@classytic/arc 2.43.0 → 2.44.0

package/dist/scim/index.d.mts

@@ -33,15 +33,15 @@ interface ScimResourceMapping {
   /** Custom outbound transform — runs after attribute mapping. */
   toScim?: (resource: Record<string, unknown>, mapped: Record<string, unknown>) => Record<string, unknown>;
 }
-declare const SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
-declare const SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
-declare const SCIM_ENTERPRISE_USER_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
-declare const DEFAULT_USER_MAPPING: ScimResourceMapping;
-declare const DEFAULT_GROUP_MAPPING: ScimResourceMapping;
+export declare const SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+export declare const SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+export declare const SCIM_ENTERPRISE_USER_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+export declare const DEFAULT_USER_MAPPING: ScimResourceMapping;
+export declare const DEFAULT_GROUP_MAPPING: ScimResourceMapping;
 /** Translate inbound SCIM JSON → resource shape. */
-declare function scimToResource(scim: Record<string, unknown>, mapping: ScimResourceMapping): Record<string, unknown>;
+export declare function scimToResource(scim: Record<string, unknown>, mapping: ScimResourceMapping): Record<string, unknown>;
 /** Translate resource → SCIM JSON. */
-declare function resourceToScim(resource: Record<string, unknown>, mapping: ScimResourceMapping, baseUrl: string): Record<string, unknown>;
+export declare function resourceToScim(resource: Record<string, unknown>, mapping: ScimResourceMapping, baseUrl: string): Record<string, unknown>;
 //#endregion
 //#region src/scim/types.d.ts
 /**
@@ -138,7 +138,7 @@ interface ScimObservedEvent {
  * ```
  */
 type ScimType = "invalidFilter" | "tooMany" | "uniqueness" | "mutability" | "invalidSyntax" | "invalidPath" | "noTarget" | "invalidValue" | "invalidVers" | "sensitive";
-declare class ScimError extends Error {
+export declare class ScimError extends Error {
   readonly statusCode: number;
   readonly scimType?: ScimType;
   constructor(statusCode: number, scimType: ScimType | undefined, detail: string);
@@ -197,9 +197,9 @@ type FilterNode = {
  *   `undefined` to deny (yields 400 invalidFilter). Use `IDENTITY_MAP` when
  *   the resource exposes SCIM-named attributes directly.
  */
-declare function parseScimFilter(filter: string, mapAttr: (scimAttr: string) => string | undefined): Record<string, unknown>;
+export declare function parseScimFilter(filter: string, mapAttr: (scimAttr: string) => string | undefined): Record<string, unknown>;
 /** Pass-through mapper for resources that already use SCIM attribute names. */
-declare const IDENTITY_MAP: (a: string) => string;
+export declare const IDENTITY_MAP: (a: string) => string;
 //#endregion
 //#region src/scim/patch.d.ts
 /**
@@ -248,17 +248,17 @@ interface ScimUpdate {
   /** Field unset (remove without filter). */
   $unset: Record<string, true>;
 }
-declare function parseScimPatch(req: ScimPatchRequest): ScimUpdate;
+export declare function parseScimPatch(req: ScimPatchRequest): ScimUpdate;
 /**
  * Flatten a {@link ScimUpdate} into a plain `{ field: value }` object suitable
  * for arc resource `PATCH` handlers that expect a partial document. Drops
  * `$push` / `$pull` / `$unset` semantics — use {@link parseScimPatch} directly
  * when the host needs the full op stream (e.g. to issue array mutations).
