@classytic/arc 2.43.0 → 2.45.0

package/dist/integrations/jobs/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-DQYrkl5f.mjs";
-import { i as runAdmittedWork, r as registerShutdownParticipant } from "../../shutdown-MqA81z_P.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-BixzgirP.mjs";
+import { i as runAdmittedWork, r as registerShutdownParticipant } from "../../shutdown-BW8qwgpx.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.d.mts

@@ -1,11 +1,11 @@
 
 import { i as RequestScope } from "../../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck } from "../../base-CZyixEQR.mjs";
-import { Bn as ServerAccessor, F as ResourceDefinition, In as IControllerResponse, Ln as IRequestContext } from "../../index-mqaqZNpe.mjs";
+import { F as ResourceDefinition, Gn as ServerAccessor, Hn as IRequestContext, Vn as IControllerResponse } from "../../index-WH7xgvxS.mjs";
 import { n as FieldPermissionMap } from "../../fields-BBSpf8pS.mjs";
 import "../../resourceRateLimit-Wf6d6FL9.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions, v as ToolInputSchema } from "../../types-B4Aq4Sdj.mjs";
-import { i as resolveToolCollisions, n as McpServerInstance, r as createMcpServer, t as AuthRef } from "../../createMcpServer-C9cxS8zt.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions, v as ToolInputSchema } from "../../types-D3Ixsh00.mjs";
+import { i as resolveToolCollisions, n as McpServerInstance, r as createMcpServer, t as AuthRef } from "../../createMcpServer-DSztofa9.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -35,7 +35,7 @@ interface McpBridge {
   guard?: (ctx: ToolContext) => string | null;
 }
 /** Convert a McpBridge into a registered MCP tool. */
-declare function bridgeToMcp(bridge: McpBridge): ToolDefinition;
+export declare function bridgeToMcp(bridge: McpBridge): ToolDefinition;
 interface BuildMcpToolsFromBridgesOptions {
   /** If set, only bridges whose `name` is in this array are registered. */
   include?: string[];
@@ -55,7 +55,7 @@ interface BuildMcpToolsFromBridgesOptions {
  * extraTools: [...buildMcpToolsFromBridges(allBridges, { exclude: ['trigger_job'] })]
  * ```
  */
-declare function buildMcpToolsFromBridges(bridges: readonly McpBridge[], options?: BuildMcpToolsFromBridgesOptions): ToolDefinition[];
+export declare function buildMcpToolsFromBridges(bridges: readonly McpBridge[], options?: BuildMcpToolsFromBridgesOptions): ToolDefinition[];
 //#endregion
 //#region src/integrations/mcp/betterAuthApiKey.d.ts
 /** Minimal subset of Better Auth's API-key record the helper needs. */
@@ -96,7 +96,7 @@ interface CreateMcpAuthFromBetterAuthApiKeyOptions {
  * Build an {@link McpAuthResolver} that authenticates MCP requests against
  * Better Auth's API-key plugin. See module docstring for the rationale.
  */
-declare function createMcpAuthFromBetterAuthApiKey(auth: BetterAuthHandler, options?: CreateMcpAuthFromBetterAuthApiKeyOptions): McpAuthResolver;
+export declare function createMcpAuthFromBetterAuthApiKey(auth: BetterAuthHandler, options?: CreateMcpAuthFromBetterAuthApiKeyOptions): McpAuthResolver;
 //#endregion
 //#region src/integrations/mcp/buildRequestContext.d.ts
 type McpOperation = "list" | "get" | "create" | "update" | "delete" | "action";
@@ -147,7 +147,7 @@ interface McpContextExtras {
  * the session-derived scope is `public` (i.e. MCP called with `auth: false`).
  * An authenticated session scope is never overwritten.
  */
-declare function buildRequestContext(input: Record<string, unknown>, auth: McpAuthResult | null, operation: McpOperation, policyFilters?: Record<string, unknown>, scopeOverride?: RequestScope, extras?: McpContextExtras): IRequestContext;
+export declare function buildRequestContext(input: Record<string, unknown>, auth: McpAuthResult | null, operation: McpOperation, policyFilters?: Record<string, unknown>, scopeOverride?: RequestScope, extras?: McpContextExtras): IRequestContext;
 //#endregion
 //#region src/integrations/mcp/http-parity.d.ts
 type ToolAdmission = (session: McpAuthResult | null, scope?: RequestScope) => boolean | Promise<boolean>;
@@ -162,7 +162,7 @@ type ToolAdmission = (session: McpAuthResult | null, scope?: RequestScope) => bo
  * override can call this from their own override to keep the auto-derived
  * blurb intact and only append extra context.
