@classytic/arc 2.40.0 → 2.41.0

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BQ2FbhPB.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-BHD3L8of.mjs";
-import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-BqJtbiUA.mjs";
-import { t as defineAggregation } from "./defineAggregation-BDA2Tw7v.mjs";
-import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
-import { l as getControllerScope } from "./actionPermissions-4OGbe3Hf.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-DaIySrQr.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-CsZR037F.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-C0GpDsB_.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BxLgNFF7.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-C_YhELhe.mjs";
+import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-DYJRZ0EJ.mjs";
+import { t as defineAggregation } from "./defineAggregation-UyeurGkp.mjs";
+import { i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { l as getControllerScope } from "./actionPermissions-DPwPWPOV.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-DzGT-2LP.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-iNGqYerO.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-DiHXy8Ck.mjs";
 //#region src/index.ts
-const version = "2.40.0";
+const version = "2.41.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-pl88PHzb.mjs → init-Y2MlSN9n.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "../EventTransport-BPOQsEer.mjs";
+import { n as DomainEvent } from "../EventTransport-CbUKDzZZ.mjs";
 import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BOXVggMf.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/integrations/event-gateway.d.ts

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-DbyXoQun.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-CH7Slxc1.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,8 +1,8 @@
 
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
-import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-eyg5WEcy.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-9rvxn5Ym.mjs";
+import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-CbJiYrfv.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-CWQn9-IC.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.d.mts

@@ -1,3 +1,3 @@
 
-import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-eyg5WEcy.mjs";
+import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-CbJiYrfv.mjs";
 export { type ExecuteTimedHandlerOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobRepeatOptions, type JobStatus, type JobsPluginOptions, type QueueStats, type TimedHandlerLogger, defineJob, executeTimedHandler, jobsPlugin };

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-D_LFvMlm.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-2YY_Kaj1.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.d.mts

@@ -1,10 +1,10 @@
 
 import { i as RequestScope } from "../../types-Ddl9OjmE.mjs";
-import { l as PermissionCheck } from "../../base-C-NL2fTi.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-D3sIPcD4.mjs";
+import { l as PermissionCheck } from "../../base-CxrV1LmG.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-DHbyPo5j.mjs";
 import { n as FieldPermissionMap } from "../../fields-I_EeRWND.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-9rvxn5Ym.mjs";
-import { i as resolveToolCollisions, n as McpServerInstance, r as createMcpServer, t as AuthRef } from "../../createMcpServer-BVTs2S5G.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-CWQn9-IC.mjs";
+import { i as resolveToolCollisions, n as McpServerInstance, r as createMcpServer, t as AuthRef } from "../../createMcpServer-CbDWkZ1T.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-D-3OLxNz.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-xF3Gw-HW.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,6 +1,6 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-9rvxn5Ym.mjs";
-import { n as McpServerInstance } from "../../createMcpServer-BVTs2S5G.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-CWQn9-IC.mjs";
+import { n as McpServerInstance } from "../../createMcpServer-CbDWkZ1T.mjs";
 import { Client } from "@modelcontextprotocol/client";
 //#region src/integrations/mcp/testing.d.ts
 /** An MCP client bound to a live loopback server, plus its teardown. */

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-D-3OLxNz.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-xF3Gw-HW.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * Serve an already-built `McpServer` on an ephemeral loopback port and connect

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-BHD3L8of.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-CFwCzEvU.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-C_YhELhe.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-dvppnxsr.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
-import { a as EventTransport, n as DomainEvent } from "../EventTransport-BPOQsEer.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-CzsKRBvO.mjs";
+import { a as EventTransport, n as DomainEvent } from "../EventTransport-CbUKDzZZ.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-BHdUnuuK.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-Bo7rSKjm.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-6DMC_WNu.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-dsCyLxXH.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent } from "@classytic/primitives/events";

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -9,7 +9,7 @@ import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as Pus
  */
 interface RedisLike {
   get(key: string): Promise<string | null>;
-  set(key: string, value: string, mode?: string, duration?: number): Promise<unknown>;
+  set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
   del(key: string): Promise<number>;
   pexpire(key: string, ttlMs: number): Promise<number>;
   scan(cursor: string | number, matchKw: "MATCH", pattern: string, countKw: "COUNT", count: number): Promise<[string, string[]]>;

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";
@@ -1490,6 +1491,16 @@ const websocketPluginImpl = async (fastify, options) => {
 		...options.pushRefStore ? { store: options.pushRefStore } : {}
 	});
 	const rooms = new RoomManager(maxClientsPerRoom, adapter ?? new LocalWebSocketAdapter(), pushRefRegistry, fastify.log);
+	declareRuntimeCapability(fastify, {
+		subsystem: "websocket.adapter",
+		durability: adapter ? "shared" : "memory",
+		detail: "LocalWebSocketAdapter: a broadcast reaches only this replica's sockets"
+	});
+	declareRuntimeCapability(fastify, {
+		subsystem: "websocket.pushref-store",
+		durability: options.pushRefStore ? "shared" : "memory",
+		detail: "MemoryPushRefStore: a client reconnecting through another replica loses its dead queue (RESUME replays nothing)"
+	});
 	if (adapter) await adapter.subscribe((room, message) => {
 		if (room.startsWith("org:")) {
 			const parts = room.split(":");

package/dist/{interface-DjtFnZxH.mjs → interface-BIpgzbZl.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-Dx6jH_Nb.mjs → jsonBody-Cq9KYl2Z.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-BHD3L8of.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-C_YhELhe.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-Ds3ekBiu.mjs → keys-Cmv4cBRa.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-E5UFlRrT.mjs → loadResources-CblF7xt2.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-C2jrJbWG.mjs → loadResourcesFromEntry-99fIMC3p.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-B9WnuG2Q.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-Cu7uTJp9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger/index.ts
 /**

package/dist/{mcpPlugin-D-3OLxNz.mjs → mcpPlugin-xF3Gw-HW.mjs}

@@ -1,18 +1,18 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-D_LFvMlm.mjs";
-import { p as isArcError, t as ArcError } from "./errors-BHD3L8of.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BFEEshDS.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CNQyOrLk.mjs";
-import { t as BaseController } from "./BaseController-BqJtbiUA.mjs";
-import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-fA-Dkou5.mjs";
-import { t as buildRequestScopeProjection } from "./projection-qbCOEvsh.mjs";
-import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-4OGbe3Hf.mjs";
-import { t as executePipeline } from "./pipe-4_XamfxI.mjs";
-import { t as pluralize } from "./pluralize-BaQ62hOW.mjs";
-import { t as createIdempotencyResult } from "./interface-DjtFnZxH.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-C2qUNzC6.mjs";
-import { n as validateAggregations } from "./validate-DV3hRbsz.mjs";
-import { n as executeAggregation } from "./buildHandler-BG_CHXqQ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { p as isArcError, t as ArcError } from "./errors-C_YhELhe.mjs";
+import { n as requireSingleHeaderValue } from "./headers-CNECDE6q.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CDy3-zw1.mjs";
+import { t as BaseController } from "./BaseController-DYJRZ0EJ.mjs";
+import { a as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-BTyPLHK0.mjs";
+import { t as buildRequestScopeProjection } from "./projection-Uvgp-EEj.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-DPwPWPOV.mjs";
+import { t as executePipeline } from "./pipe-CBVmUJ-j.mjs";
+import { t as pluralize } from "./pluralize-2_U6QZQg.mjs";
+import { t as createIdempotencyResult } from "./interface-BIpgzbZl.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-K16Bb5BX.mjs";
+import { n as validateAggregations } from "./validate-R0G_JrnK.mjs";
+import { n as executeAggregation } from "./buildHandler-CUhjGHGZ.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/{memory-CNvjxzB2.mjs → memory-CpDZ9NPw.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-P37sNV5H.mjs → metrics-BaKnq8ag.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-D3sIPcD4.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DHbyPo5j.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BQ2FbhPB.mjs";
-import { t as multipartBody } from "../multipartBody-Bl_gU3Wg.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BxLgNFF7.mjs";
+import { t as multipartBody } from "../multipartBody-C92aJ8am.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-B5Grm0pI.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-B3VYh5aU.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-CNcwCKUJ.mjs → module-BkQEesNQ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-Bl_gU3Wg.mjs → multipartBody-C92aJ8am.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-BYrL8zvY.mjs → openapi-C3LFRzPq.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-DENbixyA.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-4OGbe3Hf.mjs";
-import { t as pluralize } from "./pluralize-BaQ62hOW.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-BR93gCKg.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-BLCSmNbr.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-DPwPWPOV.mjs";
+import { t as pluralize } from "./pluralize-2_U6QZQg.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BBlbPs3k.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { t as ArcModule } from "../types-BVlowlm7.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { t as ArcModule } from "../types-DfVDvkdP.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-BHD3L8of.mjs";
-import { t as defineResource } from "../defineResource-DaIySrQr.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-CNcwCKUJ.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-C_YhELhe.mjs";
+import { t as defineResource } from "../defineResource-DzGT-2LP.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-BkQEesNQ.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-CzsKRBvO.d.mts → outbox-module-BHdUnuuK.d.mts}

@@ -1,6 +1,6 @@
 
-import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-BPOQsEer.mjs";
-import { t as ArcModule } from "./types-BVlowlm7.mjs";
+import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-CbUKDzZZ.mjs";
+import { t as ArcModule } from "./types-DfVDvkdP.mjs";
 import { FastifyInstance } from "fastify";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 import { OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";
@@ -379,6 +379,10 @@ interface OutboxModuleExports {
    * just wrote is delivered in milliseconds rather than up to `relayEveryMs`
    * later. Safe under concurrency: the store's lease and fence token make an
    * extra pass a no-op, not a double publish.
+   *
+   * Calling from inside a request does NOT put the pass in that request's
+   * scope: a pass drains whatever is pending, which is other requests' rows.
+   * The pass runs scope-free, so each event opens its own (see `runWorkScope`).
    */
   requestDrain: () => void;
 }

package/dist/{outbox-module-6DMC_WNu.mjs → outbox-module-dsCyLxXH.mjs}

@@ -1,7 +1,8 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "./transactionContext-46KyUADP.mjs";
-import { i as resolveEventTransport } from "./EventTransport-BUkTwY_x.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-BfyOd5i6.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-DCWMI6hV.mjs";
+import { n as requestContext } from "./requestContext-cSVKnYPk.mjs";
+import { i as resolveEventTransport } from "./EventTransport-n7qO5Cz3.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-9DX9-1j_.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
@@ -836,8 +837,10 @@ function createOutboxModule(options) {
 				drainQueued = true;
 				setImmediate(() => {
 					drainQueued = false;
-					relay.relayBatch().catch((err) => {
-						fastify.log.error({ err }, `outbox relay "${name}" requested drain failed`);
+					requestContext.storage.exit(() => {
+						relay.relayBatch().catch((err) => {
+							fastify.log.error({ err }, `outbox relay "${name}" requested drain failed`);
+						});
 					});
 				});
 			};

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-C-NL2fTi.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-CxrV1LmG.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BtYoMip1.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BHdZD8zK.mjs";
 export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-D_LFvMlm.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DLueLQdQ.mjs";
-import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-fA-Dkou5.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-C0GpDsB_.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-2YY_Kaj1.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-DDMOZ_Pm.mjs";
+import { a as resolveEffectiveRoles, i as fields, n as applyFieldWritePermissions, t as applyFieldReadPermissions } from "../fields-BTyPLHK0.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-DiHXy8Ck.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-C0GpDsB_.mjs → permissions-DiHXy8Ck.mjs}

@@ -1,10 +1,11 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-D_LFvMlm.mjs";
-import { n as getUserRoles } from "./userHelpers-DLueLQdQ.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CNQyOrLk.mjs";
-import { t as MemoryCacheStore } from "./memory-CNvjxzB2.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-2YY_Kaj1.mjs";
+import { n as getUserRoles } from "./userHelpers-DDMOZ_Pm.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CDy3-zw1.mjs";
+import { n as declareRuntimeCapability } from "./runtimeCapabilities-DSA_dH1_.mjs";
+import { t as MemoryCacheStore } from "./memory-CpDZ9NPw.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**
@@ -871,6 +872,11 @@ function createDynamicPermissionMatrix(config) {
 		maxEntries: config.cache?.maxEntries ?? 1e3
 	}) : void 0;
 	const cacheStore = config.cacheStore ?? internalStore;
+	if (config.fastify && cacheStore) declareRuntimeCapability(config.fastify, {
+		subsystem: "permissions.dynamic-cache",
+		durability: internalStore ? "memory" : "shared",
+		detail: "internal MemoryCacheStore: a role change invalidates on this replica only"
+	});
 	const trackedKeys = /* @__PURE__ */ new Set();
 	const orgKeyIndex = /* @__PURE__ */ new Map();
 	const maxTrackedKeys = config.cache?.maxEntries ?? 1e4;

package/dist/{pipe-4_XamfxI.mjs → pipe-CBVmUJ-j.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-BHD3L8of.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-C_YhELhe.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,5 +1,5 @@
 
-import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-D3sIPcD4.mjs";
+import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DHbyPo5j.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-4_XamfxI.mjs";
+/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-CBVmUJ-j.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.