  */
-declare function scimUpdateToFlatPatch(update: ScimUpdate): Record<string, unknown>;
+export declare function scimUpdateToFlatPatch(update: ScimUpdate): Record<string, unknown>;
 //#endregion
 //#region src/scim/index.d.ts
 declare const scimPlugin: FastifyPluginAsync<ScimPluginOptions>;
 declare const _default: FastifyPluginAsync<ScimPluginOptions>;
 //#endregion
-export { DEFAULT_GROUP_MAPPING, DEFAULT_USER_MAPPING, type FilterNode, IDENTITY_MAP, SCIM_ENTERPRISE_USER_SCHEMA, SCIM_GROUP_SCHEMA, SCIM_USER_SCHEMA, ScimError, type ScimObservedEvent, type ScimPatchRequest, type ScimPluginOptions, type ScimResourceBinding, type ScimResourceMapping, type ScimType, type ScimUpdate, _default as default, parseScimFilter, parseScimPatch, resourceToScim, scimPlugin, scimToResource, scimUpdateToFlatPatch };
+export { type FilterNode, type ScimObservedEvent, type ScimPatchRequest, type ScimPluginOptions, type ScimResourceBinding, type ScimResourceMapping, type ScimType, type ScimUpdate, _default as default, scimPlugin };

package/dist/scim/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as parseJsonBody } from "../jsonBody-B4YVGcql.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as parseJsonBody } from "../jsonBody-YIq-vGLv.mjs";
 import fp from "fastify-plugin";
 //#region src/scim/errors.ts
 var ScimError = class extends Error {

package/dist/scope/index.d.mts

@@ -11,7 +11,7 @@ interface TenantKeyGeneratorOptions {
   /** Custom strategy — overrides default scope-based logic */
   strategy?: (ctx: RateLimitKeyContext) => string;
 }
-declare function createTenantKeyGenerator(opts?: TenantKeyGeneratorOptions): (ctx: RateLimitKeyContext) => string;
+export declare function createTenantKeyGenerator(opts?: TenantKeyGeneratorOptions): (ctx: RateLimitKeyContext) => string;
 //#endregion
 //#region src/scope/resolveOrgFromHeader.d.ts
 interface ResolveOrgFromHeaderOptions {
@@ -28,6 +28,6 @@ interface ResolveOrgFromHeaderOptions {
  * If the header is present and user is a member, sets `request.scope` to `member`.
  * If the header is absent, scope stays as-is (typically `authenticated`).
  */
-declare function resolveOrgFromHeader(options: ResolveOrgFromHeaderOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+export declare function resolveOrgFromHeader(options: ResolveOrgFromHeaderOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
 //#endregion
-export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, createTenantKeyGenerator, _default as elevationPlugin, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };
+export { AUTHENTICATED_SCOPE, type ElevationEvent, type ElevationOptions, type Mandate, PUBLIC_SCOPE, type RateLimitKeyContext, type RequestScope, type ResolveOrgFromHeaderOptions, type ScopeFirstCtx, type ScopeFirstCtxOptions, type ScopeFirstCtxRequest, type TenantKeyGeneratorOptions, _default as elevationPlugin, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, scopeFirstCtx };

package/dist/scope/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-Bk9NOgOC.mjs";
-import { t as createTenantKeyGenerator } from "../rateLimitKey-C4O-kPm0.mjs";
-import { t as elevation_default } from "../elevation-DG8SrLN-.mjs";
-import { t as resolveOrgFromHeader } from "../scope-DQthe88b.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { C as isService, D as requireUserId, E as requireTeamId, O as scopeFirstCtx, S as isOrgInScope, T as requireOrgId, _ as getUserRoles, a as getDPoPJkt, b as isElevated, c as getOrgId, d as getScopeContext, f as getScopeContextMap, g as getUserId, h as getTenantFromRequest, i as getClientId, l as getOrgRoles, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, r as getAncestorOrgIds, s as getOrgContext, t as AUTHENTICATED_SCOPE, u as getRequestScope, v as hasOrgAccess, w as requireClientId, x as isMember, y as isAuthenticated } from "../types-fvO6Ovzx.mjs";
+import { t as createTenantKeyGenerator } from "../rateLimitKey-DVEZ_UpV.mjs";
+import { t as elevation_default } from "../elevation-BG4gnMsJ.mjs";
+import { t as resolveOrgFromHeader } from "../scope-DINaj7Ax.mjs";
 export { AUTHENTICATED_SCOPE, PUBLIC_SCOPE, createTenantKeyGenerator, elevation_default as elevationPlugin, getAncestorOrgIds, getClientId, getDPoPJkt, getMandate, getOrgContext, getOrgId, getOrgRoles, getRequestScope, getScopeContext, getScopeContextMap, getServiceScopes, getTeamId, getTenantFromRequest, getUserId, getUserRoles, hasOrgAccess, isAuthenticated, isElevated, isMember, isOrgInScope, isService, requireClientId, requireOrgId, requireTeamId, requireUserId, resolveOrgFromHeader, scopeFirstCtx };

package/dist/{scope-DQthe88b.mjs → scope-DINaj7Ax.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-CtrywMHP.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BbkIF6vA.mjs";
-import { n as getUserRoles } from "./userHelpers-aklawRaK.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, l as UnauthorizedError } from "./errors-CW4anJBy.mjs";
+import { n as requireSingleHeaderValue } from "./headers-DKZQKL-Z.mjs";
+import { n as getUserRoles } from "./userHelpers-C76zD5pa.mjs";
 //#region src/scope/resolveOrgFromHeader.ts
 /**
 * Create a preHandler hook that resolves org scope from a header.

package/dist/{shutdown-MqA81z_P.mjs → shutdown-LpLMH8T1.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/utils/shutdown.ts
 /** Stop admissions across every runtime before draining work and disposing domain engines. */

package/dist/{simpleEqualityMatcher-auW8QjXN.mjs → simpleEqualityMatcher-DbwIM1f1.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/utils/simpleEqualityMatcher.ts
 /**
 * `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality

package/dist/{sse-CYzQBVFe.mjs → sse-BzJFPX_1.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
-import { t as arcLog } from "./logger-DXjfIqjV.mjs";
-import { n as PUBLIC_SCOPE } from "./types-Bk9NOgOC.mjs";
-import { n as isEventVisible, t as eventAudienceOf } from "./tenancy--ed9eH_z.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-DjTQhZrN.mjs";
-import { t as openSseStream } from "./sseStream-B5_Afiqn.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
+import { t as arcLog } from "./logger-D4V1zGLI.mjs";
+import { n as PUBLIC_SCOPE } from "./types-fvO6Ovzx.mjs";
+import { n as isEventVisible, t as eventAudienceOf } from "./tenancy-DxV8OuX2.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-JzB5CAga.mjs";
+import { t as openSseStream } from "./sseStream-DQChzGTs.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/sse.ts
 var sse_exports = /* @__PURE__ */ __exportAll({

package/dist/{sseStream-B5_Afiqn.mjs → sseStream-DQChzGTs.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as forwardedStreamHeaders } from "./streaming-DjTQhZrN.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { n as forwardedStreamHeaders } from "./streaming-JzB5CAga.mjs";
 //#region src/utils/sseStream.ts
 /**
 * Take over the reply socket and open an SSE stream. Call ONLY after every

package/dist/{store-helpers-BOzk-CuX.mjs → store-helpers-Coj9RhOZ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/utils/store-helpers.ts
 /**
 * Classify an error thrown by `getOne` / `getById` / `update` as a

package/dist/{streaming-DjTQhZrN.mjs → streaming-JzB5CAga.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import { Readable } from "node:stream";
 //#region src/utils/streaming.ts
 /**

package/dist/{subscriberIdentity-CW39uA8G.mjs → subscriberIdentity-DeyppIif.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/events/subscriberIdentity.ts
 const SUBSCRIBER_ID = Symbol.for("@classytic/arc/subscriber-id");
 /** Assign a deployment-stable identity for durable per-handler progress; never use an index. */

package/dist/{tenancy--ed9eH_z.mjs → tenancy-DxV8OuX2.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { b as isElevated, c as getOrgId } from "./types-Bk9NOgOC.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { b as isElevated, c as getOrgId } from "./types-fvO6Ovzx.mjs";
 //#region src/core/tenancy.ts
 function eventAudienceOf(scope) {
 	const tenancy = resolveTenancy({ _scope: scope }, "organizationId");

package/dist/{tenantPreparation-BKon6Yox.mjs → tenantPreparation-CBvvAcAj.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
-import { d as createDomainError } from "./errors-CtrywMHP.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, v as hasOrgAccess } from "./types-Bk9NOgOC.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as conjoinPolicyFilters } from "./filter-merge-DGM-GQ1J.mjs";
+import { d as createDomainError } from "./errors-CW4anJBy.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, v as hasOrgAccess } from "./types-fvO6Ovzx.mjs";
 //#region src/permissions/tenantPreparation.ts
 /** Tenant preparation shared by HTTP middleware and direct transport invocation. */
 const PREPARATION = Symbol.for("arc.tenantPreparation");

package/dist/testing/cleanupStoreContract.d.mts

@@ -1,11 +1,10 @@
 
 import { D as CleanupRunStore } from "../types-DVLddu2q.mjs";
 //#region src/testing/cleanupStoreContract.d.ts
-interface CleanupRunStoreContractSetupResult {
+export interface CleanupRunStoreContractSetupResult {
   store: CleanupRunStore;
   teardown?: () => Promise<void>;
 }
-type CleanupRunStoreContractSetup = () => Promise<CleanupRunStoreContractSetupResult>;
-declare function runCleanupRunStoreContract(name: string, setup: CleanupRunStoreContractSetup): void;
-//#endregion
-export { CleanupRunStoreContractSetup, CleanupRunStoreContractSetupResult, runCleanupRunStoreContract };
+export type CleanupRunStoreContractSetup = () => Promise<CleanupRunStoreContractSetupResult>;
+export declare function runCleanupRunStoreContract(name: string, setup: CleanupRunStoreContractSetup): void;
+//#endregion

package/dist/testing/cleanupStoreContract.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 //#region src/testing/cleanupStoreContract.ts
 /**

package/dist/testing/index.d.mts

@@ -1,10 +1,10 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck, t as AnyRecord } from "../base-CZyixEQR.mjs";
-import { F as ResourceDefinition } from "../index-mqaqZNpe.mjs";
+import { F as ResourceDefinition } from "../index-WH7xgvxS.mjs";
 import { h as ModuleSetupContext, m as ModuleDisposer, o as ArcPorts, p as PortName, r as ArcModuleInput, u as ModuleName } from "../types-BJ-2XqVF.mjs";
-import "../index-JdbZAIsm.mjs";
-import { n as CreateAppOptions } from "../index-C8zVGYsk.mjs";
+import "../index-CUJvoyw3.mjs";
+import { n as CreateAppOptions } from "../index-BkV55WlV.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { StandardRepo } from "@classytic/repo-core/repository";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
@@ -72,11 +72,11 @@ interface ArcAssertion {
   /** Assert a specific key on `body.meta` or flattened top-level (matches sendControllerResponse flattening). */
   hasMeta(key: string, value?: unknown): ArcAssertion;
 }
-declare function expectArc(response: ArcResponseLike): ArcAssertion;
+export declare function expectArc(response: ArcResponseLike): ArcAssertion;
 //#endregion
 //#region src/testing/testActor.d.ts
 /** The header the testing harness uses to carry a request's actor. */
-declare const TEST_ACTOR_HEADER = "x-test-actor";
+export declare const TEST_ACTOR_HEADER = "x-test-actor";
 /**
  * What a test wants to be. An `organizationId` produces a `member` scope (the
  * org-scoped case); without one the actor is `authenticated`.
@@ -119,7 +119,7 @@ interface TestActor {
  *   headers: testActorHeaders('manager', ORG) });
  * ```
  */
-declare function testActorHeaders(actor: TestActor | string | null, organizationId?: string): Record<string, string>;
+export declare function testActorHeaders(actor: TestActor | string | null, organizationId?: string): Record<string, string>;
 /**
  * Turn a spec into a `RequestScope`.
  *
@@ -127,7 +127,7 @@ declare function testActorHeaders(actor: TestActor | string | null, organization
  * levels, and making the caller repeat itself only produces tests that pass a
  * global gate and mysteriously fail an org one.
  */
-declare function scopeFromTestActor(spec: TestActor): RequestScope;
+export declare function scopeFromTestActor(spec: TestActor): RequestScope;
 /**
  * Build the `auth` option that makes the test actor arc's authenticator.
  *
@@ -144,7 +144,7 @@ declare function scopeFromTestActor(spec: TestActor): RequestScope;
  * REJECTS rather than falling back to public — a test that meant to be an admin
  * and got quietly demoted is the most expensive way to fail.
  */
-declare function testActorAuth(defaultActor?: TestActor): {
+export declare function testActorAuth(defaultActor?: TestActor): {
   type: "authenticator";
   authenticate: (request: unknown) => Promise<void>;
 };
@@ -230,10 +230,10 @@ interface ModuleTestApp<TConn = unknown> {
  * Everything Mongo-specific about the harness lives HERE — the harness
  * itself is driver-blind and any kit can replace this via `database`.
  */
-declare function mongoMemoryDatabase(opts: {
+export declare function mongoMemoryDatabase(opts: {
   replset?: boolean;
 }): Promise<TestDatabase<unknown>>;
-declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
+export declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
 //#endregion
 //#region src/testing/assertModuleBootsAlone.d.ts
 interface ModuleBootsAloneOptions<TConn = unknown> extends BootModuleAppOptions<TConn> {
@@ -244,7 +244,7 @@ interface ModuleBootsAloneResult {
   /** The closure's modules (bridges excluded), in input order. */
   readonly closure: readonly string[];
 }
-declare function assertModuleBootsAlone<TConn = unknown>(modules: BootModulesInput<TConn>,
+export declare function assertModuleBootsAlone<TConn = unknown>(modules: BootModulesInput<TConn>,
 /** The module — or several roots booted together, when a deployment rule pairs them. */
 name: ModuleName | readonly ModuleName[], options?: ModuleBootsAloneOptions<TConn>): Promise<ModuleBootsAloneResult>;
 //#endregion
@@ -281,7 +281,7 @@ interface AuthorizationConformance {
  * Boot a one-resource app gated by `permission` on both list + an aggregation,
  * hit both surfaces anonymously, and report what arc enforced on each.
  */
-declare function runAuthorizationConformance(opts: {
+export declare function runAuthorizationConformance(opts: {
   /** The permission under test — applied to `list` and the aggregation alike. */
   permission: PermissionCheck;
   /** Rows the mock repo returns for list (aggregation returns a count). */
@@ -340,21 +340,21 @@ interface TestAuthProvider {
  * Accepts both `user` (payload to sign) and `token` (pre-signed) role configs,
  * so the same provider handles mixed flows in a single test.
  */
-declare function createJwtAuthProvider(app: FastifyInstance, opts?: {
+export declare function createJwtAuthProvider(app: FastifyInstance, opts?: {
   defaultOrgId?: string;
 }): TestAuthProvider;
 /**
  * Better Auth provider — uses pre-signed tokens (from signUp/signIn flows).
  * No signing: role configs MUST carry `token`. A `user` alone will throw.
  */
-declare function createBetterAuthProvider(opts?: {
+export declare function createBetterAuthProvider(opts?: {
   defaultOrgId?: string;
 }): TestAuthProvider;
 /**
  * Custom provider — plug in your own token minting logic. Useful for
  * mocked external issuers, session-cookie flows, or fixtures that pre-mint.
  */
-declare function createCustomAuthProvider(mintToken: (role: string, config: RoleConfig) => string, opts?: {
+export declare function createCustomAuthProvider(mintToken: (role: string, config: RoleConfig) => string, opts?: {
   defaultOrgId?: string;
 }): TestAuthProvider;
 //#endregion
@@ -487,13 +487,13 @@ interface SetupBetterAuthTestAppResult {
  * Auth endpoints occasionally emit empty 204 bodies (e.g. set-active) and
  * tests shouldn't crash on the parse.
  */
-declare function safeParseBody<T = unknown>(body: string | undefined): T | null;
+export declare function safeParseBody<T = unknown>(body: string | undefined): T | null;
 /**
  * Stateless Better Auth helpers. Each function takes the app as a positional
  * argument, so a single helper instance works across multiple test apps in
  * the same suite.
  */
-declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOptions): BetterAuthTestHelpers;
+export declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOptions): BetterAuthTestHelpers;
 /**
  * Composite setup for Better Auth apps. Replaces the pre-v2.11
  * `setupBetterAuthOrg` with a tighter contract:
@@ -513,7 +513,7 @@ declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOpti
  * creators are supplied (ambiguous ownership is a boot-time bug, not a
  * runtime one).
  */
-declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
+export declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
 //#endregion
 //#region src/testing/fixtures.d.ts
 type FixtureFactory<T extends object = AnyRecord> = (data: Partial<T>) => Promise<T>;
@@ -543,7 +543,7 @@ interface TestFixtures {
   /** Registered factory names. */
   readonly names: readonly string[];
 }
-declare function createTestFixtures(): TestFixtures;
+export declare function createTestFixtures(): TestFixtures;
 //#endregion
 //#region src/testing/HttpTestHarness.d.ts
 interface HttpTestHarnessOptions<T = unknown> {
@@ -563,7 +563,7 @@ interface HttpTestHarnessOptions<T = unknown> {
   apiPrefix?: string;
 }
 type OptionsOrGetter<T> = HttpTestHarnessOptions<T> | (() => HttpTestHarnessOptions<T>);
-declare class HttpTestHarness<T = unknown> {
+export declare class HttpTestHarness<T = unknown> {
   private resource;
   private optionsOrGetter;
   private enabledRoutes;
@@ -581,7 +581,7 @@ declare class HttpTestHarness<T = unknown> {
  * Create an HTTP test harness. `optionsOrGetter` may be a plain object
  * (for eager app setup) or a getter function (for async `beforeAll` apps).
  */
-declare function createHttpTestHarness<T = unknown>(resource: ResourceDefinition<unknown>, optionsOrGetter: HttpTestHarnessOptions<T> | (() => HttpTestHarnessOptions<T>)): HttpTestHarness<T>;
+export declare function createHttpTestHarness<T = unknown>(resource: ResourceDefinition<unknown>, optionsOrGetter: HttpTestHarnessOptions<T> | (() => HttpTestHarnessOptions<T>)): HttpTestHarness<T>;
 //#endregion
 //#region src/testing/mocks.d.ts
 /**
@@ -606,11 +606,11 @@ interface MockRepository<T> extends StandardRepo<T> {
  *
  * await mockRepo.getById('1'); // Returns mocked product
  */
-declare function createMockRepository<T extends object = AnyRecord>(overrides?: Partial<MockRepository<T>>): MockRepository<T>;
+export declare function createMockRepository<T extends object = AnyRecord>(overrides?: Partial<MockRepository<T>>): MockRepository<T>;
 /**
  * Create a mock user for authentication testing
  */
-declare function createMockUser(overrides?: Partial<AnyRecord>): {
+export declare function createMockUser(overrides?: Partial<AnyRecord>): {
   _id: string;
   id: string;
   email: string;
@@ -620,11 +620,11 @@ declare function createMockUser(overrides?: Partial<AnyRecord>): {
 /**
  * Create a mock Fastify request
  */
-declare function createMockRequest(overrides?: Partial<AnyRecord>): unknown;
+export declare function createMockRequest(overrides?: Partial<AnyRecord>): unknown;
 /**
  * Create a mock Fastify reply
  */
-declare function createMockReply(): unknown;
+export declare function createMockReply(): unknown;
 /**
  * Create a mock controller for testing.
  *
@@ -640,7 +640,7 @@ declare function createMockReply(): unknown;
  * arguments) while naming only `vitest`, which arc does declare. Same shape
  * `MockRepository` above uses.
  */
-declare function createMockController(repository: StandardRepo<AnyRecord>): {
+export declare function createMockController(repository: StandardRepo<AnyRecord>): {
   repository: StandardRepo<AnyRecord>;
   list: Mock;
   get: Mock;
@@ -661,7 +661,7 @@ declare function createMockController(repository: StandardRepo<AnyRecord>): {
  * const product = productFactory.build();
  * const products = productFactory.buildMany(10);
  */
-declare function createDataFactory<T extends AnyRecord>(template: Record<keyof T, (index: number) => unknown>): {
+export declare function createDataFactory<T extends AnyRecord>(template: Record<keyof T, (index: number) => unknown>): {
   build(overrides?: Partial<T>): T;
   buildMany(count: number, overrides?: Partial<T>): T[];
   reset(): void;
@@ -671,7 +671,7 @@ declare function createDataFactory<T extends AnyRecord>(template: Record<keyof T
  *
  * Useful for testing side effects without full mocking
  */
-declare function createSpy<T extends (...args: unknown[]) => unknown>(_name?: string): Mock<T> & {
+export declare function createSpy<T extends (...args: unknown[]) => unknown>(_name?: string): Mock<T> & {
   getCalls(): unknown[][];
   getLastCall(): unknown[];
 };
@@ -692,7 +692,7 @@ declare function createSpy<T extends (...args: unknown[]) => unknown>(_name?: st
  * @example
  * await waitFor(() => runs >= 3, { label: "3 scheduler ticks" });
  */
-declare function waitFor(condition: () => boolean | Promise<boolean>, options?: {
+export declare function waitFor(condition: () => boolean | Promise<boolean>, options?: {
   timeout?: number;
   interval?: number;
   label?: string;
@@ -700,7 +700,7 @@ declare function waitFor(condition: () => boolean | Promise<boolean>, options?:
 /**
  * Create a test timer that can be controlled
  */
-declare function createTestTimer(): {
+export declare function createTestTimer(): {
   now: () => number;
   advance: (ms: number) => void;
   set: (timestamp: number) => void;
@@ -727,7 +727,7 @@ interface TestModuleSetup {
    */
   dispose(): Promise<void>;
 }
-declare function createTestModuleSetup(options?: {
+export declare function createTestModuleSetup(options?: {
   /** The `context.ports` the phases see — supply what the module declares. */
   readonly ports?: ArcPorts;
 }): TestModuleSetup;
@@ -755,7 +755,7 @@ declare function createTestModuleSetup(options?: {
  * filters by tenant, so a gate that waves a tenant-less request through is how a
  * green test reads another org's rows.
  */
-declare function scopeRoleGate(...allowed: string[]): PermissionCheck;
+export declare function scopeRoleGate(...allowed: string[]): PermissionCheck;
 //#endregion
 //#region src/testing/testApp.d.ts
 type DbMode = "in-memory" | {
@@ -826,12 +826,12 @@ interface TestAppContext {
    */
   close(): Promise<void>;
 }
-declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppContext>;
+export declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppContext>;
 /**
  * Minimal Fastify instance — no arc plugins, no auth, no db. Use when a test
  * needs bare Fastify (e.g. plugin unit tests that manually register their
  * dependencies).
  */
-declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
+export declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleBootsAloneOptions, type ModuleBootsAloneResult, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, TEST_ACTOR_HEADER, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestModuleSetup, type TestkitContext, assertModuleBootsAlone, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type AuthorizationConformance, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, type HttpTestHarnessOptions, type MockRepository, type ModuleBootsAloneOptions, type ModuleBootsAloneResult, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type SurfaceObservation, type TestActor, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestModuleSetup, type TestkitContext, runStorageContract };

package/dist/testing/index.mjs

@@ -1,13 +1,14 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-Cu7Mx7_U.mjs";
-import { c as BaseController } from "../plugin-BccET1tL.mjs";
-import { g as getUserId } from "../types-Bk9NOgOC.mjs";
-import { t as defineAggregation } from "../defineAggregation-Bm8RjMbq.mjs";
-import { t as defineResource } from "../defineResource-DIC7JZGU.mjs";
-import { E as requireOrgRole } from "../permissions-Cm0uYHvd.mjs";
-import { h as asModulePorts, r as createApp } from "../createApp-D-953ZAq.mjs";
-import { d as resolveModule, l as isLazyBridge, o as resolveModuleClosure } from "../plan-FVR6LP59.mjs";
-import { n as getModuleExports } from "../module-BSvOQC7E.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { o as __toESM } from "../rolldown-runtime-MYrLNGnq.mjs";
+import { t as CRUD_OPERATIONS } from "../constants-B2QHb6u6.mjs";
+import { c as BaseController } from "../plugin-DALd9dcF.mjs";
+import { g as getUserId } from "../types-fvO6Ovzx.mjs";
+import { t as defineAggregation } from "../defineAggregation--3xguLkk.mjs";
+import { t as defineResource } from "../defineResource-gUp9ug66.mjs";
+import { E as requireOrgRole } from "../permissions-C5ijIz5Q.mjs";
+import { h as asModulePorts, r as createApp } from "../createApp-BGLYtErt.mjs";
+import { d as resolveModule, l as isLazyBridge, o as resolveModuleClosure } from "../plan-CJGMKoui.mjs";
+import { n as getModuleExports } from "../module--L0iBIZz.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -265,13 +266,13 @@ function testActorAuth(defaultActor) {
 async function mongoMemoryDatabase(opts) {
 	let mms;
 	try {
-		mms = await import("mongodb-memory-server");
+		mms = await import("../mongodb-memory-server-CHhYSq5y.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
 	} catch {
 		throw new Error("[arc-testing] bootModuleApp's default database is in-memory MongoDB — install 'mongodb-memory-server' + 'mongoose' as devDependencies, or inject your own `database` factory for a different store");
 	}
 	const server = opts.replset ? await mms.MongoMemoryReplSet.create({ replSet: { count: 1 } }) : await mms.MongoMemoryServer.create();
 	const uri = server.getUri();
-	const mongoose = (await import("mongoose")).default;
+	const mongoose = (await import("../mongoose-CYJCLyi-.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
 	if (mongoose.connection.readyState !== 0) await mongoose.disconnect();
 	await mongoose.connect(uri);
 	mongoose.connection.deleteModel(/.*/);
@@ -1547,7 +1548,7 @@ function scopeRoleGate(...allowed) {
 */
 async function startInMemoryMongo() {
 	try {
-		const { MongoMemoryServer } = await import("mongodb-memory-server");
+		const { MongoMemoryServer } = await import("../mongodb-memory-server-CHhYSq5y.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
 		const mongod = await MongoMemoryServer.create();
 		return {
 			uri: mongod.getUri(),
@@ -1561,7 +1562,7 @@ async function startInMemoryMongo() {
 }
 async function connectMongooseToUri(uri) {
 	try {
-		const mongoose = (await import("mongoose")).default;
+		const mongoose = (await import("../mongoose-CYJCLyi-.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1))).default;
 		await mongoose.connect(uri);
 		return { async disconnect() {
 			await mongoose.disconnect();
@@ -1578,7 +1579,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-D-953ZAq.mjs").then((n) => n.i);
+	const { createApp } = await import("../createApp-BGLYtErt.mjs").then((n) => n.i);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;

package/dist/testing/outboxStoreContract.d.mts

@@ -1,7 +1,7 @@
 
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/testing/outboxStoreContract.d.ts
-interface OutboxStoreContractSetupResult {
+export interface OutboxStoreContractSetupResult {
   store: OutboxStore;
   /** Called once after the suite. */
   teardown?: () => Promise<void>;
@@ -17,7 +17,6 @@ interface OutboxStoreContractSetupResult {
    */
   reset: () => Promise<void>;
 }
-type OutboxStoreContractSetup = () => Promise<OutboxStoreContractSetupResult>;
-declare function runOutboxStoreContract(name: string, setup: OutboxStoreContractSetup): void;
-//#endregion
-export { OutboxStoreContractSetup, OutboxStoreContractSetupResult, runOutboxStoreContract };
+export type OutboxStoreContractSetup = () => Promise<OutboxStoreContractSetupResult>;
+export declare function runOutboxStoreContract(name: string, setup: OutboxStoreContractSetup): void;
+//#endregion

package/dist/testing/outboxStoreContract.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as claimedAttempts } from "../claimed-B10RTfkM.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as claimedAttempts } from "../claimed-DYvQoZLv.mjs";
 import { OutboxConflictError, OutboxOwnershipError } from "@classytic/primitives/outbox";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 //#region src/testing/outboxStoreContract.ts

package/dist/testing/requiredPorts.d.mts

@@ -1,17 +1,16 @@
 
 import { r as ArcModuleInput } from "../types-BJ-2XqVF.mjs";
 //#region src/testing/requiredPorts.d.ts
-interface RequiredPortsOptions {
+export interface RequiredPortsOptions {
   /** Modules composed alongside — the peers the module `dependsOn` or `requires.modules`. */
   readonly with?: readonly ArcModuleInput[];
   /** Ports supplied in every case — the peers' own required ports. Never one under test. Values are never read. */
   readonly ports?: Readonly<Record<string, unknown>>;
 }
-interface RequiredPortsResult {
+export interface RequiredPortsResult {
   readonly module: string;
   /** The required ports, in declared order. */
   readonly ports: readonly string[];
 }
-declare function assertRequiresPorts(module: ArcModuleInput, ports: readonly string[], options?: RequiredPortsOptions): Promise<RequiredPortsResult>;
-//#endregion
-export { RequiredPortsOptions, RequiredPortsResult, assertRequiresPorts };
+export declare function assertRequiresPorts(module: ArcModuleInput, ports: readonly string[], options?: RequiredPortsOptions): Promise<RequiredPortsResult>;
+//#endregion