  */
-declare function defaultCrudDescription(op: CrudOperation, displayName: string, softDelete: boolean, queryMeta?: {
+export declare function defaultCrudDescription(op: CrudOperation, displayName: string, softDelete: boolean, queryMeta?: {
   filterableFields?: readonly string[];
   allowedOperators?: readonly string[];
   sortableFields?: readonly string[];
@@ -174,7 +174,7 @@ declare function defaultCrudDescription(op: CrudOperation, displayName: string,
  *
  * Falls back to {@link defaultCrudDescription} when no override is set.
  */
-declare function resolveCrudDescription(override: CrudDescriptionOverride | undefined, meta: CrudDescriptionMeta): string;
+export declare function resolveCrudDescription(override: CrudDescriptionOverride | undefined, meta: CrudDescriptionMeta): string;
 //#endregion
 //#region src/integrations/mcp/definePrompt.d.ts
 /** definePrompt() config */
@@ -191,7 +191,7 @@ interface DefinePromptConfig<TArgs extends Record<string, z.ZodTypeAny>> {
  * @param name - Prompt name (snake_case recommended)
  * @param config - Description, args schema, handler
  */
-declare function definePrompt<TArgs extends Record<string, z.ZodTypeAny>>(name: string, config: DefinePromptConfig<TArgs>): PromptDefinition;
+export declare function definePrompt<TArgs extends Record<string, z.ZodTypeAny>>(name: string, config: DefinePromptConfig<TArgs>): PromptDefinition;
 //#endregion
 //#region src/integrations/mcp/defineTool.d.ts
 /**
@@ -218,7 +218,7 @@ interface DefineToolConfig<TInput extends Record<string, z.ZodTypeAny>, TSession
  * @param name - Tool name (snake_case recommended)
  * @param config - Tool description, input schema, annotations, handler
  */
-declare function defineTool<TInput extends Record<string, z.ZodTypeAny>, TSession = McpAuthResult>(name: string, config: DefineToolConfig<TInput, TSession>): ToolDefinition<TSession>;
+export declare function defineTool<TInput extends Record<string, z.ZodTypeAny>, TSession = McpAuthResult>(name: string, config: DefineToolConfig<TInput, TSession>): ToolDefinition<TSession>;
 //#endregion
 //#region src/integrations/mcp/fieldRulesToZod.d.ts
 interface FieldRulesToZodOptions {
@@ -267,21 +267,21 @@ interface FieldRuleEntry {
  *
  * @returns Flat shape `Record<string, z.ZodTypeAny>` — pass directly to defineTool() or registerTool()
  */
-declare function fieldRulesToZod(fieldRules: Record<string, FieldRuleEntry> | undefined, options?: FieldRulesToZodOptions): Record<string, z.ZodTypeAny>;
+export declare function fieldRulesToZod(fieldRules: Record<string, FieldRuleEntry> | undefined, options?: FieldRulesToZodOptions): Record<string, z.ZodTypeAny>;
 //#endregion
 //#region src/integrations/mcp/guards.d.ts
 /** Check if the tool context has an authenticated user (not anonymous/null) */
-declare function isAuthenticated(ctx: ToolContext): boolean;
+export declare function isAuthenticated(ctx: ToolContext): boolean;
 /** Check if the tool context has an organization scope */
-declare function hasOrg(ctx: ToolContext): boolean;
+export declare function hasOrg(ctx: ToolContext): boolean;
 /** Check if the tool context matches a specific org */
-declare function isOrg(ctx: ToolContext, orgId: string): boolean;
+export declare function isOrg(ctx: ToolContext, orgId: string): boolean;
 /** Get the current user ID from context (undefined if anonymous/null) */
-declare function getUserId(ctx: ToolContext): string | undefined;
+export declare function getUserId(ctx: ToolContext): string | undefined;
 /** Get the current org ID from context */
-declare function getOrgId(ctx: ToolContext): string | undefined;
+export declare function getOrgId(ctx: ToolContext): string | undefined;
 /** Create a denied (isError) CallToolResult */
-declare function denied(reason: string): CallToolResult;
+export declare function denied(reason: string): CallToolResult;
 /** Guard type — checks ToolContext, returns error message or null (pass) */
 type McpGuard = (ctx: ToolContext) => string | null | Promise<string | null>;
 /**
@@ -298,15 +298,15 @@ type McpGuard = (ctx: ToolContext) => string | null | Promise<string | null>;
  * });
  * ```
  */
-declare function guard(...args: [...McpGuard[], (input: Record<string, unknown>, ctx: ToolContext) => Promise<CallToolResult>]): (input: Record<string, unknown>, ctx: ToolContext) => Promise<CallToolResult>;
+export declare function guard(...args: [...McpGuard[], (input: Record<string, unknown>, ctx: ToolContext) => Promise<CallToolResult>]): (input: Record<string, unknown>, ctx: ToolContext) => Promise<CallToolResult>;
 /** Require authenticated user (not anonymous) */
-declare const requireAuth: McpGuard;
+export declare const requireAuth: McpGuard;
 /** Require organization context */
-declare const requireOrg: McpGuard;
+export declare const requireOrg: McpGuard;
 /** Require specific user role (checks session metadata if available) */
-declare function requireRole(...roles: string[]): McpGuard;
+export declare function requireRole(...roles: string[]): McpGuard;
 /** Require specific organization */
-declare function requireOrgId(orgId: string): McpGuard;
+export declare function requireOrgId(orgId: string): McpGuard;
 /**
  * Custom guard from a predicate function.
  *
@@ -318,7 +318,7 @@ declare function requireOrgId(orgId: string): McpGuard;
  * );
  * ```
  */
-declare function customGuard(check: (ctx: ToolContext) => boolean | Promise<boolean>, errorMessage: string): McpGuard;
+export declare function customGuard(check: (ctx: ToolContext) => boolean | Promise<boolean>, errorMessage: string): McpGuard;
 //#endregion
 //#region src/integrations/mcp/invokeController.d.ts
 /**
@@ -412,7 +412,7 @@ interface InvokeControllerOptions {
  * `McpAuthResult` the HTTP MCP plugin produces, so the same permission
  * checks compose.
  */
-declare function invokeController(controller: unknown, op: McpOperation, input: Record<string, unknown>, options: InvokeControllerOptions): Promise<CallToolResult>;
+export declare function invokeController(controller: unknown, op: McpOperation, input: Record<string, unknown>, options: InvokeControllerOptions): Promise<CallToolResult>;
 /**
  * Wrap an async function as a {@link ToolDefinition} handler — handles the
  * try/catch → canonical-error translation in one place so MCP tools that
@@ -440,7 +440,7 @@ declare function invokeController(controller: unknown, op: McpOperation, input:
  * });
  * ```
  */
-declare function mcpHandlerAdapter<TSession = McpAuthResult>(fn: (input: Record<string, unknown>, ctx: ToolContext<TSession>) => Promise<unknown>): ToolDefinition<TSession>["handler"];
+export declare function mcpHandlerAdapter<TSession = McpAuthResult>(fn: (input: Record<string, unknown>, ctx: ToolContext<TSession>) => Promise<unknown>): ToolDefinition<TSession>["handler"];
 //#endregion
 //#region src/integrations/mcp/sessionCache.d.ts
 declare class McpSessionCache {
@@ -526,11 +526,11 @@ interface ResourceFilterInputs {
  * Exported so `mcp/testing.ts` and external test harnesses can apply the
  * same precedence rules without duplicating them.
  */
-declare function filterResourcesForMcp<T extends {
+export declare function filterResourcesForMcp<T extends {
   name: string;
   mcp?: boolean;
 }>(resources: readonly T[], inputs: ResourceFilterInputs): T[];
-declare const mcpPlugin: FastifyPluginAsync<McpPluginOptions>;
+export declare const mcpPlugin: FastifyPluginAsync<McpPluginOptions>;
 //#endregion
 //#region src/integrations/mcp/realtimeBridge.d.ts
 /**
@@ -570,7 +570,7 @@ interface DispatchOptions<TSession = unknown> {
  * handler throw). The realtime client uses the `id` to correlate
  * responses to the original calls.
  */
-declare function dispatchRealtimeToolCall<TSession = unknown>(tools: readonly ToolDefinition[], calls: readonly RealtimeToolCall[], opts?: DispatchOptions<TSession>): Promise<RealtimeToolResponse[]>;
+export declare function dispatchRealtimeToolCall<TSession = unknown>(tools: readonly ToolDefinition[], calls: readonly RealtimeToolCall[], opts?: DispatchOptions<TSession>): Promise<RealtimeToolResponse[]>;
 //#endregion
 //#region src/integrations/mcp/resourceToTools.d.ts
 interface ResourceToToolsConfig extends McpResourceConfig {
@@ -598,14 +598,14 @@ interface ResourceToToolsConfig extends McpResourceConfig {
  * @param resource - Arc resource definition
  * @param config - Optional overrides (operations, descriptions, hideFields, prefix, names)
  */
-declare function resourceToTools(resource: ResourceDefinition, config?: ResourceToToolsConfig): ToolDefinition[];
+export declare function resourceToTools(resource: ResourceDefinition, config?: ResourceToToolsConfig): ToolDefinition[];
 //#endregion
 //#region src/integrations/mcp/route-input-schema.d.ts
 /**
  * The field shape a tool advertises — the flat record itself, or a whole object
  * schema's `.shape`. `undefined` for a union, which has no single shape.
  */
-declare function toolInputShape(schema: ToolInputSchema | undefined): Record<string, z.ZodTypeAny> | undefined;
+export declare function toolInputShape(schema: ToolInputSchema | undefined): Record<string, z.ZodTypeAny> | undefined;
 //#endregion
 //#region src/integrations/mcp/tool-helpers.d.ts
 /**
@@ -616,7 +616,7 @@ declare function toolInputShape(schema: ToolInputSchema | undefined): Record<str
  * Errors are not represented here — controllers throw `ArcError` and the
  * MCP tool wrapper catches them via {@link toCallToolError}.
  */
-declare function toCallToolResult(result: IControllerResponse): CallToolResult;
+export declare function toCallToolResult(result: IControllerResponse): CallToolResult;
 /**
  * Wrap a raw success payload as an MCP `CallToolResult`. Use when the
  * tool produced a value directly (action handler return, aggregation
@@ -626,7 +626,7 @@ declare function toCallToolResult(result: IControllerResponse): CallToolResult;
  * the HTTP wire follows. The `isError: true` flag on `CallToolResult`
  * is the success/error discriminant for MCP, mirroring HTTP status.
  */
-declare function toCallToolSuccess(value: unknown): CallToolResult;
+export declare function toCallToolSuccess(value: unknown): CallToolResult;
 /**
  * Wrap an error as an MCP `CallToolResult` with the canonical
  * `ErrorContract` shape inside the text payload. Single source of truth
@@ -640,7 +640,7 @@ declare function toCallToolSuccess(value: unknown): CallToolResult;
  *  - A partial contract `{code, message, status, details?}` → used as-is.
  *  - Any other `Error` → falls back to `arc.internal_error` 500.
  */
-declare function toCallToolError(input: Error | {
+export declare function toCallToolError(input: Error | {
   code: string;
   message: string;
   status?: number;
@@ -652,11 +652,11 @@ declare function toCallToolError(input: Error | {
  * 403 (session present, denied — "Permission denied"). Mirrors the
  * status split the HTTP `errorHandler` plugin uses.
  */
-declare function permissionDeniedResult(args: {
+export declare function permissionDeniedResult(args: {
   resource: string;
   operation: string;
   reason?: string;
   session: McpAuthResult | null;
 }): CallToolResult;
 //#endregion
-export { type AuthRef, type BetterAuthHandler, type BuildMcpToolsFromBridgesOptions, type CallToolResult, type CreateMcpAuthFromBetterAuthApiKeyOptions, type CreateMcpServerConfig, type CrudDescriptionMeta, type CrudDescriptionOverride, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type DispatchOptions, type FieldRuleEntry, type FieldRulesToZodOptions, type InvokeControllerOptions, type McpAuthResolver, type McpAuthResult, type McpBridge, type McpContextExtras, type McpGuard, type McpOperation, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type RealtimeToolCall, type RealtimeToolResponse, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, type ToolInputSchema, bridgeToMcp, buildMcpToolsFromBridges, buildRequestContext, createMcpAuthFromBetterAuthApiKey, createMcpServer, customGuard, defaultCrudDescription, definePrompt, defineTool, denied, dispatchRealtimeToolCall, fieldRulesToZod, filterResourcesForMcp, getOrgId, getUserId, guard, hasOrg, invokeController, isAuthenticated, isOrg, mcpHandlerAdapter, mcpPlugin, permissionDeniedResult, requireAuth, requireOrg, requireOrgId, requireRole, resolveCrudDescription, resolveToolCollisions, resourceToTools, toCallToolError, toCallToolResult, toCallToolSuccess, toolInputShape };
+export { type AuthRef, type BetterAuthHandler, type BuildMcpToolsFromBridgesOptions, type CallToolResult, type CreateMcpAuthFromBetterAuthApiKeyOptions, type CreateMcpServerConfig, type CrudDescriptionMeta, type CrudDescriptionOverride, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type DispatchOptions, type FieldRuleEntry, type FieldRulesToZodOptions, type InvokeControllerOptions, type McpAuthResolver, type McpAuthResult, type McpBridge, type McpContextExtras, type McpGuard, type McpOperation, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type RealtimeToolCall, type RealtimeToolResponse, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, type ToolInputSchema, createMcpServer, resolveToolCollisions };

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { _ as resolveToolCollisions, a as toolInputShape, c as resolveCrudDescription, d as permissionDeniedResult, f as toCallToolError, g as createMcpServer, h as buildRequestContext, i as isZodTypeSchema, l as invokeController, m as toCallToolSuccess, n as mcpPlugin, o as fieldRulesToZod, p as toCallToolResult, r as resourceToTools, s as defaultCrudDescription, t as filterResourcesForMcp, u as mcpHandlerAdapter } from "../../mcpPlugin-C08HalN5.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { _ as resolveToolCollisions, a as toolInputShape, c as resolveCrudDescription, d as permissionDeniedResult, f as toCallToolError, g as createMcpServer, h as buildRequestContext, i as isZodTypeSchema, l as invokeController, m as toCallToolSuccess, n as mcpPlugin, o as fieldRulesToZod, p as toCallToolResult, r as resourceToTools, s as defaultCrudDescription, t as filterResourcesForMcp, u as mcpHandlerAdapter } from "../../mcpPlugin-DP_UB0LK.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,10 +1,10 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-B4Aq4Sdj.mjs";
-import { n as McpServerInstance } from "../../createMcpServer-C9cxS8zt.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-D3Ixsh00.mjs";
+import { n as McpServerInstance } from "../../createMcpServer-DSztofa9.mjs";
 import { Client } from "@modelcontextprotocol/client";
 //#region src/integrations/mcp/testing.d.ts
 /** An MCP client bound to a live loopback server, plus its teardown. */
-interface ConnectedMcpTestClient {
+export interface ConnectedMcpTestClient {
   /** The connected SDK client — full `listTools` / `callTool` / `listPrompts` surface. */
   client: Client;
   /** Closes the client and the HTTP server. Always await it. */
@@ -20,8 +20,8 @@ interface ConnectedMcpTestClient {
  * One implementation, two entry points: this for a server you built, that for
  * one built from resources.
  */
-declare function connectMcpTestClient(server: McpServerInstance | unknown): Promise<ConnectedMcpTestClient>;
-interface TestMcpClientOptions {
+export declare function connectMcpTestClient(server: McpServerInstance | unknown): Promise<ConnectedMcpTestClient>;
+export interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */
   pluginOptions?: Pick<McpPluginOptions, "resources" | "overrides" | "expose" | "exclude" | "toolNamePrefix" | "extraTools" | "extraPrompts" | "instructions">;
   /** Auth identity for the test session */
@@ -29,7 +29,7 @@ interface TestMcpClientOptions {
   /** Server name (default: 'test-mcp') */
   serverName?: string;
 }
-interface TestMcpClient {
+export interface TestMcpClient {
   /** List all registered tools */
   listTools(): Promise<Array<{
     name: string;
@@ -68,6 +68,5 @@ interface TestMcpClient {
  * await client.close();
  * ```
  */
-declare function createTestMcpClient(options?: TestMcpClientOptions): Promise<TestMcpClient>;
-//#endregion
-export { ConnectedMcpTestClient, TestMcpClient, TestMcpClientOptions, connectMcpTestClient, createTestMcpClient };
+export declare function createTestMcpClient(options?: TestMcpClientOptions): Promise<TestMcpClient>;
+//#endregion

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { g as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-C08HalN5.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { g as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-DP_UB0LK.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * Serve an already-built `McpServer` on an ephemeral loopback port and connect

package/dist/integrations/streamline.d.mts

@@ -6,7 +6,7 @@ import { FastifyPluginAsync, FastifyRequest } from "fastify";
  * `bypassTenant` must come from auth context (`tenantResolver`), never the
  * request body.
  */
-interface WorkflowStartOptions {
+export interface WorkflowStartOptions {
   meta?: Record<string, unknown>;
   idempotencyKey?: string;
   priority?: number;
@@ -14,7 +14,7 @@ interface WorkflowStartOptions {
   bypassTenant?: boolean;
 }
 /** Minimal workflow interface — matches @classytic/streamline's createWorkflow() return */
-interface WorkflowLike {
+export interface WorkflowLike {
   definition: {
     id: string;
     name?: string;
@@ -78,7 +78,7 @@ interface WorkflowLike {
     dispose?: () => void;
   };
 }
-interface WorkflowRunLike {
+export interface WorkflowRunLike {
   _id: string;
   workflowId: string;
   status: string;
@@ -106,12 +106,12 @@ interface WorkflowRunLike {
  *   - `'VERSION_MISMATCH'` — engine deployed a step graph the run can't
  *     resume against; admin must rewind / migrate / cancel.
  */
-declare const STREAMLINE_FAILURE_CODES: {
+export declare const STREAMLINE_FAILURE_CODES: {
   readonly STALE_HEARTBEAT: "stale_heartbeat";
   readonly DEAD_LETTERED: "dead_lettered";
   readonly VERSION_MISMATCH: "VERSION_MISMATCH";
 };
-interface StreamlinePluginOptions {
+export interface StreamlinePluginOptions {
   /** Array of workflows created with createWorkflow() */
   workflows: WorkflowLike[];
   /** URL prefix for workflow endpoints (default: '/workflows') */
@@ -193,13 +193,13 @@ interface StreamlinePluginOptions {
  * to one the running version doesn't emit is a no-op. Pinned against
  * streamline's `ALL_WORKFLOW_EVENT_NAMES` by `tests/integrations/streamline-drift.test.ts`.
  */
-declare const STREAMLINE_BUS_EVENTS: readonly ["step:started", "step:completed", "step:failed", "step:waiting", "step:skipped", "step:retry-scheduled", "step:compensated", "workflow:started", "workflow:completed", "workflow:failed", "workflow:waiting", "workflow:resumed", "workflow:cancelled", "workflow:recovered", "workflow:retry", "workflow:compensating", "workflow:paused", "workflow:compensated", "workflow:compensation_failed", "engine:error", "scheduler:error", "scheduler:circuit-open"];
+export declare const STREAMLINE_BUS_EVENTS: readonly ["step:started", "step:completed", "step:failed", "step:waiting", "step:skipped", "step:retry-scheduled", "step:compensated", "workflow:started", "workflow:completed", "workflow:failed", "workflow:waiting", "workflow:resumed", "workflow:cancelled", "workflow:recovered", "workflow:retry", "workflow:compensating", "workflow:paused", "workflow:compensated", "workflow:compensation_failed", "engine:error", "scheduler:error", "scheduler:circuit-open"];
 /**
  * Non-durable `ctx.stream(frame)` frames (LLM tokens, progress). SSE ONLY —
  * excluded from `bridgeBusEvents` because high-frequency at-most-once UI
  * traffic would flood arc's event transport.
  */
-declare const STREAMLINE_STREAM_EVENTS: readonly ["step:stream"];
+export declare const STREAMLINE_STREAM_EVENTS: readonly ["step:stream"];
 /**
  * Workflow events that end a run and auto-close an SSE stream.
  *
@@ -207,22 +207,21 @@ declare const STREAMLINE_STREAM_EVENTS: readonly ["step:stream"];
  * emits `failed` THEN rolls back, so closing there would hide the rollback.
  * See {@link isStreamTerminal}.
  */
-declare const STREAMLINE_TERMINAL_EVENTS: readonly ["workflow:completed", "workflow:failed", "workflow:cancelled", "workflow:compensated", "workflow:compensation_failed"];
+export declare const STREAMLINE_TERMINAL_EVENTS: readonly ["workflow:completed", "workflow:failed", "workflow:cancelled", "workflow:compensated", "workflow:compensation_failed"];
 /**
  * Terminal run STATUSES (vs. the event names above). A run in one emits no
  * further events, so SSE sends its snapshot and closes. Pinned against
  * streamline's own list by `tests/integrations/streamline-drift.test.ts`.
  */
-declare const TERMINAL_RUN_STATUSES: Set<string>;
+export declare const TERMINAL_RUN_STATUSES: Set<string>;
 /**
  * Whether a run has ended, for the purpose of closing its stream — by event
  * name or by status. `failed` ends a run only when nothing will compensate it.
  */
-declare function isStreamTerminal(eventOrStatus: string, compensates: boolean, kind: "event" | "status"): boolean;
+export declare function isStreamTerminal(eventOrStatus: string, compensates: boolean, kind: "event" | "status"): boolean;
 /**
  * Streamline integration for Arc. Wrapped in `fastify-plugin` so `prefix` is
  * a plain option, not an encapsulation prefix (which would apply it twice).
  */
-declare const streamlinePlugin: FastifyPluginAsync<StreamlinePluginOptions>;
-//#endregion
-export { STREAMLINE_BUS_EVENTS, STREAMLINE_FAILURE_CODES, STREAMLINE_STREAM_EVENTS, STREAMLINE_TERMINAL_EVENTS, StreamlinePluginOptions, TERMINAL_RUN_STATUSES, WorkflowLike, WorkflowRunLike, WorkflowStartOptions, isStreamTerminal, streamlinePlugin };
+export declare const streamlinePlugin: FastifyPluginAsync<StreamlinePluginOptions>;
+//#endregion

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-CtrywMHP.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DjTQhZrN.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-C9G4A8cN.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-BLg1buwL.mjs";
 import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
@@ -436,10 +436,24 @@ const streamlinePluginImpl = async (fastify, options) => {
 	}
 	if (enableHookEndpoint) {
 		let resumeHookFn;
+		/**
+		* The container the token's run lives in. Streamline's DB-fallback resume writes through the DEFAULT
+		* connection's repository and strict-concurrency counter unless it is handed the run's container —
+		* wrong for a streamline bound to another connection. One distinct container is the common case;
+		* several are told apart by which one holds the run.
+		*/
+		const containerForRun = async (runId) => {
+			const containers = [...new Set([...registry.values()].map((wf) => wf.container).filter((c) => c !== void 0))];
+			if (containers.length <= 1) return containers[0];
+			for (const container of containers) try {
+				if (await container.repository?.getById?.(runId)) return container;
+			} catch {}
+		};
 		fastify.post(`${routeScope}/hooks/:token`, { preHandler: authPreHandler }, async (request, _reply) => {
 			if (!resumeHookFn) resumeHookFn = (await import("@classytic/streamline")).resumeHook;
 			const { token } = request.params;
-			const result = await resumeHookFn(token, request.body);
+			const container = await containerForRun(token.split(":")[0] ?? token);
+			const result = await resumeHookFn(token, request.body, container ? { container } : void 0);
 			return {
 				runId: result.runId,
 				run: result.run

package/dist/integrations/webhooks.d.mts

@@ -4,7 +4,7 @@ import { i as createOutboxModule, r as OutboxModuleOptions } from "../outbox-mod
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
-interface WebhookSubscription {
+export interface WebhookSubscription {
   /** Unique subscription ID */
   id: string;
   /** Delivery URL */
@@ -16,7 +16,7 @@ interface WebhookSubscription {
   /** Optional metadata */
   metadata?: Record<string, unknown>;
 }
-interface WebhookDeliveryRecord {
+export interface WebhookDeliveryRecord {
   subscriptionId: string;
   eventType: string;
   success: boolean;
@@ -27,13 +27,13 @@ interface WebhookDeliveryRecord {
   attempts?: number;
 }
 /** Pluggable persistence — memory for dev, bring your own DB for prod */
-interface WebhookStore {
+export interface WebhookStore {
   readonly name: string;
   getAll(): Promise<WebhookSubscription[]>;
   save(sub: WebhookSubscription): Promise<void>;
   remove(id: string): Promise<void>;
 }
-interface WebhookPluginOptions {
+export interface WebhookPluginOptions {
   /** Custom store for persistent subscriptions (default: in-memory) */
   store?: WebhookStore;
   /** Custom fetch (for testing) */
@@ -84,8 +84,8 @@ interface WebhookPluginOptions {
   };
 }
 /** `WebhookSubscription` as returned by `list()` — secret withheld. */
-type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
-interface WebhookManager {
+export type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
+export interface WebhookManager {
   register(sub: WebhookSubscription): Promise<void> | void;
   unregister(id: string): Promise<void> | void;
   /** Subscriptions WITHOUT secrets — safe for admin UIs / API responses. */
@@ -113,11 +113,11 @@ declare module "fastify" {
  *     `meta.id` — STABLE across retries of the same event, so dedup on it
  *     collapses redeliveries)
  */
-declare function signWebhook(body: string, secret: string, meta: {
+export declare function signWebhook(body: string, secret: string, meta: {
   timestamp: number;
   deliveryId: string;
 }): string;
-interface VerifyWebhookInput {
+export interface VerifyWebhookInput {
   /** Raw request body — the exact bytes the sender signed (`req.rawBody`). */
   body: string | Buffer;
   /** Shared secret. */
@@ -136,7 +136,7 @@ interface VerifyWebhookInput {
   /** Injectable clock for tests. @default Date.now */
   now?: () => number;
 }
-type VerifyWebhookResult = {
+export type VerifyWebhookResult = {
   valid: true;
   /** The AUTHENTICATED delivery id — dedup redeliveries on this. */
   deliveryId: string;
@@ -169,7 +169,7 @@ type VerifyWebhookResult = {
  * });
  * ```
  */
-declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
+export declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
 /**
  * Opt-in URL policy: requires HTTPS and rejects loopback, link-local,
  * private-network and cloud-metadata hosts. Pass as `validateUrl`.
@@ -177,9 +177,9 @@ declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
  * Validates the URL LITERAL only — no DNS resolution. Rebinding protection
  * belongs at the outbound network boundary (egress proxy / network policy).
  */
-declare function defaultWebhookUrlPolicy(url: URL): void;
+export declare function defaultWebhookUrlPolicy(url: URL): void;
 /** Options for `verifySignature` — customize for non-Arc webhook senders */
-interface VerifySignatureOptions {
+export interface VerifySignatureOptions {
   /**
    * Expected prefix before the hex digest (default: `'sha256='`).
    * Set to `''` for bare hex signatures.
@@ -213,13 +213,13 @@ interface VerifySignatureOptions {
  * });
  * ```
  */
-declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
+export declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
 declare const webhookPlugin: FastifyPluginAsync<WebhookPluginOptions>;
 declare const _default: FastifyPluginAsync<WebhookPluginOptions>;
 /** Event type carried by durable webhook delivery rows. */
-declare const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
+export declare const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
 /** Payload of a {@link WEBHOOK_DELIVERY_EVENT} row. */
-interface WebhookDeliveryPayload {
+export interface WebhookDeliveryPayload {
   subscriptionId: string;
   /** The original event, verbatim — what the receiver is signed and sent. */
   event: {
@@ -232,7 +232,7 @@ interface WebhookDeliveryPayload {
  * A failed webhook POST. `transient` (network, timeout, 429, 5xx) retries;
  * anything else (4xx, 3xx, URL-policy rejection, malformed row) dead-letters.
  */
-declare class WebhookDeliveryError extends Error {
+export declare class WebhookDeliveryError extends Error {
   readonly status?: number;
   readonly transient: boolean;
   constructor(message: string, options: {
@@ -241,7 +241,7 @@ declare class WebhookDeliveryError extends Error {
     cause?: unknown;
   });
 }
-interface WebhookDeliveryTransportOptions {
+export interface WebhookDeliveryTransportOptions {
   /**
    * Resolve a subscription (WITH secret) per attempt. `undefined` (unregistered)
    * acknowledges the delivery as moot.
@@ -267,8 +267,8 @@ interface WebhookDeliveryTransportOptions {
  * Same wire contract as inline dispatch: `x-arc-webhook-delivery` is the
  * ORIGINAL event's `meta.id`, stable across retries.
  */
-declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
-interface WebhookDeliveryPolicyOptions {
+export declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
+export interface WebhookDeliveryPolicyOptions {
   /** Total attempts before dead-lettering (default: 8). */
   maxAttempts?: number;
   /** First retry delay in ms (default: 5000). */
@@ -281,8 +281,8 @@ interface WebhookDeliveryPolicyOptions {
  * dead-letter immediately; others retry with exponential backoff until
  * `maxAttempts`.
  */
-declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
-interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
+export declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
+export interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
   /** Module name / `dependsOn` key. Default `'webhook-delivery'`. */
   name?: string;
   /** Retry/backoff tuning for the default failure policy. */
@@ -309,6 +309,6 @@ interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" |
  * delivering process must ALSO register `webhookPlugin` with the shared
  * subscription store (boot-checked).
  */
-declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
+export declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
 //#endregion
-export { DurableWebhookModuleOptions, VerifySignatureOptions, VerifyWebhookInput, VerifyWebhookResult, WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, WebhookDeliveryPayload, WebhookDeliveryPolicyOptions, WebhookDeliveryRecord, WebhookDeliveryTransportOptions, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WebhookSubscriptionPublic, createDurableWebhookModule, createWebhookDeliveryTransport, _default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };
+export { _default as default, webhookPlugin };

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-Bjgzl6tg.mjs";
+/*! @classytic/arc v2.45.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-C7gAbIxC.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-BVDiMwXb.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent, matchEventPattern } from "@classytic/primitives/events";

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -7,7 +7,7 @@ import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as Pus
  * `optional: true` in package.json; hosts who don't use this subpath
  * never need to install ioredis.
  */
-interface RedisLike {
+export interface RedisLike {
   get(key: string): Promise<string | null>;
   set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
   del(key: string): Promise<number>;
@@ -15,7 +15,7 @@ interface RedisLike {
   scan(cursor: string | number, matchKw: "MATCH", pattern: string, countKw: "COUNT", count: number): Promise<[string, string[]]>;
   eval(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
 }
-interface RedisPushRefStoreOptions {
+export interface RedisPushRefStoreOptions {
   /** Redis key namespace. Default `arc:pushref:`. */
   keyPrefix?: string;
   /**
@@ -25,7 +25,7 @@ interface RedisPushRefStoreOptions {
    */
   graceMs?: number;
 }
-declare class RedisPushRefStore implements PushRefStore {
+export declare class RedisPushRefStore implements PushRefStore {
   private redis;
   private prefix;
   private graceMs;
@@ -67,5 +67,4 @@ declare class RedisPushRefStore implements PushRefStore {
   gc(_now: number): Promise<number>;
   size(): Promise<number>;
 }
-//#endregion
-export { RedisLike, RedisPushRefStore, RedisPushRefStoreOptions };
+//#endregion