@classytic/arc 2.38.0 → 2.41.0

package/dist/{BaseController-CYaDvmOB.mjs → BaseController-DYJRZ0EJ.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BxLgNFF7.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-2ExmOgIJ.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-CXySQFRg.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-B7qVjQBv.mjs";
-import { t as buildQueryKey } from "./keys-BSuxGS-B.mjs";
-import { t as transactionContext } from "./transactionContext-DMmvcfdo.mjs";
-import { A as scheduleBackground, E as ArcQueryParser } from "./utils-BbGG8XNT.mjs";
-import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-Cha2QCKH.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-C_YhELhe.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-DDMOZ_Pm.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CDy3-zw1.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-BiOnyflP.mjs";
+import { t as buildQueryKey } from "./keys-Cmv4cBRa.mjs";
+import { t as transactionContext } from "./transactionContext-DCWMI6hV.mjs";
+import { D as ArcQueryParser, j as scheduleBackground } from "./utils-B-zj_b__.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-BTyPLHK0.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
@@ -179,6 +179,7 @@ var AccessControl = class {
 	*/
 	checkOrgScope(item, arcContext) {
 		if (!this.tenantField) return true;
+		if (arcContext?._crossTenantRead === true) return true;
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
 		if (!item || !orgId) return true;
@@ -423,6 +424,11 @@ function buildTenantRepoOptions(req, tenantField, arcContext) {
 	if (cached) return cached;
 	const out = {};
 	const scope = arcContext?._scope;
+	if (arcContext?._crossTenantRead === true) {
+		out.bypassTenant = true;
+		req._tenantRepoOptions = out;
+		return out;
+	}
 	if (tenantField) {
 		const orgId = scope ? getOrgId(scope) : void 0;
 		if (orgId) out[tenantField] = orgId;
@@ -650,7 +656,7 @@ async function executeAfterHook(ctx, op, data, meta) {
 * Every mixin used to spell out its own narrowing cast inline:
 *
 * ```ts
-* const repo = this.repository as unknown as {
+* const repo = this.repository as {
 *   getTree?: (options?: unknown) => Promise<AnyRecord[]>;
 * };
 * ```
@@ -717,7 +723,7 @@ async function runDistinctVerb(repository, field, resolveScope) {
 	const repo = withRepoFeatures(repository);
 	if (typeof repo.distinct !== "function") throw createError(501, "_distinct is not supported: the resource's storage adapter does not implement repo.distinct()");
 	const { filter, options } = resolveScope();
-	return await repo.distinct(field, filter, options);
+	return { values: await repo.distinct(field, filter, options) };
 }
 /**
 * `?_exists=true` → `repo.exists(filter)`. Returns the RAW repo result —
@@ -789,6 +795,27 @@ function noteDeniedJoins(kind) {
 	notedDeniedJoins = true;
 	log.warn(`client requested ${kind} but no allowlist is configured — DENIED (2.24 default flip; it was allow-all). Set schemaOptions.query.allowedPopulate / allowedLookups to enable client-driven joins. (dev-only note, shown once)`);
 }
+/**
+* A `$lookup` reaches ANOTHER collection, and the tenant filter arc conjoins applies to the
+* BASE one only. The joined side carries whatever predicate the lookup itself names and
+* nothing more — no tenant scope, no soft-delete filter — so a resource that opens
+* `allowedLookups` can return rows from a collection the caller could not query directly.
+*
+* Unreachable by default (2.24 denies `lookup=` with no allowlist) and no resource in this
+* fleet configures one, so this is a WARNING at the moment a deployment first opts in
+* rather than machinery for a door nobody has opened. Warned once per collection set: the
+* decision is made when the allowlist is written, not per request.
+*
+* Scope the join with the lookup's own `where`, which mongokit compiles into a `$match`
+* inside the lookup pipeline.
+*/
+const notedUnscopedJoins = /* @__PURE__ */ new Set();
+function noteUnscopedJoin(lookups) {
+	const key = lookups.map((l) => l.from).filter((f) => typeof f === "string").sort().join(",");
+	if (key.length === 0 || notedUnscopedJoins.has(key)) return;
+	notedUnscopedJoins.add(key);
+	log.warn(`client-driven $lookup on [${key}] — the JOINED side carries no tenant or soft-delete filter (arc scopes the base collection only). Narrow each lookup with its own \`where\`, or the join can surface rows the caller cannot query directly. (shown once)`);
+}
 var QueryResolver = class {
 	queryParser;
 	maxLimit;
@@ -912,6 +939,12 @@ var QueryResolver = class {
 			query = rest;
 		}
 		const parsed = this.queryParser.parse(query);
+		/**
+		* Client-supplied keys only, and BEFORE the policy conjunction below: trusted policy
+		* legitimately filters on hidden fields (`requireOwnership('userId')` emits exactly that),
+		* so checking the conjoined result would reject the framework's own restrictions.
+		*/
+		this.assertNoBlockedReadKeys(parsed.filters, parsed.sort);
 		const arcContext = meta ?? req.metadata;
 		const limit = Math.min(Math.max(1, parsed.limit || this.defaultLimit), this.maxLimit);
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
@@ -921,7 +954,7 @@ var QueryResolver = class {
 		let filters = conjoinPolicyFilters(parsed.filters, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
+		if (this.tenantField && orgId && !arcContext?._crossTenantRead && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
 		const portableFilters = toRepositoryFilter(filters);
 		return {
 			page,
@@ -950,20 +983,14 @@ var QueryResolver = class {
 		if (!select) return exclusion();
 		if (typeof select === "object" && !Array.isArray(select)) {
 			const sanitized = {};
-			for (const [field, val] of Object.entries(select)) if (!blockedFields.includes(field)) sanitized[field] = val;
+			for (const [field, val] of Object.entries(select)) if (!this.isBlockedProjection(field, blockedFields)) sanitized[field] = val;
 			return Object.keys(sanitized).length > 0 ? sanitized : exclusion();
 		}
 		if (Array.isArray(select)) {
-			const sanitized = select.filter((f) => {
-				const fieldName = f.replace(/^-/, "");
-				return !blockedFields.includes(fieldName);
-			});
+			const sanitized = select.filter((f) => !this.isBlockedProjection(f, blockedFields));
 			return sanitized.length > 0 ? sanitized : exclusion();
 		}
-		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => {
-			const fieldName = f.replace(/^-/, "");
-			return !blockedFields.includes(fieldName);
-		});
+		const sanitized = select.split(/[\s,]+/).filter(Boolean).filter((f) => !this.isBlockedProjection(f, blockedFields));
 		return sanitized.length > 0 ? sanitized.join(" ") : exclusion();
 	}
 	/** Sanitize populate fields */
@@ -1011,6 +1038,7 @@ var QueryResolver = class {
 			if (!allowedLookups.includes(lookup.from)) return false;
 			return true;
 		});
+		if (sanitized.length > 0) noteUnscopedJoin(sanitized);
 		return sanitized.length > 0 ? sanitized : void 0;
 	}
 	/**
@@ -1023,6 +1051,68 @@ var QueryResolver = class {
 		const blocked = collectReadBlockedFields(schemaOptions);
 		return blocked ? Array.from(blocked) : [];
 	}
+	/**
+	* Is this projection path blocked — by its own name, or by a hidden ANCESTOR?
+	*
+	* `hidden: { secret: true }` hides the object, and an exact-name match left its children
+	* reachable: `?select=secret.value` projected the very field the rule exists to withhold.
+	* A rule on a parent covers everything under it, which is what "hidden" already means to
+	* whoever wrote it.
+	*/
+	isBlockedProjection(path, blockedFields) {
+		const field = path.replace(/^-/, "");
+		return blockedFields.some((blocked) => field === blocked || field.startsWith(`${blocked}.`));
+	}
+	/**
+	* Refuse a read that FILTERS or SORTS on a `hidden` field.
+	*
+	* `hidden` was enforced on the surfaces that RETURN a value — the response, `select=`,
+	* `_distinct`, aggregations — but a filter key never returns the field, it INTERROGATES it:
+	* `?passwordHash[like]=^ab` narrows the result set, so the row count answers a question about
+	* a value the caller may not read. A resource with no `allowedFilterFields` was a blind
+	* existence oracle over every hidden field it declared.
+	*
+	* Rejected rather than dropped, unlike `select`. Dropping a projection narrows what comes
+	* back; dropping a filter WIDENS the rows, which is the silent-permissive shape this
+	* framework fails loudly on everywhere else.
+	*
+	* Compound keys (`$or`, `$and`) are walked, because the offending key can be nested inside
+	* one. A dotted path is blocked by its own name or by a hidden ancestor, so a rule on
+	* `secret` also covers `secret.value`.
+	*/
+	assertNoBlockedReadKeys(filters, sort) {
+		const blocked = collectReadBlockedFields(this.schemaOptions);
+		if (!blocked) return;
+		const offenders = /* @__PURE__ */ new Set();
+		const isBlocked = (key) => {
+			if (blocked.has(key)) return true;
+			const dot = key.indexOf(".");
+			return dot > 0 && blocked.has(key.slice(0, dot));
+		};
+		const walk = (node, depth) => {
+			if (depth > 8 || !node || typeof node !== "object") return;
+			if (Array.isArray(node)) {
+				for (const item of node) walk(item, depth + 1);
+				return;
+			}
+			for (const [key, value] of Object.entries(node)) {
+				if (key.startsWith("$")) {
+					walk(value, depth + 1);
+					continue;
+				}
+				if (isBlocked(key)) offenders.add(key);
+			}
+		};
+		walk(filters, 0);
+		const sortKeys = typeof sort === "string" ? sort.split(",").map((s) => s.trim().replace(/^-/, "")).filter(Boolean) : Object.keys(sort ?? {});
+		for (const key of sortKeys) if (isBlocked(key)) offenders.add(key);
+		if (offenders.size === 0) return;
+		const fields = [...offenders];
+		throw new ValidationError(`Cannot filter or sort on hidden field(s): ${fields.join(", ")}`, fields.map((field) => ({
+			field,
+			message: "Field is not readable"
+		})));
+	}
 };
 //#endregion
 //#region src/core/BaseCrudController.ts
@@ -1550,7 +1640,7 @@ var BaseCrudController = class {
 	}
 	async list(req) {
 		const dispatch = this.dispatchResourceVerb(req);
-		if (dispatch) return dispatch;
+		if (dispatch !== null) return dispatch;
 		const options = this.queryResolver.resolve(req, this.meta(req));
 		const cached = await this.withListCache(req, options);
 		if (cached) return cached;

package/dist/{EventTransport-Cx60_s-6.d.mts → EventTransport-CbUKDzZZ.d.mts}

@@ -42,6 +42,30 @@ interface MemoryEventTransportOptions {
    * QUEUE, not of the work.
    */
   handlerDispatch?: "sequential" | "parallel";
+  /**
+   * Called when a published event matched ZERO subscribers.
+   *
+   * Silence is the default because a fire-and-forget bus legitimately carries
+   * events nobody wants. It stops being legitimate the moment an OUTBOX is
+   * wired: the relay acknowledges a row it delivered to nobody, so the numbers
+   * report success and the instruction the event carried was never carried
+   * out. A host that expects its events to be consumed passes this and finds
+   * out.
+   *
+   * Runs inside the publish's work scope, after handler resolution and before
+   * the (empty) dispatch. It must not throw — a reporter that fails must not
+   * decide whether an event was published.
+   *
+   * MEMORY TRANSPORT ONLY, and deliberately so — this is not an oversight to be
+   * fixed by adding it to the Redis transports. In-process, "no handler
+   * matched" IS "nobody consumed it": this process is the whole bus. On a
+   * broker, no LOCAL handler matched says nothing about consumption — another
+   * replica, another consumer group, or a consumer not yet started may own the
+   * event, and firing there would report a healthy fan-out as a fault every
+   * time work is routed away from this node. The broker's own pending/lag
+   * metrics answer that question; this one cannot.
+   */
+  onUnroutedEvent?: (event: DomainEvent) => void;
   /**
    * Cap on handlers running at once under `'parallel'`. Default: unlimited.
    *
@@ -69,8 +93,17 @@ declare class MemoryEventTransport implements EventTransport {
   private onHandlerError;
   private handlerDispatch;
   private handlerConcurrency;
+  private onUnroutedEvent;
   constructor(options?: MemoryEventTransportOptions);
+  /**
+   * One work scope per publish, around the WHOLE handler set — so every
+   * handler of this event, parallel or not, shares one `requestScopedCache()`
+   * and one correlation id. Inherits an active request scope (a live
+   * in-request dispatch keeps the request's reads); a relay- or job-driven
+   * publish gets its own.
+   */
   publish(event: DomainEvent): Promise<void>;
+  private dispatch;
   /**
    * Reference `publishMany` implementation — delegates to `publish()` in order.
    *

package/dist/{EventTransport-Gq7JWbWw.mjs → EventTransport-n7qO5Cz3.mjs}

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-BhsWde4k.mjs";
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -81,17 +82,36 @@ var MemoryEventTransport = class {
 	onHandlerError;
 	handlerDispatch;
 	handlerConcurrency;
+	onUnroutedEvent;
 	constructor(options) {
 		this.logger = options?.logger ?? console;
 		this.onHandlerError = options?.onHandlerError ?? "log";
 		this.handlerDispatch = options?.handlerDispatch ?? "sequential";
+		this.onUnroutedEvent = options?.onUnroutedEvent;
 		const cap = options?.handlerConcurrency;
 		if (cap !== void 0 && (!Number.isInteger(cap) || cap < 1)) throw new TypeError(`MemoryEventTransport: handlerConcurrency must be a positive integer, received ${String(cap)}`);
 		this.handlerConcurrency = cap ?? Number.POSITIVE_INFINITY;
 	}
-	async publish(event) {
+	/**
+	* One work scope per publish, around the WHOLE handler set — so every
+	* handler of this event, parallel or not, shares one `requestScopedCache()`
+	* and one correlation id. Inherits an active request scope (a live
+	* in-request dispatch keeps the request's reads); a relay- or job-driven
+	* publish gets its own.
+	*/
+	publish(event) {
+		return runWorkScope(workSeedFromEvent(event), () => this.dispatch(event));
+	}
+	async dispatch(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		if (allHandlers.size === 0 && this.onUnroutedEvent) try {
+			this.onUnroutedEvent(event);
+		} catch (err) {
+			try {
+				this.logger.error(`[EventTransport] onUnroutedEvent threw for ${event.type}:`, err);
+			} catch {}
+		}
 		const failures = [];
 		const run = async (handler) => {
 			try {

package/dist/{HookSystem-C0ikzqQf.mjs → HookSystem-CxvZBo77.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-DPcX--zk.mjs → ResourceRegistry-Cu7uTJp9.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import "./constants-BONghE1Y.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import "./constants-BxLgNFF7.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{actionPermissions-jlFZ1it4.mjs → actionPermissions-DPwPWPOV.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CXySQFRg.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-BqLyyH0o.mjs";
-import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-Cha2QCKH.mjs";
-import { t as buildRequestScopeProjection } from "./projection-DSfEoooA.mjs";
-import { t as executePipeline } from "./pipe-SunhEaZ6.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CDy3-zw1.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
+import { t as executePipeline } from "./pipe-CBVmUJ-j.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -82,6 +82,7 @@ function createRequestContext(req) {
 			arc: reqWithExtras.arc,
 			_scope: rawScope,
 			_ownershipCheck: reqWithExtras._ownershipCheck,
+			_crossTenantRead: reqWithExtras._crossTenantRead,
 			_policyFilters: reqWithExtras._policyFilters ?? {},
 			log: reqWithExtras.log
 		},

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import { d as UserBase } from "../base-C-NL2fTi.mjs";
-import "../index-B78WZom8.mjs";
+import { d as UserBase } from "../base-CxrV1LmG.mjs";
+import "../index-DHbyPo5j.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-DMmvcfdo.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DCWMI6hV.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts
@@ -187,7 +188,13 @@ const auditPlugin = async (fastify, opts = {}) => {
 	const stores = [];
 	if (repository) stores.push(repositoryAsAuditStore(repository, { sessionProvider: sessionProvider === false ? void 0 : sessionProvider }));
 	stores.push(...customStores);
-	if (stores.length === 0) stores.push(new MemoryAuditStore());
+	const memoryFallback = stores.length === 0;
+	if (memoryFallback) stores.push(new MemoryAuditStore());
+	declareRuntimeCapability(fastify, {
+		subsystem: "audit.store",
+		durability: memoryFallback ? "memory" : "shared",
+		detail: "default MemoryAuditStore: the trail is replica-local and lost on restart"
+	});
 	async function logToStores(entry) {
 		await Promise.all(stores.map((store) => store.log(entry)));
 	}

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-B78WZom8.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-DHbyPo5j.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-2ExmOgIJ.mjs";
-import { n as requireSingleHeaderValue } from "../headers-DeXNifVj.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CXySQFRg.mjs";
-import { o as toJsonSchema } from "../schemaConverter-Db-MMsH6.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-H7Zcb82Z.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-C_YhELhe.mjs";
+import { n as requireSingleHeaderValue } from "../headers-CNECDE6q.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DDMOZ_Pm.mjs";
+import { o as toJsonSchema } from "../schemaConverter-BLCSmNbr.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-DiHXy8Ck.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
@@ -1298,6 +1299,11 @@ function createSessionManager(options) {
 		}
 	};
 	const sessionPlugin = async (fastify) => {
+		declareRuntimeCapability(fastify, {
+			subsystem: "auth.sessions",
+			durability: store instanceof MemorySessionStore ? "memory" : "shared",
+			detail: "MemorySessionStore: sessions exist on the replica that created them"
+		});
 		const authenticate = async (request, reply) => {
 			const cookieHeader = request.headers.cookie;
 			const signedValue = parseCookies(typeof cookieHeader === "string" ? cookieHeader : void 0).get(cookieName);

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-BP8GHtjc.mjs → authorizationDecision-2YY_Kaj1.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-2ExmOgIJ.mjs";
+import { t as ArcError } from "./errors-C_YhELhe.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{base-C-NL2fTi.d.mts → base-CxrV1LmG.d.mts}

@@ -294,6 +294,16 @@ declare module "fastify" {
     document?: unknown;
     /** Ownership check context (field name + user field) */
     _ownershipCheck?: Record<string, unknown>;
+    /**
+     * This read is deliberately NOT scoped to a tenant — a marketplace listing.
+     *
+     * Set by `multiTenantPreset({ crossTenant: [...] })`. Tenancy is applied in four separate
+     * places for a read (the preset middleware, `QueryResolver`, `buildTenantRepoOptions` and the
+     * post-fetch `checkOrgScope`), each deriving the org from the scope on its own, so a decision
+     * made in one of them is silently re-made by the other three. This flag is how that decision
+     * travels. Never set from user input.
+     */
+    _crossTenantRead?: boolean;
   }
 }
 type AnyRecord = Record<string, unknown>;

package/dist/{buildHandler-DjXOqIvX.mjs → buildHandler-CUhjGHGZ.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-BP8GHtjc.mjs";
-import { g as toRepositoryFilter } from "./BaseController-CYaDvmOB.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CidSeUrx.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { g as toRepositoryFilter } from "./BaseController-DYJRZ0EJ.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-R0G_JrnK.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -180,13 +180,15 @@ declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
 }
 /**
  * Minimal ioredis shape we depend on. We don't import ioredis itself so the
- * cache subpath stays peer-dep-free.
+ * cache subpath stays peer-dep-free. The `scan` tail is `unknown[]` so a real
+ * ioredis `Redis` (overloads with literal tokens + optional callback) is
+ * assignable — see the same note on the idempotency `IoredisLike`.
  */
 interface IoredisLike {
   get(key: string): Promise<string | null>;
   set(...args: unknown[]): Promise<string | null>;
   del(...keys: string[]): Promise<number>;
-  scan(cursor: string | number, ...args: (string | number)[]): Promise<[string, string[]]>;
+  scan(cursor: string | number, ...args: unknown[]): Promise<[string, string[]]>;
   pipeline?(): {
     del(key: string): unknown;
     exec(): Promise<unknown>;

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-BSuxGS-B.mjs";
-import { t as MemoryCacheStore } from "../memory-BiPVaCPg.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-oTsmVyEQ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cmv4cBRa.mjs";
+import { t as MemoryCacheStore } from "../memory-CpDZ9NPw.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-B5F09bYr.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-a3ZEcJJs.mjs → caching-DsWDjIxx.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-Add2L50I.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-B78WZom8.mjs";
+import { L as RequestWithExtras } from "../index-DHbyPo5j.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BRU-Kd3t.mjs";
+import { t as ArcModule } from "../types-DfVDvkdP.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-BqLyyH0o.mjs";
-import { t as defineResource } from "../defineResource-BMdyRelW.mjs";
-import { t as defineModule } from "../module-BQXHxMEk.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-CDy3-zw1.mjs";
+import { t as defineResource } from "../defineResource-DzGT-2LP.mjs";
+import { t as defineModule } from "../module-BkQEesNQ.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -723,9 +723,25 @@ function createCleanupService(deps) {
 	const logger = deps.logger;
 	const generateId = deps.generateId ?? (() => globalThis.crypto.randomUUID());
 	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	/**
+	* Undefined-valued keys are DROPPED, not spread.
+	*
+	* `limits` is `Partial<CleanupLimits>`, which permits an EXPLICIT `undefined`
+	* — and a plain spread lets that overwrite the default rather than fall back
+	* to it. Every limit is then read in a comparison, and `n > undefined` is
+	* always `false`, so `{ limits: { maxPlanItems: undefined } }` did not raise
+	* the cap: it silently REMOVED it, on a framework whose whole job is deleting
+	* data. Same for `maxReasonLength` / `maxParamDepth`, and `maxResults` turned
+	* `slice(0, undefined)` into "keep everything".
+	*
+	* A host reaches this by forwarding an optional config through
+	* (`limits: { maxPlanItems: cfg.planCap }`) — no cast, no obvious mistake.
+	* `permissions/presets.ts` already filters for exactly this reason; this is
+	* the same rule applied to the destructive path.
+	*/
 	const limits = {
 		...DEFAULT_CLEANUP_LIMITS,
-		...deps.limits
+		...Object.fromEntries(Object.entries(deps.limits ?? {}).filter(([, v]) => v !== void 0))
 	};
 	const leaseMs = deps.leaseMs ?? 3e5;
 	const progressThrottleMs = deps.progressThrottleMs ?? 0;

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-B78WZom8.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DHbyPo5j.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BONghE1Y.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-DPcX--zk.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BxLgNFF7.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-Cu7uTJp9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-Dxc8RLy_.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-DNj8cpiY.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-C3LFRzPq.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-99fIMC3p.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-BUP4Oydg.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-D_YmiCNf.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.38.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-Dg_Am2o_.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-Y2MlSN9n.mjs";
 export { init };