@classytic/arc 2.40.0 → 2.41.0

package/dist/{BaseController-BqJtbiUA.mjs → BaseController-DYJRZ0EJ.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BQ2FbhPB.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-BxLgNFF7.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-BHD3L8of.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-DLueLQdQ.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cldubvul.mjs";
-import { t as buildQueryKey } from "./keys-Ds3ekBiu.mjs";
-import { t as transactionContext } from "./transactionContext-46KyUADP.mjs";
-import { A as scheduleBackground, E as ArcQueryParser } from "./utils-CUFBrhq-.mjs";
-import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-fA-Dkou5.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError, u as ValidationError } from "./errors-C_YhELhe.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-DDMOZ_Pm.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CDy3-zw1.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-BiOnyflP.mjs";
+import { t as buildQueryKey } from "./keys-Cmv4cBRa.mjs";
+import { t as transactionContext } from "./transactionContext-DCWMI6hV.mjs";
+import { D as ArcQueryParser, j as scheduleBackground } from "./utils-B-zj_b__.mjs";
+import { a as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-BTyPLHK0.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 import { retryingTransaction } from "@classytic/repo-core/repository";
 import { isProductionEnv } from "@classytic/primitives/environment";
@@ -179,6 +179,7 @@ var AccessControl = class {
 	*/
 	checkOrgScope(item, arcContext) {
 		if (!this.tenantField) return true;
+		if (arcContext?._crossTenantRead === true) return true;
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
 		if (!item || !orgId) return true;
@@ -423,6 +424,11 @@ function buildTenantRepoOptions(req, tenantField, arcContext) {
 	if (cached) return cached;
 	const out = {};
 	const scope = arcContext?._scope;
+	if (arcContext?._crossTenantRead === true) {
+		out.bypassTenant = true;
+		req._tenantRepoOptions = out;
+		return out;
+	}
 	if (tenantField) {
 		const orgId = scope ? getOrgId(scope) : void 0;
 		if (orgId) out[tenantField] = orgId;
@@ -948,7 +954,7 @@ var QueryResolver = class {
 		let filters = conjoinPolicyFilters(parsed.filters, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
+		if (this.tenantField && orgId && !arcContext?._crossTenantRead && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
 		const portableFilters = toRepositoryFilter(filters);
 		return {
 			page,

package/dist/{EventTransport-BPOQsEer.d.mts → EventTransport-CbUKDzZZ.d.mts}

@@ -42,6 +42,30 @@ interface MemoryEventTransportOptions {
    * QUEUE, not of the work.
    */
   handlerDispatch?: "sequential" | "parallel";
+  /**
+   * Called when a published event matched ZERO subscribers.
+   *
+   * Silence is the default because a fire-and-forget bus legitimately carries
+   * events nobody wants. It stops being legitimate the moment an OUTBOX is
+   * wired: the relay acknowledges a row it delivered to nobody, so the numbers
+   * report success and the instruction the event carried was never carried
+   * out. A host that expects its events to be consumed passes this and finds
+   * out.
+   *
+   * Runs inside the publish's work scope, after handler resolution and before
+   * the (empty) dispatch. It must not throw — a reporter that fails must not
+   * decide whether an event was published.
+   *
+   * MEMORY TRANSPORT ONLY, and deliberately so — this is not an oversight to be
+   * fixed by adding it to the Redis transports. In-process, "no handler
+   * matched" IS "nobody consumed it": this process is the whole bus. On a
+   * broker, no LOCAL handler matched says nothing about consumption — another
+   * replica, another consumer group, or a consumer not yet started may own the
+   * event, and firing there would report a healthy fan-out as a fault every
+   * time work is routed away from this node. The broker's own pending/lag
+   * metrics answer that question; this one cannot.
+   */
+  onUnroutedEvent?: (event: DomainEvent) => void;
   /**
    * Cap on handlers running at once under `'parallel'`. Default: unlimited.
    *
@@ -69,6 +93,7 @@ declare class MemoryEventTransport implements EventTransport {
   private onHandlerError;
   private handlerDispatch;
   private handlerConcurrency;
+  private onUnroutedEvent;
   constructor(options?: MemoryEventTransportOptions);
   /**
    * One work scope per publish, around the WHOLE handler set — so every

