@classytic/arc 2.38.0 → 2.40.0

package/dist/{BaseController-CYaDvmOB.mjs → BaseController-BqJtbiUA.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BQ2FbhPB.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-2ExmOgIJ.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-CXySQFRg.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-B7qVjQBv.mjs";
-import { t as buildQueryKey } from "./keys-BSuxGS-B.mjs";
-import { t as transactionContext } from "./transactionContext-DMmvcfdo.mjs";
-import { A as scheduleBackground, E as ArcQueryParser } from "./utils-BbGG8XNT.mjs";
-import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-Cha2QCKH.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-BHD3L8of.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-DLueLQdQ.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cldubvul.mjs";
+import { t as buildQueryKey } from "./keys-Ds3ekBiu.mjs";
+import { t as transactionContext } from "./transactionContext-46KyUADP.mjs";
+import { A as scheduleBackground, E as ArcQueryParser } from "./utils-CUFBrhq-.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-fA-Dkou5.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
@@ -650,7 +650,7 @@ async function executeAfterHook(ctx, op, data, meta) {
 * Every mixin used to spell out its own narrowing cast inline:
 *
 * ```ts
-* const repo = this.repository as unknown as {
+* const repo = this.repository as {
 *   getTree?: (options?: unknown) => Promise<AnyRecord[]>;
 * };
 * ```
@@ -717,7 +717,7 @@ async function runDistinctVerb(repository, field, resolveScope) {
 	const repo = withRepoFeatures(repository);
 	if (typeof repo.distinct !== "function") throw createError(501, "_distinct is not supported: the resource's storage adapter does not implement repo.distinct()");
 	const { filter, options } = resolveScope();
-	return await repo.distinct(field, filter, options);
+	return { values: await repo.distinct(field, filter, options) };
 }
 /**
 * `?_exists=true` → `repo.exists(filter)`. Returns the RAW repo result —
@@ -789,6 +789,27 @@ function noteDeniedJoins(kind) {
 	notedDeniedJoins = true;
 	log.warn(`client requested ${kind} but no allowlist is configured — DENIED (2.24 default flip; it was allow-all). Set schemaOptions.query.allowedPopulate / allowedLookups to enable client-driven joins. (dev-only note, shown once)`);
 }
+/**
+* A `$lookup` reaches ANOTHER collection, and the tenant filter arc conjoins applies to the
+* BASE one only. The joined side carries whatever predicate the lookup itself names and
+* nothing more — no tenant scope, no soft-delete filter — so a resource that opens
+* `allowedLookups` can return rows from a collection the caller could not query directly.
+*
+* Unreachable by default (2.24 denies `lookup=` with no allowlist) and no resource in this
+* fleet configures one, so this is a WARNING at the moment a deployment first opts in
+* rather than machinery for a door nobody has opened. Warned once per collection set: the
+* decision is made when the allowlist is written, not per request.
+*
+* Scope the join with the lookup's own `where`, which mongokit compiles into a `$match`
+* inside the lookup pipeline.
+*/
+const notedUnscopedJoins = /* @__PURE__ */ new Set();
+function noteUnscopedJoin(lookups) {
+	const key = lookups.map((l) => l.from).filter((f) => typeof f === "string").sort().join(",");
+	if (key.length === 0 || notedUnscopedJoins.has(key)) return;
+	notedUnscopedJoins.add(key);
+	log.warn(`client-driven $lookup on [${key}] — the JOINED side carries no tenant or soft-delete filter (arc scopes the base collection only). Narrow each lookup with its own \`where\`, or the join can surface rows the caller cannot query directly. (shown once)`);
+}
 var QueryResolver = class {
 	queryParser;
 	maxLimit;
@@ -912,6 +933,12 @@ var QueryResolver = class {
 			query = rest;
 		}
 		const parsed = this.queryParser.parse(query);
+		/**
+		* Client-supplied keys only, and BEFORE the policy conjunction below: trusted policy
+		* legitimately filters on hidden fields (`requireOwnership('userId')` emits exactly that),
+		* so checking the conjoined result would reject the framework's own restrictions.
+		*/
+		this.assertNoBlockedReadKeys(parsed.filters, parsed.sort);
 		const arcContext = meta ?? req.metadata;
 		const limit = Math.min(Math.max(1, parsed.limit || this.defaultLimit), this.maxLimit);
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
@@ -950,20 +977,14 @@ var QueryResolver = class {
 		if (!select) return exclusion();
 		if (typeof select === "object" && !Array.isArray(select)) {
 			const sanitized = {};
-			for (const [field, val] of Object.entries(select)) if (!blockedFields.includes(field)) sanitized[field] = val;
+			for (const [field, val] of Object.entries(select)) if (!this.isBlockedProjection(field, blockedFields)) sanitized[field] = val;
 			return Object.keys(sanitized).length > 0 ? sanitized : exclusion();
 		}
 		if (Array.isArray(select)) {
-			const sanitized = select.filter((f) => {
-				const fieldName = f.replace(/^-/, "");
-				return !blockedFields.includes(fieldName);
-			});
+			const sanitized = select.filter((f) => !this.isBlockedProjection(f, blockedFields));
 			return sanitized.length > 0 ? sanitized : exclusion();
 		}
-		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => {
-			const fieldName = f.replace(/^-/, "");
-			return !blockedFields.includes(fieldName);
-		});
+		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => !this.isBlockedProjection(f, blockedFields));
 		return sanitized.length > 0 ? sanitized.join(" ") : exclusion();
 	}
 	/** Sanitize populate fields */
@@ -1011,6 +1032,7 @@ var QueryResolver = class {
 			if (!allowedLookups.includes(lookup.from)) return false;
 			return true;
 		});
+		if (sanitized.length > 0) noteUnscopedJoin(sanitized);
 		return sanitized.length > 0 ? sanitized : void 0;
 	}
 	/**
@@ -1023,6 +1045,68 @@ var QueryResolver = class {
 		const blocked = collectReadBlockedFields(schemaOptions);
 		return blocked ? Array.from(blocked) : [];
 	}
+	/**
+	* Is this projection path blocked — by its own name, or by a hidden ANCESTOR?
+	*
+	* `hidden: { secret: true }` hides the object, and an exact-name match left its children
+	* reachable: `?select=secret.value` projected the very field the rule exists to withhold.
+	* A rule on a parent covers everything under it, which is what "hidden" already means to
+	* whoever wrote it.
+	*/
+	isBlockedProjection(path, blockedFields) {
+		const field = path.replace(/^-/, "");
+		return blockedFields.some((blocked) => field === blocked || field.startsWith(`${blocked}.`));
+	}
+	/**
+	* Refuse a read that FILTERS or SORTS on a `hidden` field.
+	*
+	* `hidden` was enforced on the surfaces that RETURN a value — the response, `select=`,
+	* `_distinct`, aggregations — but a filter key never returns the field, it INTERROGATES it:
+	* `?passwordHash[like]=^ab` narrows the result set, so the row count answers a question about
+	* a value the caller may not read. A resource with no `allowedFilterFields` was a blind
+	* existence oracle over every hidden field it declared.
+	*
+	* Rejected rather than dropped, unlike `select`. Dropping a projection narrows what comes
+	* back; dropping a filter WIDENS the rows, which is the silent-permissive shape this
+	* framework fails loudly on everywhere else.
+	*
+	* Compound keys (`$or`, `$and`) are walked, because the offending key can be nested inside
+	* one. A dotted path is blocked by its own name or by a hidden ancestor, so a rule on
+	* `secret` also covers `secret.value`.
+	*/
+	assertNoBlockedReadKeys(filters, sort) {
+		const blocked = collectReadBlockedFields(this.schemaOptions);
+		if (!blocked) return;
+		const offenders = /* @__PURE__ */ new Set();
+		const isBlocked = (key) => {
+			if (blocked.has(key)) return true;
+			const dot = key.indexOf(".");
+			return dot > 0 && blocked.has(key.slice(0, dot));
+		};
+		const walk = (node, depth) => {
+			if (depth > 8 || !node || typeof node !== "object") return;
+			if (Array.isArray(node)) {
+				for (const item of node) walk(item, depth + 1);
+				return;
+			}
+			for (const [key, value] of Object.entries(node)) {
+				if (key.startsWith("$")) {
+					walk(value, depth + 1);
+					continue;
+				}
+				if (isBlocked(key)) offenders.add(key);
+			}
+		};
+		walk(filters, 0);
+		const sortKeys = typeof sort === "string" ? sort.split(",").map((s) => s.trim().replace(/^-/, "")).filter(Boolean) : Object.keys(sort ?? {});
+		for (const key of sortKeys) if (isBlocked(key)) offenders.add(key);
+		if (offenders.size === 0) return;
+		const fields = [...offenders];
+		throw new ValidationError(`Cannot filter or sort on hidden field(s): ${fields.join(", ")}`, fields.map((field) => ({
+			field,
+			message: "Field is not readable"
+		})));
+	}
 };
 //#endregion
 //#region src/core/BaseCrudController.ts
@@ -1550,7 +1634,7 @@ var BaseCrudController = class {
 	}
 	async list(req) {
 		const dispatch = this.dispatchResourceVerb(req);
-		if (dispatch) return dispatch;
+		if (dispatch !== null) return dispatch;
 		const options = this.queryResolver.resolve(req, this.meta(req));
 		const cached = await this.withListCache(req, options);
 		if (cached) return cached;

package/dist/{EventTransport-Cx60_s-6.d.mts → EventTransport-BPOQsEer.d.mts}

@@ -70,7 +70,15 @@ declare class MemoryEventTransport implements EventTransport {
   private handlerDispatch;
   private handlerConcurrency;
   constructor(options?: MemoryEventTransportOptions);
+  /**
+   * One work scope per publish, around the WHOLE handler set — so every
+   * handler of this event, parallel or not, shares one `requestScopedCache()`
+   * and one correlation id. Inherits an active request scope (a live
+   * in-request dispatch keeps the request's reads); a relay- or job-driven
+   * publish gets its own.
+   */
   publish(event: DomainEvent): Promise<void>;
+  private dispatch;
   /**
    * Reference `publishMany` implementation — delegates to `publish()` in order.
    *

package/dist/{EventTransport-Gq7JWbWw.mjs → EventTransport-BUkTwY_x.mjs}

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-CoGpuzDX.mjs";
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -89,7 +90,17 @@ var MemoryEventTransport = class {
 		if (cap !== void 0 && (!Number.isInteger(cap) || cap < 1)) throw new TypeError(`MemoryEventTransport: handlerConcurrency must be a positive integer, received ${String(cap)}`);
 		this.handlerConcurrency = cap ?? Number.POSITIVE_INFINITY;
 	}
-	async publish(event) {
+	/**
+	* One work scope per publish, around the WHOLE handler set — so every
+	* handler of this event, parallel or not, shares one `requestScopedCache()`
+	* and one correlation id. Inherits an active request scope (a live
+	* in-request dispatch keeps the request's reads); a relay- or job-driven
+	* publish gets its own.
+	*/
+	publish(event) {
+		return runWorkScope(workSeedFromEvent(event), () => this.dispatch(event));
+	}
+	async dispatch(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
 		const failures = [];

package/dist/{HookSystem-C0ikzqQf.mjs → HookSystem-96nzZLmk.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-DPcX--zk.mjs → ResourceRegistry-B9WnuG2Q.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import "./constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import "./constants-BQ2FbhPB.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{actionPermissions-jlFZ1it4.mjs → actionPermissions-4OGbe3Hf.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
-import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
-import { t as executePipeline } from "./pipe-SunhEaZ6.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
+import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
+import { t as executePipeline } from "./pipe-4_XamfxI.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
 import { d as UserBase } from "../base-C-NL2fTi.mjs";
-import "../index-B78WZom8.mjs";
+import "../index-D3sIPcD4.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-DMmvcfdo.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-46KyUADP.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
 import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-B78WZom8.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-D3sIPcD4.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-2ExmOgIJ.mjs";
-import { n as requireSingleHeaderValue } from "../headers-DeXNifVj.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CXySQFRg.mjs";
-import { o as toJsonSchema } from "../schemaConverter-Db-MMsH6.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-BHD3L8of.mjs";
+import { n as requireSingleHeaderValue } from "../headers-BFEEshDS.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DLueLQdQ.mjs";
+import { o as toJsonSchema } from "../schemaConverter-DENbixyA.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-C0GpDsB_.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-BP8GHtjc.mjs → authorizationDecision-D_LFvMlm.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-2ExmOgIJ.mjs";
+import { t as ArcError } from "./errors-BHD3L8of.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{buildHandler-DjXOqIvX.mjs → buildHandler-BG_CHXqQ.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
-import { g as toRepositoryFilter } from "./BaseController-CYaDvmOB.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CidSeUrx.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
+import { g as toRepositoryFilter } from "./BaseController-BqJtbiUA.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DV3hRbsz.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-BSuxGS-B.mjs";
-import { t as MemoryCacheStore } from "../memory-BiPVaCPg.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-oTsmVyEQ.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Ds3ekBiu.mjs";
+import { t as MemoryCacheStore } from "../memory-CNvjxzB2.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-2Pp9w-8D.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-a3ZEcJJs.mjs → caching-Bqcn3Brl.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-B78WZom8.mjs";
+import { L as RequestWithExtras } from "../index-D3sIPcD4.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BRU-Kd3t.mjs";
+import { t as ArcModule } from "../types-BVlowlm7.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-BqLyyH0o.mjs";
-import { t as defineResource } from "../defineResource-BMdyRelW.mjs";
-import { t as defineModule } from "../module-BQXHxMEk.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-CNQyOrLk.mjs";
+import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
+import { t as defineModule } from "../module-CNcwCKUJ.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -723,9 +723,25 @@ function createCleanupService(deps) {
 	const logger = deps.logger;
 	const generateId = deps.generateId ?? (() => globalThis.crypto.randomUUID());
 	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	/**
+	* Undefined-valued keys are DROPPED, not spread.
+	*
+	* `limits` is `Partial<CleanupLimits>`, which permits an EXPLICIT `undefined`
+	* — and a plain spread lets that overwrite the default rather than fall back
+	* to it. Every limit is then read in a comparison, and `n > undefined` is
+	* always `false`, so `{ limits: { maxPlanItems: undefined } }` did not raise
+	* the cap: it silently REMOVED it, on a framework whose whole job is deleting
+	* data. Same for `maxReasonLength` / `maxParamDepth`, and `maxResults` turned
+	* `slice(0, undefined)` into "keep everything".
+	*
+	* A host reaches this by forwarding an optional config through
+	* (`limits: { maxPlanItems: cfg.planCap }`) — no cast, no obvious mistake.
+	* `permissions/presets.ts` already filters for exactly this reason; this is
+	* the same rule applied to the destructive path.
+	*/
 	const limits = {
 		...DEFAULT_CLEANUP_LIMITS,
-		...deps.limits
+		...Object.fromEntries(Object.entries(deps.limits ?? {}).filter(([, v]) => v !== void 0))
 	};
 	const leaseMs = deps.leaseMs ?? 3e5;
 	const progressThrottleMs = deps.progressThrottleMs ?? 0;

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-B78WZom8.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-D3sIPcD4.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BONghE1Y.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-DPcX--zk.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BQ2FbhPB.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-B9WnuG2Q.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-Dxc8RLy_.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DNj8cpiY.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-BYrL8zvY.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-BUP4Oydg.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-BSSdtiOy.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-Dg_Am2o_.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-pl88PHzb.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DNj8cpiY.mjs";
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-BUP4Oydg.mjs";
-import { t as init } from "../init-Dg_Am2o_.mjs";
+import { t as generate } from "../generate-BSSdtiOy.mjs";
+import { t as init } from "../init-pl88PHzb.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-BONghE1Y.mjs → constants-BQ2FbhPB.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.d.mts

@@ -1,13 +1,19 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CacheAdapter } from "@classytic/repo-core/cache";
+import { DomainEvent } from "@classytic/primitives/events";
 //#region src/context/requestContext.d.ts
+/** What started this unit of work. See `workScope.ts`. */
+type WorkKind = "request" | "event" | "job";
 /**
  * Shape of the request-scoped context store.
- * Populated by Arc's onRequest hook in arcCorePlugin.
+ * Populated by Arc's onRequest hook in arcCorePlugin, or by `runWorkScope`
+ * for an event dispatch or a job run.
  */
 interface RequestStore {
-  /** Unique request identifier */
+  /** Absent on stores created before scopes had kinds; treat as `'request'`. */
+  kind?: WorkKind;
+  /** Unique request identifier — the correlation key of an event or job scope. */
   requestId?: string;
   /** Authenticated user (if any) */
   user?: {
@@ -88,14 +94,15 @@ declare function getTraceHeaders(): Record<string, string> | undefined;
 //#endregion
 //#region src/context/requestScopedCache.d.ts
 /**
- * The cache for the CURRENT request, or `undefined` outside one.
+ * The cache for the CURRENT unit of work — a request, an event dispatch or a
+ * job run (see `runWorkScope`) — or `undefined` outside one.
  *
- * Lazily created on first use, so a request that never touches a cached
+ * Lazily created on first use, so a scope that never touches a cached
  * repository allocates nothing.
  */
 declare function requestScopedCache(): CacheAdapter | undefined;
 /**
- * Whether the current request has allocated a cache yet. Diagnostics and
+ * Whether the current scope has allocated a cache yet. Diagnostics and
  * tests only — never branch application behaviour on this.
  */
 declare function hasRequestScopedCache(): boolean;
@@ -124,4 +131,25 @@ declare const transactionContext: {
   storage: AsyncLocalStorage<unknown>;
 };
 //#endregion
-export { type DbSession, type RequestStore, getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, transactionContext };
+//#region src/context/workScope.d.ts
+interface WorkSeed {
+  readonly kind: WorkKind;
+  /** Becomes `requestId` — the correlation key for anything published inside. */
+  readonly id: string;
+  readonly organizationId?: string;
+}
+/** Enter a scope for `fn`, or run it inside the active one. */
+declare function runWorkScope<T>(seed: WorkSeed, fn: () => T): T;
+/**
+ * A per-scope memo slot: created once on first use, the same instance after.
+ * `undefined` outside a scope.
+ */
+declare function scopedValue<T>(slot: symbol, create: () => T): T | undefined;
+/**
+ * The scope an event dispatch runs in. The correlation id is the scope id so a
+ * child event published from a handler chains to the same correlation; the
+ * tenant rides `meta`, never the payload.
+ */
+declare function workSeedFromEvent(event: DomainEvent): WorkSeed;
+//#endregion
+export { type DbSession, type RequestStore, type WorkKind, type WorkSeed, getTraceHeaders, hasRequestScopedCache, requestContext, requestScopedCache, runWorkScope, scopedValue, transactionContext, workSeedFromEvent };