@classytic/arc 2.7.1 → 2.7.3

package/README.md

@@ -1,8 +1,8 @@
 # @classytic/arc
 
-Database-agnostic resource framework for Fastify. Define resources, get CRUD routes, permissions, presets, caching, events, and OpenAPI — without boilerplate.
+Database-agnostic resource framework for Fastify. Define resources, get CRUD routes, permissions, presets, caching, events, OpenAPI, and MCP tools — without boilerplate.
 
-**Requires:** Fastify 5+ | Node.js 22+ | ESM only
+**v2.7.3** | Fastify 5+ | Node.js 22+ | ESM only | 260+ test files, 3523+ tests
 
 ## Install
 
@@ -690,9 +690,21 @@ npx @classytic/arc doctor                                        # Health check
 | `@classytic/arc/integrations/websocket` | WebSocket |
 | `@classytic/arc/integrations/event-gateway` | Unified SSE + WebSocket gateway |
 | `@classytic/arc/integrations/streamline` | Workflow orchestration |
+| `@classytic/arc/mcp` | MCP tools for AI agents |
 | `@classytic/arc/docs` | OpenAPI generation |
 | `@classytic/arc/cli` | CLI commands (programmatic) |
 
+## v2.7.3 Highlights
+
+- **MCP Integration** — expose resources as AI agent tools (stateless by default, service scope, multi-tenancy)
+- **Reply Helpers** — `reply.ok()`, `reply.fail()`, `reply.paginated()`, `reply.stream()` (opt-in)
+- **Error Mappers** — class-based `instanceof` domain error → HTTP response mapping
+- **Multipart Body** — `multipartBody()` middleware for file upload in CRUD routes
+- **Service Scope** — `kind: "service"` RequestScope for machine-to-machine auth (MCP + WebSocket)
+- **BigInt Serialization** — `serializeBigInt: true` auto-converts BigInt → Number
+- **Event WAL** — skips internal `arc.*` events to prevent startup timeout with durable stores
+- **Security** — `auth: false` produces null `ctx.user` (prevents anonymous bypass of `!!ctx.user` guards)
+
 ## License
 
 MIT

package/dist/adapters/index.d.mts

@@ -1,3 +1,3 @@
-import { a as RelationMetadata, c as ValidationResult, i as FieldMetadata, o as RepositoryLike, r as DataAdapter, s as SchemaMetadata, t as AdapterFactory } from "../interface-Dwzqt4mn.mjs";
-import { a as PrismaQueryParserOptions, c as MongooseAdapterOptions, i as PrismaQueryParser, l as createMongooseAdapter, n as PrismaAdapterOptions, o as createPrismaAdapter, r as PrismaQueryOptions, s as MongooseAdapter, t as PrismaAdapter } from "../index-StgFaQKD.mjs";
+import { a as RelationMetadata, c as ValidationResult, i as FieldMetadata, o as RepositoryLike, r as DataAdapter, s as SchemaMetadata, t as AdapterFactory } from "../interface-B91alUzq.mjs";
+import { a as PrismaQueryParserOptions, c as MongooseAdapterOptions, i as PrismaQueryParser, l as createMongooseAdapter, n as PrismaAdapterOptions, o as createPrismaAdapter, r as PrismaQueryOptions, s as MongooseAdapter, t as PrismaAdapter } from "../index-C9eYNjGR.mjs";
 export { AdapterFactory, DataAdapter, FieldMetadata, MongooseAdapter, MongooseAdapterOptions, PrismaAdapter, PrismaAdapterOptions, PrismaQueryOptions, PrismaQueryParser, PrismaQueryParserOptions, RelationMetadata, RepositoryLike, SchemaMetadata, ValidationResult, createMongooseAdapter, createPrismaAdapter };

package/dist/audit/index.d.mts

@@ -1,4 +1,4 @@
-import { a as AuditContext, c as AuditStore, i as AuditAction, l as AuditStoreOptions, n as MongoAuditStoreOptions, o as AuditEntry, r as MongoConnection, s as AuditQueryOptions, u as createAuditEntry } from "../mongodb-DdyYlIXg.mjs";
+import { a as AuditContext, c as AuditStore, i as AuditAction, l as AuditStoreOptions, n as MongoAuditStoreOptions, o as AuditEntry, r as MongoConnection, s as AuditQueryOptions, u as createAuditEntry } from "../mongodb-Cgu9F1Nd.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/audit/auditPlugin.d.ts

package/dist/audit/index.mjs

@@ -1,4 +1,4 @@
-import { t as MongoAuditStore } from "../mongodb-mlgxkYI3.mjs";
+import { t as MongoAuditStore } from "../mongodb-B7X7P1P8.mjs";
 import fp from "fastify-plugin";
 //#region src/audit/stores/interface.ts
 /**

package/dist/audit/mongodb.d.mts

@@ -1,2 +1,2 @@
-import { n as MongoAuditStoreOptions, t as MongoAuditStore } from "../mongodb-DdyYlIXg.mjs";
+import { n as MongoAuditStoreOptions, t as MongoAuditStore } from "../mongodb-Cgu9F1Nd.mjs";
 export { MongoAuditStore, type MongoAuditStoreOptions };

package/dist/audit/mongodb.mjs

@@ -1,2 +1,2 @@
-import { t as MongoAuditStore } from "../mongodb-mlgxkYI3.mjs";
+import { t as MongoAuditStore } from "../mongodb-B7X7P1P8.mjs";
 export { MongoAuditStore };

package/dist/auth/index.d.mts

@@ -1,7 +1,7 @@
-import { g as AuthPluginOptions, h as AuthHelpers } from "../interface-Dwzqt4mn.mjs";
-import { t as PermissionCheck } from "../types-DPsC0taJ.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-Dg7OLsKo.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-IW4sbIea.mjs";
+import { g as AuthPluginOptions, h as AuthHelpers } from "../interface-B91alUzq.mjs";
+import { t as PermissionCheck } from "../types-B4BNthET.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-iba7jD3d.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-CEo9jwPI.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest as FastifyRequest$1 } from "fastify";
 
 //#region src/auth/authPlugin.d.ts

package/dist/auth/redis-session.d.mts

@@ -1,4 +1,4 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-IW4sbIea.mjs";
+import { i as SessionData, s as SessionStore } from "../sessionManager-CEo9jwPI.mjs";
 
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */

package/dist/cache/index.d.mts

@@ -1,5 +1,5 @@
-import { i as CacheStore, n as CacheSetOptions, r as CacheStats, t as CacheLogger } from "../interface-CnluRL4_.mjs";
-import { a as CacheEnvelope, c as QueryCache, i as queryCachePlugin, l as QueryCacheConfig, n as QueryCacheDefaults, o as CacheResult, r as QueryCachePluginOptions, s as CacheStatus, t as CrossResourceRule } from "../queryCachePlugin-Bw8XyJpX.mjs";
+import { i as CacheStore, n as CacheSetOptions, r as CacheStats, t as CacheLogger } from "../interface-CG7oRZjX.mjs";
+import { a as CacheEnvelope, c as QueryCache, i as queryCachePlugin, l as QueryCacheConfig, n as QueryCacheDefaults, o as CacheResult, r as QueryCachePluginOptions, s as CacheStatus, t as CrossResourceRule } from "../queryCachePlugin-Ckl71mkc.mjs";
 
 //#region src/cache/keys.d.ts
 /**

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,5 @@
 import { t as ResourceRegistry } from "../../ResourceRegistry-DsHiG9cL.mjs";
-import { t as buildOpenApiSpec } from "../../openapi-C5UhIeWu.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-BBSTVcMm.mjs";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/generate.mjs

@@ -1,4 +1,4 @@
-import { t as pluralize } from "../../pluralize-COpOVar8.mjs";
+import { t as pluralize } from "../../pluralize-Dckfq6US.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate.ts

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { At as AccessControl, Dt as QueryResolverConfig, Et as QueryResolver, Ht as defineResource, Ot as BodySanitizer, Tt as BaseControllerOptions, Vt as ResourceDefinition, jt as AccessControlConfig, kt as BodySanitizerConfig, wt as BaseController } from "../interface-Dwzqt4mn.mjs";
-import { A as MutationOperation, C as HOOK_PHASES, D as MAX_REGEX_LENGTH, E as MAX_FILTER_DEPTH, M as SYSTEM_FIELDS, O as MAX_SEARCH_LENGTH, S as HOOK_OPERATIONS, T as HookPhase, _ as DEFAULT_LIMIT, a as getControllerScope, b as DEFAULT_TENANT_FIELD, c as createCrudRouter, d as ActionRouterConfig, f as IdempotencyService, g as DEFAULT_ID_FIELD, h as CrudOperation, i as getControllerContext, j as RESERVED_QUERY_PARAMS, k as MUTATION_OPERATIONS, l as createPermissionMiddleware, m as CRUD_OPERATIONS, n as createFastifyHandler, o as sendControllerResponse, p as createActionRouter, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as ActionHandler, v as DEFAULT_MAX_LIMIT, w as HookOperation, x as DEFAULT_UPDATE_METHOD, y as DEFAULT_SORT } from "../index-KXM8_JmQ.mjs";
+import { At as AccessControl, Dt as QueryResolverConfig, Et as QueryResolver, Ht as defineResource, Ot as BodySanitizer, Tt as BaseControllerOptions, Vt as ResourceDefinition, jt as AccessControlConfig, kt as BodySanitizerConfig, wt as BaseController } from "../interface-B91alUzq.mjs";
+import { A as MutationOperation, C as HOOK_PHASES, D as MAX_REGEX_LENGTH, E as MAX_FILTER_DEPTH, M as SYSTEM_FIELDS, O as MAX_SEARCH_LENGTH, S as HOOK_OPERATIONS, T as HookPhase, _ as DEFAULT_LIMIT, a as getControllerScope, b as DEFAULT_TENANT_FIELD, c as createCrudRouter, d as ActionRouterConfig, f as IdempotencyService, g as DEFAULT_ID_FIELD, h as CrudOperation, i as getControllerContext, j as RESERVED_QUERY_PARAMS, k as MUTATION_OPERATIONS, l as createPermissionMiddleware, m as CRUD_OPERATIONS, n as createFastifyHandler, o as sendControllerResponse, p as createActionRouter, r as createRequestContext, s as defineResourceVariants, t as createCrudHandlers, u as ActionHandler, v as DEFAULT_MAX_LIMIT, w as HookOperation, x as DEFAULT_UPDATE_METHOD, y as DEFAULT_SORT } from "../index-BjShrzoj.mjs";
 export { AccessControl, AccessControlConfig, ActionHandler, ActionRouterConfig, BaseController, BaseControllerOptions, BodySanitizer, BodySanitizerConfig, CRUD_OPERATIONS, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, IdempotencyService, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, createActionRouter, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineResource, defineResourceVariants, getControllerContext, getControllerScope, sendControllerResponse };

package/dist/{createApp-B_nvKNAQ.mjs → createApp-D7e77m8C.mjs}

@@ -73,9 +73,8 @@ const productionPreset = {
 */
 function devLoggerConfig() {
 	try {
-		const req = eval("require") ?? null;
-		if (req?.resolve) {
-			req.resolve("pino-pretty");
+		if (typeof import.meta?.resolve === "function") {
+			import.meta.resolve("pino-pretty");
 			return {
 				level: "debug",
 				transport: {
@@ -208,7 +207,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-DsaNNXzZ.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-B6U_nCFU.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -261,7 +260,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-Bp3dabF1.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-6W0hjVS_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
@@ -273,7 +272,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-aUUVziBY.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-CdBbFefk.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -351,7 +350,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-DXUttWEO.mjs").then((n) => n.n);
+	const { errorHandlerPlugin } = await import("./errorHandler-CH8wk1eD.mjs").then((n) => n.n);
 	const errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	await fastify.register(errorHandlerPlugin, errorOpts);
 	trackPlugin("arc-error-handler", errorOpts);
@@ -720,6 +719,18 @@ async function createApp(options) {
 	await registerElevation(fastify, config, trackPlugin);
 	await registerErrorHandler(fastify, config, trackPlugin);
 	await registerResources(fastify, config);
+	if (config.replyHelpers) {
+		const { replyHelpersPlugin } = await import("./replyHelpers-uDUIYh7u.mjs").then((n) => n.n);
+		await fastify.register(replyHelpersPlugin);
+	}
+	if (config.serializeBigInt) fastify.addHook("preSerialization", async (_request, _reply, payload) => {
+		if (payload === null || payload === void 0) return payload;
+		try {
+			return JSON.parse(JSON.stringify(payload, (_key, value) => typeof value === "bigint" ? Number(value) : value));
+		} catch {
+			return payload;
+		}
+	});
 	const authMode = config.auth === false ? "none" : config.auth ? config.auth.type : "none";
 	fastify.log.info({
 		preset: config.preset ?? "custom",

package/dist/docs/index.d.mts

@@ -1,5 +1,5 @@
-import { et as RegistryEntry } from "../interface-Dwzqt4mn.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-Dg7OLsKo.mjs";
+import { et as RegistryEntry } from "../interface-B91alUzq.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-iba7jD3d.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/docs/openapi.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-ZUu_h0jp.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-C5UhIeWu.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BBSTVcMm.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/dynamic/index.d.mts

@@ -1,5 +1,5 @@
-import { Vt as ResourceDefinition, r as DataAdapter } from "../interface-Dwzqt4mn.mjs";
-import { t as PermissionCheck } from "../types-DPsC0taJ.mjs";
+import { Vt as ResourceDefinition, r as DataAdapter } from "../interface-B91alUzq.mjs";
+import { t as PermissionCheck } from "../types-B4BNthET.mjs";
 
 //#region src/dynamic/ArcDynamicLoader.d.ts
 interface ArcArchitectureSchema {

package/dist/{errorHandler-DXUttWEO.mjs → errorHandler-CH8wk1eD.mjs}

@@ -5,7 +5,7 @@ import fp from "fastify-plugin";
 var errorHandler_exports = /* @__PURE__ */ __exportAll({ errorHandlerPlugin: () => errorHandlerPlugin });
 async function errorHandlerPluginFn(fastify, options = {}) {
 	const isProduction = process.env.NODE_ENV === "production";
-	const { includeStack = !isProduction, onError, errorMap = {} } = options;
+	const { includeStack = !isProduction, onError, errorMap = {}, errorMappers = [] } = options;
 	fastify.setErrorHandler(async (error, request, reply) => {
 		if (onError) try {
 			await onError(error, request);
@@ -13,6 +13,21 @@ async function errorHandlerPluginFn(fastify, options = {}) {
 			request.log.error({ err: callbackError }, "Error in onError callback");
 		}
 		const requestId = request.id;
+		if (errorMappers.length > 0) {
+			for (const mapper of errorMappers) if (error instanceof mapper.type) {
+				const mapped = mapper.toResponse(error);
+				const response = {
+					success: false,
+					error: mapped.message ?? error.message,
+					code: mapped.code ?? "DOMAIN_ERROR",
+					timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+					...requestId && { requestId },
+					...mapped.details && { details: mapped.details },
+					...includeStack && error.stack ? { stack: error.stack } : {}
+				};
+				return reply.code(mapped.status).send(response);
+			}
+		}
 		const response = {
 			success: false,
 			error: error.message || "Internal Server Error",

package/dist/{errorHandler-COa51ho_.d.mts → errorHandler-pCpEtNd7.d.mts}

@@ -1,4 +1,4 @@
-import { t as DomainEvent } from "./EventTransport-CUpRK_Lg.mjs";
+import { t as DomainEvent } from "./EventTransport-C4VheKeC.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/plugins/caching.d.ts
@@ -115,6 +115,18 @@ declare const versioningPlugin: FastifyPluginAsync<VersioningOptions>;
 declare const _default: FastifyPluginAsync<VersioningOptions>;
 //#endregion
 //#region src/plugins/errorHandler.d.ts
+/** Class-based error mapper — maps thrown error instances to HTTP responses */
+interface ErrorMapper<T extends Error = Error> {
+  /** Error class to match (uses instanceof) */
+  type: new (...args: unknown[]) => T;
+  /** Convert the error to an HTTP response shape */
+  toResponse: (error: T) => {
+    status: number;
+    code?: string;
+    message?: string;
+    details?: Record<string, unknown>;
+  };
+}
 interface ErrorHandlerOptions {
   /**
    * Include stack trace in error responses (default: false in production)
@@ -125,13 +137,45 @@ interface ErrorHandlerOptions {
    */
   onError?: (error: Error, request: FastifyRequest) => void | Promise<void>;
   /**
-   * Map specific error types to custom responses
+   * Map specific error types to custom responses (by error.name string)
    */
   errorMap?: Record<string, {
     statusCode: number;
     code: string;
     message?: string;
   }>;
+  /**
+   * Class-based error mappers — checked via `instanceof`, highest priority.
+   *
+   * Register your domain error classes once; Arc auto-catches and maps them
+   * in every handler. Handlers just `throw` — no try/catch needed.
+   *
+   * @example
+   * ```typescript
+   * class AccountingError extends Error {
+   *   constructor(message: string, public status: number, public code: string) {
+   *     super(message);
+   *   }
+   * }
+   *
+   * const app = await createApp({
+   *   errorHandler: {
+   *     errorMappers: [
+   *       {
+   *         type: AccountingError,
+   *         toResponse: (err) => ({ status: err.status, code: err.code, message: err.message }),
+   *       },
+   *     ],
+   *   },
+   * });
+   *
+   * // Now handlers just throw:
+   * handler: async (req) => {
+   *   await ledger.post(id); // throws AccountingError → Arc maps to proper HTTP response
+   * }
+   * ```
+   */
+  errorMappers?: ErrorMapper[];
 }
 declare function errorHandlerPluginFn(fastify: FastifyInstance, options?: ErrorHandlerOptions): Promise<void>;
 declare const errorHandlerPlugin: typeof errorHandlerPluginFn;

package/dist/{eventPlugin-DsaNNXzZ.mjs → eventPlugin-B6U_nCFU.mjs}

@@ -165,9 +165,10 @@ const eventPlugin = async (fastify, opts = {}) => {
 				}
 			}
 			try {
-				if (wal) await wal.save(event);
+				const isInternalEvent = type.startsWith("arc.");
+				if (wal && !isInternalEvent) await wal.save(event);
 				await transport.publish(event);
-				if (wal?.acknowledge) await wal.acknowledge(event.meta.id);
+				if (wal?.acknowledge && !isInternalEvent) await wal.acknowledge(event.meta.id);
 				onPublish?.(event);
 			} catch (error) {
 				fastify.log?.error?.({

package/dist/{eventPlugin-BgLxJkIB.d.mts → eventPlugin-CdvUoUna.d.mts}

@@ -1,4 +1,4 @@
-import { i as EventTransport, n as EventHandler, r as EventLogger, t as DomainEvent } from "./EventTransport-CUpRK_Lg.mjs";
+import { i as EventTransport, n as EventHandler, r as EventLogger, t as DomainEvent } from "./EventTransport-C4VheKeC.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/events/defineEvent.d.ts

package/dist/events/index.d.mts

@@ -1,7 +1,7 @@
-import { a as MemoryEventTransport, i as EventTransport, n as EventHandler, o as MemoryEventTransportOptions, r as EventLogger, s as createEvent, t as DomainEvent } from "../EventTransport-CUpRK_Lg.mjs";
-import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-BgLxJkIB.mjs";
+import { a as MemoryEventTransport, i as EventTransport, n as EventHandler, o as MemoryEventTransportOptions, r as EventLogger, s as createEvent, t as DomainEvent } from "../EventTransport-C4VheKeC.mjs";
+import { a as withRetry, c as EventDefinitionOutput, d as EventSchema, f as ValidationResult, i as createDeadLetterPublisher, l as EventRegistry, m as defineEvent, n as eventPlugin, o as CustomValidator, p as createEventRegistry, r as RetryOptions, s as EventDefinitionInput, t as EventPluginOptions, u as EventRegistryOptions } from "../eventPlugin-CdvUoUna.mjs";
 import { RedisEventTransportOptions, RedisLike } from "./transports/redis.mjs";
-import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-We_Ucl9-.mjs";
+import { r as RedisStreamTransportOptions, t as RedisStreamLike } from "../redis-stream-Dag5LFa9.mjs";
 
 //#region src/events/eventTypes.d.ts
 /**

package/dist/events/index.mjs

@@ -1,4 +1,4 @@
-import { a as MemoryEventTransport, i as withRetry, o as createEvent, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-DsaNNXzZ.mjs";
+import { a as MemoryEventTransport, i as withRetry, o as createEvent, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-B6U_nCFU.mjs";
 //#region src/events/defineEvent.ts
 /**
 * defineEvent — Typed Event Definitions with Optional Schema Validation

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,2 +1,2 @@
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-We_Ucl9-.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-Dag5LFa9.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis.d.mts

@@ -1,4 +1,4 @@
-import { i as EventTransport, n as EventHandler, r as EventLogger, t as DomainEvent } from "../../EventTransport-CUpRK_Lg.mjs";
+import { i as EventTransport, n as EventHandler, r as EventLogger, t as DomainEvent } from "../../EventTransport-C4VheKeC.mjs";
 
 //#region src/events/transports/redis.d.ts
 interface RedisLike {

package/dist/factory/index.d.mts

@@ -1,4 +1,4 @@
-import { a as CustomPluginAuthOption, c as RawBodyOptions, d as ResourceLike, f as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as LoadResourcesOptions } from "../types-D0qf0Mf4.mjs";
+import { a as CustomPluginAuthOption, c as RawBodyOptions, d as ResourceLike, f as loadResources, i as CustomAuthenticatorOption, l as UnderPressureOptions, n as BetterAuthOption, o as JwtAuthOption, r as CreateAppOptions, s as MultipartOptions, t as AuthOption, u as LoadResourcesOptions } from "../types-2FlNl0mL.mjs";
 import { FastifyInstance } from "fastify";
 
 //#region src/factory/createApp.d.ts

package/dist/factory/index.mjs

@@ -1,4 +1,4 @@
-import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-B_nvKNAQ.mjs";
+import { a as edgePreset, c as testingPreset, i as developmentPreset, n as createApp, o as getPreset, s as productionPreset, t as ArcFactory } from "../createApp-D7e77m8C.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { _n as defineHook, an as HookOperation, cn as HookSystem, dn as afterDelete, fn as afterUpdate, gn as createHookSystem, hn as beforeUpdate, in as HookHandler, ln as HookSystemOptions, mn as beforeDelete, nn as DefineHookOptions, on as HookPhase, pn as beforeCreate, rn as HookContext, sn as HookRegistration, un as afterCreate } from "../interface-Dwzqt4mn.mjs";
+import { _n as defineHook, an as HookOperation, cn as HookSystem, dn as afterDelete, fn as afterUpdate, gn as createHookSystem, hn as beforeUpdate, in as HookHandler, ln as HookSystemOptions, mn as beforeDelete, nn as DefineHookOptions, on as HookPhase, pn as beforeCreate, rn as HookContext, sn as HookRegistration, un as afterCreate } from "../interface-B91alUzq.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -1,6 +1,6 @@
-import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-B9rHWPxD.mjs";
-import { n as MongoIdempotencyStoreOptions } from "../mongodb-Bq90j-Uj.mjs";
-import { r as RedisIdempotencyStoreOptions, t as RedisClient } from "../redis-CyCntzTO.mjs";
+import { i as createIdempotencyResult, n as IdempotencyResult, r as IdempotencyStore, t as IdempotencyLock } from "../interface-CSbZdv_3.mjs";
+import { n as MongoIdempotencyStoreOptions } from "../mongodb-B7zupyck.mjs";
+import { r as RedisIdempotencyStoreOptions, t as RedisClient } from "../redis-3TQxm2VZ.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/idempotency/idempotencyPlugin.d.ts

package/dist/idempotency/mongodb.d.mts

@@ -1,2 +1,2 @@
-import { n as MongoIdempotencyStoreOptions, t as MongoIdempotencyStore } from "../mongodb-Bq90j-Uj.mjs";
+import { n as MongoIdempotencyStoreOptions, t as MongoIdempotencyStore } from "../mongodb-B7zupyck.mjs";
 export { MongoIdempotencyStore, type MongoIdempotencyStoreOptions };

package/dist/idempotency/redis.d.mts

@@ -1,2 +1,2 @@
-import { n as RedisIdempotencyStore, r as RedisIdempotencyStoreOptions, t as RedisClient } from "../redis-CyCntzTO.mjs";
+import { n as RedisIdempotencyStore, r as RedisIdempotencyStoreOptions, t as RedisClient } from "../redis-3TQxm2VZ.mjs";
 export { type RedisClient, RedisIdempotencyStore, type RedisIdempotencyStoreOptions };

package/dist/{index-BYpRGXif.d.mts → index-B0extFr4.d.mts}

@@ -1,6 +1,6 @@
-import { r as RequestScope } from "./types-CNEbix8T.mjs";
-import { n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-DPsC0taJ.mjs";
-import { i as CacheStore, t as CacheLogger } from "./interface-CnluRL4_.mjs";
+import { r as RequestScope } from "./types--D3vvfdt.mjs";
+import { n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-B4BNthET.mjs";
+import { i as CacheStore, t as CacheLogger } from "./interface-CG7oRZjX.mjs";
 import { FastifyRequest } from "fastify";
 
 //#region src/permissions/applyPermissionResult.d.ts

package/dist/{index-KXM8_JmQ.d.mts → index-BjShrzoj.d.mts}

@@ -1,6 +1,6 @@
-import { r as RequestScope } from "./types-CNEbix8T.mjs";
-import { C as CrudRouterOptions, Ft as IController, It as IControllerResponse, Lt as IRequestContext, Vt as ResourceDefinition, it as RequestWithExtras, k as FastifyWithDecorators, nt as RequestContext, ot as ResourceConfig, u as AnyRecord, x as CrudController } from "./interface-Dwzqt4mn.mjs";
-import { t as PermissionCheck } from "./types-DPsC0taJ.mjs";
+import { r as RequestScope } from "./types--D3vvfdt.mjs";
+import { C as CrudRouterOptions, Ft as IController, It as IControllerResponse, Lt as IRequestContext, Vt as ResourceDefinition, it as RequestWithExtras, k as FastifyWithDecorators, nt as RequestContext, ot as ResourceConfig, u as AnyRecord, x as CrudController } from "./interface-B91alUzq.mjs";
+import { t as PermissionCheck } from "./types-B4BNthET.mjs";
 import { FastifyInstance, FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
 
 //#region src/constants.d.ts

package/dist/{index-StgFaQKD.d.mts → index-C9eYNjGR.d.mts}

@@ -1,4 +1,4 @@
-import { G as OpenApiSchemas, Q as QueryParserInterface, Ut as CrudRepository, c as ValidationResult, ft as RouteSchemaOptions, n as AdapterSchemaContext, o as RepositoryLike, q as ParsedQuery, r as DataAdapter, s as SchemaMetadata } from "./interface-Dwzqt4mn.mjs";
+import { G as OpenApiSchemas, Q as QueryParserInterface, Ut as CrudRepository, c as ValidationResult, ft as RouteSchemaOptions, n as AdapterSchemaContext, o as RepositoryLike, q as ParsedQuery, r as DataAdapter, s as SchemaMetadata } from "./interface-B91alUzq.mjs";
 import { Model } from "mongoose";
 
