@classytic/arc 2.34.0 → 2.36.0

package/dist/{BaseController-CbkuhNI2.mjs → BaseController-CTJKm6Cb.mjs}

@@ -1,17 +1,92 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DUoKAGYD.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-CWF5pbZD.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Se8VrsaP.mjs";
-import { n as toRepositoryFilter } from "./repositoryFilter-BANpz6BX.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CojeUkS4.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-h1V_sT-t.mjs";
-import { t as buildQueryKey } from "./keys-WeKvY1dE.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-EsiY3nUu.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DDKni6Tz.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-xQAi5bPF.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-B8lwJv9Q.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-_9NAMHUD.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-DdP225wt.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-DgNFsJ2c.mjs";
+import { t as buildQueryKey } from "./keys-BcNl12HN.mjs";
+import { t as transactionContext } from "./transactionContext-D2HwJM2z.mjs";
+import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
+//#region src/core/repositoryFilter.ts
+const NATIVE_FILTER_DIALECT = Symbol.for("@classytic/arc/native-filter-dialect");
+/**
+* Mark a server-owned policy as intentionally adapter-native. This is an
+* explicit escape hatch for semantics absent from repo-core's universal IR
+* (for example MongoDB `$elemMatch`). Never apply it to client input.
+*/
+function nativePolicyFilter(dialect, record) {
+	return Object.freeze({
+		...record,
+		[NATIVE_FILTER_DIALECT]: dialect
+	});
+}
+function nativeDialects(value, found = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value !== "object") return found;
+	const dialect = value[NATIVE_FILTER_DIALECT];
+	if (typeof dialect === "string") found.add(dialect);
+	if (Array.isArray(value)) for (const entry of value) nativeDialects(entry, found);
+	else for (const entry of Object.values(value)) nativeDialects(entry, found);
+	return found;
+}
+function stripNativeMarkers(value) {
+	if (Array.isArray(value)) return value.map(stripNativeMarkers);
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) out[key] = stripNativeMarkers(entry);
+	return out;
+}
+const log$2 = arcLog("repository-filter");
+let warnedUnconvertible = false;
+/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
+function isOperatorObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value) || value instanceof Date) return false;
+	const keys = Object.keys(value);
+	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
+}
+/**
+* Does this compound filter contain any `$`-operator (top-level logical like
+* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
+* pure flat equality and portable as-is.
+*/
+function filterHasDollarOperator(record) {
+	for (const [key, value] of Object.entries(record)) {
+		if (key.startsWith("$")) return true;
+		if (isOperatorObject(value)) return true;
+	}
+	return false;
+}
+/**
+* Normalize a compound query/policy filter for the repository layer. Flat
+* equality records pass through unchanged; anything carrying `$`-operators is
+* converted to repo-core {@link Filter} IR so semantics stay explicit. Common
+* operators compile identically across kits; capability-specific operators
+* such as array-element matching fail loudly on adapters that cannot model them.
+*/
+function toRepositoryFilter(record) {
+	const dialects = nativeDialects(record);
+	if (dialects.size > 0) {
+		if (dialects.size > 1) throw new Error(`Cannot compose native policy-filter dialects: ${[...dialects].sort().join(", ")}`);
+		return stripNativeMarkers(record);
+	}
+	if (!filterHasDollarOperator(record)) return record;
+	try {
+		return policyRecordToFilter(record);
+	} catch (err) {
+		if (!warnedUnconvertible) {
+			warnedUnconvertible = true;
+			log$2.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
+		}
+		return record;
+	}
+}
+//#endregion
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -1334,7 +1409,10 @@ var BaseCrudController = class {
 	*/
 	runWritePersistence(fn) {
 		if (!this._transactional) return fn(this.repository);
-		return retryingTransaction(this.repository, (txRepo, uow) => fn(txRepo, uow));
+		return retryingTransaction(this.repository, (txRepo, uow) => {
+			const run = () => fn(txRepo, uow);
+			return uow?.session === void 0 ? run() : transactionContext.run(uow.session, run);
+		});
 	}
 	/** Assemble the `WriteContext` a `create` verb receives. */
 	writeContext(req, repo = this.repository, uow) {
@@ -1475,8 +1553,10 @@ var BaseCrudController = class {
 		const options = this.queryResolver.resolve(req, this.meta(req));
 		const cached = await this.withListCache(req, options);
 		if (cached) return cached;
+		const result = await this.executeListQuery(options, req);
+		await this.runAfterHook(req, "list", result);
 		return {
-			data: await this.executeListQuery(options, req),
+			data: result,
 			status: 200
 		};
 	}
@@ -1567,6 +1647,7 @@ var BaseCrudController = class {
 		if (cached) return cached;
 		const { doc, reason } = await this.executeGetQuery(id, options, req);
 		if (!doc) this.throwNotFound(reason);
+		await this.runAfterHook(req, "read", doc);
 		return {
 			data: doc,
 			status: 200
@@ -2046,4 +2127,4 @@ function TreeMixin(Base) {
 */
 var BaseController = class extends SoftDeleteMixin(TreeMixin(SlugMixin(BulkMixin(BaseCrudController)))) {};
 //#endregion
-export { BulkMixin as a, collectReadBlockedFields as c, isWriteVerbCapable as d, BodySanitizer as f, SlugMixin as i, isFieldReadable as l, AccessControl as m, TreeMixin as n, BaseCrudController as o, DEFAULT_FIELD_WRITE_DENIAL_POLICY as p, SoftDeleteMixin as r, QueryResolver as s, BaseController as t, detectOverriddenWriteSlots as u };
+export { BulkMixin as a, collectReadBlockedFields as c, isWriteVerbCapable as d, BodySanitizer as f, toRepositoryFilter as g, nativePolicyFilter as h, SlugMixin as i, isFieldReadable as l, AccessControl as m, TreeMixin as n, BaseCrudController as o, DEFAULT_FIELD_WRITE_DENIAL_POLICY as p, SoftDeleteMixin as r, QueryResolver as s, BaseController as t, detectOverriddenWriteSlots as u };

package/dist/{EventTransport-tq4CEB-q.mjs → EventTransport-D23Uvhg4.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-DqXkMXkB.mjs → HookSystem-DgwxNZTx.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-koISNyQo.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System
@@ -116,9 +116,11 @@ var HookSystem = class {
 	}
 	async execute(ctx) {
 		const key = this.getKey(ctx.resource, ctx.operation, ctx.phase);
-		const hooks = this.hooks.get(key) ?? [];
+		const hooks = this.hooks.get(key);
 		const wildcardKey = this.getKey("*", ctx.operation, ctx.phase);
-		let allHooks = [...this.hooks.get(wildcardKey) ?? [], ...hooks];
+		const wildcardHooks = this.hooks.get(wildcardKey);
+		if (!hooks?.length && !wildcardHooks?.length) return ctx.data;
+		let allHooks = [...wildcardHooks ?? [], ...hooks ?? []];
 		allHooks.sort((a, b) => a.priority - b.priority);
 		if (allHooks.some((h) => h.dependsOn?.length)) allHooks = this.topologicalSort(allHooks);
 		let result = ctx.data;

package/dist/{ResourceRegistry-DoALUlOO.mjs → ResourceRegistry-DNuYVbmv.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import "./constants-BxCoxmiN.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import "./constants-DUoKAGYD.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{pipeline-q69DZzgG.mjs → actionPermissions-D97DniUQ.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CoqIRrkY.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-xQAi5bPF.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-B8lwJv9Q.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DdP225wt.mjs";
+import { t as executePipeline } from "./pipe-Cjy1UiXX.mjs";
+import { t as buildRequestScopeProjection } from "./projection-koISNyQo.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -323,4 +323,27 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t };
+//#region src/core/actionPermissions.ts
+/**
+* Return the effective `PermissionCheck` for a single action, or `undefined`
+* when the resource declares no gate at any level.
+*
+* Callers decide what "no gate" means:
+*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
+*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
+*     two surfaces fail closed identically so MCP can't expose an
+*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
+*     run).
+*   - OpenAPI: docs advertise the endpoint as unauthenticated.
+*/
+function resolveActionPermission(input) {
+	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
+	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
+	if (explicit) return explicit;
+	if (resourceActionPermissions) return resourceActionPermissions;
+	if (globalAuth) return globalAuth;
+	const updateFallback = resourcePermissions?.update;
+	if (updateFallback) return updateFallback;
+}
+//#endregion
+export { createCrudHandlers as a, getControllerContext as c, resolvePipelineSteps as i, getControllerScope as l, buildActionPipelineHandler as n, createFastifyHandler as o, buildPipelineHandler as r, createRequestContext as s, resolveActionPermission as t, sendControllerResponse as u };

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import { d as UserBase } from "../base-Csjc2oF-.mjs";
-import "../index-BcR2bFZQ.mjs";
+import { d as UserBase } from "../base-C-NL2fTi.mjs";
+import "../index-C01wWGJt.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-D2HwJM2z.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-BcR2bFZQ.mjs";
+import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-C01wWGJt.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { o as toJsonSchema } from "../schemaConverter-XH1RZRyu.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DDKni6Tz.mjs";
+import { n as requireSingleHeaderValue } from "../headers-DKslnhey.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-xQAi5bPF.mjs";
+import { o as toJsonSchema } from "../schemaConverter-gg0_aUPF.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-DgPrZsJh.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-CMMLWmuZ.mjs → authorizationDecision-EsiY3nUu.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
+import { t as ArcError } from "./errors-DDKni6Tz.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{base-Csjc2oF-.d.mts → base-C-NL2fTi.d.mts}

@@ -1,5 +1,5 @@
 
-import { i as RequestScope } from "./types-ChuShpCP.mjs";
+import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
 import { FastifyRequest } from "fastify";
 //#region src/utils/userHelpers.d.ts
 /**
@@ -169,6 +169,21 @@ type PermissionCheck<TDoc = Record<string, unknown>> = ((context: PermissionCont
 interface PermissionCheckMeta {
   /** Set by allowPublic() — marks the endpoint as publicly accessible */
   _isPublic?: boolean;
+  /**
+   * Set by `denyAll()` — nobody passes this gate, ever.
+   *
+   * Marked because `denyAll` used to return a BARE closure with no metadata, and
+   * introspection reads metadata: `describePermission` found no `_isPublic`, no
+   * `_roles` and no scope, and fell through to its last branch —
+   * `{ kind: "authenticated" }`. So the most restrictive gate in the library was
+   * published to permission UIs and audits as "any signed-in user may do this",
+   * which is the exact opposite of what it does.
+   *
+   * The enforcement path was always correct; only the DESCRIPTION lied. That is
+   * the dangerous direction: a dashboard renders the button, every click 403s,
+   * and an access audit reports a surface that does not exist.
+   */
+  _isDenied?: boolean;
   /**
    * Set by requireAuth() — a pure identity gate (must be signed in) that adds NO
    * row-level or environmental condition. Marked so `allOf` does not mistake it

package/dist/{buildHandler-BrdYrG_1.mjs → buildHandler-Dohd2JuY.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { n as toRepositoryFilter } from "./repositoryFilter-BANpz6BX.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CdQlz52F.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-EsiY3nUu.mjs";
+import { g as toRepositoryFilter } from "./BaseController-CTJKm6Cb.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DI3L5V9w.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-WeKvY1dE.mjs";
-import { t as MemoryCacheStore } from "../memory-qYSB7rMQ.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DhsZ0ZIc.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-BcNl12HN.mjs";
+import { t as MemoryCacheStore } from "../memory-BU-C-MV3.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DHueQT9O.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-BcGmvnHh.mjs → caching-CP3GLJ7U.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-BcR2bFZQ.mjs";
+import { L as RequestWithExtras } from "../index-C01wWGJt.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BcTumAz_.mjs";
+import { t as ArcModule } from "../types-DDD5RKTu.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-CoqIRrkY.mjs";
-import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
-import { t as defineModule } from "../module-CwKsgZXp.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-B8lwJv9Q.mjs";
+import { t as defineResource } from "../defineResource-DWzjyxb2.mjs";
+import { t as defineModule } from "../module-CQNHzE7g.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-BcR2bFZQ.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-C01wWGJt.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BxCoxmiN.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-DoALUlOO.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-DUoKAGYD.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-DNuYVbmv.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-CkV5mQ53.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DwaxNcE2.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-RpNbPBL-.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-VYPGSas8.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-DiB0nHPR.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-B1bKdcV9.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-mdJ-v4Xp.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-LuGxIbQ_.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DwaxNcE2.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-VYPGSas8.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-DiB0nHPR.mjs";
-import { t as init } from "../init-mdJ-v4Xp.mjs";
+import { t as generate } from "../generate-B1bKdcV9.mjs";
+import { t as init } from "../init-LuGxIbQ_.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-BxCoxmiN.mjs → constants-DUoKAGYD.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.d.mts

@@ -1,5 +1,6 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
+import { CacheAdapter } from "@classytic/repo-core/cache";
 //#region src/context/requestContext.d.ts
 /**
  * Shape of the request-scoped context store.
@@ -85,6 +86,20 @@ declare const requestContext: {
  */
 declare function getTraceHeaders(): Record<string, string> | undefined;
 //#endregion
+//#region src/context/requestScopedCache.d.ts
+/**
+ * The cache for the CURRENT request, or `undefined` outside one.
+ *
+ * Lazily created on first use, so a request that never touches a cached
+ * repository allocates nothing.
+ */
+declare function requestScopedCache(): CacheAdapter | undefined;
+/**
+ * Whether the current request has allocated a cache yet. Diagnostics and
+ * tests only — never branch application behaviour on this.
+ */
+declare function hasRequestScopedCache(): boolean;
+//#endregion
 //#region src/context/transactionContext.d.ts
 /** DB session/transaction handle. Typed as unknown — arc is DB-agnostic. */
 type DbSession = unknown;
@@ -109,4 +124,4 @@ declare const transactionContext: {
   storage: AsyncLocalStorage<unknown>;
 };
 //#endregion
-export { type DbSession, type RequestStore, getTraceHeaders, requestContext, transactionContext };
+export { type DbSession, type RequestStore, getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, transactionContext };

package/dist/context/index.mjs

@@ -1,4 +1,64 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-uYE35JxI.mjs";
-import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
-export { getTraceHeaders, requestContext, transactionContext };
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-B93dmpf0.mjs";
+import { t as transactionContext } from "../transactionContext-D2HwJM2z.mjs";
+//#region src/context/requestScopedCache.ts
+/**
+* The slot the per-request store hangs off. Underscore-prefixed to sit apart
+* from the fields arc's own hooks populate on `RequestStore`.
+*/
+const SLOT = "_requestCache";
+/**
+* A `Map`-backed `CacheAdapter` with NO eviction and NO TTL — both deliberate.
+*
+* The store is unreachable once the request's async context ends, so it is
+* garbage in milliseconds and bounded by what one request touches; an LRU
+* would guard a lifetime that cannot occur. TTL is accepted and ignored
+* because repo-core stamps freshness INTO the envelope and re-checks on read —
+* honouring it here too would put two clocks on one question.
+*/
+function createRequestCacheAdapter() {
+	const map = /* @__PURE__ */ new Map();
+	return {
+		async get(key) {
+			return map.get(key);
+		},
+		async set(key, value, _ttlSeconds) {
+			map.set(key, value);
+		},
+		async delete(key) {
+			map.delete(key);
+		},
+		/**
+		* Ignores the pattern and wipes the whole store. Over-invalidating within
+		* one request costs at most a re-read; pattern matching is complexity a
+		* store that dies in milliseconds does not earn.
+		*/
+		async clear(_pattern) {
+			map.clear();
+		}
+	};
+}
+/**
+* The cache for the CURRENT request, or `undefined` outside one.
+*
+* Lazily created on first use, so a request that never touches a cached
+* repository allocates nothing.
+*/
+function requestScopedCache() {
+	const store = requestContext.get();
+	if (!store) return void 0;
+	const existing = store[SLOT];
+	if (existing) return existing;
+	const created = createRequestCacheAdapter();
+	store[SLOT] = created;
+	return created;
+}
+/**
+* Whether the current request has allocated a cache yet. Diagnostics and
+* tests only — never branch application behaviour on this.
+*/
+function hasRequestScopedCache() {
+	return requestContext.get()?.[SLOT] !== void 0;
+}
+//#endregion
+export { getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, transactionContext };

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-BcR2bFZQ.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-CFAJEWCX.mjs";
+import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-C01wWGJt.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-RdpLP71b.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,9 +1,8 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BxCoxmiN.mjs";
-import { t as nativePolicyFilter } from "../repositoryFilter-BANpz6BX.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CbkuhNI2.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-ZhuLonLm.mjs";
-import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-q69DZzgG.mjs";
-import { t as defineAggregation } from "../defineAggregation-Nv-DwfOf.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-BYKa8wHu.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DUoKAGYD.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CTJKm6Cb.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DWzjyxb2.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-D97DniUQ.mjs";
+import { t as defineAggregation } from "../defineAggregation-CpQfcM8R.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-DTXsiNTJ.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };