@classytic/arc 2.40.0 → 2.41.1

package/dist/plugins/index.d.mts

@@ -1,10 +1,10 @@
 
-import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-D3sIPcD4.mjs";
+import { t as AnyRecord } from "../base-CxrV1LmG.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DHbyPo5j.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler--4rSMMvq.mjs";
-import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-BVlowlm7.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-HncZMmze.mjs";
-import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-P3V6ATyC.mjs";
+import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-DfVDvkdP.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-Cq2nHVaW.mjs";
+import { C as gracefulShutdownPlugin, S as _default$2, _ as CachingRule, a as MetricsCollector, b as GracefulShutdownOptions, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, x as ShutdownState, y as cachingPlugin } from "../versioning-D6JIK8Tk.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -59,36 +59,6 @@ interface ArcPlugin<TRootOpts extends AnyRecord = AnyRecord, TResourceOpts exten
  */
 declare function createPlugin<TRootOpts extends AnyRecord = AnyRecord, TResourceOpts extends AnyRecord = AnyRecord>(name: string, definition: CreatePluginDefinition<TRootOpts, TResourceOpts>): ArcPlugin<TRootOpts, TResourceOpts>;
 //#endregion
-//#region src/plugins/gracefulShutdown.d.ts
-interface GracefulShutdownOptions {
-  /** Maximum time to wait for graceful shutdown in ms (default: 30000) */
-  timeout?: number;
-  /** Custom cleanup function called before exit */
-  onShutdown?: () => Promise<void> | void;
-  /** Signals to handle (default: ['SIGTERM', 'SIGINT']) */
-  signals?: NodeJS.Signals[];
-  /** Whether to log shutdown events (default: true) */
-  logEvents?: boolean;
-  /**
-   * Called when shutdown times out or encounters an error.
-   * Defaults to `process.exit(1)` — appropriate for production but dangerous in:
-   * - **Tests**: kills the test runner. Pass `() => {}` or `() => { throw … }`.
-   * - **Shared runtimes** (e.g., serverless): may kill unrelated handlers.
-   *
-   * @param reason - `'timeout'` if shutdown exceeded `timeout` ms,
-   *                 `'error'` if `onShutdown` or `fastify.close()` threw.
-   */
-  onForceExit?: (reason: "timeout" | "error") => void;
-}
-declare const gracefulShutdownPlugin: FastifyPluginAsync<GracefulShutdownOptions>;
-declare module "fastify" {
-  interface FastifyInstance {
-    /** Trigger graceful shutdown manually */
-    shutdown: () => Promise<void>;
-  }
-}
-declare const _default$2: FastifyPluginAsync<GracefulShutdownOptions>;
-//#endregion
 //#region src/plugins/pressure.d.ts
 /**
  * One measurable source of load, normalised by whoever owns it.
@@ -253,4 +223,4 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
 declare const _default$7: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as pressurePlugin, pressurePlugin as pressurePluginFn, _default$6 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$7 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$8 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$9 as ssePlugin, ssePlugin as ssePluginFn, _default$10 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type ShutdownState, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as pressurePlugin, pressurePlugin as pressurePluginFn, _default$6 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$7 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$8 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$9 as ssePlugin, ssePlugin as ssePluginFn, _default$10 as versioningPlugin, versioningPlugin as versioningPluginFn };

package/dist/plugins/index.mjs

@@ -1,20 +1,20 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { p as MUTATION_OPERATIONS } from "../constants-BQ2FbhPB.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS } from "../constants-D5Ubn1fe.mjs";
 import { arcLog } from "../logger/index.mjs";
-import { c as getOrgId } from "../types-CNQyOrLk.mjs";
-import { n as requestContext } from "../requestContext-D4PuGhEw.mjs";
-import { t as hasEvents } from "../typeGuards-t_CVgRXN.mjs";
-import { t as HookSystem } from "../HookSystem-96nzZLmk.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-B9WnuG2Q.mjs";
-import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-BlGHjkqZ.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-Bqcn3Brl.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-By9keRvX.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-P37sNV5H.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-zzoNLDtj.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-9h-a592u.mjs";
-import { n as schedules_default, t as schedulesPlugin } from "../schedules-Dm21pqHU.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-DbyXoQun.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-BXwmj5SD.mjs";
+import { c as getOrgId } from "../types-CgenB1gv.mjs";
+import { n as requestContext } from "../requestContext-cDkAUr-P.mjs";
+import { t as hasEvents } from "../typeGuards-BLjPgVBm.mjs";
+import { t as HookSystem } from "../HookSystem-CMF94SEA.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-MGpXoxHZ.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-ZRHeDHXH.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-DbCBxlgw.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-D1GHKGlV.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-NMsmpRmY.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-8tIQWZz4.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-CNdvMfM4.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-j6uXXAeJ.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-BeqVKQKu.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-DKkT4hNJ.mjs";
 import fp from "fastify-plugin";
 import { performance as performance$1 } from "node:perf_hooks";
 //#region src/core/arcCorePlugin.ts
@@ -35,6 +35,7 @@ const arcCorePlugin = async (fastify, opts = {}) => {
 	for (const field of [
 		"_policyFilters",
 		"_ownershipCheck",
+		"_crossTenantRead",
 		"fieldMask",
 		"policyMetadata",
 		"document"
@@ -154,18 +155,20 @@ function createPlugin(name, definition) {
 //#endregion
 //#region src/plugins/gracefulShutdown.ts
 const gracefulShutdownPlugin = async (fastify, opts = {}) => {
-	const { timeout = 3e4, onShutdown, signals = ["SIGTERM", "SIGINT"], logEvents = true, onForceExit = () => process.exit(1) } = opts;
-	let isShuttingDown = false;
+	const { timeout = 3e4, onShutdown, signals = ["SIGTERM", "SIGINT"], logEvents = true, drainDelayMs = 0, onForceExit = () => process.exit(1) } = opts;
+	const state = { draining: false };
 	const signalHandlers = /* @__PURE__ */ new Map();
 	const shutdown = async (signal) => {
-		if (isShuttingDown) {
+		if (state.draining) {
 			if (logEvents) fastify.log?.warn?.({ signal }, "Shutdown already in progress, ignoring signal");
 			return;
 		}
-		isShuttingDown = true;
+		state.draining = true;
+		state.since = /* @__PURE__ */ new Date();
 		if (logEvents) fastify.log?.info?.({
 			signal,
-			timeout
+			timeout,
+			drainDelayMs
 		}, "Shutdown signal received, starting graceful shutdown");
 		const forceExitTimer = setTimeout(() => {
 			if (logEvents) fastify.log?.error?.("Graceful shutdown timeout exceeded, forcing exit");
@@ -173,6 +176,10 @@ const gracefulShutdownPlugin = async (fastify, opts = {}) => {
 		}, timeout);
 		forceExitTimer.unref();
 		try {
+			if (drainDelayMs > 0) {
+				if (logEvents) fastify.log?.info?.({ drainDelayMs }, "Draining — readiness failing, still serving");
+				await new Promise((resolve) => setTimeout(resolve, drainDelayMs));
+			}
 			if (logEvents) fastify.log?.info?.("Closing server to new connections");
 			await fastify.close();
 			if (onShutdown) {
@@ -201,7 +208,11 @@ const gracefulShutdownPlugin = async (fastify, opts = {}) => {
 	fastify.decorate("shutdown", async () => {
 		await shutdown("MANUAL");
 	});
-	if (logEvents) fastify.log?.debug?.({ signals }, "Graceful shutdown plugin registered");
+	fastify.decorate("shutdownState", state);
+	if (logEvents) fastify.log?.debug?.({
+		signals,
+		drainDelayMs
+	}, "Graceful shutdown plugin registered");
 };
 var gracefulShutdown_default = fp(gracefulShutdownPlugin, {
 	name: "arc-graceful-shutdown",

package/dist/plugins/response-cache.mjs

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as hasEvents } from "../typeGuards-t_CVgRXN.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-CkhS6jn6.mjs";
+import { t as hasEvents } from "../typeGuards-BLjPgVBm.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**
@@ -96,6 +97,12 @@ const responseCachePluginImpl = async (fastify, opts = {}) => {
 	if (maxEntries > 5e3) fastify.log.warn(`[arc] responseCache maxEntries=${maxEntries}: prefix invalidation scans all entries synchronously on every mutating request — expect event-loop pauses at this size. This cache is an instance-local micro-cache; for large shared caching use the queryCache with a Redis store instead.`);
 	const cache = new LRUCache(maxEntries);
 	const invalidateMethods = new Set(invalidateOn.map((m) => m.toUpperCase()));
+	declareRuntimeCapability(fastify, {
+		subsystem: "http.response-cache",
+		durability: "memory",
+		accepted: true,
+		detail: "per-replica micro-cache; correctness comes from short TTLs, not shared state"
+	});
 	if (!fastify.hasRequestDecorator("__arcCacheTTL")) fastify.decorateRequest("__arcCacheTTL", void 0);
 	/** Find TTL for a given URL path (seconds) */
 	function getTTL(url) {

package/dist/plugins/tracing-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -59,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.40.0";
+	const resolvedVersion = serviceVersion ?? "2.41.1";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-BaQ62hOW.mjs → pluralize-CXWZIzTv.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-DVgPCNcD.d.mts → preloadResources-CjS2OfpU.d.mts}

@@ -1,15 +1,15 @@
 
-import { It as Authenticator } from "./index-D3sIPcD4.mjs";
+import { It as Authenticator } from "./index-DHbyPo5j.mjs";
 import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 import { n as ElevationOptions } from "./elevation-BXCfVcNG.mjs";
-import { a as EventTransport } from "./EventTransport-BPOQsEer.mjs";
+import { a as EventTransport } from "./EventTransport-CbUKDzZZ.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
 import { r as QueryCachePluginOptions } from "./queryCachePlugin-BzqxconG.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler--4rSMMvq.mjs";
-import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-BVlowlm7.mjs";
-import "./index-DbMglURO.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-DfHaKEWQ.mjs";
-import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-P3V6ATyC.mjs";
+import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-DfVDvkdP.mjs";
+import "./index-CFfLKMH4.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-B52abJ8W.mjs";
+import { b as GracefulShutdownOptions, g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-D6JIK8Tk.mjs";
 import { r as IdempotencyStore } from "./interface-DEWNOMza.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
 //#region src/factory/types/assets.d.ts
@@ -652,8 +652,13 @@ interface CreateAppOptions {
      * ```
      */
     health?: boolean | HealthOptions;
-    /** Graceful shutdown handling (default: true) */
-    gracefulShutdown?: boolean;
+    /**
+     * Graceful shutdown handling (default: true). Pass `GracefulShutdownOptions`
+     * to configure it inline — in particular `drainDelayMs`, the lame-duck
+     * window behind a load balancer (readiness fails first, the server keeps
+     * serving until the LB has deregistered the instance, then closes).
+     */
+    gracefulShutdown?: boolean | GracefulShutdownOptions;
     /** Emit events for CRUD operations (default: true) */
     emitEvents?: boolean;
     /**

package/dist/{preloadResources-BAx5s9EF.mjs → preloadResources-f3boenVZ.mjs}

@@ -1,12 +1,12 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DzE6ikSH.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
 import { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger } from "./logger/index.mjs";
-import { n as PUBLIC_SCOPE } from "./types-CNQyOrLk.mjs";
-import { t as auditRuntimeCapabilities } from "./runtimeCapabilities-Bo7rSKjm.mjs";
-import { n as isScopeAwareKeyGenerator, t as createTenantKeyGenerator } from "./rateLimitKey-umrS6-vu.mjs";
-import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-BlGHjkqZ.mjs";
-import { t as parseJsonBody } from "./jsonBody-Dx6jH_Nb.mjs";
-import { r as wrapWithBoundary } from "./subscribe-helpers-KgVEcn8L.mjs";
+import { n as PUBLIC_SCOPE } from "./types-CgenB1gv.mjs";
+import { r as initRuntimeCapabilityRegistry, t as auditRuntimeCapabilities } from "./runtimeCapabilities-CkhS6jn6.mjs";
+import { n as isScopeAwareKeyGenerator, t as createTenantKeyGenerator } from "./rateLimitKey-BvOvcBDi.mjs";
+import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-ZRHeDHXH.mjs";
+import { t as parseJsonBody } from "./jsonBody-ELR9lfeU.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-DatDkcuG.mjs";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import Fastify from "fastify";
 import qs from "qs";
@@ -851,7 +851,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-DB26V7uX.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-zZY-unhr.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			/**
@@ -906,19 +906,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 		trackPlugin("arc-health", { checkCount: healthOpts.checks?.length ?? 0 });
 	}
 	if (config.arcPlugins?.gracefulShutdown !== false) {
-		await fastify.register(gracefulShutdownPlugin);
-		trackPlugin("arc-graceful-shutdown");
+		const shutdownOpts = typeof config.arcPlugins?.gracefulShutdown === "object" ? config.arcPlugins.gracefulShutdown : {};
+		await fastify.register(gracefulShutdownPlugin, shutdownOpts);
+		trackPlugin("arc-graceful-shutdown", shutdownOpts);
 	}
 	if (config.arcPlugins?.caching) {
-		const { default: cachingPlugin } = await import("./caching-Bqcn3Brl.mjs").then((n) => n.r);
+		const { default: cachingPlugin } = await import("./caching-DbCBxlgw.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.caching === true ? {} : config.arcPlugins.caching;
 		await fastify.register(cachingPlugin, opts);
 		trackPlugin("arc-caching", opts);
 	}
 	if (config.arcPlugins?.queryCache) {
-		const { queryCachePlugin } = await import("./queryCachePlugin-2Pp9w-8D.mjs").then((n) => n.n);
+		const { queryCachePlugin } = await import("./queryCachePlugin-DZHPOm9p.mjs").then((n) => n.n);
 		const opts = config.arcPlugins.queryCache === true ? {} : config.arcPlugins.queryCache;
-		const store = config.stores?.queryCache ?? new (await (import("./memory-CNvjxzB2.mjs").then((n) => n.n))).MemoryCacheStore();
+		const store = config.stores?.queryCache ?? new (await (import("./memory-Iotz0cCx.mjs").then((n) => n.n))).MemoryCacheStore();
 		await fastify.register(queryCachePlugin, {
 			store,
 			...opts
@@ -928,7 +929,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.sse) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 		else {
-			const { default: ssePlugin } = await import("./sse-DbyXoQun.mjs").then((n) => n.r);
+			const { default: ssePlugin } = await import("./sse-BeqVKQKu.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 			await fastify.register(ssePlugin, opts);
 			trackPlugin("arc-sse", opts);
@@ -937,20 +938,20 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	if (config.arcPlugins?.realtime) {
 		if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 		else {
-			const { default: realtimePlugin } = await import("./realtime-zzoNLDtj.mjs").then((n) => n.r);
+			const { default: realtimePlugin } = await import("./realtime-8tIQWZz4.mjs").then((n) => n.r);
 			const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 			await fastify.register(realtimePlugin, opts);
 			trackPlugin("arc-realtime", opts);
 		}
 	}
 	if (config.arcPlugins?.metrics) {
-		const { default: metricsPlugin } = await import("./metrics-P37sNV5H.mjs").then((n) => n.r);
+		const { default: metricsPlugin } = await import("./metrics-NMsmpRmY.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
 		await fastify.register(metricsPlugin, opts);
 		trackPlugin("arc-metrics", opts);
 	}
 	if (config.arcPlugins?.versioning) {
-		const { default: versioningPlugin } = await import("./versioning-BXwmj5SD.mjs").then((n) => n.r);
+		const { default: versioningPlugin } = await import("./versioning-DKkT4hNJ.mjs").then((n) => n.r);
 		await fastify.register(versioningPlugin, config.arcPlugins.versioning);
 		trackPlugin("arc-versioning", config.arcPlugins.versioning);
 	}
@@ -1027,7 +1028,7 @@ async function registerAuth(fastify, config, trackPlugin) {
 */
 async function registerElevation(fastify, config, trackPlugin) {
 	if (!config.elevation) return;
-	const { elevationPlugin } = await import("./elevation-CZy6n50b.mjs").then((n) => n.r);
+	const { elevationPlugin } = await import("./elevation-CkvG0LG2.mjs").then((n) => n.r);
 	await fastify.register(elevationPlugin, config.elevation);
 	trackPlugin("arc-elevation", config.elevation);
 	fastify.log.debug("Elevation plugin enabled");
@@ -1042,7 +1043,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-By9keRvX.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-D1GHKGlV.mjs").then((n) => n.r);
 	/**
 	* DISCLOSURE DEFAULTS MERGE — they used to be REPLACED, and that was two bugs.
 	*
@@ -1266,7 +1267,7 @@ async function registerResources(fastify, config, preResolvedModules) {
 		let discoveryPath;
 		let discoveryYieldedZero = false;
 		if (resolvedResources === void 0 && config.resourceDir) {
-			const { loadResources } = await import("./loadResources-E5UFlRrT.mjs").then((n) => n.n);
+			const { loadResources } = await import("./loadResources-BPfWiI5s.mjs").then((n) => n.n);
 			const { resolve, dirname } = await import("node:path");
 			const { fileURLToPath } = await import("node:url");
 			const rawDir = config.resourceDir;
@@ -1392,7 +1393,7 @@ Resources supplied by "${m.name}": ${provided}.`);
 			if (fastify.hasDecorator("getScheduleStats")) throw new Error("[arc] modules declare scheduledJobs but schedulesPlugin was already registered manually. Configure their runner through arcPlugins.schedules so Arc can compose one schedule table.");
 			const frozenJobs = Object.freeze(scheduledJobs.map((job) => Object.freeze({ ...job })));
 			const scheduleOptions = typeof config.arcPlugins?.schedules === "object" ? config.arcPlugins.schedules : {};
-			const { default: schedulesPlugin } = await import("./schedules-Dm21pqHU.mjs").then((n) => n.r);
+			const { default: schedulesPlugin } = await import("./schedules-j6uXXAeJ.mjs").then((n) => n.r);
 			await fastify.register(schedulesPlugin, {
 				...scheduleOptions,
 				schedules: frozenJobs
@@ -1648,8 +1649,9 @@ async function registerSecurityPlugins(fastify, config) {
 			timeWindow: "1 minute"
 		});
 		await fastify.register(rateLimit, rateLimitOpts);
-		if (!(typeof rateLimitOpts === "object" && "store" in rateLimitOpts)) {
-			if (config.runtime === "distributed") throw new Error("[Arc] runtime: 'distributed' with rate limiting requires a shared store.\nProvide rateLimit: { store: new RedisStore({ ... }) } or disable rate limiting: rateLimit: false");
+		const rateLimitRecord = typeof rateLimitOpts === "object" && rateLimitOpts !== null ? rateLimitOpts : void 0;
+		if (!(rateLimitRecord !== void 0 && (rateLimitRecord.store != null || rateLimitRecord.redis != null))) {
+			if (config.runtime === "distributed") throw new Error("[Arc] runtime: 'distributed' with rate limiting requires a shared store.\nProvide rateLimit: { redis: ioredisClient } (or { store: CustomStore }) or disable rate limiting: rateLimit: false");
 			else if (config.preset === "production") fastify.log.warn("Rate limiting is using in-memory store. In multi-instance deployments, each instance tracks limits independently. Configure a Redis store for distributed rate limiting.");
 		}
 		fastify.log.debug("Rate limiting enabled");
@@ -1790,6 +1792,7 @@ const DEFAULT_LOGGER_REDACT_PATHS = [
 	"req.headers.authorization",
 	"req.headers[\"x-api-key\"]",
 	"req.headers[\"x-internal-api-key\"]",
+	"req.headers[\"x-device-token\"]",
 	"req.headers.cookie",
 	"req.headers[\"set-cookie\"]",
 	"res.headers[\"set-cookie\"]",
@@ -1861,7 +1864,10 @@ function validateDistributedRuntime(options) {
 		});
 	}
 	const schedules = options.arcPlugins?.schedules;
-	if (schedules && typeof schedules === "object" && schedules.enabled !== false && !schedules.lock) deferredWarnings.push("runtime: 'distributed' — schedules configured without a `lock` adapter. EVERY replica will fire every schedule tick. Pass an ecosystem lock (e.g. createMongoLockAdapter) under arcPlugins.schedules.lock for single-firer leases.");
+	if (schedules && typeof schedules === "object" && schedules.enabled !== false && !schedules.lock && !schedules.singleReplica) missing.push({
+		key: "arcPlugins.schedules.lock",
+		hint: "a LockAdapter for single-firer leases (e.g. createMongoLockAdapter) — or `arcPlugins.schedules.singleReplica: true` if exactly one replica arms schedules"
+	});
 	if (missing.length > 0) {
 		const lines = missing.map((m) => `  • ${m.key.padEnd(20)} → ${m.hint}`).join("\n");
 		throw new Error(`[Arc] runtime: 'distributed' requires durable (Redis/MongoDB) adapters, not memory.
@@ -1986,6 +1992,7 @@ async function buildApp(options, loggerScope, onInstance) {
 		} }
 	});
 	onInstance(fastify);
+	initRuntimeCapabilityRegistry(fastify);
 	if (resolvedLogger !== false) {
 		const writer = createPinoWriter(fastify.log);
 		loggerScope.writer = writer;
@@ -2048,7 +2055,7 @@ async function buildApp(options, loggerScope, onInstance) {
 	await registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers);
 	await registerResources(fastify, config, resolvedModules);
 	if (config.replyHelpers) {
-		const { replyHelpersPlugin } = await import("./replyHelpers-9h-a592u.mjs").then((n) => n.n);
+		const { replyHelpersPlugin } = await import("./replyHelpers-CNdvMfM4.mjs").then((n) => n.n);
 		await fastify.register(replyHelpersPlugin);
 	}
 	if (config.serializeBigInt) {

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { Y as PresetResult } from "../index-D3sIPcD4.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { Y as PresetResult } from "../index-DHbyPo5j.mjs";
 import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Cx9Sz3Ou.mjs";
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-BHD3L8of.mjs";
-import { c as getOrgId, g as getUserId } from "../types-CNQyOrLk.mjs";
-import { B as requireAuth, F as allowPublic } from "../permissions-C0GpDsB_.mjs";
-import { t as multipartBody } from "../multipartBody-Bl_gU3Wg.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-BH7YU_9O.mjs";
+import { c as getOrgId, g as getUserId } from "../types-CgenB1gv.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-D8TBH44E.mjs";
+import { t as multipartBody } from "../multipartBody-DtRWM6_U.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/presets/index.d.mts

@@ -1,6 +1,6 @@
 
-import { t as AnyRecord } from "../base-C-NL2fTi.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-D3sIPcD4.mjs";
+import { t as AnyRecord } from "../base-CxrV1LmG.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, U as ResourceConfig, Y as PresetResult, d as PaginationResult } from "../index-DHbyPo5j.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-CAaqVVcW.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-ZJSPgmT2.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,5 +1,5 @@
 
-import { X as CrudRouteKey, Y as PresetResult } from "../index-D3sIPcD4.mjs";
+import { X as CrudRouteKey, Y as PresetResult } from "../index-DHbyPo5j.mjs";
 //#region src/presets/multiTenant.d.ts
 /**
  * One tenant dimension for multi-field filtering. Discriminated by source:
@@ -65,6 +65,43 @@ interface MultiTenantOptions {
    * multiTenantPreset({ allowPublic: ['list', 'get'] })
    */
   allowPublic?: CrudRouteKey[];
+  /**
+   * Reads that are NOT scoped to a tenant at all — a marketplace listing.
+   *
+   * `allowPublic` answers "may an anonymous caller reach this route?". That is a different
+   * question from "is this listing scoped to a tenant?", and until this option there was no way
+   * to answer the second one with "no". An `allowPublic` route still filters by the caller's
+   * organization whenever they have one, and a signed-in user of a multi-org product ALWAYS has
+   * one, because choosing an organization writes it onto the session. So a cross-tenant catalog
+   * silently became single-tenant the moment one of its own sellers browsed it: the same URL,
+   * with no header and no query parameter to explain the difference, returned a different world
+   * depending on who was asking.
+   *
+   * The only escape was to drop this preset from the resource entirely, which also drops tenant
+   * INJECTION on create/update — the thing that stops a member moving a document into another
+   * organization. Trading a write guarantee for a read behaviour is not a real choice.
+   *
+   * Listed routes get no tenant middleware: no filter, and nothing stashed for the repo layer.
+   * Everything else keeps its filter, so writes are unaffected.
+   *
+   * READS ONLY, by type. A cross-tenant `create` or `update` is not a listing, it is an escape
+   * from tenancy, and it should never be one option away by accident.
+   *
+   * THIS DOES NOT AUTHORIZE ANYTHING. Removing the tenant filter widens what the query can
+   * return, so the resource owes a row-level `policy` from its permission check saying what a
+   * stranger may see (`{ status: 'active' }`, `{ visibility: 'public' }`). Declaring this without
+   * one publishes every row in every tenant.
+   *
+   * @default []
+   * @example
+   * // A public catalog: anyone may browse every seller's LIVE products,
+   * // while create/update/delete stay pinned to the caller's own shop.
+   * multiTenantPreset({
+   *   allowPublic: ['list', 'get'],
+   *   crossTenant: ['list', 'get'],
+   * })
+   */
+  crossTenant?: readonly Extract<CrudRouteKey, "list" | "get">[];
 }
 declare function multiTenantPreset(options?: MultiTenantOptions): PresetResult;
 //#endregion

package/dist/presets/multiTenant.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import "../constants-BQ2FbhPB.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CNQyOrLk.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import "../constants-D5Ubn1fe.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-CgenB1gv.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.
@@ -162,7 +162,7 @@ function createTenantInjection(specs) {
 	};
 }
 function multiTenantPreset(options = {}) {
-	const { tenantField, tenantFields, allowPublic = [] } = options;
+	const { tenantField, tenantFields, allowPublic = [], crossTenant = [] } = options;
 	if (tenantField !== void 0 && tenantFields !== void 0) throw new Error("multiTenantPreset: pass either `tenantField` (single-field) or `tenantFields` (multi-field), not both");
 	const specs = tenantFields ?? [{
 		field: tenantField ?? "organizationId",
@@ -173,6 +173,24 @@ function multiTenantPreset(options = {}) {
 	const flexibleTenantFilter = createFlexibleTenantFilter(specs);
 	const tenantInjection = createTenantInjection(specs);
 	const getFilter = (route) => allowPublic.includes(route) ? flexibleTenantFilter : strictTenantFilter;
+	/**
+	* A cross-tenant read MARKS the request rather than simply skipping the filter.
+	*
+	* Skipping is not enough, because this middleware is only the first of four places that scope a
+	* read, and the other three each re-derive the organization from the request scope on their own:
+	* `QueryResolver` adds the tenant filter for `list`, `buildTenantRepoOptions` forwards it to the
+	* repository as tenant context, and `checkOrgScope` re-checks it post-fetch on `get`. Removing
+	* one of four changes nothing observable, which is exactly what made this look unfixable from the
+	* preset: the listing stayed single-tenant no matter what the preset decided.
+	*
+	* So the decision travels on the request instead, and each of those layers honours it. The
+	* repository layer needs no change of its own — kits already accept `bypassTenant`, which is the
+	* same door elevated cross-tenant reads have always used.
+	*/
+	const markCrossTenantRead = async (request) => {
+		request._crossTenantRead = true;
+	};
+	const readMiddleware = (route) => crossTenant.includes(route) ? [markCrossTenantRead] : [getFilter(route)];
 	const fieldRules = {};
 	for (const spec of specs) fieldRules[spec.field] = {
 		systemManaged: true,
@@ -182,8 +200,8 @@ function multiTenantPreset(options = {}) {
 		name: "multiTenant",
 		schemaOptions: { fieldRules },
 		middlewares: {
-			list: [getFilter("list")],
-			get: [getFilter("get")],
+			list: readMiddleware("list"),
+			get: readMiddleware("get"),
 			create: [tenantInjection],
 			update: [getFilter("update"), tenantInjection],
 			delete: [getFilter("delete")],

package/dist/presets/search.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
-import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-D3sIPcD4.mjs";
+import { l as PermissionCheck } from "../base-CxrV1LmG.mjs";
+import { At as RouteDefinition, Y as PresetResult, jn as ControllerHandler, jt as RouteMcpConfig } from "../index-DHbyPo5j.mjs";
 //#region src/presets/search.d.ts
 /**
  * Search Preset — backend-agnostic search / vector / embed routes

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { B as requireAuth, F as allowPublic } from "../permissions-C0GpDsB_.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-D8TBH44E.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-CAaqVVcW.mjs → presets-ZJSPgmT2.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-BHD3L8of.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CNQyOrLk.mjs";
-import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-C0GpDsB_.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-BH7YU_9O.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-CgenB1gv.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-D8TBH44E.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**

package/dist/{projection-qbCOEvsh.mjs → projection-BzIgzoKZ.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.40.0 | MIT | https://classytic.com */
-import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CNQyOrLk.mjs";
+/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+import { c as getOrgId, f as getScopeContextMap, g as getUserId, m as getTeamId, x as isMember } from "./types-CgenB1gv.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no