package/dist/{EventTransport-BUkTwY_x.mjs → EventTransport-n7qO5Cz3.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-CoGpuzDX.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-BhsWde4k.mjs";
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -82,10 +82,12 @@ var MemoryEventTransport = class {
 	onHandlerError;
 	handlerDispatch;
 	handlerConcurrency;
+	onUnroutedEvent;
 	constructor(options) {
 		this.logger = options?.logger ?? console;
 		this.onHandlerError = options?.onHandlerError ?? "log";
 		this.handlerDispatch = options?.handlerDispatch ?? "sequential";
+		this.onUnroutedEvent = options?.onUnroutedEvent;
 		const cap = options?.handlerConcurrency;
 		if (cap !== void 0 && (!Number.isInteger(cap) || cap < 1)) throw new TypeError(`MemoryEventTransport: handlerConcurrency must be a positive integer, received ${String(cap)}`);
 		this.handlerConcurrency = cap ?? Number.POSITIVE_INFINITY;
@@ -103,6 +105,13 @@ var MemoryEventTransport = class {
 	async dispatch(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		if (allHandlers.size === 0 && this.onUnroutedEvent) try {
+			this.onUnroutedEvent(event);
+		} catch (err) {
+			try {
+				this.logger.error(`[EventTransport] onUnroutedEvent threw for ${event.type}:`, err);
+			} catch {}
+		}
 		const failures = [];
 		const run = async (handler) => {
 			try {

package/dist/{HookSystem-96nzZLmk.mjs → HookSystem-CxvZBo77.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-B9WnuG2Q.mjs → ResourceRegistry-Cu7uTJp9.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import "./constants-BQ2FbhPB.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import "./constants-BxLgNFF7.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/{actionPermissions-4OGbe3Hf.mjs → actionPermissions-DPwPWPOV.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CNQyOrLk.mjs";
-import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
-import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
-import { t as executePipeline } from "./pipe-4_XamfxI.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CDy3-zw1.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
+import { t as executePipeline } from "./pipe-CBVmUJ-j.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -82,6 +82,7 @@ function createRequestContext(req) {
 			arc: reqWithExtras.arc,
 			_scope: rawScope,
 			_ownershipCheck: reqWithExtras._ownershipCheck,
+			_crossTenantRead: reqWithExtras._crossTenantRead,
 			_policyFilters: reqWithExtras._policyFilters ?? {},
 			log: reqWithExtras.log
 		},

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import { d as UserBase } from "../base-C-NL2fTi.mjs";
-import "../index-D3sIPcD4.mjs";
+import { d as UserBase } from "../base-CxrV1LmG.mjs";
+import "../index-DHbyPo5j.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-46KyUADP.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DCWMI6hV.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts
@@ -187,7 +188,13 @@ const auditPlugin = async (fastify, opts = {}) => {
 	const stores = [];
 	if (repository) stores.push(repositoryAsAuditStore(repository, { sessionProvider: sessionProvider === false ? void 0 : sessionProvider }));
 	stores.push(...customStores);
-	if (stores.length === 0) stores.push(new MemoryAuditStore());
+	const memoryFallback = stores.length === 0;
+	if (memoryFallback) stores.push(new MemoryAuditStore());
+	declareRuntimeCapability(fastify, {
+		subsystem: "audit.store",
+		durability: memoryFallback ? "memory" : "shared",
+		detail: "default MemoryAuditStore: the trail is replica-local and lost on restart"
+	});
 	async function logToStores(entry) {
 		await Promise.all(stores.map((store) => store.log(entry)));
 	}

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-D3sIPcD4.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-DHbyPo5j.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-BHD3L8of.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BFEEshDS.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DLueLQdQ.mjs";
-import { o as toJsonSchema } from "../schemaConverter-DENbixyA.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-C0GpDsB_.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-C_YhELhe.mjs";
+import { n as requireSingleHeaderValue } from "../headers-CNECDE6q.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DDMOZ_Pm.mjs";
+import { o as toJsonSchema } from "../schemaConverter-BLCSmNbr.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-DiHXy8Ck.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
@@ -1298,6 +1299,11 @@ function createSessionManager(options) {
 		}
 	};
 	const sessionPlugin = async (fastify) => {
+		declareRuntimeCapability(fastify, {
+			subsystem: "auth.sessions",
+			durability: store instanceof MemorySessionStore ? "memory" : "shared",
+			detail: "MemorySessionStore: sessions exist on the replica that created them"
+		});
 		const authenticate = async (request, reply) => {
 			const cookieHeader = request.headers.cookie;
 			const signedValue = parseCookies(typeof cookieHeader === "string" ? cookieHeader : void 0).get(cookieName);

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-D_LFvMlm.mjs → authorizationDecision-2YY_Kaj1.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-BHD3L8of.mjs";
+import { t as ArcError } from "./errors-C_YhELhe.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{base-C-NL2fTi.d.mts → base-CxrV1LmG.d.mts}

@@ -294,6 +294,16 @@ declare module "fastify" {
     document?: unknown;
     /** Ownership check context (field name + user field) */
     _ownershipCheck?: Record<string, unknown>;
+    /**
+     * This read is deliberately NOT scoped to a tenant — a marketplace listing.
+     *
+     * Set by `multiTenantPreset({ crossTenant: [...] })`. Tenancy is applied in four separate
+     * places for a read (the preset middleware, `QueryResolver`, `buildTenantRepoOptions` and the
+     * post-fetch `checkOrgScope`), each deriving the org from the scope on its own, so a decision
+     * made in one of them is silently re-made by the other three. This flag is how that decision
+     * travels. Never set from user input.
+     */
+    _crossTenantRead?: boolean;
   }
 }
 type AnyRecord = Record<string, unknown>;

package/dist/{buildHandler-BG_CHXqQ.mjs → buildHandler-CUhjGHGZ.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-D_LFvMlm.mjs";
-import { g as toRepositoryFilter } from "./BaseController-BqJtbiUA.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DV3hRbsz.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { g as toRepositoryFilter } from "./BaseController-DYJRZ0EJ.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-R0G_JrnK.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -180,13 +180,15 @@ declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
 }
 /**
  * Minimal ioredis shape we depend on. We don't import ioredis itself so the
- * cache subpath stays peer-dep-free.
+ * cache subpath stays peer-dep-free. The `scan` tail is `unknown[]` so a real
+ * ioredis `Redis` (overloads with literal tokens + optional callback) is
+ * assignable — see the same note on the idempotency `IoredisLike`.
  */
 interface IoredisLike {
   get(key: string): Promise<string | null>;
   set(...args: unknown[]): Promise<string | null>;
   del(...keys: string[]): Promise<number>;
-  scan(cursor: string | number, ...args: (string | number)[]): Promise<[string, string[]]>;
+  scan(cursor: string | number, ...args: unknown[]): Promise<[string, string[]]>;
   pipeline?(): {
     del(key: string): unknown;
     exec(): Promise<unknown>;

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Ds3ekBiu.mjs";
-import { t as MemoryCacheStore } from "../memory-CNvjxzB2.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-2Pp9w-8D.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cmv4cBRa.mjs";
+import { t as MemoryCacheStore } from "../memory-CpDZ9NPw.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-B5F09bYr.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-Bqcn3Brl.mjs → caching-DsWDjIxx.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-D3sIPcD4.mjs";
+import { L as RequestWithExtras } from "../index-DHbyPo5j.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-BVlowlm7.mjs";
+import { t as ArcModule } from "../types-DfVDvkdP.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-CNQyOrLk.mjs";
-import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
-import { t as defineModule } from "../module-CNcwCKUJ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-CDy3-zw1.mjs";
+import { t as defineResource } from "../defineResource-DzGT-2LP.mjs";
+import { t as defineModule } from "../module-BkQEesNQ.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-D3sIPcD4.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DHbyPo5j.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BQ2FbhPB.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-B9WnuG2Q.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-BxLgNFF7.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-Cu7uTJp9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-BYrL8zvY.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-C3LFRzPq.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-99fIMC3p.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-BSSdtiOy.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-D_YmiCNf.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-pl88PHzb.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-Y2MlSN9n.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-C2jrJbWG.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-99fIMC3p.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-BSSdtiOy.mjs";
-import { t as init } from "../init-pl88PHzb.mjs";
+import { t as generate } from "../generate-D_YmiCNf.mjs";
+import { t as init } from "../init-Y2MlSN9n.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-BQ2FbhPB.mjs → constants-BxLgNFF7.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.mjs

@@ -1,27 +1,52 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-46KyUADP.mjs";
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-D4PuGhEw.mjs";
-import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-CoGpuzDX.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DCWMI6hV.mjs";
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-cSVKnYPk.mjs";
+import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-BhsWde4k.mjs";
 //#region src/context/requestScopedCache.ts
 /** The memo slot the per-scope store hangs off. */
 const SLOT = Symbol.for("arc.requestScopedCache");
 /**
-* A `Map`-backed `CacheAdapter` with NO eviction and NO TTL — both deliberate.
+* Entry cap for one scope's cache. A request touching this many distinct keys
+* is already pathological; a JOB RUN reaching it is ordinary, and that is the
+* case this exists for (see the eviction note below).
+*/
+const MAX_ENTRIES = 1e4;
+/**
+* A `Map`-backed `CacheAdapter` with NO TTL and LRU eviction above
+* {@link MAX_ENTRIES}.
+*
+* TTL is accepted and ignored because repo-core stamps freshness INTO the
+* envelope and re-checks on read — honouring it here too would put two clocks
+* on one question.
 *
-* The store is unreachable once the request's async context ends, so it is
-* garbage in milliseconds and bounded by what one request touches; an LRU
-* would guard a lifetime that cannot occur. TTL is accepted and ignored
-* because repo-core stamps freshness INTO the envelope and re-checks on read —
-* honouring it here too would put two clocks on one question.
+* Eviction is newer than the rest of this file and the reason is worth
+* keeping. Unbounded was correct while a scope meant an HTTP REQUEST: the
+* store is unreachable once that async context ends, so it was garbage in
+* milliseconds and bounded by what one request touched, and an LRU would have
+* guarded a lifetime that could not occur. 2.40 extended scopes to job runs
+* and event dispatches — and `schedulesPlugin` wraps the WHOLE handler in one
+* scope, so a nightly job sweeping a million rows holds a single cache for the
+* duration. That is now a lifetime that occurs, and the old premise no longer
+* holds. Evicting is always safe here: this is a cache, so the worst a miss
+* costs is the re-read it was avoiding.
 */
 function createRequestCacheAdapter() {
 	const map = /* @__PURE__ */ new Map();
 	return {
 		async get(key) {
-			return map.get(key);
+			if (!map.has(key)) return void 0;
+			const value = map.get(key);
+			map.delete(key);
+			map.set(key, value);
+			return value;
 		},
 		async set(key, value, _ttlSeconds) {
+			map.delete(key);
 			map.set(key, value);
+			if (map.size > MAX_ENTRIES) {
+				const oldest = map.keys().next();
+				if (!oldest.done) map.delete(oldest.value);
+			}
 		},
 		async delete(key) {
 			map.delete(key);

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-D3sIPcD4.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-SCsOJxWB.mjs";
+import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-DHbyPo5j.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-D4u76eQW.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BQ2FbhPB.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-BqJtbiUA.mjs";
-import { t as defineAggregation } from "../defineAggregation-BDA2Tw7v.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-4OGbe3Hf.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DaIySrQr.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-CsZR037F.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-BxLgNFF7.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-DYJRZ0EJ.mjs";
+import { t as defineAggregation } from "../defineAggregation-UyeurGkp.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-DPwPWPOV.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DzGT-2LP.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-iNGqYerO.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/{core-CsZR037F.mjs → core-iNGqYerO.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import "./constants-BQ2FbhPB.mjs";
-import { t as defineResource } from "./defineResource-DaIySrQr.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import "./constants-BxLgNFF7.mjs";
+import { t as defineResource } from "./defineResource-DzGT-2LP.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema

package/dist/{createActionRouter-BR93gCKg.mjs → createActionRouter-BBlbPs3k.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
-import "./constants-BQ2FbhPB.mjs";
-import { f as createError } from "./errors-BHD3L8of.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-4OGbe3Hf.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-_6zHiz0x.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-C2qUNzC6.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
+import "./constants-BxLgNFF7.mjs";
+import { f as createError } from "./errors-C_YhELhe.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-DPwPWPOV.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-DRsSHPSM.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-K16Bb5BX.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,