 //#region src/adapters/mongoose.d.ts

package/dist/index.d.mts

@@ -1,11 +1,12 @@
-import { $ as RateLimitConfig, $t as PipelineContext, A as FieldRule, C as CrudRouterOptions, D as FastifyRequestExtras, F as InferDocType, Ft as IController, Gt as PaginatedResult, H as MiddlewareConfig, Ht as defineResource, I as InferResourceDoc, It as IControllerResponse, Jt as Guard, K as OwnershipCheck, L as IntrospectionData, Lt as IRequestContext, M as HealthCheck, N as HealthOptions, Nt as ControllerLike, O as FastifyWithAuth, P as InferAdapterDoc, Qt as PipelineConfig, R as IntrospectionPluginOptions, Rt as RouteHandler, S as CrudRouteKey, St as envelope, T as EventDefinition, Tt as BaseControllerOptions, U as MiddlewareHandler, Ut as CrudRepository, Vt as ResourceDefinition, Xt as NextFunction, Y as PresetFunction, Yt as Interceptor, Z as PresetResult, Zt as OperationFilter, _t as TypedResourceConfig, a as RelationMetadata, bt as ValidateOptions, c as ValidationResult, d as ApiResponse, dt as RouteHandlerMethod, en as PipelineStep, et as RegistryEntry, ft as RouteSchemaOptions, g as AuthPluginOptions, gt as TypedRepository, ht as TypedController, i as FieldMetadata, it as RequestWithExtras, j as GracefulShutdownOptions, k as FastifyWithDecorators, l as AdditionalRoute, lt as ResourceMetadata, m as ArcRequest, nt as RequestContext, o as RepositoryLike, ot as ResourceConfig, p as ArcInternalMetadata, pt as ServiceContext, qt as QueryOptions, r as DataAdapter, rt as RequestIdOptions, s as SchemaMetadata, tn as Transform, tt as RegistryStats, u as AnyRecord, w as CrudSchemas, wt as BaseController, x as CrudController, xt as ValidationResult$1, y as ConfigError, yt as UserOrganization, z as JWTPayload } from "./interface-Dwzqt4mn.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-CYuLMJPD.mjs";
-import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-DPsC0taJ.mjs";
-import { l as createMongooseAdapter, o as createPrismaAdapter, s as MongooseAdapter, t as PrismaAdapter } from "./index-StgFaQKD.mjs";
-import { A as MutationOperation, C as HOOK_PHASES, D as MAX_REGEX_LENGTH, E as MAX_FILTER_DEPTH, M as SYSTEM_FIELDS, O as MAX_SEARCH_LENGTH, S as HOOK_OPERATIONS, T as HookPhase, _ as DEFAULT_LIMIT, a as getControllerScope, b as DEFAULT_TENANT_FIELD, g as DEFAULT_ID_FIELD, h as CrudOperation, j as RESERVED_QUERY_PARAMS, k as MUTATION_OPERATIONS, m as CRUD_OPERATIONS, s as defineResourceVariants, v as DEFAULT_MAX_LIMIT, w as HookOperation, x as DEFAULT_UPDATE_METHOD, y as DEFAULT_SORT } from "./index-KXM8_JmQ.mjs";
-import { C as authenticated, D as publicRead, E as presets_d_exports, O as publicReadAdminWrite, S as adminOnly, T as ownerWithAdminBypass, _ as requireScopeContext, a as allOf, c as createDynamicPermissionMatrix, d as requireAuth, f as requireOrgInScope, g as requireRoles, h as requireOwnership, k as readOnly, l as createOrgPermissions, m as requireOrgRole, n as DynamicPermissionMatrix, o as allowPublic, p as requireOrgMembership, r as DynamicPermissionMatrixConfig, s as anyOf, u as denyAll, v as requireServiceScope, w as fullPublic, x as when, y as requireTeamMembership } from "./index-BYpRGXif.mjs";
-import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-CCSsMpXE.mjs";
+import { $ as RateLimitConfig, $t as PipelineContext, A as FieldRule, C as CrudRouterOptions, D as FastifyRequestExtras, F as InferDocType, Ft as IController, Gt as PaginatedResult, H as MiddlewareConfig, Ht as defineResource, I as InferResourceDoc, It as IControllerResponse, Jt as Guard, K as OwnershipCheck, L as IntrospectionData, Lt as IRequestContext, M as HealthCheck, N as HealthOptions, Nt as ControllerLike, O as FastifyWithAuth, P as InferAdapterDoc, Qt as PipelineConfig, R as IntrospectionPluginOptions, Rt as RouteHandler, S as CrudRouteKey, St as envelope, T as EventDefinition, Tt as BaseControllerOptions, U as MiddlewareHandler, Ut as CrudRepository, Vt as ResourceDefinition, Xt as NextFunction, Y as PresetFunction, Yt as Interceptor, Z as PresetResult, Zt as OperationFilter, _t as TypedResourceConfig, a as RelationMetadata, bt as ValidateOptions, c as ValidationResult, d as ApiResponse, dt as RouteHandlerMethod, en as PipelineStep, et as RegistryEntry, ft as RouteSchemaOptions, g as AuthPluginOptions, gt as TypedRepository, ht as TypedController, i as FieldMetadata, it as RequestWithExtras, j as GracefulShutdownOptions, k as FastifyWithDecorators, l as AdditionalRoute, lt as ResourceMetadata, m as ArcRequest, nt as RequestContext, o as RepositoryLike, ot as ResourceConfig, p as ArcInternalMetadata, pt as ServiceContext, qt as QueryOptions, r as DataAdapter, rt as RequestIdOptions, s as SchemaMetadata, tn as Transform, tt as RegistryStats, u as AnyRecord, w as CrudSchemas, wt as BaseController, x as CrudController, xt as ValidationResult$1, y as ConfigError, yt as UserOrganization, z as JWTPayload } from "./interface-B91alUzq.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-D4nMDqnK.mjs";
+import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "./types-B4BNthET.mjs";
+import { l as createMongooseAdapter, o as createPrismaAdapter, s as MongooseAdapter, t as PrismaAdapter } from "./index-C9eYNjGR.mjs";
+import { A as MutationOperation, C as HOOK_PHASES, D as MAX_REGEX_LENGTH, E as MAX_FILTER_DEPTH, M as SYSTEM_FIELDS, O as MAX_SEARCH_LENGTH, S as HOOK_OPERATIONS, T as HookPhase, _ as DEFAULT_LIMIT, a as getControllerScope, b as DEFAULT_TENANT_FIELD, g as DEFAULT_ID_FIELD, h as CrudOperation, j as RESERVED_QUERY_PARAMS, k as MUTATION_OPERATIONS, m as CRUD_OPERATIONS, s as defineResourceVariants, v as DEFAULT_MAX_LIMIT, w as HookOperation, x as DEFAULT_UPDATE_METHOD, y as DEFAULT_SORT } from "./index-BjShrzoj.mjs";
+import { C as authenticated, D as publicRead, E as presets_d_exports, O as publicReadAdminWrite, S as adminOnly, T as ownerWithAdminBypass, _ as requireScopeContext, a as allOf, c as createDynamicPermissionMatrix, d as requireAuth, f as requireOrgInScope, g as requireRoles, h as requireOwnership, k as readOnly, l as createOrgPermissions, m as requireOrgRole, n as DynamicPermissionMatrix, o as allowPublic, p as requireOrgMembership, r as DynamicPermissionMatrixConfig, s as anyOf, u as denyAll, v as requireServiceScope, w as fullPublic, x as when, y as requireTeamMembership } from "./index-B0extFr4.mjs";
+import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BS6lZvWy.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 
 //#region src/context/requestContext.d.ts
 /**

package/dist/index.mjs

@@ -128,6 +128,6 @@ function transform(name, handlerOrOptions) {
 }
 //#endregion
 //#region src/index.ts
-const version = "2.7.1";
+const version = "2.7.3";
 //#endregion
 export { ArcError, BaseController, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MongooseAdapter, NotFoundError, PrismaAdapter, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, arcLog, assertValidConfig, authenticated, configureArcLogger, createDomainError, createDynamicPermissionMatrix, createMongooseAdapter, createOrgPermissions, createPrismaAdapter, defineResource, defineResourceVariants, denyAll, envelope, fields, formatValidationErrors, fullPublic, getControllerScope, guard, intercept, middleware, ownerWithAdminBypass, presets_exports as permissions, pipe, publicRead, publicReadAdminWrite, readOnly, requestContext, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, sortMiddlewares, transform, validateResourceConfig, version, when };

package/dist/integrations/event-gateway.d.mts

@@ -1,4 +1,4 @@
-import { t as DomainEvent } from "../EventTransport-CUpRK_Lg.mjs";
+import { t as DomainEvent } from "../EventTransport-C4VheKeC.mjs";
 import { WebSocketClient, WebSocketMessage } from "./websocket.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 

package/dist/integrations/event-gateway.mjs

@@ -4,7 +4,7 @@ const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-Bp3dabF1.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-6W0hjVS_.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
 import { WebSocketClient, WebSocketMessage, WebSocketPluginOptions } from "./websocket.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats } from "./jobs.mjs";
-import { c as McpResourceConfig, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler } from "../types-ClmkMDK1.mjs";
+import { c as McpResourceConfig, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler } from "../types-C5g2oRC7.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export { type BetterAuthHandler, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type EventGatewayOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobsPluginOptions, type McpAuthResult, type McpPluginOptions, type McpResourceConfig, type PromptDefinition, type QueueStats, type StreamlinePluginOptions, type ToolAnnotations, type ToolContext, type ToolDefinition, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, type WebhookDeliveryRecord, type WebhookManager, type WebhookPluginOptions, type WebhookStore, type WebhookSubscription, type WorkflowLike, type WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,5 +1,5 @@
-import { Vt as ResourceDefinition } from "../../interface-Dwzqt4mn.mjs";
-import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-ClmkMDK1.mjs";
+import { Vt as ResourceDefinition } from "../../interface-B91alUzq.mjs";
+import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-C5g2oRC7.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
 

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { n as fieldRulesToZod, r as createMcpServer, t as resourceToTools } from "../../resourceToTools-CkVSSzKg.mjs";
+import { n as fieldRulesToZod, r as createMcpServer, t as resourceToTools } from "../../resourceToTools-BJkoQoUP.mjs";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/integrations/mcp/definePrompt.ts
@@ -150,7 +150,7 @@ function isBetterAuth(auth) {
 * @param authCache - Optional short-lived cache to avoid redundant auth lookups
 */
 async function resolveMcpAuth(headers, auth, authCache) {
-	if (auth === false) return { userId: "anonymous" };
+	if (auth === false) return null;
 	const cacheKey = authCache ? extractAuthCacheKey(headers) : null;
 	if (cacheKey && authCache) {
 		const cached = authCache.get(cacheKey);
@@ -167,7 +167,9 @@ async function resolveMcpAuth(headers, auth, authCache) {
 		if (!session?.userId) result = null;
 		else result = {
 			userId: session.userId,
-			organizationId: session.activeOrganizationId
+			organizationId: session.activeOrganizationId,
+			...session.clientId ? { clientId: session.clientId } : {},
+			...session.scopes ? { scopes: session.scopes.split(" ") } : {}
 		};
 	} catch {
 		result = null;
@@ -494,10 +496,11 @@ function registerStatelessRoutes(fastify, prefix, options, createServer, Transpo
 	});
 }
 function registerStatefulRoutes(fastify, prefix, options, cache, createServer, Transport) {
-	/** Check if the requesting user owns the session */
+	/** Check if the requesting principal owns the session */
 	function isSessionOwner(entry, authResult) {
 		if (!options.auth || !entry.auth || !authResult) return true;
-		return entry.auth.userId === authResult.userId && entry.auth.organizationId === authResult.organizationId;
+		const prev = entry.auth;
+		return prev.userId === authResult.userId && prev.organizationId === authResult.organizationId && prev.clientId === authResult.clientId;
 	}
 	fastify.post(prefix, async (request, reply) => {
 		const authResult = await resolveMcpAuth(request.headers, options.auth ?? false);

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { o as McpAuthResult, s as McpPluginOptions } from "../../types-ClmkMDK1.mjs";
+import { o as McpAuthResult, s as McpPluginOptions } from "../../types-C5g2oRC7.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { r as createMcpServer, t as resourceToTools } from "../../resourceToTools-CkVSSzKg.mjs";
+import { r as createMcpServer, t as resourceToTools } from "../../resourceToTools-BJkoQoUP.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities