@classytic/arc 2.33.0 → 2.35.0

package/dist/{BaseController-CaQC5EXX.mjs → BaseController-C-pofd0v.mjs}

@@ -1,17 +1,92 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BhzLXCfN.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-CWF5pbZD.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CojeUkS4.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-h1V_sT-t.mjs";
-import { t as buildQueryKey } from "./keys-WeKvY1dE.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-DYXBBgtg.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-CLid6atr.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-AKcB4V03.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-GY4kATJb.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-BO-sFTQf.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-UtpiJO5R.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-CBK9HQOI.mjs";
+import { t as buildQueryKey } from "./keys-GlU7XpmG.mjs";
+import { t as transactionContext } from "./transactionContext-BTZzEcRo.mjs";
+import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
+//#region src/core/repositoryFilter.ts
+const NATIVE_FILTER_DIALECT = Symbol.for("@classytic/arc/native-filter-dialect");
+/**
+* Mark a server-owned policy as intentionally adapter-native. This is an
+* explicit escape hatch for semantics absent from repo-core's universal IR
+* (for example MongoDB `$elemMatch`). Never apply it to client input.
+*/
+function nativePolicyFilter(dialect, record) {
+	return Object.freeze({
+		...record,
+		[NATIVE_FILTER_DIALECT]: dialect
+	});
+}
+function nativeDialects(value, found = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value !== "object") return found;
+	const dialect = value[NATIVE_FILTER_DIALECT];
+	if (typeof dialect === "string") found.add(dialect);
+	if (Array.isArray(value)) for (const entry of value) nativeDialects(entry, found);
+	else for (const entry of Object.values(value)) nativeDialects(entry, found);
+	return found;
+}
+function stripNativeMarkers(value) {
+	if (Array.isArray(value)) return value.map(stripNativeMarkers);
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) out[key] = stripNativeMarkers(entry);
+	return out;
+}
+const log$2 = arcLog("repository-filter");
+let warnedUnconvertible = false;
+/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
+function isOperatorObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value) || value instanceof Date) return false;
+	const keys = Object.keys(value);
+	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
+}
+/**
+* Does this compound filter contain any `$`-operator (top-level logical like
+* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
+* pure flat equality and portable as-is.
+*/
+function filterHasDollarOperator(record) {
+	for (const [key, value] of Object.entries(record)) {
+		if (key.startsWith("$")) return true;
+		if (isOperatorObject(value)) return true;
+	}
+	return false;
+}
+/**
+* Normalize a compound query/policy filter for the repository layer. Flat
+* equality records pass through unchanged; anything carrying `$`-operators is
+* converted to repo-core {@link Filter} IR so semantics stay explicit. Common
+* operators compile identically across kits; capability-specific operators
+* such as array-element matching fail loudly on adapters that cannot model them.
+*/
+function toRepositoryFilter(record) {
+	const dialects = nativeDialects(record);
+	if (dialects.size > 0) {
+		if (dialects.size > 1) throw new Error(`Cannot compose native policy-filter dialects: ${[...dialects].sort().join(", ")}`);
+		return stripNativeMarkers(record);
+	}
+	if (!filterHasDollarOperator(record)) return record;
+	try {
+		return policyRecordToFilter(record);
+	} catch (err) {
+		if (!warnedUnconvertible) {
+			warnedUnconvertible = true;
+			log$2.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
+		}
+		return record;
+	}
+}
+//#endregion
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -801,9 +876,43 @@ var QueryResolver = class {
 	* Combines what was previously _buildContext + _parseQueryOptions + _applyFilters.
 	*/
 	resolve(req, meta) {
-		const parsed = this.queryParser.parse(req.query);
+		/**
+		* Strip `_policyFilters` BEFORE the parse, not after.
+		*
+		* **Reachable only when a CLIENT puts it in the URL.** Trusted policy is a
+		* request DECORATION (`request._policyFilters`, set by the permission
+		* middleware) that `createRequestContext` lifts into `metadata` — it never
+		* enters `req.query`, which is Fastify's parsed querystring. So the key
+		* arriving here is always user-supplied, always inert (the authoritative
+		* copy is read from `arcContext` below), and must simply not reach the
+		* parser.
+		*
+		* The previous `delete` ran on `parsed.filters` — AFTER
+		* `queryParser.parse()` — so on the one path that needed it, it could
+		* never run: a KIT parser validates every key against the resource's
+		* `allowedFilterFields` and throws during the parse, before the cleanup
+		* line. Arc's own parser skips the key via `RESERVED_QUERY_PARAMS`, so the
+		* two parsers disagreed on the same request: arc ignored a probe, kits
+		* 400'd it.
+		*
+		* Stripping here makes them agree, and agrees with arc. Nothing is
+		* weakened — the client's value was already inert — but note the trade:
+		* under a kit parser `?_policyFilters=…` used to be a loud 400 and is now
+		* silently dropped. The alternative, teaching every kit's reserved-key list
+		* about an arc-internal key, spreads one framework's leak across the
+		* ecosystem for the same outcome.
+		*
+		* Copy only when present: the hot path allocates nothing, and `req.query`
+		* is never mutated (it is shared with the rest of the request).
+		*/
+		const rawQuery = req.query;
+		let query = rawQuery;
+		if (rawQuery && "_policyFilters" in rawQuery) {
+			const { _policyFilters: _ignored, ...rest } = rawQuery;
+			query = rest;
+		}
+		const parsed = this.queryParser.parse(query);
 		const arcContext = meta ?? req.metadata;
-		delete parsed.filters?._policyFilters;
 		const limit = Math.min(Math.max(1, parsed.limit || this.defaultLimit), this.maxLimit);
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
 		const sortString = parsed.sort ? Object.entries(parsed.sort).map(([k, v]) => v === -1 ? `-${k}` : k).join(",") : this.permittedDefaultSort();
@@ -1300,7 +1409,10 @@ var BaseCrudController = class {
 	*/
 	runWritePersistence(fn) {
 		if (!this._transactional) return fn(this.repository);
-		return retryingTransaction(this.repository, (txRepo, uow) => fn(txRepo, uow));
+		return retryingTransaction(this.repository, (txRepo, uow) => {
+			const run = () => fn(txRepo, uow);
+			return uow?.session === void 0 ? run() : transactionContext.run(uow.session, run);
+		});
 	}
 	/** Assemble the `WriteContext` a `create` verb receives. */
 	writeContext(req, repo = this.repository, uow) {
@@ -1441,8 +1553,10 @@ var BaseCrudController = class {
 		const options = this.queryResolver.resolve(req, this.meta(req));
 		const cached = await this.withListCache(req, options);
 		if (cached) return cached;
+		const result = await this.executeListQuery(options, req);
+		await this.runAfterHook(req, "list", result);
 		return {
-			data: await this.executeListQuery(options, req),
+			data: result,
 			status: 200
 		};
 	}
@@ -1533,6 +1647,7 @@ var BaseCrudController = class {
 		if (cached) return cached;
 		const { doc, reason } = await this.executeGetQuery(id, options, req);
 		if (!doc) this.throwNotFound(reason);
+		await this.runAfterHook(req, "read", doc);
 		return {
 			data: doc,
 			status: 200
@@ -2012,4 +2127,4 @@ function TreeMixin(Base) {
 */
 var BaseController = class extends SoftDeleteMixin(TreeMixin(SlugMixin(BulkMixin(BaseCrudController)))) {};
 //#endregion
-export { BulkMixin as a, collectReadBlockedFields as c, isWriteVerbCapable as d, BodySanitizer as f, SlugMixin as i, isFieldReadable as l, AccessControl as m, TreeMixin as n, BaseCrudController as o, DEFAULT_FIELD_WRITE_DENIAL_POLICY as p, SoftDeleteMixin as r, QueryResolver as s, BaseController as t, detectOverriddenWriteSlots as u };
+export { BulkMixin as a, collectReadBlockedFields as c, isWriteVerbCapable as d, BodySanitizer as f, toRepositoryFilter as g, nativePolicyFilter as h, SlugMixin as i, isFieldReadable as l, AccessControl as m, TreeMixin as n, BaseCrudController as o, DEFAULT_FIELD_WRITE_DENIAL_POLICY as p, SoftDeleteMixin as r, QueryResolver as s, BaseController as t, detectOverriddenWriteSlots as u };

package/dist/{EventTransport-tq4CEB-q.mjs → EventTransport-BrPeGUil.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-DqXkMXkB.mjs → HookSystem-LlPm3Anm.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-aevMua7Q.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System
@@ -116,9 +116,11 @@ var HookSystem = class {
 	}
 	async execute(ctx) {
 		const key = this.getKey(ctx.resource, ctx.operation, ctx.phase);
-		const hooks = this.hooks.get(key) ?? [];
+		const hooks = this.hooks.get(key);
 		const wildcardKey = this.getKey("*", ctx.operation, ctx.phase);
-		let allHooks = [...this.hooks.get(wildcardKey) ?? [], ...hooks];
+		const wildcardHooks = this.hooks.get(wildcardKey);
+		if (!hooks?.length && !wildcardHooks?.length) return ctx.data;
+		let allHooks = [...wildcardHooks ?? [], ...hooks ?? []];
 		allHooks.sort((a, b) => a.priority - b.priority);
 		if (allHooks.some((h) => h.dependsOn?.length)) allHooks = this.topologicalSort(allHooks);
 		let result = ctx.data;

package/dist/{ResourceRegistry-DoALUlOO.mjs → ResourceRegistry-yuD1Ra53.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import "./constants-BhzLXCfN.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{pipeline-q69DZzgG.mjs → actionPermissions-LFuOra7W.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-GY4kATJb.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-UtpiJO5R.mjs";
+import { t as executePipeline } from "./pipe-DNOuCfAs.mjs";
+import { t as buildRequestScopeProjection } from "./projection-aevMua7Q.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -323,4 +323,27 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t };
+//#region src/core/actionPermissions.ts
+/**
+* Return the effective `PermissionCheck` for a single action, or `undefined`
+* when the resource declares no gate at any level.
+*
+* Callers decide what "no gate" means:
+*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
+*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
+*     two surfaces fail closed identically so MCP can't expose an
+*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
+*     run).
+*   - OpenAPI: docs advertise the endpoint as unauthenticated.
+*/
+function resolveActionPermission(input) {
+	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
+	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
+	if (explicit) return explicit;
+	if (resourceActionPermissions) return resourceActionPermissions;
+	if (globalAuth) return globalAuth;
+	const updateFallback = resourcePermissions?.update;
+	if (updateFallback) return updateFallback;
+}
+//#endregion
+export { createCrudHandlers as a, getControllerContext as c, resolvePipelineSteps as i, getControllerScope as l, buildActionPipelineHandler as n, createFastifyHandler as o, buildPipelineHandler as r, createRequestContext as s, resolveActionPermission as t, sendControllerResponse as u };

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import { d as UserBase } from "../base-Csjc2oF-.mjs";
-import "../index-BcR2bFZQ.mjs";
+import { d as UserBase } from "../base-GZU3LlzP.mjs";
+import "../index-C5K78SXo.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-BTZzEcRo.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-BcR2bFZQ.mjs";
+import { l as PermissionCheck } from "../base-GZU3LlzP.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-C5K78SXo.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { o as toJsonSchema } from "../schemaConverter-XH1RZRyu.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-BAfwgBxc.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-CLid6atr.mjs";
+import { n as requireSingleHeaderValue } from "../headers-DODWf7aC.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-AKcB4V03.mjs";
+import { o as toJsonSchema } from "../schemaConverter-D2_bHGil.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-CpSBlFXZ.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-B3mP_QTy.mjs → authorizationDecision-DYXBBgtg.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
+import { t as ArcError } from "./errors-CLid6atr.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.
@@ -91,6 +91,10 @@ function conjoinPolicyFilters(base, incoming) {
 		delete result[key];
 	}
 	if (andParts.length > 0) result.$and = andParts;
+	for (const source of [base, incoming]) for (const symbol of Object.getOwnPropertySymbols(source)) {
+		const descriptor = Object.getOwnPropertyDescriptor(source, symbol);
+		if (descriptor) Object.defineProperty(result, symbol, descriptor);
+	}
 	return result;
 }
 //#endregion

package/dist/{base-Csjc2oF-.d.mts → base-GZU3LlzP.d.mts}

@@ -1,5 +1,5 @@
 
-import { i as RequestScope } from "./types-ChuShpCP.mjs";
+import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
 import { FastifyRequest } from "fastify";
 //#region src/utils/userHelpers.d.ts
 /**

package/dist/{buildHandler-DLE9xX-V.mjs → buildHandler-Do9aMIvL.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CdQlz52F.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-DYXBBgtg.mjs";
+import { g as toRepositoryFilter } from "./BaseController-C-pofd0v.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-dosAIvQU.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-WeKvY1dE.mjs";
-import { t as MemoryCacheStore } from "../memory-qYSB7rMQ.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DhsZ0ZIc.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-GlU7XpmG.mjs";
+import { t as MemoryCacheStore } from "../memory-BwedEXau.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BI7Z88Cx.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-BcGmvnHh.mjs → caching-cN5X9VEL.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-BcR2bFZQ.mjs";
+import { L as RequestWithExtras } from "../index-C5K78SXo.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BcTumAz_.mjs";
+import { t as ArcModule } from "../types-DDD5RKTu.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-CoqIRrkY.mjs";
-import { t as defineResource } from "../defineResource-DR9vsUYy.mjs";
-import { t as defineModule } from "../module-CwKsgZXp.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-GY4kATJb.mjs";
+import { t as defineResource } from "../defineResource-BOrGeocE.mjs";
+import { t as defineModule } from "../module-Bh5OC7ww.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-BcR2bFZQ.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-C5K78SXo.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BxCoxmiN.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-DoALUlOO.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BhzLXCfN.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-yuD1Ra53.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-BN5cQaO2.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DwaxNcE2.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-ItLH12_L.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-s6aGs6-0.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-DiB0nHPR.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-BoAVy3_b.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-mdJ-v4Xp.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-Ce4R0ZGK.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DwaxNcE2.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-s6aGs6-0.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-DiB0nHPR.mjs";
-import { t as init } from "../init-mdJ-v4Xp.mjs";
+import { t as generate } from "../generate-BoAVy3_b.mjs";
+import { t as init } from "../init-Ce4R0ZGK.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-BxCoxmiN.mjs → constants-BhzLXCfN.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.d.mts

@@ -1,5 +1,6 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
+import { CacheAdapter } from "@classytic/repo-core/cache";
 //#region src/context/requestContext.d.ts
 /**
  * Shape of the request-scoped context store.
@@ -85,6 +86,20 @@ declare const requestContext: {
  */
 declare function getTraceHeaders(): Record<string, string> | undefined;
 //#endregion
+//#region src/context/requestScopedCache.d.ts
+/**
+ * The cache for the CURRENT request, or `undefined` outside one.
+ *
+ * Lazily created on first use, so a request that never touches a cached
+ * repository allocates nothing.
+ */
+declare function requestScopedCache(): CacheAdapter | undefined;
+/**
+ * Whether the current request has allocated a cache yet. Diagnostics and
+ * tests only — never branch application behaviour on this.
+ */
+declare function hasRequestScopedCache(): boolean;
+//#endregion
 //#region src/context/transactionContext.d.ts
 /** DB session/transaction handle. Typed as unknown — arc is DB-agnostic. */
 type DbSession = unknown;
@@ -109,4 +124,4 @@ declare const transactionContext: {
   storage: AsyncLocalStorage<unknown>;
 };
 //#endregion
-export { type DbSession, type RequestStore, getTraceHeaders, requestContext, transactionContext };
+export { type DbSession, type RequestStore, getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, transactionContext };

package/dist/context/index.mjs

@@ -1,4 +1,64 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-uYE35JxI.mjs";
-import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
-export { getTraceHeaders, requestContext, transactionContext };
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-DzOUGNdY.mjs";
+import { t as transactionContext } from "../transactionContext-BTZzEcRo.mjs";
+//#region src/context/requestScopedCache.ts
+/**
+* The slot the per-request store hangs off. Underscore-prefixed to sit apart
+* from the fields arc's own hooks populate on `RequestStore`.
+*/
+const SLOT = "_requestCache";
+/**
+* A `Map`-backed `CacheAdapter` with NO eviction and NO TTL — both deliberate.
+*
+* The store is unreachable once the request's async context ends, so it is
+* garbage in milliseconds and bounded by what one request touches; an LRU
+* would guard a lifetime that cannot occur. TTL is accepted and ignored
+* because repo-core stamps freshness INTO the envelope and re-checks on read —
+* honouring it here too would put two clocks on one question.
+*/
+function createRequestCacheAdapter() {
+	const map = /* @__PURE__ */ new Map();
+	return {
+		async get(key) {
+			return map.get(key);
+		},
+		async set(key, value, _ttlSeconds) {
+			map.set(key, value);
+		},
+		async delete(key) {
+			map.delete(key);
+		},
+		/**
+		* Ignores the pattern and wipes the whole store. Over-invalidating within
+		* one request costs at most a re-read; pattern matching is complexity a
+		* store that dies in milliseconds does not earn.
+		*/
+		async clear(_pattern) {
+			map.clear();
+		}
+	};
+}
+/**
+* The cache for the CURRENT request, or `undefined` outside one.
+*
+* Lazily created on first use, so a request that never touches a cached
+* repository allocates nothing.
+*/
+function requestScopedCache() {
+	const store = requestContext.get();
+	if (!store) return void 0;
+	const existing = store[SLOT];
+	if (existing) return existing;
+	const created = createRequestCacheAdapter();
+	store[SLOT] = created;
+	return created;
+}
+/**
+* Whether the current request has allocated a cache yet. Diagnostics and
+* tests only — never branch application behaviour on this.
+*/
+function hasRequestScopedCache() {
+	return requestContext.get()?.[SLOT] !== void 0;
+}
+//#endregion
+export { getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, transactionContext };