@classytic/arc 2.37.0 → 2.38.0

package/dist/{BaseController-B5GZfUBy.mjs → BaseController-CYaDvmOB.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-CUpamQMJ.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BONghE1Y.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-DgyWdav8.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DsdZc1Xv.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-DU_Z5OBA.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-lDs9oF4z.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Bhp7WrRF.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-DvGz47Ul.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-sXGFLegw.mjs";
-import { t as buildQueryKey } from "./keys-DoUI9-yP.mjs";
-import { t as transactionContext } from "./transactionContext-Ca5peQpc.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-2ExmOgIJ.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-CXySQFRg.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-B7qVjQBv.mjs";
+import { t as buildQueryKey } from "./keys-BSuxGS-B.mjs";
+import { t as transactionContext } from "./transactionContext-DMmvcfdo.mjs";
+import { A as scheduleBackground, E as ArcQueryParser } from "./utils-BbGG8XNT.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-Cha2QCKH.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
@@ -944,26 +944,27 @@ var QueryResolver = class {
 	* Mongoose uses space-separated strings, SQL adapters may use arrays.
 	*/
 	sanitizeSelectAny(select, schemaOptions) {
-		if (!select) return void 0;
 		const blockedFields = this.getBlockedFields(schemaOptions);
 		if (blockedFields.length === 0) return select;
+		const exclusion = () => Object.fromEntries(blockedFields.map((field) => [field, 0]));
+		if (!select) return exclusion();
 		if (typeof select === "object" && !Array.isArray(select)) {
 			const sanitized = {};
 			for (const [field, val] of Object.entries(select)) if (!blockedFields.includes(field)) sanitized[field] = val;
-			return Object.keys(sanitized).length > 0 ? sanitized : void 0;
+			return Object.keys(sanitized).length > 0 ? sanitized : exclusion();
 		}
 		if (Array.isArray(select)) {
 			const sanitized = select.filter((f) => {
 				const fieldName = f.replace(/^-/, "");
 				return !blockedFields.includes(fieldName);
 			});
-			return sanitized.length > 0 ? sanitized : void 0;
+			return sanitized.length > 0 ? sanitized : exclusion();
 		}
 		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => {
 			const fieldName = f.replace(/^-/, "");
 			return !blockedFields.includes(fieldName);
 		});
-		return sanitized.length > 0 ? sanitized.join(" ") : void 0;
+		return sanitized.length > 0 ? sanitized.join(" ") : exclusion();
 	}
 	/** Sanitize populate fields */
 	sanitizePopulate(populate, schemaOptions) {

package/dist/{EventTransport-BEVP50ka.d.mts → EventTransport-Cx60_s-6.d.mts}

@@ -19,6 +19,41 @@ interface MemoryEventTransportOptions {
    * handlers must be idempotent. Every handler runs before the rejection.
    */
   onHandlerError?: "log" | "throw";
+  /**
+   * Whether independent subscribers run one at a time or together.
+   *
+   * - `'sequential'` (default) — handler N+1 starts after handler N settles.
+   * - `'parallel'` — all matching handlers start together; `publish()` resolves
+   *   when the last settles.
+   *
+   * Same delivery and the same failure semantics either way: every handler
+   * still receives the event, every failure is still collected, and `'throw'`
+   * still rejects with one `AggregateError` after all of them have run.
+   *
+   * **Opting in requires an AUDIT, not an assumption.** Every other transport
+   * in this package runs matching handlers sequentially in registration order
+   * (`redis-stream.ts` states it outright; `redis.ts` implements it), so an app
+   * relying on that order is relying on documented behaviour — switching this
+   * on is what breaks it, and swapping to a broker would not have surfaced it.
+   * Confirm no subscriber reads another subscriber's write before enabling.
+   *
+   * Measured on one order placement: 6 subscribers, each spending most of its
+   * time on its own round trips, cost 2.8s sequentially — the length of the
+   * QUEUE, not of the work.
+   */
+  handlerDispatch?: "sequential" | "parallel";
+  /**
+   * Cap on handlers running at once under `'parallel'`. Default: unlimited.
+   *
+   * Sequential dispatch was an accidental per-publish rate limiter on whatever
+   * pool the handlers share; removing it converts a latency problem into a
+   * saturation one when several publishes overlap. `RedisStreamTransport`
+   * exposes `processingConcurrency` for the same reason — this is its peer, so
+   * an operator has a dial rather than only "queued" or "all at once".
+   *
+   * Ignored under `'sequential'`, which is already a concurrency of 1.
+   */
+  handlerConcurrency?: number;
 }
 /**
  * In-memory event transport (default).
@@ -32,6 +67,8 @@ declare class MemoryEventTransport implements EventTransport {
   private handlers;
   private logger;
   private onHandlerError;
+  private handlerDispatch;
+  private handlerConcurrency;
   constructor(options?: MemoryEventTransportOptions);
   publish(event: DomainEvent): Promise<void>;
   /**

package/dist/{EventTransport-pGNNDQ__.mjs → EventTransport-Gq7JWbWw.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -79,20 +79,52 @@ var MemoryEventTransport = class {
 	handlers = /* @__PURE__ */ new Map();
 	logger;
 	onHandlerError;
+	handlerDispatch;
+	handlerConcurrency;
 	constructor(options) {
 		this.logger = options?.logger ?? console;
 		this.onHandlerError = options?.onHandlerError ?? "log";
+		this.handlerDispatch = options?.handlerDispatch ?? "sequential";
+		const cap = options?.handlerConcurrency;
+		if (cap !== void 0 && (!Number.isInteger(cap) || cap < 1)) throw new TypeError(`MemoryEventTransport: handlerConcurrency must be a positive integer, received ${String(cap)}`);
+		this.handlerConcurrency = cap ?? Number.POSITIVE_INFINITY;
 	}
 	async publish(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
 		const failures = [];
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-			failures.push(err);
-		}
+		const run = async (handler) => {
+			try {
+				await handler(event);
+			} catch (err) {
+				failures.push(err);
+				try {
+					this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+				} catch {}
+			}
+		};
+		if (this.handlerDispatch === "parallel") {
+			/**
+			* `allSettled`, not `all`. Correctness must not rest on `run` never
+			* rejecting: `all` short-circuits on the first rejection and resolves
+			* `publish()` while the other handlers are still in flight — detached
+			* work racing the outbox relay's redelivery of the same event. `run` is
+			* written not to reject, and `allSettled` means the next person to add a
+			* timeout or a metric to it cannot silently break that.
+			*/
+			const pending = [...allHandlers];
+			if (this.handlerConcurrency >= pending.length) await Promise.allSettled(pending.map(run));
+			else {
+				let next = 0;
+				const worker = async () => {
+					while (next < pending.length) {
+						const handler = pending[next++];
+						if (handler) await run(handler);
+					}
+				};
+				await Promise.allSettled(Array.from({ length: this.handlerConcurrency }, worker));
+			}
+		} else for (const handler of allHandlers) await run(handler);
 		/**
 		* Rejecting is what lets an OUTBOX see the failure. With this transport,
 		* `publish()` IS the handling — synchronous and in-process — so resolving

package/dist/{HookSystem-CuhHvcyZ.mjs → HookSystem-C0ikzqQf.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-BunxoeON.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-DFOmazXg.mjs → ResourceRegistry-DPcX--zk.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import "./constants-CUpamQMJ.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import "./constants-BONghE1Y.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{actionPermissions-CQQrR4tu.mjs → actionPermissions-jlFZ1it4.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-DU_Z5OBA.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-lDs9oF4z.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DvGz47Ul.mjs";
-import { t as executePipeline } from "./pipe-Dbs3GhOZ.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BunxoeON.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
+import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
+import { t as executePipeline } from "./pipe-SunhEaZ6.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
 import { d as UserBase } from "../base-C-NL2fTi.mjs";
-import "../index-C01wWGJt.mjs";
+import "../index-B78WZom8.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-Ca5peQpc.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DMmvcfdo.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-C01wWGJt.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-B78WZom8.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DsdZc1Xv.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BFu1st_i.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DU_Z5OBA.mjs";
-import { o as toJsonSchema } from "../schemaConverter-C8zbW7tJ.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-DWkl60hx.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-2ExmOgIJ.mjs";
+import { n as requireSingleHeaderValue } from "../headers-DeXNifVj.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CXySQFRg.mjs";
+import { o as toJsonSchema } from "../schemaConverter-Db-MMsH6.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-H7Zcb82Z.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
@@ -668,19 +668,30 @@ async function getMemberRolesByOrg(auth, headers, organizationId) {
 	}
 }
 /**
-* List teams the current user is a member of. Used to validate
-* `activeTeamId` against the membership set before binding it to scope.
+* Teams the current user is a MEMBER of, scoped to one organization. Used to
+* validate `activeTeamId` before binding it to scope.
 *
-* Better Auth 1.6+ exposes this as `auth.api.listUserTeams` (path:
-* `/organization/list-user-teams`). Older 1.5.x exposed
-* `auth.api.listTeams` — kept as a fallback so stubs/older versions still
-* work.
+* `auth.api.listUserTeams` (`/organization/list-user-teams`) is the only name
+* probed. A `listTeams` fallback lived here for "older 1.5.x" and was removed:
+* Better Auth exposes `listUserTeams` and `listOrganizationTeams` on `auth.api`
+* and has never exposed a bare `listTeams` — that is the CLIENT name
+* (`authClient.organization.listTeams`). It could only ever resolve against a
+* test double, which is exactly what it was doing.
+*
+* Do not "restore" it as `listOrganizationTeams`: that endpoint lists every team
+* in the organization, while this one lists the teams the USER belongs to.
+* Validating `activeTeamId` against the org-wide list would admit a team the
+* user is not a member of — the organization check below constrains the org, not
+* membership.
 */
-async function listTeamsDirect(auth, headers) {
-	const fn = pickApiMethod(auth, "listUserTeams", "organization") ?? pickApiMethod(auth, "listTeams", "organization");
+async function listTeamsDirect(auth, headers, organizationId) {
+	const fn = pickApiMethod(auth, "listUserTeams", "organization");
 	if (!fn) return null;
 	try {
-		const result = await fn({ headers });
+		const result = await fn({
+			headers,
+			query: { organizationId }
+		});
 		const teams = Array.isArray(result) ? result : result?.teams;
 		return Array.isArray(teams) ? teams : null;
 	} catch {
@@ -720,6 +731,11 @@ function extractRolesFromMembership(membership) {
 	}
 	return [];
 }
+async function resolveActiveTeamId(input) {
+	const activeTeamId = normalizeId(input.session?.activeTeamId);
+	if (!activeTeamId) return void 0;
+	return (await listTeamsDirect(input.auth, input.headers, input.activeOrgId))?.find((team) => normalizeId(team.id ?? team._id) === activeTeamId && normalizeId(team.organizationId) === input.activeOrgId) ? activeTeamId : void 0;
+}
 /**
 * Create a Better Auth adapter for Arc/Fastify.
 *
@@ -786,7 +802,18 @@ function createBetterAuthAdapter(options) {
 				const requestedOrgId = requireSingleHeaderValue(request.headers, "x-organization-id");
 				const activeOrgId = session?.activeOrganizationId || requestedOrgId;
 				if (activeOrgId) {
-					let orgRoles = await getActiveMemberRoles(auth, headers);
+					/**
+					* `getActiveMember` resolves the member for the SESSION's active
+					* organization, so with no `activeOrganizationId` it cannot succeed —
+					* it throws `No active organization`, which the helper swallows into
+					* `null` after paying the full endpoint round trip.
+					*
+					* A bearer-only deployment never calls `setActive`, so that was every
+					* request: ~440ms spent to learn what the session already said, before
+					* the ~870ms header-based lookup that actually answers. Ask the
+					* session first; it is already in hand.
+					*/
+					let orgRoles = session?.activeOrganizationId ? await getActiveMemberRoles(auth, headers) : null;
 					if (!orgRoles) orgRoles = await getMemberRolesByOrg(auth, headers, activeOrgId);
 					if (orgRoles) {
 						const scope = {
@@ -796,10 +823,13 @@ function createBetterAuthAdapter(options) {
 							organizationId: activeOrgId,
 							orgRoles
 						};
-						const activeTeamId = session?.activeTeamId;
-						if (activeTeamId) {
-							if ((await listTeamsDirect(auth, headers))?.some((t) => normalizeId(t.id) === activeTeamId)) scope.teamId = activeTeamId;
-						}
+						const activeTeamId = await resolveActiveTeamId({
+							auth,
+							headers,
+							session,
+							activeOrgId
+						});
+						if (activeTeamId) scope.teamId = activeTeamId;
 						req.scope = scope;
 					}
 				}
@@ -843,15 +873,36 @@ function createBetterAuthAdapter(options) {
 				const requestedOrgId = requireSingleHeaderValue(request.headers, "x-organization-id");
 				const activeOrgId = session?.activeOrganizationId || requestedOrgId;
 				if (activeOrgId) {
-					let orgRoles = await getActiveMemberRoles(auth, headers);
+					/**
+					* `getActiveMember` resolves the member for the SESSION's active
+					* organization, so with no `activeOrganizationId` it cannot succeed —
+					* it throws `No active organization`, which the helper swallows into
+					* `null` after paying the full endpoint round trip.
+					*
+					* A bearer-only deployment never calls `setActive`, so that was every
+					* request: ~440ms spent to learn what the session already said, before
+					* the ~870ms header-based lookup that actually answers. Ask the
+					* session first; it is already in hand.
+					*/
+					let orgRoles = session?.activeOrganizationId ? await getActiveMemberRoles(auth, headers) : null;
 					if (!orgRoles) orgRoles = await getMemberRolesByOrg(auth, headers, activeOrgId);
-					if (orgRoles) req.scope = {
-						kind: "member",
-						userId: optUserId,
-						userRoles: optUserRoles,
-						organizationId: activeOrgId,
-						orgRoles
-					};
+					if (orgRoles) {
+						const scope = {
+							kind: "member",
+							userId: optUserId,
+							userRoles: optUserRoles,
+							organizationId: activeOrgId,
+							orgRoles
+						};
+						const activeTeamId = await resolveActiveTeamId({
+							auth,
+							headers,
+							session,
+							activeOrgId
+						});
+						if (activeTeamId) scope.teamId = activeTeamId;
+						req.scope = scope;
+					}
 				}
 			}
 		} catch (err) {

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-DgyWdav8.mjs → authorizationDecision-BP8GHtjc.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-DsdZc1Xv.mjs";
+import { t as ArcError } from "./errors-2ExmOgIJ.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{buildHandler-D2DkqtiY.mjs → buildHandler-DjXOqIvX.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-DgyWdav8.mjs";
-import { g as toRepositoryFilter } from "./BaseController-B5GZfUBy.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-qK_-7MVk.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
+import { g as toRepositoryFilter } from "./BaseController-CYaDvmOB.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CidSeUrx.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-DoUI9-yP.mjs";
-import { t as MemoryCacheStore } from "../memory-BnafVem_.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BYqmg89O.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-BSuxGS-B.mjs";
+import { t as MemoryCacheStore } from "../memory-BiPVaCPg.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-oTsmVyEQ.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-BmC2T-pX.mjs → caching-a3ZEcJJs.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-C01wWGJt.mjs";
+import { L as RequestWithExtras } from "../index-B78WZom8.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BMa2EPtv.mjs";
+import { t as ArcModule } from "../types-BRU-Kd3t.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-lDs9oF4z.mjs";
-import { t as defineResource } from "../defineResource-WcbE1kJL.mjs";
-import { t as defineModule } from "../module-DIvG8qOg.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-BqLyyH0o.mjs";
+import { t as defineResource } from "../defineResource-BMdyRelW.mjs";
+import { t as defineModule } from "../module-BQXHxMEk.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-C01wWGJt.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-B78WZom8.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-CUpamQMJ.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-DFOmazXg.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BONghE1Y.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-DPcX--zk.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-D_i6CifU.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-CPCZiX9n.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-Dxc8RLy_.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DNj8cpiY.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-D7CIIWhS.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-BUP4Oydg.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-BMgU1wYR.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-Dg_Am2o_.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-CPCZiX9n.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DNj8cpiY.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-D7CIIWhS.mjs";
-import { t as init } from "../init-BMgU1wYR.mjs";
+import { t as generate } from "../generate-BUP4Oydg.mjs";
+import { t as init } from "../init-Dg_Am2o_.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-CUpamQMJ.mjs → constants-BONghE1Y.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-DGM7EZRI.mjs";
-import { t as transactionContext } from "../transactionContext-Ca5peQpc.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DMmvcfdo.mjs";
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-DpmntRZy.mjs";
 //#region src/context/requestScopedCache.ts
 /**
 * The slot the per-request store hangs off. Underscore-prefixed to sit apart

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-C01wWGJt.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-du18bJjH.mjs";
+import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-B78WZom8.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-BRoDtjek.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-CUpamQMJ.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-B5GZfUBy.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-WcbE1kJL.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-CQQrR4tu.mjs";
-import { t as defineAggregation } from "../defineAggregation-cCitY2FA.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-C8GWw-Iu.mjs";
+/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BONghE1Y.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CYaDvmOB.mjs";
+import { t as defineAggregation } from "../defineAggregation-0KBvqEEC.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-jlFZ1it4.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-BMdyRelW.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-8She7FgF.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };