor";
+/**
+ * What a test wants to be. An `organizationId` produces a `member` scope (the
+ * org-scoped case); without one the actor is `authenticated`.
+ */
+interface TestActor {
+  /**
+   * Defaults to a synthetic id derived from the roles. Pass one explicitly when
+   * a test distinguishes two actors — ownership and audit assertions do, and
+   * two actors sharing roles would otherwise share an id.
+   */
+  userId?: string;
+  /** Global roles — what `requireRoles` reads. */
+  roles?: string[];
+  /** Tenant. Present ⇒ a `member` scope. */
+  organizationId?: string;
+  /** Org-level roles from membership records. Defaults to `roles`. */
+  orgRoles?: string[];
+  teamId?: string;
+  /** App-defined dimensions (branch, project, region) read via `getScopeContext`. */
+  context?: Record<string, string>;
+  /**
+   * Elevated (platform-admin) scope. The value is the `elevatedBy` audit string
+   * arc requires — an elevated scope must record who granted it. `true` is
+   * shorthand for `'test'`.
+   *
+   * An elevated scope carries no roles: elevation is a different kind of actor,
+   * not a role. A test needing a role gate AND elevation wants `member`.
+   */
+  elevated?: string | boolean;
+}
+/**
+ * Build the headers that make an injected request act as `actor`.
+ *
+ * A string is shorthand for a single role. `null` means "stay public", so a test
+ * can prove an endpoint is reachable anonymously.
+ *
+ * @example
+ * ```ts
+ * t.app.inject({ method: 'GET', url: '/pos/shifts/current',
+ *   headers: testActorHeaders('manager', ORG) });
+ * ```
+ */
+declare function testActorHeaders(actor: TestActor | string | null, organizationId?: string): Record<string, string>;
+/**
+ * Turn a spec into a `RequestScope`.
+ *
+ * `orgRoles` defaults to `roles`: a test that says "manager" means it at both
+ * levels, and making the caller repeat itself only produces tests that pass a
+ * global gate and mysteriously fail an org one.
+ */
+declare function scopeFromTestActor(spec: TestActor): RequestScope;
+/**
+ * Build the `auth` option that makes the test actor arc's authenticator.
+ *
+ * It must be an authenticator, not a hook. Fastify encapsulates plugins and
+ * modules register DURING `createApp`, so a hook added to the root instance
+ * afterwards never runs for their routes — every request still resolves as
+ * public and every role gate still answers 401, which reads exactly like a
+ * broken authorization rule in the code under test. Registering as
+ * `auth: { type: 'authenticator' }` puts the scope where arc's own auth would,
+ * at the phase arc expects, so tenant filtering and permission checks behave
+ * identically to production.
+ *
+ * `defaultActor` applies to requests carrying no header. A malformed header
+ * REJECTS rather than falling back to public — a test that meant to be an admin
+ * and got quietly demoted is the most expensive way to fail.
+ */
+declare function testActorAuth(defaultActor?: TestActor): {
+  type: "authenticator";
+  authenticate: (request: unknown) => Promise<void>;
+};
+//#endregion
+//#region src/testing/bootModuleApp.d.ts
+/** Handed to a modules factory — the in-memory DB is live at call time. */
+/**
+ * A provisioned test database — what the `database` seam yields. Arc
+ * core never names a driver: kits ship factories (`mongoMemoryDatabase`
+ * is the built-in default; a sqlitekit/pgkit testkit ships its own) and
+ * the connection flows through as an opaque generic.
+ */
+interface TestDatabase<TConn = unknown> {
+  /** Connection string, when the backend has one (informational). */
+  uri: string;
+  /** Driver connection handle passed to the modules factory. */
+  connection: TConn;
+  /** Stop/disconnect everything this factory started. MUST be idempotent-safe to call once. */
+  teardown(): Promise<void>;
+}
+/** The DB-provisioning seam — `bootModuleApp({ database })`. */
+type TestDatabaseFactory<TConn = unknown> = (opts: {
+  replset?: boolean;
+}) => Promise<TestDatabase<TConn>>;
+interface TestkitContext<TConn = unknown> {
+  /** The provisioned database's connection string. */
+  uri: string;
+  /**
+   * Driver connection handle (the default factory yields mongoose's
+   * DEFAULT connection). Generic so DB-typed wrappers assert the driver
+   * type ONCE: `bootModuleApp<Connection>(...)`. Arc core stays DB-agnostic.
+   */
+  connection: TConn;
+}
+type BootModulesInput<TConn = unknown> = ArcModuleInput | readonly ArcModuleInput[] | ((ctx: TestkitContext<TConn>) => ArcModuleInput | readonly ArcModuleInput[] | Promise<ArcModuleInput | readonly ArcModuleInput[]>);
+interface BootModuleAppOptions<TConn = unknown> {
+  /**
+   * DB provisioner. Default: `mongoMemoryDatabase` (in-memory MongoDB —
+   * lazy devDep imports, nothing Mongo touches arc's runtime). Kits for
+   * other stores inject their own factory here; the rest of the harness
+   * (module resolution, app boot, teardown ordering) is DB-agnostic.
+   */
+  database?: TestDatabaseFactory<TConn>;
+  /** Single-node replica set (transactions). Default: standalone. Passed to the database factory. */
+  replset?: boolean;
+  /**
+   * Extra `createApp` options merged over the testing defaults
+   * (`preset: 'testing'`, `auth: false`, `sensible: false` — utility
+   * plugins stay off so the testkit is dependency-light; re-enable per
+   * boot when a module genuinely exercises one).
+   */
+  app?: Partial<CreateAppOptions>;
+  /**
+   * Default actor for every injected request that carries no `x-test-actor` header.
+   *
+   * The harness boots with `auth: false`, so without this every request is
+   * `PUBLIC_SCOPE` and role-gated routes answer 401 — correct, but it left tests with
+   * no supported way to be somebody. See `testActor.ts` for why the seam lives in the
+   * testing entrypoint and can never be reached from production.
+   */
+  actor?: TestActor;
+  /** Host ports for the booted modules — typed and checked exactly as `createApp({ ports })`. */
+  ports?: ArcPorts;
+}
+interface ModuleTestApp<TConn = unknown> {
+  app: FastifyInstance;
+  /** The provisioned database's connection string. */
+  uri: string;
+  /** The mongoose `Connection` handed to the modules factory. */
+  connection: TConn;
+  /**
+   * Typed module-export accessor — `t.exports<CatalogEngine>('catalog')`
+   * instead of reaching through `(t.app as ...).arc.modules.catalog`.
+   * Delegates to `getModuleExports` (throws with the registered-module
+   * list when the name is unknown — same contract hosts get).
+   */
+  exports<TExports = unknown>(name: string): TExports;
+  /** Close app → disconnect mongoose → stop the in-memory server. Idempotent. */
+  close(): Promise<void>;
+}
+/**
+ * The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+ * Everything Mongo-specific about the harness lives HERE — the harness
+ * itself is driver-blind and any kit can replace this via `database`.
+ */
+declare function mongoMemoryDatabase(opts: {
+  replset?: boolean;
+}): Promise<TestDatabase<unknown>>;
+declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
+//#endregion
+//#region src/testing/assertModuleBootsAlone.d.ts
+interface ModuleBootsAloneOptions<TConn = unknown> extends BootModuleAppOptions<TConn> {
+  /** Runs against the booted closure before it closes — drive the module's cross-module ports. */
+  probe?: (t: ModuleTestApp<TConn>) => void | Promise<void>;
+}
+interface ModuleBootsAloneResult {
+  /** The closure's modules (bridges excluded), in input order. */
+  readonly closure: readonly string[];
+}
+declare function assertModuleBootsAlone<TConn = unknown>(modules: BootModulesInput<TConn>,
+/** The module — or several roots booted together, when a deployment rule pairs them. */
+name: ModuleName | readonly ModuleName[], options?: ModuleBootsAloneOptions<TConn>): Promise<ModuleBootsAloneResult>;
+//#endregion
 //#region src/testing/authorizationConformance.d.ts
 /** One surface's observed enforcement: the HTTP status + the filter arc passed the repo. */
 interface SurfaceObservation {
@@ -341,181 +515,22 @@ declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOpti
  */
 declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
 //#endregion
-//#region src/testing/testActor.d.ts
-/** The header the testing harness uses to carry a request's actor. */
-declare const TEST_ACTOR_HEADER = "x-test-actor";
-/**
- * What a test wants to be. An `organizationId` produces a `member` scope (the
- * org-scoped case); without one the actor is `authenticated`.
- */
-interface TestActor {
-  /**
-   * Defaults to a synthetic id derived from the roles. Pass one explicitly when
-   * a test distinguishes two actors — ownership and audit assertions do, and
-   * two actors sharing roles would otherwise share an id.
-   */
-  userId?: string;
-  /** Global roles — what `requireRoles` reads. */
-  roles?: string[];
-  /** Tenant. Present ⇒ a `member` scope. */
-  organizationId?: string;
-  /** Org-level roles from membership records. Defaults to `roles`. */
-  orgRoles?: string[];
-  teamId?: string;
-  /** App-defined dimensions (branch, project, region) read via `getScopeContext`. */
-  context?: Record<string, string>;
-  /**
-   * Elevated (platform-admin) scope. The value is the `elevatedBy` audit string
-   * arc requires — an elevated scope must record who granted it. `true` is
-   * shorthand for `'test'`.
-   *
-   * An elevated scope carries no roles: elevation is a different kind of actor,
-   * not a role. A test needing a role gate AND elevation wants `member`.
-   */
-  elevated?: string | boolean;
-}
-/**
- * Build the headers that make an injected request act as `actor`.
- *
- * A string is shorthand for a single role. `null` means "stay public", so a test
- * can prove an endpoint is reachable anonymously.
- *
- * @example
- * ```ts
- * t.app.inject({ method: 'GET', url: '/pos/shifts/current',
- *   headers: testActorHeaders('manager', ORG) });
- * ```
- */
-declare function testActorHeaders(actor: TestActor | string | null, organizationId?: string): Record<string, string>;
-/**
- * Turn a spec into a `RequestScope`.
- *
- * `orgRoles` defaults to `roles`: a test that says "manager" means it at both
- * levels, and making the caller repeat itself only produces tests that pass a
- * global gate and mysteriously fail an org one.
- */
-declare function scopeFromTestActor(spec: TestActor): RequestScope;
-/**
- * Build the `auth` option that makes the test actor arc's authenticator.
- *
- * It must be an authenticator, not a hook. Fastify encapsulates plugins and
- * modules register DURING `createApp`, so a hook added to the root instance
- * afterwards never runs for their routes — every request still resolves as
- * public and every role gate still answers 401, which reads exactly like a
- * broken authorization rule in the code under test. Registering as
- * `auth: { type: 'authenticator' }` puts the scope where arc's own auth would,
- * at the phase arc expects, so tenant filtering and permission checks behave
- * identically to production.
- *
- * `defaultActor` applies to requests carrying no header. A malformed header
- * REJECTS rather than falling back to public — a test that meant to be an admin
- * and got quietly demoted is the most expensive way to fail.
- */
-declare function testActorAuth(defaultActor?: TestActor): {
-  type: "authenticator";
-  authenticate: (request: unknown) => Promise<void>;
-};
-//#endregion
-//#region src/testing/bootModuleApp.d.ts
-/** Handed to a modules factory — the in-memory DB is live at call time. */
-/**
- * A provisioned test database — what the `database` seam yields. Arc
- * core never names a driver: kits ship factories (`mongoMemoryDatabase`
- * is the built-in default; a sqlitekit/pgkit testkit ships its own) and
- * the connection flows through as an opaque generic.
- */
-interface TestDatabase<TConn = unknown> {
-  /** Connection string, when the backend has one (informational). */
-  uri: string;
-  /** Driver connection handle passed to the modules factory. */
-  connection: TConn;
-  /** Stop/disconnect everything this factory started. MUST be idempotent-safe to call once. */
-  teardown(): Promise<void>;
-}
-/** The DB-provisioning seam — `bootModuleApp({ database })`. */
-type TestDatabaseFactory<TConn = unknown> = (opts: {
-  replset?: boolean;
-}) => Promise<TestDatabase<TConn>>;
-interface TestkitContext<TConn = unknown> {
-  /** The provisioned database's connection string. */
-  uri: string;
-  /**
-   * Driver connection handle (the default factory yields mongoose's
-   * DEFAULT connection). Generic so DB-typed wrappers assert the driver
-   * type ONCE: `bootModuleApp<Connection>(...)`. Arc core stays DB-agnostic.
-   */
-  connection: TConn;
-}
-type BootModulesInput<TConn = unknown> = ArcModuleInput | readonly ArcModuleInput[] | ((ctx: TestkitContext<TConn>) => ArcModuleInput | readonly ArcModuleInput[] | Promise<ArcModuleInput | readonly ArcModuleInput[]>);
-interface BootModuleAppOptions<TConn = unknown> {
-  /**
-   * DB provisioner. Default: `mongoMemoryDatabase` (in-memory MongoDB —
-   * lazy devDep imports, nothing Mongo touches arc's runtime). Kits for
-   * other stores inject their own factory here; the rest of the harness
-   * (module resolution, app boot, teardown ordering) is DB-agnostic.
-   */
-  database?: TestDatabaseFactory<TConn>;
-  /** Single-node replica set (transactions). Default: standalone. Passed to the database factory. */
-  replset?: boolean;
-  /**
-   * Extra `createApp` options merged over the testing defaults
-   * (`preset: 'testing'`, `auth: false`, `sensible: false` — utility
-   * plugins stay off so the testkit is dependency-light; re-enable per
-   * boot when a module genuinely exercises one).
-   */
-  app?: Partial<CreateAppOptions>;
-  /**
-   * Default actor for every injected request that carries no `x-test-actor` header.
-   *
-   * The harness boots with `auth: false`, so without this every request is
-   * `PUBLIC_SCOPE` and role-gated routes answer 401 — correct, but it left tests with
-   * no supported way to be somebody. See `testActor.ts` for why the seam lives in the
-   * testing entrypoint and can never be reached from production.
-   */
-  actor?: TestActor;
-}
-interface ModuleTestApp<TConn = unknown> {
-  app: FastifyInstance;
-  /** The provisioned database's connection string. */
-  uri: string;
-  /** The mongoose `Connection` handed to the modules factory. */
-  connection: TConn;
-  /**
-   * Typed module-export accessor — `t.exports<CatalogEngine>('catalog')`
-   * instead of reaching through `(t.app as ...).arc.modules.catalog`.
-   * Delegates to `getModuleExports` (throws with the registered-module
-   * list when the name is unknown — same contract hosts get).
-   */
-  exports<TExports = unknown>(name: string): TExports;
-  /** Close app → disconnect mongoose → stop the in-memory server. Idempotent. */
-  close(): Promise<void>;
-}
-/**
- * The built-in DB factory: in-memory MongoDB via lazy devDep imports.
- * Everything Mongo-specific about the harness lives HERE — the harness
- * itself is driver-blind and any kit can replace this via `database`.
- */
-declare function mongoMemoryDatabase(opts: {
-  replset?: boolean;
-}): Promise<TestDatabase<unknown>>;
-declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
-//#endregion
 //#region src/testing/fixtures.d.ts
-type FixtureFactory<T extends AnyRecord = AnyRecord> = (data: Partial<T>) => Promise<T>;
+type FixtureFactory<T extends object = AnyRecord> = (data: Partial<T>) => Promise<T>;
 /** Delete hook invoked by `clear()` for records that were created through a factory. */
-type FixtureDestroyer<T extends AnyRecord = AnyRecord> = (record: T) => Promise<void>;
-interface FixtureRegistration<T extends AnyRecord = AnyRecord> {
+type FixtureDestroyer<T extends object = AnyRecord> = (record: T) => Promise<void>;
+interface FixtureRegistration<T extends object = AnyRecord> {
   create: FixtureFactory<T>;
   /** Optional cleanup. Defaults to a no-op; adapters that support deletion should provide one. */
   destroy?: FixtureDestroyer<T>;
 }
 interface TestFixtures {
   /** Register a named factory. Later calls replace the earlier registration. */
-  register<T extends AnyRecord = AnyRecord>(name: string, factoryOrRegistration: FixtureFactory<T> | FixtureRegistration<T>): void;
+  register<T extends object = AnyRecord>(name: string, factoryOrRegistration: FixtureFactory<T> | FixtureRegistration<T>): void;
   /** Create one record through the named factory. Tracked for cleanup. */
-  create<T extends AnyRecord = AnyRecord>(name: string, data?: Partial<T>): Promise<T>;
+  create<T extends object = AnyRecord>(name: string, data?: Partial<T>): Promise<T>;
   /** Create many records with a shared template. Tracked for cleanup. */
-  createMany<T extends AnyRecord = AnyRecord>(name: string, count: number, template?: Partial<T>): Promise<T[]>;
+  createMany<T extends object = AnyRecord>(name: string, count: number, template?: Partial<T>): Promise<T[]>;
   /**
    * Run every registered `destroy` hook over the records this instance
    * created, then forget them. Safe to call multiple times (idempotent).
@@ -524,7 +539,7 @@ interface TestFixtures {
    */
   clear(): Promise<void>;
   /** All records ever created by a given factory name (read-only snapshot). */
-  all<T extends AnyRecord = AnyRecord>(name: string): readonly T[];
+  all<T extends object = AnyRecord>(name: string): readonly T[];
   /** Registered factory names. */
   readonly names: readonly string[];
 }
@@ -591,7 +606,7 @@ interface MockRepository<T> extends StandardRepo<T> {
  *
  * await mockRepo.getById('1'); // Returns mocked product
  */
-declare function createMockRepository<T extends AnyRecord = AnyRecord>(overrides?: Partial<MockRepository<T>>): MockRepository<T>;
+declare function createMockRepository<T extends object = AnyRecord>(overrides?: Partial<MockRepository<T>>): MockRepository<T>;
 /**
  * Create a mock user for authentication testing
  */
@@ -695,7 +710,7 @@ declare function createTestTimer(): {
 //#region src/testing/moduleSetup.d.ts
 interface TestModuleSetup {
   /** Pass this as the second argument to `bootstrap` / `plugins` / `afterResources`. */
-  readonly context: ModuleSetupContext;
+  readonly context: ModuleSetupContext<PortName, PortName>;
   /**
    * Disposers the module registered, in REGISTRATION order (`dispose()` runs
    * them backwards). Assert on `.length` to prove a phase registered teardown
@@ -712,7 +727,10 @@ interface TestModuleSetup {
    */
   dispose(): Promise<void>;
 }
-declare function createTestModuleSetup(): TestModuleSetup;
+declare function createTestModuleSetup(options?: {
+  /** The `context.ports` the phases see — supply what the module declares. */
+  readonly ports?: ArcPorts;
+}): TestModuleSetup;
 //#endregion
 //#region src/testing/scopeRoleGate.d.ts
 /**
@@ -816,4 +834,4 @@ declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppC
  */
 declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestModuleSetup, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleBootsAloneOptions, type ModuleBootsAloneResult, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestModuleSetup, type TestkitContext, assertModuleBootsAlone, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };