@classytic/arc 2.8.3 → 2.8.5

package/dist/integrations/jobs.d.mts

@@ -1,6 +1,19 @@
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/integrations/jobs.d.ts
+/** Repeat schedule — cron pattern or fixed interval. Explicit timezone is required. */
+interface JobRepeatOptions {
+  /** Cron pattern (e.g. '0 9 * * *' = every day 09:00). Mutually exclusive with `every`. */
+  pattern?: string;
+  /** Fixed interval in ms. Mutually exclusive with `pattern`. */
+  every?: number;
+  /** IANA timezone (e.g. 'UTC', 'America/New_York'). Required for `pattern` — prevents DST drift. */
+  tz?: string;
+  /** Stop repeating after this date. */
+  endDate?: Date | string | number;
+  /** Max total runs. */
+  limit?: number;
+}
 interface JobDefinition<TData = unknown, TResult = unknown> {
   /** Unique job name */
   name: string;
@@ -22,8 +35,10 @@ interface JobDefinition<TData = unknown, TResult = unknown> {
     max: number;
     duration: number;
   };
-  /** Dead letter queue name (default: '{name}:dead') */
+  /** Dead letter queue name (default: '{name}-dead') */
   deadLetterQueue?: string;
+  /** Repeat schedule — cron or interval. Requires explicit timezone for cron. */
+  repeat?: JobRepeatOptions;
 }
 interface JobMeta {
   jobId: string;
@@ -41,6 +56,8 @@ interface JobDispatchOptions {
   removeOnComplete?: boolean | number;
   /** Remove job after failure */
   removeOnFail?: boolean | number;
+  /** One-shot repeat override at dispatch time. Usually prefer `JobDefinition.repeat`. */
+  repeat?: JobRepeatOptions;
 }
 interface JobsPluginOptions {
   /** Redis connection options (passed to BullMQ) */
@@ -97,7 +114,12 @@ interface QueueStats {
  * });
  */
 declare function defineJob<TData = unknown, TResult = unknown>(definition: JobDefinition<TData, TResult>): JobDefinition<TData, TResult>;
-/** Pluggable BullMQ job queue integration for Arc */
+/**
+ * Pluggable BullMQ job queue integration for Arc.
+ *
+ * Wrapped with fastify-plugin so the `fastify.jobs` decorator is available
+ * in the outer scope (the documented `fastify.jobs.dispatch(...)` usage).
+ */
 declare const jobsPlugin: FastifyPluginAsync<JobsPluginOptions>;
 //#endregion
-export { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, QueueStats, defineJob, jobsPlugin };
+export { JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobRepeatOptions, JobsPluginOptions, QueueStats, defineJob, jobsPlugin };

package/dist/integrations/jobs.mjs

@@ -1,3 +1,4 @@
+import fp from "fastify-plugin";
 //#region src/integrations/jobs.ts
 /**
 * Define a background job with typed data and configuration.
@@ -26,16 +27,41 @@ const jobsPluginImpl = async (fastify, options) => {
 	} catch {
 		throw new Error("@classytic/arc/integrations/jobs requires \"bullmq\" package.\nInstall it: npm install bullmq");
 	}
+	if (connection && typeof connection === "object" && "options" in connection) {
+		if (connection.options?.maxRetriesPerRequest !== null) fastify.log.warn("[arc/jobs] BullMQ requires ioredis `maxRetriesPerRequest: null`. Pass `new Redis(url, { maxRetriesPerRequest: null, enableReadyCheck: false })` or workers will stall on transient Redis errors.");
+	}
 	const queues = /* @__PURE__ */ new Map();
 	const dlqQueues = /* @__PURE__ */ new Map();
 	const workers = /* @__PURE__ */ new Map();
+	for (const job of jobs) {
+		if (!job.repeat) continue;
+		const { pattern, every, tz } = job.repeat;
+		if (pattern && every) throw new Error(`[arc/jobs] Job '${job.name}' sets both repeat.pattern and repeat.every — use one.`);
+		if (!pattern && every == null) throw new Error(`[arc/jobs] Job '${job.name}' has repeat config but no pattern or every.`);
+		if (pattern && !tz) throw new Error(`[arc/jobs] Job '${job.name}' uses a cron pattern but no timezone. Set repeat.tz (e.g. 'UTC' or 'America/New_York') to avoid DST drift.`);
+	}
 	for (const job of jobs) {
 		const queueName = job.name;
 		const queue = new Queue(queueName, { connection });
 		queues.set(queueName, queue);
+		if (job.repeat) {
+			const repeatOpts = {
+				...job.repeat.pattern ? {
+					pattern: job.repeat.pattern,
+					tz: job.repeat.tz
+				} : { every: job.repeat.every },
+				...job.repeat.endDate ? { endDate: job.repeat.endDate } : {},
+				...job.repeat.limit != null ? { limit: job.repeat.limit } : {}
+			};
+			await queue.add(queueName, {}, {
+				repeat: repeatOpts,
+				removeOnComplete: defaults.removeOnComplete ?? 100,
+				removeOnFail: defaults.removeOnFail ?? 500
+			});
+		}
 		let dlqQueue = null;
 		if (job.deadLetterQueue != null) {
-			const dlqName = job.deadLetterQueue || `${queueName}:dead`;
+			const dlqName = job.deadLetterQueue || `${queueName}-dead`;
 			dlqQueue = new Queue(dlqName, { connection });
 			dlqQueues.set(dlqName, dlqQueue);
 		}
@@ -110,12 +136,35 @@ const jobsPluginImpl = async (fastify, options) => {
 				}, `Failed to publish job.${queueName}.failed event`);
 			}
 		});
+		worker.on("stalled", async (jobId) => {
+			fastify.log.warn({
+				jobId,
+				queue: queueName
+			}, "Job stalled — worker may have crashed");
+			if (bridgeEvents && fastify.events?.publish) try {
+				await fastify.events.publish(`job.${queueName}.stalled`, { jobId });
+			} catch (err) {
+				fastify.log.warn({
+					err,
+					jobId
+				}, `Failed to publish job.${queueName}.stalled event`);
+			}
+		});
 		workers.set(queueName, worker);
 	}
+	const JOB_PAYLOAD_WARN_BYTES = 100 * 1024;
 	const dispatcher = {
 		async dispatch(name, data, opts = {}) {
 			const queue = queues.get(name);
 			if (!queue) throw new Error(`Job queue '${name}' not registered. Available: ${Array.from(queues.keys()).join(", ")}`);
+			try {
+				const serializedBytes = Buffer.byteLength(JSON.stringify(data) ?? "", "utf8");
+				if (serializedBytes > JOB_PAYLOAD_WARN_BYTES) fastify.log.warn({
+					queue: name,
+					bytes: serializedBytes,
+					limit: JOB_PAYLOAD_WARN_BYTES
+				}, `[arc/jobs] Large job payload — prefer passing IDs and reloading in the handler`);
+			} catch {}
 			const jobDef = jobs.find((j) => j.name === name);
 			return { jobId: (await queue.add(name, data, {
 				delay: opts.delay,
@@ -127,7 +176,8 @@ const jobsPluginImpl = async (fastify, options) => {
 				backoff: jobDef?.backoff ?? defaults.backoff ?? {
 					type: "exponential",
 					delay: 1e3
-				}
+				},
+				repeat: jobDef?.repeat ?? opts.repeat
 			})).id };
 		},
 		getQueue(name) {
@@ -148,6 +198,7 @@ const jobsPluginImpl = async (fastify, options) => {
 			return stats;
 		},
 		async close() {
+			await Promise.all(Array.from(workers.values()).map((w) => w.pause().catch(() => {})));
 			const closePromises = [];
 			for (const worker of workers.values()) closePromises.push(worker.close());
 			for (const queue of queues.values()) closePromises.push(queue.close());
@@ -166,7 +217,15 @@ const jobsPluginImpl = async (fastify, options) => {
 		await dispatcher.close();
 	});
 };
-/** Pluggable BullMQ job queue integration for Arc */
-const jobsPlugin = jobsPluginImpl;
+/**
+* Pluggable BullMQ job queue integration for Arc.
+*
+* Wrapped with fastify-plugin so the `fastify.jobs` decorator is available
+* in the outer scope (the documented `fastify.jobs.dispatch(...)` usage).
+*/
+const jobsPlugin = fp(jobsPluginImpl, {
+	name: "arc-jobs",
+	fastify: "5.x"
+});
 //#endregion
 export { defineJob, jobsPlugin };

package/dist/integrations/mcp/index.d.mts

@@ -1,8 +1,56 @@
-import { qt as ResourceDefinition } from "../../interface-BVuMfeVv.mjs";
-import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-CcG4avic.mjs";
+import { qt as ResourceDefinition } from "../../interface-CMRutPfe.mjs";
+import { a as McpAuthResolver, c as McpResourceConfig, d as SessionEntry, f as ToolAnnotations, i as CrudOperation, l as PromptDefinition, m as ToolDefinition, n as CallToolResult, o as McpAuthResult, p as ToolContext, r as CreateMcpServerConfig, s as McpPluginOptions, t as BetterAuthHandler, u as PromptResult } from "../../types-BsbNMEDR.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
 
+//#region src/integrations/mcp/aiSdkBridge.d.ts
+/** Minimal AI SDK tool shape we need to invoke. */
+interface AiSdkExecutable {
+  execute: (input: unknown, options?: unknown) => Promise<unknown>;
+}
+interface McpBridge {
+  /** MCP tool name. */
+  name: string;
+  /** LLM-facing description. */
+  description: string;
+  /** Zod input schema — matches the AI SDK tool's inputSchema. */
+  inputSchema: Record<string, z.ZodType>;
+  /** MCP annotations — same shape as `defineTool`. */
+  annotations?: ToolAnnotations;
+  /**
+   * Build the AI SDK tool from MCP session context. Called per-request.
+   * The caller injects deps (companyId, projectId, etc.) from `ctx`.
+   */
+  buildTool: (ctx: ToolContext) => AiSdkExecutable;
+  /**
+   * Optional pre-execution guard. Return an error message to reject, or
+   * `null` to proceed. Runs after `isAuthenticated`.
+   */
+  guard?: (ctx: ToolContext) => string | null;
+}
+/** Convert a McpBridge into a registered MCP tool. */
+declare function bridgeToMcp(bridge: McpBridge): ToolDefinition;
+interface BuildMcpToolsFromBridgesOptions {
+  /** If set, only bridges whose `name` is in this array are registered. */
+  include?: string[];
+  /** If set, bridges whose `name` is in this array are skipped. */
+  exclude?: string[];
+}
+/**
+ * Take a list of McpBridge objects and produce a ready-to-register MCP tool
+ * array, with optional include/exclude filtering for per-environment config.
+ *
+ * @example
+ * ```typescript
+ * // All bridges
+ * extraTools: [...buildMcpToolsFromBridges(allBridges)]
+ *
+ * // Read-only deployment — hide destructive tools
+ * extraTools: [...buildMcpToolsFromBridges(allBridges, { exclude: ['trigger_job'] })]
+ * ```
+ */
+declare function buildMcpToolsFromBridges(bridges: readonly McpBridge[], options?: BuildMcpToolsFromBridgesOptions): ToolDefinition[];
+//#endregion
 //#region src/integrations/mcp/createMcpServer.d.ts
 /**
  * Mutable auth ref — updated per-request by mcpPlugin.
@@ -218,4 +266,4 @@ interface ResourceToToolsConfig extends McpResourceConfig {
  */
 declare function resourceToTools(resource: ResourceDefinition, config?: ResourceToToolsConfig): ToolDefinition[];
 //#endregion
-export { type AuthRef, type BetterAuthHandler, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type FieldRuleEntry, type FieldRulesToZodOptions, type McpAuthResolver, type McpAuthResult, type McpGuard, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, createMcpServer, customGuard, definePrompt, defineTool, denied, fieldRulesToZod, getOrgId, getUserId, guard, hasOrg, isAuthenticated, isOrg, mcpPlugin, requireAuth, requireOrg, requireOrgId, requireRole, resourceToTools };
+export { type AuthRef, type BetterAuthHandler, type BuildMcpToolsFromBridgesOptions, type CallToolResult, type CreateMcpServerConfig, type CrudOperation, type DefinePromptConfig, type DefineToolConfig, type FieldRuleEntry, type FieldRulesToZodOptions, type McpAuthResolver, type McpAuthResult, type McpBridge, type McpGuard, type McpPluginOptions, type McpResourceConfig, type McpServerInstance, type PromptDefinition, type PromptResult, type ResourceToToolsConfig, type ToolAnnotations, type ToolContext, type ToolDefinition, bridgeToMcp, buildMcpToolsFromBridges, createMcpServer, customGuard, definePrompt, defineTool, denied, fieldRulesToZod, getOrgId, getUserId, guard, hasOrg, isAuthenticated, isOrg, mcpPlugin, requireAuth, requireOrg, requireOrgId, requireRole, resourceToTools };

package/dist/integrations/mcp/index.mjs

@@ -1,23 +1,6 @@
-import { n as fieldRulesToZod, r as createMcpServer, t as resourceToTools } from "../../resourceToTools-O_HwWXFa.mjs";
+import { n as fieldRulesToZod, r as createMcpServer, t as resourceToTools } from "../../resourceToTools-8s-EsCCe.mjs";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
-//#region src/integrations/mcp/definePrompt.ts
-/**
-* Define a type-safe MCP prompt.
-*
-* @param name - Prompt name (snake_case recommended)
-* @param config - Description, args schema, handler
-*/
-function definePrompt(name, config) {
-	return {
-		name,
-		description: config.description,
-		title: config.title,
-		argsSchema: config.args,
-		handler: config.handler
-	};
-}
-//#endregion
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.
@@ -127,6 +110,82 @@ function customGuard(check, errorMessage) {
 	};
 }
 //#endregion
+//#region src/integrations/mcp/aiSdkBridge.ts
+/** Serialize an AI SDK tool result into MCP's text-content envelope. */
+function toMcpEnvelope(result) {
+	if (result && typeof result === "object" && "error" in result) {
+		const msg = result.error;
+		return {
+			content: [{
+				type: "text",
+				text: typeof msg === "string" ? msg : JSON.stringify(msg)
+			}],
+			isError: true
+		};
+	}
+	return { content: [{
+		type: "text",
+		text: typeof result === "string" ? result : JSON.stringify(result, null, 2)
+	}] };
+}
+/** Convert a McpBridge into a registered MCP tool. */
+function bridgeToMcp(bridge) {
+	return defineTool(bridge.name, {
+		description: bridge.description,
+		input: bridge.inputSchema,
+		annotations: bridge.annotations,
+		handler: async (input, ctx) => {
+			if (!isAuthenticated(ctx)) return denied("Authentication required");
+			if (bridge.guard) {
+				const reason = bridge.guard(ctx);
+				if (reason) return denied(reason);
+			}
+			try {
+				return toMcpEnvelope(await bridge.buildTool(ctx).execute(input));
+			} catch (err) {
+				return denied(err instanceof Error ? err.message : String(err));
+			}
+		}
+	});
+}
+/**
+* Take a list of McpBridge objects and produce a ready-to-register MCP tool
+* array, with optional include/exclude filtering for per-environment config.
+*
+* @example
+* ```typescript
+* // All bridges
+* extraTools: [...buildMcpToolsFromBridges(allBridges)]
+*
+* // Read-only deployment — hide destructive tools
+* extraTools: [...buildMcpToolsFromBridges(allBridges, { exclude: ['trigger_job'] })]
+* ```
+*/
+function buildMcpToolsFromBridges(bridges, options = {}) {
+	return bridges.filter((bridge) => {
+		if (options.include) return options.include.includes(bridge.name);
+		if (options.exclude) return !options.exclude.includes(bridge.name);
+		return true;
+	}).map(bridgeToMcp);
+}
+//#endregion
+//#region src/integrations/mcp/definePrompt.ts
+/**
+* Define a type-safe MCP prompt.
+*
+* @param name - Prompt name (snake_case recommended)
+* @param config - Description, args schema, handler
+*/
+function definePrompt(name, config) {
+	return {
+		name,
+		description: config.description,
+		title: config.title,
+		argsSchema: config.args,
+		handler: config.handler
+	};
+}
+//#endregion
 //#region src/integrations/mcp/authBridge.ts
 /**
 * @classytic/arc — MCP Auth Bridge
@@ -572,4 +631,4 @@ const mcpPlugin = fp(mcpPluginImpl, {
 	fastify: "5.x"
 });
 //#endregion
-export { createMcpServer, customGuard, definePrompt, defineTool, denied, fieldRulesToZod, getOrgId, getUserId, guard, hasOrg, isAuthenticated, isOrg, mcpPlugin, requireAuth, requireOrg, requireOrgId, requireRole, resourceToTools };
+export { bridgeToMcp, buildMcpToolsFromBridges, createMcpServer, customGuard, definePrompt, defineTool, denied, fieldRulesToZod, getOrgId, getUserId, guard, hasOrg, isAuthenticated, isOrg, mcpPlugin, requireAuth, requireOrg, requireOrgId, requireRole, resourceToTools };

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { o as McpAuthResult, s as McpPluginOptions } from "../../types-CcG4avic.mjs";
+import { o as McpAuthResult, s as McpPluginOptions } from "../../types-BsbNMEDR.mjs";
 
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { r as createMcpServer, t as resourceToTools } from "../../resourceToTools-O_HwWXFa.mjs";
+import { r as createMcpServer, t as resourceToTools } from "../../resourceToTools-8s-EsCCe.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/{interface-BVuMfeVv.d.mts → interface-CMRutPfe.d.mts}

@@ -1,6 +1,6 @@
-import { r as RequestScope } from "./types-C72d3NDn.mjs";
-import { n as FieldPermissionMap } from "./fields-DC4So2M2.mjs";
-import { i as UserBase, t as PermissionCheck } from "./types-CVC4HOKi.mjs";
+import { r as RequestScope } from "./types-BD85MlEK.mjs";
+import { n as FieldPermissionMap } from "./fields-DpZQa_Q3.mjs";
+import { i as UserBase, t as PermissionCheck } from "./types-DZi1aYhm.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 
 //#region src/hooks/HookSystem.d.ts
@@ -2419,8 +2419,20 @@ interface RouteDefinition {
   readonly preAuth?: RouteHandlerMethod[];
   /** SSE streaming mode */
   readonly streamResponse?: boolean;
-  /** Fastify route schema */
-  readonly schema?: Record<string, unknown>;
+  /**
+   * Fastify route schema. Each slot (`body`, `querystring`, `params`, `headers`,
+   * `response[status]`) accepts a plain JSON Schema object **or** a Zod v4 schema —
+   * arc auto-converts via `convertRouteSchema` at registration time. Slot values
+   * are typed `unknown` so class-based Zod schemas assign without casts.
+   */
+  readonly schema?: {
+    body?: unknown;
+    querystring?: unknown;
+    params?: unknown;
+    headers?: unknown;
+    response?: Record<number | string, unknown>;
+    [key: string]: unknown;
+  };
   /**
    * MCP tool generation:
    * - omitted/true: auto-generate (non-raw routes only)
@@ -2452,8 +2464,11 @@ interface ActionDefinition {
   readonly handler: ActionHandlerFn;
   /** Per-action permission check (overrides resource-level actionPermissions) */
   readonly permissions?: PermissionCheck;
-  /** JSON Schema for action-specific body fields */
-  readonly schema?: Record<string, Record<string, unknown>>;
+  /**
+   * JSON Schema or Zod v4 schema for action-specific body fields.
+   * Per-field values are typed `unknown` so Zod class instances assign without casts.
+   */
+  readonly schema?: Record<string, unknown>;
   /** Description for OpenAPI docs and MCP tool */
   readonly description?: string;
   /**
@@ -2506,47 +2521,54 @@ interface FieldRule {
 /**
  * CRUD Route Schemas (Fastify Native Format)
  *
+ * Each slot accepts either a plain JSON Schema object **or** a Zod v4 schema —
+ * arc's `convertRouteSchema` feature-detects at runtime. The slot values are
+ * typed `unknown` (not `Record<string, unknown>`) so class-based Zod schemas
+ * assign cleanly without `as unknown as Record<string, unknown>` casts.
+ *
  * @example
+ * ```ts
  * {
  *   list: {
  *     querystring: { type: 'object', properties: { page: { type: 'number' } } },
- *     response: { 200: { type: 'object', properties: { docs: { type: 'array' } } } }
+ *     response: { 200: z.object({ docs: z.array(EntitySchema) }) }
  *   },
  *   create: {
- *     body: { type: 'object', properties: { name: { type: 'string' } } },
- *     response: { 201: { type: 'object' } }
+ *     body: z.object({ name: z.string(), size: z.number().int().positive() }),
+ *     response: { 201: EntitySchema }
  *   }
  * }
+ * ```
  */
 interface CrudSchemas {
   /** GET / - List all resources */
   list?: {
-    querystring?: Record<string, unknown>;
+    /** Plain JSON Schema or Zod schema (auto-converted). */querystring?: unknown; /** Map of HTTP status code → JSON Schema or Zod schema. */
     response?: Record<number, unknown>;
     [key: string]: unknown;
   };
   /** GET /:id - Get single resource */
   get?: {
-    params?: Record<string, unknown>;
+    params?: unknown;
     response?: Record<number, unknown>;
     [key: string]: unknown;
   };
   /** POST / - Create resource */
   create?: {
-    body?: Record<string, unknown>;
+    body?: unknown;
     response?: Record<number, unknown>;
     [key: string]: unknown;
   };
   /** PATCH /:id - Update resource */
   update?: {
-    params?: Record<string, unknown>;
-    body?: Record<string, unknown>;
+    params?: unknown;
+    body?: unknown;
     response?: Record<number, unknown>;
     [key: string]: unknown;
   };
   /** DELETE /:id - Delete resource */
   delete?: {
-    params?: Record<string, unknown>;
+    params?: unknown;
     response?: Record<number, unknown>;
     [key: string]: unknown;
   };

package/dist/{mongodb-B8U2xaLj.d.mts → mongodb-BsP-WbhN.d.mts}

@@ -1,4 +1,4 @@
-import { i as UserBase } from "./types-CVC4HOKi.mjs";
+import { i as UserBase } from "./types-DZi1aYhm.mjs";
 
 //#region src/audit/stores/interface.d.ts
 type AuditAction = "create" | "update" | "delete" | "restore" | "custom";

package/dist/{mongodb-X7LbEjTN.d.mts → mongodb-CTcp0hQZ.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-B-pe8fhj.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DfLGcus7.mjs";
 
 //#region src/idempotency/stores/mongodb.d.ts
 interface MongoConnection {

package/dist/{openapi-CYCuekCn.mjs → openapi-CbKUJY_m.mjs}

@@ -1,6 +1,6 @@
 import { t as getUserRoles } from "./types-ZUu_h0jp.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-OxfCshus.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-Df1BuawX.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-Y7nCYaLJ.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BORM8f17.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi.ts
 const openApiPlugin = async (fastify, opts = {}) => {
@@ -288,7 +288,7 @@ function generateResourcePaths(resource, apiPrefix = "", additionalSecurity = []
 			responses: { "200": { description: route.description || "Success" } }
 		};
 		const rawSchema = route.schema;
-		const routeSchema = rawSchema ? convertRouteSchema(rawSchema) : void 0;
+		const routeSchema = rawSchema ? convertRouteSchema(rawSchema, "openapi-3.0") : void 0;
 		if (routeSchema?.body && [
 			"post",
 			"put",

package/dist/org/index.d.mts

@@ -1,5 +1,5 @@
-import { Wt as RouteHandler } from "../interface-BVuMfeVv.mjs";
-import { i as UserBase } from "../types-CVC4HOKi.mjs";
+import { Wt as RouteHandler } from "../interface-CMRutPfe.mjs";
+import { i as UserBase } from "../types-DZi1aYhm.mjs";
 import { InvitationAdapter, InvitationDoc, MemberDoc, OrgAdapter, OrgDoc, OrgPermissionStatement, OrgRole, OrganizationPluginOptions } from "./types.mjs";
 import { FastifyPluginAsync, RouteHandlerMethod } from "fastify";
 

package/dist/permissions/index.d.mts

@@ -1,4 +1,4 @@
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-DC4So2M2.mjs";
-import { a as getUserRoles, i as UserBase, n as PermissionContext, o as normalizeRoles, r as PermissionResult, t as PermissionCheck } from "../types-CVC4HOKi.mjs";
-import { A as RoleHierarchy, C as authenticated, D as publicRead, E as presets_d_exports, M as applyPermissionResult, N as normalizePermissionResult, O as publicReadAdminWrite, S as adminOnly, T as ownerWithAdminBypass, _ as requireScopeContext, a as allOf, b as roles, c as createDynamicPermissionMatrix, d as requireAuth, f as requireOrgInScope, g as requireRoles, h as requireOwnership, i as PermissionEventBus, j as createRoleHierarchy, k as readOnly, l as createOrgPermissions, m as requireOrgRole, n as DynamicPermissionMatrix, o as allowPublic, p as requireOrgMembership, r as DynamicPermissionMatrixConfig, s as anyOf, t as ConnectEventsOptions, u as denyAll, v as requireServiceScope, w as fullPublic, x as when, y as requireTeamMembership } from "../index-CSkeivBx.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-DpZQa_Q3.mjs";
+import { a as getUserRoles, i as UserBase, n as PermissionContext, o as normalizeRoles, r as PermissionResult, t as PermissionCheck } from "../types-DZi1aYhm.mjs";
+import { A as RoleHierarchy, C as authenticated, D as publicRead, E as presets_d_exports, M as applyPermissionResult, N as normalizePermissionResult, O as publicReadAdminWrite, S as adminOnly, T as ownerWithAdminBypass, _ as requireScopeContext, a as allOf, b as roles, c as createDynamicPermissionMatrix, d as requireAuth, f as requireOrgInScope, g as requireRoles, h as requireOwnership, i as PermissionEventBus, j as createRoleHierarchy, k as readOnly, l as createOrgPermissions, m as requireOrgRole, n as DynamicPermissionMatrix, o as allowPublic, p as requireOrgMembership, r as DynamicPermissionMatrixConfig, s as anyOf, t as ConnectEventsOptions, u as denyAll, v as requireServiceScope, w as fullPublic, x as when, y as requireTeamMembership } from "../index-BLXBmWud.mjs";
 export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
-import { K as MiddlewareConfig, Kt as ResourceRegistry, Tn as HookSystem, et as PresetHook, m as AnyRecord, p as AdditionalRoute, vt as RouteSchemaOptions } from "../interface-BVuMfeVv.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-Bapitwvd.mjs";
-import { _ as _default$1, a as _default$7, c as MetricsCollector, d as metricsPlugin, f as SSEOptions, g as CachingRule, h as CachingOptions, i as VersioningOptions, l as MetricsOptions, m as ssePlugin, n as ErrorMapper, o as versioningPlugin, p as _default$6, r as errorHandlerPlugin, s as MetricEntry, t as ErrorHandlerOptions, u as _default$4, v as cachingPlugin } from "../errorHandler-CdZDavNH.mjs";
-import { t as TracingOptions } from "../tracing-DxjKk7eW.mjs";
+import { K as MiddlewareConfig, Kt as ResourceRegistry, Tn as HookSystem, et as PresetHook, m as AnyRecord, p as AdditionalRoute, vt as RouteSchemaOptions } from "../interface-CMRutPfe.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-BnkYrNzp.mjs";
+import { _ as _default$1, a as _default$7, c as MetricsCollector, d as metricsPlugin, f as SSEOptions, g as CachingRule, h as CachingOptions, i as VersioningOptions, l as MetricsOptions, m as ssePlugin, n as ErrorMapper, o as versioningPlugin, p as _default$6, r as errorHandlerPlugin, s as MetricEntry, t as ErrorHandlerOptions, u as _default$4, v as cachingPlugin } from "../errorHandler-Bah5JhBd.mjs";
+import { t as TracingOptions } from "../tracing-DdN2-wHJ.mjs";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 

package/dist/plugins/index.mjs

@@ -2,14 +2,14 @@ import { p as MUTATION_OPERATIONS } from "../constants-Cxde4rpC.mjs";
 import { o as getOrgId } from "../types-AOD8fxIw.mjs";
 import { t as requestContext } from "../requestContext-DYvHl113.mjs";
 import { t as hasEvents } from "../typeGuards-CcFZXgU7.mjs";
-import { t as HookSystem } from "../HookSystem-BjFu7zf1.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-Dq3_zBQP.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-CjybdRwx.mjs";
-import { t as errorHandlerPlugin } from "../errorHandler-mzqk4cGl.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-TuOmguhi.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-BLojtuvR.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-CJpt7LGI.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-Cm8qoFDg.mjs";
+import { t as HookSystem } from "../HookSystem-HprTmvVY.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-C6uXlWe3.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-IMuYVjTL.mjs";
+import { t as errorHandlerPlugin } from "../errorHandler-f869_8PQ.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-B-PU4-Yu.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-CxkYGT81.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-Ad7ypl9e.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CDugduqI.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-DxjKk7eW.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-DdN2-wHJ.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -44,7 +44,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.8.3";
+	const resolvedVersion = serviceVersion ?? "2.8.5";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/policies/index.d.mts

@@ -1,4 +1,4 @@
-import { t as PermissionCheck } from "../types-CVC4HOKi.mjs";
+import { t as PermissionCheck } from "../types-DZi1aYhm.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 
 //#region src/policies/PolicyInterface.d.ts

package/dist/presets/filesUpload.d.mts

@@ -0,0 +1,49 @@
+import { r as RequestScope } from "../types-BD85MlEK.mjs";
+import { tt as PresetResult } from "../interface-CMRutPfe.mjs";
+import { t as PermissionCheck } from "../types-DZi1aYhm.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Dfzt4VTl.mjs";
+
+//#region src/presets/filesUpload.d.ts
+interface FilesUploadPresetRoutes {
+  upload?: boolean;
+  read?: boolean;
+  delete?: boolean;
+}
+interface FilesUploadPresetPermissions {
+  upload?: PermissionCheck;
+  read?: PermissionCheck;
+  delete?: PermissionCheck;
+}
+interface FilesUploadPresetOptions {
+  /** Any implementation of the `Storage` interface. App owns it. */
+  storage: Storage;
+  /** Multipart form field name. Default: `'file'`. */
+  fieldName?: string;
+  /** Max bytes per file. Forwarded to `multipartBody`. Default: 10 MB. */
+  maxFileSize?: number;
+  /** IANA MIME allow-list. Forwarded to `multipartBody`. Default: no filter. */
+  allowedMimeTypes?: string[];
+  /**
+   * Per-route permissions.
+   * Defaults: upload → `requireAuth()`, read → `allowPublic()`, delete → `requireAuth()`.
+   */
+  permissions?: FilesUploadPresetPermissions;
+  /** Opt out of individual routes. Default: all three enabled. */
+  includeRoutes?: FilesUploadPresetRoutes;
+  /**
+   * Map arc's `RequestScope` to `StorageContext.scope`.
+   * Default: `{ userId, organizationId }` extracted via `getUserId` / `getOrgId`.
+   * Adapters ignore keys they don't care about.
+   */
+  contextFrom?: (scope: RequestScope | undefined) => Record<string, unknown>;
+}
+/**
+ * Create a files-upload preset bound to a `Storage` adapter.
+ *
+ * The preset uses `raw: true` routes so binary responses bypass arc's JSON
+ * envelope. Upload still returns the standard `{ success: true, data }`
+ * envelope manually because the response is structured metadata, not bytes.
+ */
+declare function filesUploadPreset(options: FilesUploadPresetOptions): PresetResult;
+//#endregion
+export { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, type Storage, type StorageContext, type StorageFile, type StorageReadRange, type StorageReadResult, type StorageUploadInput, filesUploadPreset };

package/dist/presets/filesUpload.mjs

@@ -0,0 +1,2 @@
+import { t as filesUploadPreset } from "../filesUpload-C7r7HIeA.mjs";
+export { filesUploadPreset };