@classytic/arc 2.37.1 → 2.40.0

package/dist/{BaseController-Chkf0Aiw.mjs → BaseController-BqJtbiUA.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DDKf25s4.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BQ2FbhPB.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BzZi2bsf.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-CbxCF9M0.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-Bi97zMEl.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-khJmBErP.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cr1F8jKZ.mjs";
-import { t as buildQueryKey } from "./keys-B1MgfDWi.mjs";
-import { t as transactionContext } from "./transactionContext-6F7Gkbxg.mjs";
-import { A as scheduleBackground, E as ArcQueryParser } from "./utils-WlLDIKuw.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-f_MdWDl_.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-BHD3L8of.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-DLueLQdQ.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cldubvul.mjs";
+import { t as buildQueryKey } from "./keys-Ds3ekBiu.mjs";
+import { t as transactionContext } from "./transactionContext-46KyUADP.mjs";
+import { A as scheduleBackground, E as ArcQueryParser } from "./utils-CUFBrhq-.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-fA-Dkou5.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
@@ -650,7 +650,7 @@ async function executeAfterHook(ctx, op, data, meta) {
 * Every mixin used to spell out its own narrowing cast inline:
 *
 * ```ts
-* const repo = this.repository as unknown as {
+* const repo = this.repository as {
 *   getTree?: (options?: unknown) => Promise<AnyRecord[]>;
 * };
 * ```
@@ -717,7 +717,7 @@ async function runDistinctVerb(repository, field, resolveScope) {
 	const repo = withRepoFeatures(repository);
 	if (typeof repo.distinct !== "function") throw createError(501, "_distinct is not supported: the resource's storage adapter does not implement repo.distinct()");
 	const { filter, options } = resolveScope();
-	return await repo.distinct(field, filter, options);
+	return { values: await repo.distinct(field, filter, options) };
 }
 /**
 * `?_exists=true` → `repo.exists(filter)`. Returns the RAW repo result —
@@ -789,6 +789,27 @@ function noteDeniedJoins(kind) {
 	notedDeniedJoins = true;
 	log.warn(`client requested ${kind} but no allowlist is configured — DENIED (2.24 default flip; it was allow-all). Set schemaOptions.query.allowedPopulate / allowedLookups to enable client-driven joins. (dev-only note, shown once)`);
 }
+/**
+* A `$lookup` reaches ANOTHER collection, and the tenant filter arc conjoins applies to the
+* BASE one only. The joined side carries whatever predicate the lookup itself names and
+* nothing more — no tenant scope, no soft-delete filter — so a resource that opens
+* `allowedLookups` can return rows from a collection the caller could not query directly.
+*
+* Unreachable by default (2.24 denies `lookup=` with no allowlist) and no resource in this
+* fleet configures one, so this is a WARNING at the moment a deployment first opts in
+* rather than machinery for a door nobody has opened. Warned once per collection set: the
+* decision is made when the allowlist is written, not per request.
+*
+* Scope the join with the lookup's own `where`, which mongokit compiles into a `$match`
+* inside the lookup pipeline.
+*/
+const notedUnscopedJoins = /* @__PURE__ */ new Set();
+function noteUnscopedJoin(lookups) {
+	const key = lookups.map((l) => l.from).filter((f) => typeof f === "string").sort().join(",");
+	if (key.length === 0 || notedUnscopedJoins.has(key)) return;
+	notedUnscopedJoins.add(key);
+	log.warn(`client-driven $lookup on [${key}] — the JOINED side carries no tenant or soft-delete filter (arc scopes the base collection only). Narrow each lookup with its own \`where\`, or the join can surface rows the caller cannot query directly. (shown once)`);
+}
 var QueryResolver = class {
 	queryParser;
 	maxLimit;
@@ -912,6 +933,12 @@ var QueryResolver = class {
 			query = rest;
 		}
 		const parsed = this.queryParser.parse(query);
+		/**
+		* Client-supplied keys only, and BEFORE the policy conjunction below: trusted policy
+		* legitimately filters on hidden fields (`requireOwnership('userId')` emits exactly that),
+		* so checking the conjoined result would reject the framework's own restrictions.
+		*/
+		this.assertNoBlockedReadKeys(parsed.filters, parsed.sort);
 		const arcContext = meta ?? req.metadata;
 		const limit = Math.min(Math.max(1, parsed.limit || this.defaultLimit), this.maxLimit);
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
@@ -950,20 +977,14 @@ var QueryResolver = class {
 		if (!select) return exclusion();
 		if (typeof select === "object" && !Array.isArray(select)) {
 			const sanitized = {};
-			for (const [field, val] of Object.entries(select)) if (!blockedFields.includes(field)) sanitized[field] = val;
+			for (const [field, val] of Object.entries(select)) if (!this.isBlockedProjection(field, blockedFields)) sanitized[field] = val;
 			return Object.keys(sanitized).length > 0 ? sanitized : exclusion();
 		}
 		if (Array.isArray(select)) {
-			const sanitized = select.filter((f) => {
-				const fieldName = f.replace(/^-/, "");
-				return !blockedFields.includes(fieldName);
-			});
+			const sanitized = select.filter((f) => !this.isBlockedProjection(f, blockedFields));
 			return sanitized.length > 0 ? sanitized : exclusion();
 		}
-		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => {
-			const fieldName = f.replace(/^-/, "");
-			return !blockedFields.includes(fieldName);
-		});
+		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => !this.isBlockedProjection(f, blockedFields));
 		return sanitized.length > 0 ? sanitized.join(" ") : exclusion();
 	}
 	/** Sanitize populate fields */
@@ -1011,6 +1032,7 @@ var QueryResolver = class {
 			if (!allowedLookups.includes(lookup.from)) return false;
 			return true;
 		});
+		if (sanitized.length > 0) noteUnscopedJoin(sanitized);
 		return sanitized.length > 0 ? sanitized : void 0;
 	}
 	/**
@@ -1023,6 +1045,68 @@ var QueryResolver = class {
 		const blocked = collectReadBlockedFields(schemaOptions);
 		return blocked ? Array.from(blocked) : [];
 	}
+	/**
+	* Is this projection path blocked — by its own name, or by a hidden ANCESTOR?
+	*
+	* `hidden: { secret: true }` hides the object, and an exact-name match left its children
+	* reachable: `?select=secret.value` projected the very field the rule exists to withhold.
+	* A rule on a parent covers everything under it, which is what "hidden" already means to
+	* whoever wrote it.
+	*/
+	isBlockedProjection(path, blockedFields) {
+		const field = path.replace(/^-/, "");
+		return blockedFields.some((blocked) => field === blocked || field.startsWith(`${blocked}.`));
+	}
+	/**
+	* Refuse a read that FILTERS or SORTS on a `hidden` field.
+	*
+	* `hidden` was enforced on the surfaces that RETURN a value — the response, `select=`,
+	* `_distinct`, aggregations — but a filter key never returns the field, it INTERROGATES it:
+	* `?passwordHash[like]=^ab` narrows the result set, so the row count answers a question about
+	* a value the caller may not read. A resource with no `allowedFilterFields` was a blind
+	* existence oracle over every hidden field it declared.
+	*
+	* Rejected rather than dropped, unlike `select`. Dropping a projection narrows what comes
+	* back; dropping a filter WIDENS the rows, which is the silent-permissive shape this
+	* framework fails loudly on everywhere else.
+	*
+	* Compound keys (`$or`, `$and`) are walked, because the offending key can be nested inside
+	* one. A dotted path is blocked by its own name or by a hidden ancestor, so a rule on
+	* `secret` also covers `secret.value`.
+	*/
+	assertNoBlockedReadKeys(filters, sort) {
+		const blocked = collectReadBlockedFields(this.schemaOptions);
+		if (!blocked) return;
+		const offenders = /* @__PURE__ */ new Set();
+		const isBlocked = (key) => {
+			if (blocked.has(key)) return true;
+			const dot = key.indexOf(".");
+			return dot > 0 && blocked.has(key.slice(0, dot));
+		};
+		const walk = (node, depth) => {
+			if (depth > 8 || !node || typeof node !== "object") return;
+			if (Array.isArray(node)) {
+				for (const item of node) walk(item, depth + 1);
+				return;
+			}
+			for (const [key, value] of Object.entries(node)) {
+				if (key.startsWith("$")) {
+					walk(value, depth + 1);
+					continue;
+				}
+				if (isBlocked(key)) offenders.add(key);
+			}
+		};
+		walk(filters, 0);
+		const sortKeys = typeof sort === "string" ? sort.split(",").map((s) => s.trim().replace(/^-/, "")).filter(Boolean) : Object.keys(sort ?? {});
+		for (const key of sortKeys) if (isBlocked(key)) offenders.add(key);
+		if (offenders.size === 0) return;
+		const fields = [...offenders];
+		throw new ValidationError(`Cannot filter or sort on hidden field(s): ${fields.join(", ")}`, fields.map((field) => ({
+			field,
+			message: "Field is not readable"
+		})));
+	}
 };
 //#endregion
 //#region src/core/BaseCrudController.ts
@@ -1550,7 +1634,7 @@ var BaseCrudController = class {
 	}
 	async list(req) {
 		const dispatch = this.dispatchResourceVerb(req);
-		if (dispatch) return dispatch;
+		if (dispatch !== null) return dispatch;
 		const options = this.queryResolver.resolve(req, this.meta(req));
 		const cached = await this.withListCache(req, options);
 		if (cached) return cached;

package/dist/{EventTransport-BEVP50ka.d.mts → EventTransport-BPOQsEer.d.mts}

@@ -19,6 +19,41 @@ interface MemoryEventTransportOptions {
    * handlers must be idempotent. Every handler runs before the rejection.
    */
   onHandlerError?: "log" | "throw";
+  /**
+   * Whether independent subscribers run one at a time or together.
+   *
+   * - `'sequential'` (default) — handler N+1 starts after handler N settles.
+   * - `'parallel'` — all matching handlers start together; `publish()` resolves
+   *   when the last settles.
+   *
+   * Same delivery and the same failure semantics either way: every handler
+   * still receives the event, every failure is still collected, and `'throw'`
+   * still rejects with one `AggregateError` after all of them have run.
+   *
+   * **Opting in requires an AUDIT, not an assumption.** Every other transport
+   * in this package runs matching handlers sequentially in registration order
+   * (`redis-stream.ts` states it outright; `redis.ts` implements it), so an app
+   * relying on that order is relying on documented behaviour — switching this
+   * on is what breaks it, and swapping to a broker would not have surfaced it.
+   * Confirm no subscriber reads another subscriber's write before enabling.
+   *
+   * Measured on one order placement: 6 subscribers, each spending most of its
+   * time on its own round trips, cost 2.8s sequentially — the length of the
+   * QUEUE, not of the work.
+   */
+  handlerDispatch?: "sequential" | "parallel";
+  /**
+   * Cap on handlers running at once under `'parallel'`. Default: unlimited.
+   *
+   * Sequential dispatch was an accidental per-publish rate limiter on whatever
+   * pool the handlers share; removing it converts a latency problem into a
+   * saturation one when several publishes overlap. `RedisStreamTransport`
+   * exposes `processingConcurrency` for the same reason — this is its peer, so
+   * an operator has a dial rather than only "queued" or "all at once".
+   *
+   * Ignored under `'sequential'`, which is already a concurrency of 1.
+   */
+  handlerConcurrency?: number;
 }
 /**
  * In-memory event transport (default).
@@ -32,8 +67,18 @@ declare class MemoryEventTransport implements EventTransport {
   private handlers;
   private logger;
   private onHandlerError;
+  private handlerDispatch;
+  private handlerConcurrency;
   constructor(options?: MemoryEventTransportOptions);
+  /**
+   * One work scope per publish, around the WHOLE handler set — so every
+   * handler of this event, parallel or not, shares one `requestScopedCache()`
+   * and one correlation id. Inherits an active request scope (a live
+   * in-request dispatch keeps the request's reads); a relay- or job-driven
+   * publish gets its own.
+   */
   publish(event: DomainEvent): Promise<void>;
+  private dispatch;
   /**
    * Reference `publishMany` implementation — delegates to `publish()` in order.
    *

package/dist/{EventTransport-CFdtK25P.mjs → EventTransport-BUkTwY_x.mjs}

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-CoGpuzDX.mjs";
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -79,20 +80,62 @@ var MemoryEventTransport = class {
 	handlers = /* @__PURE__ */ new Map();
 	logger;
 	onHandlerError;
+	handlerDispatch;
+	handlerConcurrency;
 	constructor(options) {
 		this.logger = options?.logger ?? console;
 		this.onHandlerError = options?.onHandlerError ?? "log";
+		this.handlerDispatch = options?.handlerDispatch ?? "sequential";
+		const cap = options?.handlerConcurrency;
+		if (cap !== void 0 && (!Number.isInteger(cap) || cap < 1)) throw new TypeError(`MemoryEventTransport: handlerConcurrency must be a positive integer, received ${String(cap)}`);
+		this.handlerConcurrency = cap ?? Number.POSITIVE_INFINITY;
 	}
-	async publish(event) {
+	/**
+	* One work scope per publish, around the WHOLE handler set — so every
+	* handler of this event, parallel or not, shares one `requestScopedCache()`
+	* and one correlation id. Inherits an active request scope (a live
+	* in-request dispatch keeps the request's reads); a relay- or job-driven
+	* publish gets its own.
+	*/
+	publish(event) {
+		return runWorkScope(workSeedFromEvent(event), () => this.dispatch(event));
+	}
+	async dispatch(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
 		const failures = [];
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-			failures.push(err);
-		}
+		const run = async (handler) => {
+			try {
+				await handler(event);
+			} catch (err) {
+				failures.push(err);
+				try {
+					this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+				} catch {}
+			}
+		};
+		if (this.handlerDispatch === "parallel") {
+			/**
+			* `allSettled`, not `all`. Correctness must not rest on `run` never
+			* rejecting: `all` short-circuits on the first rejection and resolves
+			* `publish()` while the other handlers are still in flight — detached
+			* work racing the outbox relay's redelivery of the same event. `run` is
+			* written not to reject, and `allSettled` means the next person to add a
+			* timeout or a metric to it cannot silently break that.
+			*/
+			const pending = [...allHandlers];
+			if (this.handlerConcurrency >= pending.length) await Promise.allSettled(pending.map(run));
+			else {
+				let next = 0;
+				const worker = async () => {
+					while (next < pending.length) {
+						const handler = pending[next++];
+						if (handler) await run(handler);
+					}
+				};
+				await Promise.allSettled(Array.from({ length: this.handlerConcurrency }, worker));
+			}
+		} else for (const handler of allHandlers) await run(handler);
 		/**
 		* Rejecting is what lets an OUTBOX see the failure. With this transport,
 		* `publish()` IS the handling — synchronous and in-process — so resolving

package/dist/{HookSystem-Csy31WS-.mjs → HookSystem-96nzZLmk.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-CRCM5S9T.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-OQA13slI.mjs → ResourceRegistry-B9WnuG2Q.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import "./constants-DDKf25s4.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import "./constants-BQ2FbhPB.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{actionPermissions-DGGqqSIV.mjs → actionPermissions-4OGbe3Hf.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-Bi97zMEl.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-khJmBErP.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-f_MdWDl_.mjs";
-import { t as buildRequestScopeProjection } from "./projection-CRCM5S9T.mjs";
-import { t as executePipeline } from "./pipe-BoV-z4db.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
+import { t as executePipeline } from "./pipe-4_XamfxI.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
 import { d as UserBase } from "../base-C-NL2fTi.mjs";
-import "../index-BqRfP1kT.mjs";
+import "../index-D3sIPcD4.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-6F7Gkbxg.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-46KyUADP.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-BqRfP1kT.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-D3sIPcD4.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-CbxCF9M0.mjs";
-import { n as requireSingleHeaderValue } from "../headers-DivLPMHe.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Bi97zMEl.mjs";
-import { o as toJsonSchema } from "../schemaConverter-cXTayNOW.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-DnAc6zoZ.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue } from "../headers-BFEEshDS.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DLueLQdQ.mjs";
+import { o as toJsonSchema } from "../schemaConverter-DENbixyA.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-C0GpDsB_.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-BzZi2bsf.mjs → authorizationDecision-D_LFvMlm.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-CbxCF9M0.mjs";
+import { t as ArcError } from "./errors-BHD3L8of.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{buildHandler-CIz0NsGS.mjs → buildHandler-BG_CHXqQ.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BzZi2bsf.mjs";
-import { g as toRepositoryFilter } from "./BaseController-Chkf0Aiw.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-pMke_boy.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
+import { g as toRepositoryFilter } from "./BaseController-BqJtbiUA.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DV3hRbsz.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B1MgfDWi.mjs";
-import { t as MemoryCacheStore } from "../memory-DvASzOn3.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-Cl3zLG7g.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Ds3ekBiu.mjs";
+import { t as MemoryCacheStore } from "../memory-CNvjxzB2.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-2Pp9w-8D.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-DldVgnC9.mjs → caching-Bqcn3Brl.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-NVzJrC-o.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-BqRfP1kT.mjs";
+import { L as RequestWithExtras } from "../index-D3sIPcD4.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BMa2EPtv.mjs";
+import { t as ArcModule } from "../types-BVlowlm7.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-khJmBErP.mjs";
-import { t as defineResource } from "../defineResource-DS3Uj2-8.mjs";
-import { t as defineModule } from "../module-CNKk_twm.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-CNQyOrLk.mjs";
+import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
+import { t as defineModule } from "../module-CNcwCKUJ.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -723,9 +723,25 @@ function createCleanupService(deps) {
 	const logger = deps.logger;
 	const generateId = deps.generateId ?? (() => globalThis.crypto.randomUUID());
 	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	/**
+	* Undefined-valued keys are DROPPED, not spread.
+	*
+	* `limits` is `Partial<CleanupLimits>`, which permits an EXPLICIT `undefined`
+	* — and a plain spread lets that overwrite the default rather than fall back
+	* to it. Every limit is then read in a comparison, and `n > undefined` is
+	* always `false`, so `{ limits: { maxPlanItems: undefined } }` did not raise
+	* the cap: it silently REMOVED it, on a framework whose whole job is deleting
+	* data. Same for `maxReasonLength` / `maxParamDepth`, and `maxResults` turned
+	* `slice(0, undefined)` into "keep everything".
+	*
+	* A host reaches this by forwarding an optional config through
+	* (`limits: { maxPlanItems: cfg.planCap }`) — no cast, no obvious mistake.
+	* `permissions/presets.ts` already filters for exactly this reason; this is
+	* the same rule applied to the destructive path.
+	*/
 	const limits = {
 		...DEFAULT_CLEANUP_LIMITS,
-		...deps.limits
+		...Object.fromEntries(Object.entries(deps.limits ?? {}).filter(([, v]) => v !== void 0))
 	};
 	const leaseMs = deps.leaseMs ?? 3e5;
 	const progressThrottleMs = deps.progressThrottleMs ?? 0;

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-BqRfP1kT.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-D3sIPcD4.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-DDKf25s4.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-OQA13slI.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BQ2FbhPB.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-B9WnuG2Q.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-473gZ-8x.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-xszlyXTs.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-BYrL8zvY.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-DxWn-XnM.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-BSSdtiOy.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as init } from "../../init-BJ6fdYnp.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-pl88PHzb.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-xszlyXTs.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-DxWn-XnM.mjs";
-import { t as init } from "../init-BJ6fdYnp.mjs";
+import { t as generate } from "../generate-BSSdtiOy.mjs";
+import { t as init } from "../init-pl88PHzb.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-DDKf25s4.mjs → constants-BQ2FbhPB.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.37.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth