@classytic/arc 2.28.0 → 2.31.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Classytic
+Copyright (c) 2025 Classytic LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -324,3 +324,10 @@ arc doctor                                       # diagnose env
 ## License
 
 MIT
+
+
+## Trademark
+
+The code is MIT-licensed. **"Classytic", "arc", and the logos are trademarks of
+Classytic LLC** and are **not** licensed under MIT — see [TRADEMARK.md](TRADEMARK.md).
+Forks must be renamed; the license covers the code, not the brand.

package/TRADEMARK.md

@@ -0,0 +1,22 @@
+# Trademark Notice
+
+The **source code** in this package is licensed under the MIT License (see
+[LICENSE](LICENSE)). Trademarks are **not** part of that license.
+
+**"Classytic", "arc", the Classytic and arc logos**, and related names and marks
+are trademarks of **Classytic LLC** (Wyoming, USA). The MIT License covers the
+code only — it grants **no right** to use Classytic LLC's names, logos, or brand.
+
+## You may
+- use, fork, modify, and redistribute the **code** under the MIT License;
+- state truthfully that your product "uses" or "is built on" arc / Classytic
+  software, without implying endorsement.
+
+## You may not (without written permission from Classytic LLC)
+- use "Classytic", "arc", or confusingly similar names as the name of your own
+  product, package, company, or service;
+- use the Classytic / arc logos or brand styling;
+- imply sponsorship, affiliation, or endorsement by Classytic LLC.
+
+Forks or redistributions must be **renamed** so they are not confused with the
+official project. Permission / questions: **trademark@classytic.com**.

package/dist/{BaseController-B65zbz9m.mjs → BaseController-De7GqHck.mjs}

@@ -1,12 +1,15 @@
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-D3Dv4LAV.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-taUVD4p3.mjs";
-import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cj42AntO.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-ChYJ6CdK.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DjQJ7FKA.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CB5Cuzk9.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-vL8BrDE2.mjs";
+import { t as buildQueryKey } from "./keys-C0_pa1tY.mjs";
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -31,14 +34,14 @@ var AccessControl = class {
 	* Combines ID filter with policy/org filters for proper security enforcement
 	*/
 	buildIdFilter(id, req) {
-		const filter = { [this.idField]: id };
+		let filter = { [this.idField]: id };
 		const arcContext = this._meta(req);
 		const policyFilters = arcContext?._policyFilters;
-		if (policyFilters) Object.assign(filter, policyFilters);
+		if (policyFilters) filter = conjoinPolicyFilters(filter, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filter[this.tenantField] = orgId;
-		return filter;
+		if (this.tenantField && orgId) filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
+		return toRepositoryFilter(filter);
 	}
 	/**
 	* Check if a post-fetch item matches the request's `_policyFilters`.
@@ -110,9 +113,9 @@ var AccessControl = class {
 	checkOwnership(item, req) {
 		const ownershipCheck = this._meta(req)?._ownershipCheck;
 		if (!item || !ownershipCheck) return true;
-		const { field, userId } = ownershipCheck;
+		const { field, userId, missingOwner } = ownershipCheck;
 		const itemOwnerId = item[field];
-		if (!itemOwnerId) return true;
+		if (!itemOwnerId) return missingOwner === "allow";
 		return String(itemOwnerId) === String(userId);
 	}
 	/**
@@ -670,12 +673,12 @@ var QueryResolver = class {
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
 		const sortString = parsed.sort ? Object.entries(parsed.sort).map(([k, v]) => v === -1 ? `-${k}` : k).join(",") : this.defaultSort;
 		const rawSelect = parsed.select ?? req.query?.select;
-		const filters = { ...parsed.filters };
 		const policyFilters = arcContext?._policyFilters;
-		if (policyFilters) Object.assign(filters, policyFilters);
+		let filters = conjoinPolicyFilters(parsed.filters, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters[this.tenantField] = orgId;
+		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
+		const portableFilters = toRepositoryFilter(filters);
 		return {
 			page,
 			limit,
@@ -684,7 +687,7 @@ var QueryResolver = class {
 			populate: this.sanitizePopulate(parsed.populate, this.schemaOptions),
 			populateOptions: this.sanitizePopulateOptions(parsed.populateOptions, this.schemaOptions),
 			lookups: this.sanitizeLookups(parsed.lookups, this.schemaOptions),
-			filters,
+			filters: portableFilters,
 			search: parsed.search,
 			after: parsed.after,
 			user: req.user,
@@ -800,7 +803,7 @@ var BaseCrudController = class {
 	/**
 	* Composable access control (ID filtering, policy checks, org scope, ownership).
 	*
-	* Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+	* Not `readonly` — `configure()` rebuilds it when the host
 	* supplies tenant/idField/matchesFilter post-construction. Same model as
 	* `queryResolver` after `setQueryParser` shipped in 2.10.9.
 	*/
@@ -808,7 +811,7 @@ var BaseCrudController = class {
 	/**
 	* Composable body sanitization (field permissions, system fields).
 	*
-	* Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+	* Not `readonly` — `configure()` rebuilds it when the host
 	* supplies schemaOptions/onFieldWriteDenied post-construction.
 	*/
 	bodySanitizer;
@@ -1486,10 +1489,8 @@ function BulkMixin(Base) {
 		* Returns the merged filter, or `null` when access must be denied.
 		*/
 		buildBulkFilter(userFilter, req) {
-			const filter = { ...userFilter };
 			const arcContext = this.meta(req);
-			const policyFilters = arcContext?._policyFilters;
-			if (policyFilters) Object.assign(filter, policyFilters);
+			let filter = conjoinPolicyFilters(userFilter, arcContext?._policyFilters);
 			if (this.tenantField) {
 				const scope = arcContext?._scope;
 				if (!scope) return filter;
@@ -1497,7 +1498,7 @@ function BulkMixin(Base) {
 				if (isElevated(scope)) return filter;
 				const orgId = getOrgId(scope);
 				if (!orgId) return null;
-				filter[this.tenantField] = orgId;
+				filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
 			}
 			return filter;
 		}

package/dist/{EventTransport-QmY7A258.d.mts → EventTransport-2uVV34WU.d.mts}

@@ -1,3 +1,4 @@
+
 import { DeadLetteredEvent, DomainEvent, DomainEvent as DomainEvent$1, EventHandler, EventHandler as EventHandler$1, EventLogger, EventLogger as EventLogger$1, EventTransport, EventTransport as EventTransport$1, PublishManyResult } from "@classytic/primitives/events";
 //#region src/events/EventTransport.d.ts
 interface MemoryEventTransportOptions {

package/dist/EventTransport-9mlTgqzE.mjs

@@ -0,0 +1,104 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { createEvent, matchEventPattern } from "@classytic/primitives/events";
+//#region src/events/EventTransport.ts
+/**
+* Internal arc events module — concrete in-memory transport.
+*
+* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
+* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
+* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
+* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
+* Two reasons:
+*
+*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
+*      audit-log plugin, future kits and downstream services all share them.
+*      Owning them in `primitives` (pure types, zero runtime, zero deps)
+*      eliminates the "manually mirror in two places" problem the previous
+*      `primitives/src/events.ts` header explicitly called out.
+*   2. Inverting the dependency direction lets future packages (sqlitekit
+*      audit, billing services) consume the contract without depending on
+*      arc's HTTP-coupled stack.
+*
+* Hosts MUST import the types from primitives directly:
+*
+* ```typescript
+* import type {
+*   EventMeta, DomainEvent, EventHandler, EventTransport,
+*   DeadLetteredEvent, PublishManyResult,
+* } from '@classytic/primitives/events';
+* import { createEvent, createChildEvent } from '@classytic/primitives/events';
+* ```
+*
+* arc's `events/index.ts` barrel does NOT re-export these — by design, so
+* that consumer code is forced into the canonical import path and the org's
+* "no re-exports" rule holds at every public surface.
+*
+* What stays here:
+*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
+*     used as arc's default transport. Its handler-set state is process-local;
+*     wrong layer for primitives.
+*   - `MemoryEventTransportOptions` — its options shape.
+*
+* Inside arc, files that previously imported types from `./EventTransport.js`
+* keep working: this file re-exports them from primitives for arc's own
+* call sites. That re-export is an internal refactor convenience — the
+* public `events/index.ts` barrel stays clean.
+*/
+/**
+* In-memory event transport (default).
+*
+* Events are delivered synchronously within the process. Not suitable for
+* multi-instance deployments — pair with `RedisEventTransport` /
+* `RedisStreamTransport` (subpath imports) for those.
+*/
+var MemoryEventTransport = class {
+	name = "memory";
+	handlers = /* @__PURE__ */ new Map();
+	logger;
+	constructor(options) {
+		this.logger = options?.logger ?? console;
+	}
+	async publish(event) {
+		const allHandlers = /* @__PURE__ */ new Set();
+		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		for (const handler of allHandlers) try {
+			await handler(event);
+		} catch (err) {
+			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+		}
+	}
+	/**
+	* Reference `publishMany` implementation — delegates to `publish()` in order.
+	*
+	* Production transports (Kafka, Redis pipeline, SQS batch) should override
+	* this with a single batched network call. Memory transport has nothing to
+	* batch, so we just loop — the loop still returns a proper result map so
+	* `EventOutbox.relay` can exercise the batched code path in tests.
+	*/
+	async publishMany(events) {
+		const results = /* @__PURE__ */ new Map();
+		for (const event of events) try {
+			await this.publish(event);
+			results.set(event.meta.id, null);
+		} catch (err) {
+			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
+		}
+		return results;
+	}
+	async subscribe(pattern, handler) {
+		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
+		this.handlers.get(pattern)?.add(handler);
+		return () => {
+			const set = this.handlers.get(pattern);
+			if (set) {
+				set.delete(handler);
+				if (set.size === 0) this.handlers.delete(pattern);
+			}
+		};
+	}
+	async close() {
+		this.handlers.clear();
+	}
+};
+//#endregion
+export { createEvent as n, MemoryEventTransport as t };

package/dist/{HookSystem-C1vB_Gc9.mjs → HookSystem-BcmPyq5I.mjs}

@@ -1,4 +1,16 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
 //#region src/hooks/HookSystem.ts
+/**
+* Hook System
+*
+* Lifecycle hooks for resource operations.
+* Allows intercepting and modifying data at various points.
+*/
+/** Lift the validated scope out of the request context (undefined when unscoped). */
+function scopeOf(context) {
+	return buildRequestScopeProjection(context?._scope);
+}
 var HookSystem = class {
 	hooks;
 	logger;
@@ -9,16 +21,10 @@ var HookSystem = class {
 		this.logger = options?.logger ?? { error: noop };
 		this.warn = options?.logger?.warn ?? noop;
 	}
-	/**
-	* Generate hook key
-	*/
 	getKey(resource, operation, phase) {
 		return `${resource}:${operation}:${phase}`;
 	}
-	/**
-	* Register a hook
-	* Supports both object parameter and positional arguments
-	*/
+	/** Supports both the object-parameter and positional argument forms. */
 	register(resourceOrOptions, operation, phase, handler, priority = 10) {
 		let hookName;
 		let resource;
@@ -63,15 +69,9 @@ var HookSystem = class {
 			if (idx !== -1) hooks.splice(idx, 1);
 		};
 	}
-	/**
-	* Register before hook
-	*/
 	before(resource, operation, handler, priority = 10) {
 		return this.register(resource, operation, "before", handler, priority);
 	}
-	/**
-	* Register after hook
-	*/
 	after(resource, operation, handler, priority = 10) {
 		return this.register(resource, operation, "after", handler, priority);
 	}
@@ -105,6 +105,7 @@ var HookSystem = class {
 					data,
 					user: options?.user,
 					context: options?.context,
+					scope: scopeOf(options?.context),
 					meta: options?.meta
 				};
 				return hook.handler(ctx, next);
@@ -113,9 +114,6 @@ var HookSystem = class {
 		};
 		return next();
 	}
-	/**
-	* Execute hooks for a given context
-	*/
 	async execute(ctx) {
 		const key = this.getKey(ctx.resource, ctx.operation, ctx.phase);
 		const hooks = this.hooks.get(key) ?? [];
@@ -133,6 +131,7 @@ var HookSystem = class {
 				result: ctx.result,
 				user: ctx.user,
 				context: ctx.context,
+				scope: ctx.scope ?? scopeOf(ctx.context),
 				meta: ctx.meta
 			};
 			const hookResult = await hook.handler(handlerContext);
@@ -140,9 +139,6 @@ var HookSystem = class {
 		}
 		return result;
 	}
-	/**
-	* Execute before hooks
-	*/
 	async executeBefore(resource, operation, data, options) {
 		return await this.execute({
 			resource,
@@ -154,10 +150,7 @@ var HookSystem = class {
 			meta: options?.meta
 		}) ?? data;
 	}
-	/**
-	* Execute after hooks
-	* Errors in after hooks are logged but don't fail the request
-	*/
+	/** Errors in after hooks are logged but never fail the request. */
 	async executeAfter(resource, operation, result, options) {
 		try {
 			await this.execute({
@@ -226,17 +219,11 @@ var HookSystem = class {
 		}
 		return result;
 	}
-	/**
-	* Get all registered hooks
-	*/
 	getAll() {
 		const all = [];
 		for (const hooks of this.hooks.values()) all.push(...hooks);
 		return all;
 	}
-	/**
-	* Get hooks for a specific resource
-	*/
 	getForResource(resource) {
 		const all = [];
 		for (const [key, hooks] of this.hooks.entries()) if (key.startsWith(`${resource}:`)) all.push(...hooks);
@@ -298,15 +285,9 @@ var HookSystem = class {
 		const key = this.getKey(resource, operation, phase);
 		return (this.hooks.get(key)?.length ?? 0) > 0;
 	}
-	/**
-	* Clear all hooks
-	*/
 	clear() {
 		this.hooks.clear();
 	}
-	/**
-	* Clear hooks for a specific resource
-	*/
 	clearResource(resource) {
 		for (const key of this.hooks.keys()) if (key.startsWith(`${resource}:`)) this.hooks.delete(key);
 	}

package/dist/{QueryCache-DOMT_iq7.d.mts → QueryCache-DFA-QrU9.d.mts}

@@ -1,4 +1,5 @@
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
+
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 //#region src/cache/QueryCache.d.ts
 /** Metadata wrapper stored in CacheStore */
 interface CacheEnvelope<T = unknown> {

package/dist/{ResourceRegistry-y9Hnypus.mjs → ResourceRegistry-qq0mn2s9.mjs}

@@ -1,4 +1,5 @@
-import "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import "./constants-D3Dv4LAV.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -59,7 +60,7 @@ var ResourceRegistry = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
-				raw: r.raw,
+				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),
 			events: Object.keys(resource.events ?? {}),

package/dist/{actionPermissions-CAphcmUG.mjs → actionPermissions-BE5NwaQk.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.d.mts

@@ -1,5 +1,6 @@
-import "../index-DPRH0Cme.mjs";
-import { i as UserBase } from "../types-Dmw-6Qeo.mjs";
+
+import "../index-CpzxqePp.mjs";
+import { a as UserBase } from "../types-B7XeLEgK.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,6 +1,7 @@
-import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
-import fp from "fastify-plugin";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
+import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts
 function repositoryAsAuditStore(repository, options = {}) {
 	const idField = repository.idField ?? "_id";

package/dist/auth/audit.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyInstance } from "fastify";
 //#region src/auth/audit.d.ts
 /**

package/dist/auth/audit.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,7 +1,8 @@
-import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-DPRH0Cme.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { Ut as AuthHelpers, Wt as AuthPluginOptions } from "../index-CpzxqePp.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
 //#region src/auth/authPlugin.d.ts
 declare module "fastify" {

package/dist/auth/index.mjs

@@ -1,8 +1,9 @@
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BvlQSDMB.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { o as toJsonSchema } from "../schemaConverter-DJvodiHj.mjs";
-import { _ as requireOrgMembership, v as requireOrgRole, x as requireTeamMembership } from "../permissions-BrtiBKGs.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cj42AntO.mjs";
+import { n as requireSingleHeaderValue } from "../headers-3zvE0rM3.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
+import { o as toJsonSchema } from "../schemaConverter-D--wdJM-.mjs";
+import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-L--QDAir.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts

package/dist/auth/redis-session.d.mts

@@ -1,4 +1,5 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { i as SessionData, s as SessionStore } from "../sessionManager-qimlKV0P.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
 interface RedisLike {

package/dist/auth/redis-session.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**