@classytic/arc 2.41.1 → 2.44.0

package/dist/auth/index.mjs

@@ -1,10 +1,11 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-BH7YU_9O.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BIXWKrzQ.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChRvkuSZ.mjs";
-import { o as toJsonSchema } from "../schemaConverter-BVA7cFRG.mjs";
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-CkhS6jn6.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-D8TBH44E.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-CW4anJBy.mjs";
+import { n as requireSingleHeaderValue } from "../headers-DKZQKL-Z.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-C76zD5pa.mjs";
+import { o as toJsonSchema } from "../schemaConverter-BVjkQ5DD.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DIMKMV2G.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-C5ijIz5Q.mjs";
+import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
@@ -47,7 +48,10 @@ const authPlugin = async (fastify, opts = {}) => {
 	let jwtContext = null;
 	if (jwtConfig?.secret) {
 		if (jwtConfig.secret.length < 32) throw new Error(`JWT secret must be at least 32 characters (current: ${jwtConfig.secret.length}).\nUse a strong random secret for production.`);
-		const jwtPlugin = await import("@fastify/jwt");
+		const jwtPlugin = await import("@fastify/jwt").catch((error) => {
+			if (error instanceof Error && "code" in error && error.code === "ERR_MODULE_NOT_FOUND" && error.message.includes("@fastify/jwt")) throw new Error("Arc JWT authentication requires @fastify/jwt. Run `npm install @fastify/jwt`. Better Auth and custom authenticators do not require this package.", { cause: error });
+			throw error;
+		});
 		await fastify.register(jwtPlugin.default ?? jwtPlugin, {
 			secret: jwtConfig.secret,
 			sign: {
@@ -543,6 +547,22 @@ function mergeUserFieldsIntoRequestBody(requestBody, userFields, endpointPath) {
 //#endregion
 //#region src/auth/betterAuth.ts
 /**
+* Better Auth Adapter for Arc/Fastify
+*
+* Bridges Fastify <-> Better Auth's Fetch API (Request/Response).
+* Better Auth is the USER's dependency -- Arc only provides this thin adapter.
+*
+* @example
+* import { betterAuth } from 'better-auth';
+* import { createBetterAuthAdapter } from '@classytic/arc/auth';
+*
+* const auth = betterAuth({ ... });
+*
+* const app = await createApp({
+*   auth: { type: 'betterAuth', betterAuth: createBetterAuthAdapter({ auth }) },
+* });
+*/
+/**
 * Convert a Fastify request into a Fetch API Request.
 *
 * Better Auth expects standard Web API Request objects.
@@ -604,28 +624,23 @@ async function sendFetchResponse(response, reply) {
 	}
 }
 /**
-* Resolve the current session via Better Auth's direct JS API.
-*
-* Throws `ArcError(BETTER_AUTH_API_MISSING)` when `auth.api.getSession` is
-* absent — this surfaces immediately and clearly when an integrator passes a
-* stub handler instead of a real `betterAuth()` instance.
+* Resolve the current session via `auth.api.getSession`. Throws
+* `ArcError(BETTER_AUTH_API_MISSING)` when it is absent (a stub, not a real
+* `betterAuth()` instance).
 */
 async function getSessionDirect(auth, headers) {
 	const api = auth.api;
-	if (!api || typeof api.getSession !== "function") throw new ArcError("Better Auth instance is missing `api.getSession` — arc 2.13+ requires the in-process API map. Pass a real `betterAuth()` instance or supply an `api: { getSession }` stub.", {
-		code: "BETTER_AUTH_API_MISSING",
+	if (!api || typeof api.getSession !== "function") throw new ArcError("Better Auth instance is missing `api.getSession` — arc requires the in-process API map. Pass a real `betterAuth()` instance or supply an `api: { getSession }` stub.", {
+		code: ARC_ERROR_CODES.AUTH_MISCONFIGURED,
 		statusCode: 500
 	});
 	const result = await api.getSession({ headers });
 	return result?.user ? result : null;
 }
 /**
-* Read a method from `auth.api` — supports both the flat shape that real
-* `betterAuth()` instances expose (`api.getActiveMember`) and the nested
-* shape some test mocks / older builds use (`api.organization.getActiveMember`).
-*
-* Real Better Auth 1.6.x flattens every plugin endpoint onto the top-level
-* `api` object. The nested form is kept as a fallback for hand-rolled stubs.
+* Read a method from `auth.api`: the flat shape real instances expose
+* (`api.getActiveMember`), falling back to the nested stub shape
+* (`api.organization.getActiveMember`).
 */
 function pickApiMethod(auth, name, group) {
 	const api = auth.api;
@@ -649,11 +664,8 @@ async function getActiveMemberRoles(auth, headers) {
 	}
 }
 /**
-* Resolve org roles for an explicit organizationId.
-*
-* Required for API key auth where the synthetic session lacks
-* `activeOrganizationId` — callers pass org context via the
-* `x-organization-id` header.
+* Resolve org roles for an explicit organizationId — for sessions without
+* `activeOrganizationId` (e.g. API-key auth via `x-organization-id`).
 */
 async function getMemberRolesByOrg(auth, headers, organizationId) {
 	const fn = pickApiMethod(auth, "getActiveMemberRole", "organization");
@@ -669,21 +681,12 @@ async function getMemberRolesByOrg(auth, headers, organizationId) {
 	}
 }
 /**
-* Teams the current user is a MEMBER of, scoped to one organization. Used to
-* validate `activeTeamId` before binding it to scope.
-*
-* `auth.api.listUserTeams` (`/organization/list-user-teams`) is the only name
-* probed. A `listTeams` fallback lived here for "older 1.5.x" and was removed:
-* Better Auth exposes `listUserTeams` and `listOrganizationTeams` on `auth.api`
-* and has never exposed a bare `listTeams` — that is the CLIENT name
-* (`authClient.organization.listTeams`). It could only ever resolve against a
-* test double, which is exactly what it was doing.
+* Teams the current user is a MEMBER of in one organization, used to validate
+* `activeTeamId` before binding it to scope.
 *
-* Do not "restore" it as `listOrganizationTeams`: that endpoint lists every team
-* in the organization, while this one lists the teams the USER belongs to.
-* Validating `activeTeamId` against the org-wide list would admit a team the
-* user is not a member of — the organization check below constrains the org, not
-* membership.
+* Must stay `listUserTeams`: `listOrganizationTeams` lists EVERY team in the
+* org and would admit a team the user isn't a member of. (`listTeams` is the
+* client-side name; `auth.api` has no such method.)
 */
 async function listTeamsDirect(auth, headers, organizationId) {
 	const fn = pickApiMethod(auth, "listUserTeams", "organization");
@@ -737,38 +740,72 @@ async function resolveActiveTeamId(input) {
 	if (!activeTeamId) return void 0;
 	return (await listTeamsDirect(input.auth, input.headers, input.activeOrgId))?.find((team) => normalizeId(team.id ?? team._id) === activeTeamId && normalizeId(team.organizationId) === input.activeOrgId) ? activeTeamId : void 0;
 }
-/**
-* Create a Better Auth adapter for Arc/Fastify.
-*
-* Returns a Fastify plugin (registers catch-all auth routes) and an
-* `authenticate` preHandler that validates sessions via Better Auth.
-*
-* @example
-* ```typescript
-* import { betterAuth } from 'better-auth';
-* import { createBetterAuthAdapter } from '@classytic/arc/auth';
-*
-* const auth = betterAuth({
-*   database: ...,
-*   emailAndPassword: { enabled: true },
-* });
-*
-* const { plugin, authenticate } = createBetterAuthAdapter({ auth });
-*
-* // Register the plugin (catch-all auth routes)
-* await fastify.register(plugin);
-*
-* // Use authenticate as a preHandler on protected routes
-* fastify.get('/me', { preHandler: [authenticate] }, handler);
-* ```
-*/
+const AUTH_SCHEME = /^[A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*$/;
 function createBetterAuthAdapter(options) {
-	const { auth, basePath = "/api/auth", orgContext: orgContextOpt = false, openapi: openapiOpt = true, userFields, exposeAuthErrors = false } = options;
+	const { auth, basePath = "/api/auth", orgContext: orgContextOpt = false, openapi: openapiOpt = true, userFields, exposeAuthErrors = false, resolveOrgRoles, memberLookup = "better-auth", credentials = {} } = options;
+	const verifiers = /* @__PURE__ */ new Map();
+	for (const [scheme, verify] of Object.entries(credentials)) {
+		if (!AUTH_SCHEME.test(scheme)) throw new Error(`createBetterAuthAdapter: "${scheme}" is not an auth scheme name.`);
+		if (scheme.toLowerCase() === "bearer") throw new Error("createBetterAuthAdapter: the Bearer scheme is the session's.");
+		verifiers.set(scheme.toLowerCase(), verify);
+	}
+	/** A registered non-session credential on this request, if any. */
+	const presentedCredential = (request) => {
+		if (verifiers.size === 0) return null;
+		const header = request.headers.authorization;
+		if (typeof header !== "string") return null;
+		const space = header.indexOf(" ");
+		if (space <= 0) return null;
+		const verify = verifiers.get(header.slice(0, space).toLowerCase());
+		return verify ? {
+			verify,
+			value: header.slice(space + 1).trim()
+		} : null;
+	};
 	const normalizedBase = basePath.replace(/\/+$/, "");
 	const orgEnabled = !!orgContextOpt;
+	if (resolveOrgRoles && !orgEnabled) throw new Error("createBetterAuthAdapter: `resolveOrgRoles` requires `orgContext: true`.");
+	if (memberLookup !== "better-auth" && memberLookup !== "resolver") throw new Error(`createBetterAuthAdapter: \`memberLookup\` must be 'better-auth' or 'resolver' (got ${String(memberLookup)}).`);
+	if (memberLookup === "resolver" && !resolveOrgRoles) throw new Error("createBetterAuthAdapter: `memberLookup: 'resolver'` requires `resolveOrgRoles` — without it nothing would read membership.");
+	const skipMemberLookup = memberLookup === "resolver";
 	/**
-	* Validates the current session by forwarding cookies/headers
-	* to Better Auth's `GET /api/auth/get-session` endpoint.
+	* The member scope for the active organization (session's active org wins; the header covers
+	* sessions without one), or `undefined` when the caller holds no role there. ONE path for
+	* `authenticate` and `optionalAuthenticate`, so `resolveOrgRoles` cannot apply on one and not the
+	* other.
+	*/
+	const resolveMemberScope = async (headers, session, requestedOrgId, userId, userRoles) => {
+		const activeOrgId = session?.activeOrganizationId || requestedOrgId;
+		if (!activeOrgId) return void 0;
+		let orgRoles = null;
+		if (!skipMemberLookup) {
+			if (session?.activeOrganizationId) orgRoles = await getActiveMemberRoles(auth, headers);
+			if (!orgRoles) orgRoles = await getMemberRolesByOrg(auth, headers, activeOrgId);
+		}
+		if (resolveOrgRoles && userId) orgRoles = await resolveOrgRoles({
+			userId,
+			organizationId: activeOrgId,
+			memberRoles: orgRoles
+		});
+		if (!orgRoles) return void 0;
+		const scope = {
+			kind: "member",
+			userId,
+			userRoles,
+			organizationId: activeOrgId,
+			orgRoles: [...orgRoles]
+		};
+		const activeTeamId = await resolveActiveTeamId({
+			auth,
+			headers,
+			session,
+			activeOrgId
+		});
+		if (activeTeamId) scope.teamId = activeTeamId;
+		return scope;
+	};
+	/**
+	* Validates the session via `auth.api.getSession` with the request headers.
 	*
 	* On success, sets `request.user` and `request.session`.
 	* When orgContext is enabled, also sets `request.scope` to
@@ -776,12 +813,26 @@ function createBetterAuthAdapter(options) {
 	* On failure, replies with 401.
 	*/
 	const authenticate = async (request, reply) => {
+		const presented = presentedCredential(request);
+		if (presented) {
+			const scope = await presented.verify(presented.value, request);
+			if (!scope) {
+				reply.code(401).send({
+					code: ARC_ERROR_CODES.UNAUTHORIZED,
+					message: "Invalid credentials",
+					status: 401
+				});
+				return;
+			}
+			request.scope = scope;
+			return;
+		}
 		try {
 			const headers = buildHeaders(request);
 			const sessionData = await getSessionDirect(auth, headers);
 			if (!sessionData?.user) {
 				reply.code(401).send({
-					code: "arc.unauthorized",
+					code: ARC_ERROR_CODES.UNAUTHORIZED,
 					message: "Invalid or expired session",
 					status: 401
 				});
@@ -799,47 +850,14 @@ function createBetterAuthAdapter(options) {
 				userRoles
 			};
 			if (orgEnabled) {
-				const session = sessionData.session;
-				const requestedOrgId = requireSingleHeaderValue(request.headers, "x-organization-id");
-				const activeOrgId = session?.activeOrganizationId || requestedOrgId;
-				if (activeOrgId) {
-					/**
-					* `getActiveMember` resolves the member for the SESSION's active
-					* organization, so with no `activeOrganizationId` it cannot succeed —
-					* it throws `No active organization`, which the helper swallows into
-					* `null` after paying the full endpoint round trip.
-					*
-					* A bearer-only deployment never calls `setActive`, so that was every
-					* request: ~440ms spent to learn what the session already said, before
-					* the ~870ms header-based lookup that actually answers. Ask the
-					* session first; it is already in hand.
-					*/
-					let orgRoles = session?.activeOrganizationId ? await getActiveMemberRoles(auth, headers) : null;
-					if (!orgRoles) orgRoles = await getMemberRolesByOrg(auth, headers, activeOrgId);
-					if (orgRoles) {
-						const scope = {
-							kind: "member",
-							userId,
-							userRoles,
-							organizationId: activeOrgId,
-							orgRoles
-						};
-						const activeTeamId = await resolveActiveTeamId({
-							auth,
-							headers,
-							session,
-							activeOrgId
-						});
-						if (activeTeamId) scope.teamId = activeTeamId;
-						req.scope = scope;
-					}
-				}
+				const memberScope = await resolveMemberScope(headers, sessionData.session, requireSingleHeaderValue(request.headers, "x-organization-id"), userId, userRoles);
+				if (memberScope) req.scope = memberScope;
 			}
 		} catch (err) {
 			if (err instanceof ArcError) throw err;
 			const message = exposeAuthErrors ? err instanceof Error ? err.message : String(err) : "Authentication required";
 			reply.code(401).send({
-				code: "arc.unauthorized",
+				code: ARC_ERROR_CODES.UNAUTHORIZED,
 				message,
 				status: 401
 			});
@@ -854,6 +872,12 @@ function createBetterAuthAdapter(options) {
 	* flexible filter) can apply org-scoped queries when a user IS authenticated.
 	*/
 	const optionalAuthenticate = async (request, _reply) => {
+		const presented = presentedCredential(request);
+		if (presented) {
+			const scope = await presented.verify(presented.value, request);
+			if (scope) request.scope = scope;
+			return;
+		}
 		try {
 			const headers = buildHeaders(request);
 			const sessionData = await getSessionDirect(auth, headers);
@@ -870,41 +894,8 @@ function createBetterAuthAdapter(options) {
 				userRoles: optUserRoles
 			};
 			if (orgEnabled) {
-				const session = sessionData.session;
-				const requestedOrgId = requireSingleHeaderValue(request.headers, "x-organization-id");
-				const activeOrgId = session?.activeOrganizationId || requestedOrgId;
-				if (activeOrgId) {
-					/**
-					* `getActiveMember` resolves the member for the SESSION's active
-					* organization, so with no `activeOrganizationId` it cannot succeed —
-					* it throws `No active organization`, which the helper swallows into
-					* `null` after paying the full endpoint round trip.
-					*
-					* A bearer-only deployment never calls `setActive`, so that was every
-					* request: ~440ms spent to learn what the session already said, before
-					* the ~870ms header-based lookup that actually answers. Ask the
-					* session first; it is already in hand.
-					*/
-					let orgRoles = session?.activeOrganizationId ? await getActiveMemberRoles(auth, headers) : null;
-					if (!orgRoles) orgRoles = await getMemberRolesByOrg(auth, headers, activeOrgId);
-					if (orgRoles) {
-						const scope = {
-							kind: "member",
-							userId: optUserId,
-							userRoles: optUserRoles,
-							organizationId: activeOrgId,
-							orgRoles
-						};
-						const activeTeamId = await resolveActiveTeamId({
-							auth,
-							headers,
-							session,
-							activeOrgId
-						});
-						if (activeTeamId) scope.teamId = activeTeamId;
-						req.scope = scope;
-					}
-				}
+				const memberScope = await resolveMemberScope(headers, sessionData.session, requireSingleHeaderValue(request.headers, "x-organization-id"), optUserId, optUserRoles);
+				if (memberScope) req.scope = memberScope;
 			}
 		} catch (err) {
 			if (err instanceof ArcError) throw err;
@@ -914,22 +905,9 @@ function createBetterAuthAdapter(options) {
 	if (openapiOpt === false) extractedOpenApi = void 0;
 	else if (typeof openapiOpt === "object") extractedOpenApi = openapiOpt;
 	const betterAuthPlugin = async (fastify) => {
-		/**
-		* `orgContext` without the `organization()` plugin is a SILENT
-		* misconfiguration, so it fails at boot instead.
-		*
-		* Arc resolves org membership through `auth.api.getActiveMember` /
-		* `getActiveMemberRole`. Absent the plugin those methods do not exist,
-		* every lookup returns null, and `request.scope` silently stays
-		* `'authenticated'` — so `requireOrgId()` throws 403 on every
-		* tenant-scoped route. It fails CLOSED (no data leak), but the symptom
-		* points nowhere near the cause: the host sees blanket 403s and no
-		* indication that a plugin is missing. One check at registration turns
-		* that into a sentence.
-		*/
 		if (orgEnabled) {
 			if (!(pickApiMethod(auth, "getActiveMember", "organization") !== void 0 || pickApiMethod(auth, "getActiveMemberRole", "organization") !== void 0)) throw new ArcError("createBetterAuthAdapter({ orgContext: true }) requires Better Auth's `organization()` plugin — `auth.api.getActiveMember` / `getActiveMemberRole` are missing. Without it arc can never resolve membership, so request.scope stays 'authenticated' and every tenant-scoped route answers 403. Add `organization()` to your betterAuth({ plugins }), or drop `orgContext`.", {
-				code: "BETTER_AUTH_ORG_PLUGIN_MISSING",
+				code: ARC_ERROR_CODES.AUTH_MISCONFIGURED,
 				statusCode: 500
 			});
 		}
@@ -940,7 +918,7 @@ function createBetterAuthAdapter(options) {
 				await sendFetchResponse(await auth.handler(fetchRequest), reply);
 			} catch (err) {
 				throw new ArcError("Authentication service error", {
-					code: "AUTH_SERVICE_ERROR",
+					code: ARC_ERROR_CODES.AUTH_SERVICE_ERROR,
 					statusCode: 500,
 					cause: err instanceof Error ? err : new Error(String(err))
 				});
@@ -1403,4 +1381,4 @@ function mirrorTrustedOriginsFromCors(options) {
 	return Array.from(/* @__PURE__ */ new Set([canonicalUrl, ...corsOrigins]));
 }
 //#endregion
-export { MemorySessionStore, authPlugin_default as authPlugin, authPlugin as authPluginFn, createBetterAuthAdapter, createSessionManager, extractBetterAuthOpenApi, mirrorTrustedOriginsFromCors };
+export { MemorySessionStore, authPlugin_default as authPlugin, createBetterAuthAdapter, createSessionManager, extractBetterAuthOpenApi, mirrorTrustedOriginsFromCors };

package/dist/auth/redis-session.d.mts

@@ -2,7 +2,7 @@
 import { i as SessionData, s as SessionStore } from "../sessionManager-qimlKV0P.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
-interface RedisLike {
+export interface RedisLike {
   get(key: string): Promise<string | null>;
   set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
   del(...keys: string[]): Promise<number>;
@@ -11,7 +11,7 @@ interface RedisLike {
   srem(key: string, ...members: string[]): Promise<number>;
   expire(key: string, seconds: number): Promise<number>;
 }
-interface RedisSessionStoreOptions {
+export interface RedisSessionStoreOptions {
   /** Redis client instance (ioredis or compatible) */
   redis: RedisLike;
   /** Key prefix for session keys (default: 'arc:session:') */
@@ -28,7 +28,7 @@ interface RedisSessionStoreOptions {
  *
  * Session expiration is handled by Redis TTL — no cleanup interval needed.
  */
-declare class RedisSessionStore implements SessionStore {
+export declare class RedisSessionStore implements SessionStore {
   private redis;
   private prefix;
   private userPrefix;
@@ -39,5 +39,4 @@ declare class RedisSessionStore implements SessionStore {
   deleteAll(userId: string): Promise<void>;
   deleteAllExcept(userId: string, currentSessionId: string): Promise<void>;
 }
-//#endregion
-export { RedisLike, RedisSessionStore, RedisSessionStoreOptions };
+//#endregion

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-DawKGoXb.mjs → authorizationDecision-wX3SA9w_.mjs}

@@ -1,103 +1,7 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-BH7YU_9O.mjs";
-//#region src/permissions/filter-merge.ts
-/**
-* Policy-filter composition — logical AND, never last-writer-wins.
-*
-* Row-level policy filters can arrive from several INDEPENDENT sources for one
-* request: a tenant preset, an `ownedByUser` grant, an `allOf(...)` branch, a
-* host permission check. Every one of them is a RESTRICTION the row must
-* satisfy, so composing them is logical AND.
-*
-* The historical `{ ...base, ...incoming }` shallow spread did NOT implement AND:
-* when two sources constrained the SAME key with different values, the later one
-* silently REPLACED the earlier one — widening (or erasing) a restriction another
-* layer deliberately imposed. That is a defense-in-depth defect, not a
-* refinement. "Later can refine" is only sound when the refinement is provably
-* narrower, and a bare overwrite proves nothing.
-*
-* {@link conjoinPolicyFilters} composes with AND semantics while preserving the
-* common case byte-for-byte:
-*
-*  - key present on only one side      → carried through flat. Non-overlapping
-*    filters (the ~99% case) produce exactly the same object the old spread did,
-*    so there is ZERO behavior change for them.
-*  - same key, deep-equal value        → kept once (idempotent — e.g. two checks
-*    both pinning the same `organizationId`).
-*  - same key, DIFFERENT value         → BOTH constraints are preserved under an
-*    `$and`, so a row must satisfy both. For flat equality that conjunction is
-*    unsatisfiable, so the query returns nothing — the safe, correct outcome for
-*    contradictory policies (deny), and the earlier restriction is never dropped.
-*
-* Adapter safety: mongokit / sqlitekit compile `$and` natively at the DB layer,
-* and arc's in-memory `simpleEqualityMatcher` (AccessControl.checkPolicyFilters)
-* already fail-closes on operator-shaped filters. So a produced `$and` is either
-* evaluated correctly by the DB or rejected fail-closed in memory — both safe.
-*
-* This is the pragmatic, adapter-neutral form of the AND semantics. A canonical
-* filter IR in `repo-core` (nested and/or/not nodes each adapter compiles) is the
-* fuller design, but this closes the security defect without one.
-*/
-/**
-* Validate + return a `$and` operand's fragment array. A security-policy
-* normalizer must NEVER silently drop a malformed constraint — a non-array
-* `$and` (e.g. `{ $and: { organizationId: "a" } }`) is a policy bug, so fail
-* loud (fail-closed) rather than discard the restriction it was meant to carry.
-*/
-function coercePolicyAnd(value) {
-	if (!Array.isArray(value)) throw new Error(`conjoinPolicyFilters: malformed '$and' — expected an array of filter fragments, got ${value === null ? "null" : typeof value}. A policy filter constraint must not be silently dropped.`);
-	return value;
-}
-/** Are two flat policy-filter values equivalent for conjunction purposes? */
-function filterValueEqual(a, b) {
-	if (Object.is(a, b)) return true;
-	if (a !== null && b !== null && typeof a === "object" && typeof b === "object") try {
-		return JSON.stringify(a) === JSON.stringify(b);
-	} catch {
-		return false;
-	}
-	return false;
-}
-/**
-* Conjoin two policy-filter maps with AND semantics. Never silently overwrites a
-* same-key constraint with a different value — conflicting keys are preserved
-* under `$and`. See the module doc for the full contract.
-*/
-function conjoinPolicyFilters(base, incoming) {
-	const baseEmpty = !base || Object.keys(base).length === 0;
-	const incomingEmpty = !incoming || Object.keys(incoming).length === 0;
-	if (baseEmpty) return incomingEmpty ? {} : { ...incoming };
-	if (incomingEmpty) return { ...base };
-	const result = {};
-	const andParts = [];
-	const baseAnd = base.$and;
-	if (baseAnd !== void 0) andParts.push(...coercePolicyAnd(baseAnd));
-	for (const [key, value] of Object.entries(base)) {
-		if (key === "$and") continue;
-		result[key] = value;
-	}
-	for (const [key, value] of Object.entries(incoming)) {
-		if (key === "$and") {
-			andParts.push(...coercePolicyAnd(value));
-			continue;
-		}
-		if (!(key in result)) {
-			result[key] = value;
-			continue;
-		}
-		if (filterValueEqual(result[key], value)) continue;
-		andParts.push({ [key]: result[key] }, { [key]: value });
-		delete result[key];
-	}
-	if (andParts.length > 0) result.$and = andParts;
-	for (const source of [base, incoming]) for (const symbol of Object.getOwnPropertySymbols(source)) {
-		const descriptor = Object.getOwnPropertyDescriptor(source, symbol);
-		if (descriptor) Object.defineProperty(result, symbol, descriptor);
-	}
-	return result;
-}
-//#endregion
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as arcLog } from "./logger-D4V1zGLI.mjs";
+import { t as conjoinPolicyFilters } from "./filter-merge-DGM-GQ1J.mjs";
+import { t as ArcError } from "./errors-CW4anJBy.mjs";
 //#region src/permissions/authorizationDecision.ts
 const log = arcLog("permissions:enforce");
 /**
@@ -194,8 +98,9 @@ async function evaluatePermissionDecision(check, context) {
 * This is the enforcement point (PEP) — the ONE place scope + data policy are
 * installed (and the obligation seam lives).
 */
-function applyAuthorizationDecision(decision, request) {
+function applyAuthorizationDecision(decision, req) {
 	if (decision.effect !== "allow") return;
+	const request = req;
 	if (decision.policy) request._policyFilters = conjoinPolicyFilters(request._policyFilters, decision.policy);
 	if (decision.scope) {
 		const current = request.scope;
@@ -267,4 +172,4 @@ async function evaluateAndApplyPermission(check, context, request, reply, opts)
 	return true;
 }
 //#endregion
-export { conjoinPolicyFilters as a, normalizeToDecision as i, evaluateAndApplyPermission as n, evaluatePermissionDecision as r, applyAuthorizationDecision as t };
+export { normalizeToDecision as i, evaluateAndApplyPermission as n, evaluatePermissionDecision as r, applyAuthorizationDecision as t };

package/dist/{base-CxrV1LmG.d.mts → base-CZyixEQR.d.mts}

@@ -169,6 +169,15 @@ type PermissionCheck<TDoc = Record<string, unknown>> = ((context: PermissionCont
 interface PermissionCheckMeta {
   /** Set by allowPublic() — marks the endpoint as publicly accessible */
   _isPublic?: boolean;
+  /**
+   * Set by `allowPublic({ policy })` — the gate admits EVERYONE, but what they
+   * can read or write is narrowed by a row policy. Public and row-filtered are
+   * independent facts: `_isPublic` says who may call the endpoint, this says the
+   * rows are not all of them. Surfaced as `rowFiltered` by `describePermission`,
+   * so a "what is publicly exposed?" audit can tell an open catalogue from a
+   * catalogue that shows strangers only its published rows.
+   */
+  _rowPolicy?: boolean;
   /**
    * Set by `denyAll()` — nobody passes this gate, ever.
    *
@@ -184,6 +193,14 @@ interface PermissionCheckMeta {
    * and an access audit reports a surface that does not exist.
    */
   _isDenied?: boolean;
+  /**
+   * A deployment-static closed door, read LAZILY by `describePermission`: when it returns
+   * `true`, nobody passes. Set it on a check whose ENTIRE runtime decision is `!_deniedWhen()`
+   * (a tier / feature flag fixed at boot but unknown when the check is built). `allOf` is
+   * denied when any child is; `anyOf` when every child is; such a check never taints `allOf`
+   * as `conditional`.
+   */
+  _deniedWhen?: () => boolean;
   /**
    * Set by requireAuth() — a pure identity gate (must be signed in) that adds NO
    * row-level or environmental condition. Marked so `allOf` does not mistake it
@@ -297,13 +314,18 @@ declare module "fastify" {
     /**
      * This read is deliberately NOT scoped to a tenant — a marketplace listing.
      *
-     * Set by `multiTenantPreset({ crossTenant: [...] })`. Tenancy is applied in four separate
-     * places for a read (the preset middleware, `QueryResolver`, `buildTenantRepoOptions` and the
-     * post-fetch `checkOrgScope`), each deriving the org from the scope on its own, so a decision
-     * made in one of them is silently re-made by the other three. This flag is how that decision
-     * travels. Never set from user input.
+     * Set by `multiTenantPreset({ crossTenant: [...] })`, read by `resolveTenancy`
+     * (`core/tenancy.ts`) — the one rule every read-scoping layer switches on.
+     * Never set from user input.
      */
     _crossTenantRead?: boolean;
+    /**
+     * Resolved tenant dimensions (`{ organizationId, teamId, … }`) from
+     * `multiTenantPreset`'s multi-field specs. Forwarded to the repository as
+     * top-level options by `buildTenantRepoOptions`, for kits whose tenant
+     * plugin reads `context.<field>`. Never set from user input.
+     */
+    _tenantFields?: Record<string, unknown>;
   }
 }
 type AnyRecord = Record<string, unknown>;