@classytic/arc 2.30.0 → 2.31.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Classytic
+Copyright (c) 2025 Classytic LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -324,3 +324,10 @@ arc doctor                                       # diagnose env
 ## License
 
 MIT
+
+
+## Trademark
+
+The code is MIT-licensed. **"Classytic", "arc", and the logos are trademarks of
+Classytic LLC** and are **not** licensed under MIT — see [TRADEMARK.md](TRADEMARK.md).
+Forks must be renamed; the license covers the code, not the brand.

package/TRADEMARK.md

@@ -0,0 +1,22 @@
+# Trademark Notice
+
+The **source code** in this package is licensed under the MIT License (see
+[LICENSE](LICENSE)). Trademarks are **not** part of that license.
+
+**"Classytic", "arc", the Classytic and arc logos**, and related names and marks
+are trademarks of **Classytic LLC** (Wyoming, USA). The MIT License covers the
+code only — it grants **no right** to use Classytic LLC's names, logos, or brand.
+
+## You may
+- use, fork, modify, and redistribute the **code** under the MIT License;
+- state truthfully that your product "uses" or "is built on" arc / Classytic
+  software, without implying endorsement.
+
+## You may not (without written permission from Classytic LLC)
+- use "Classytic", "arc", or confusingly similar names as the name of your own
+  product, package, company, or service;
+- use the Classytic / arc logos or brand styling;
+- imply sponsorship, affiliation, or endorsement by Classytic LLC.
+
+Forks or redistributions must be **renamed** so they are not confused with the
+official project. Permission / questions: **trademark@classytic.com**.

package/dist/{BaseController-B5DwufbB.mjs → BaseController-De7GqHck.mjs}

@@ -1,14 +1,15 @@
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-D3Dv4LAV.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-Dz8k3S4P.mjs";
-import { o as conjoinPolicyFilters } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CQ_7KQWw.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-taUVD4p3.mjs";
-import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cj42AntO.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-ChYJ6CdK.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DjQJ7FKA.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CB5Cuzk9.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-vL8BrDE2.mjs";
+import { t as buildQueryKey } from "./keys-C0_pa1tY.mjs";
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -33,13 +34,13 @@ var AccessControl = class {
 	* Combines ID filter with policy/org filters for proper security enforcement
 	*/
 	buildIdFilter(id, req) {
-		const filter = { [this.idField]: id };
+		let filter = { [this.idField]: id };
 		const arcContext = this._meta(req);
 		const policyFilters = arcContext?._policyFilters;
-		if (policyFilters) Object.assign(filter, policyFilters);
+		if (policyFilters) filter = conjoinPolicyFilters(filter, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filter[this.tenantField] = orgId;
+		if (this.tenantField && orgId) filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
 		return toRepositoryFilter(filter);
 	}
 	/**
@@ -1488,10 +1489,8 @@ function BulkMixin(Base) {
 		* Returns the merged filter, or `null` when access must be denied.
 		*/
 		buildBulkFilter(userFilter, req) {
-			const filter = { ...userFilter };
 			const arcContext = this.meta(req);
-			const policyFilters = arcContext?._policyFilters;
-			if (policyFilters) Object.assign(filter, policyFilters);
+			let filter = conjoinPolicyFilters(userFilter, arcContext?._policyFilters);
 			if (this.tenantField) {
 				const scope = arcContext?._scope;
 				if (!scope) return filter;
@@ -1499,7 +1498,7 @@ function BulkMixin(Base) {
 				if (isElevated(scope)) return filter;
 				const orgId = getOrgId(scope);
 				if (!orgId) return null;
-				filter[this.tenantField] = orgId;
+				filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
 			}
 			return filter;
 		}

package/dist/{EventTransport-QmY7A258.d.mts → EventTransport-2uVV34WU.d.mts}

@@ -1,3 +1,4 @@
+
 import { DeadLetteredEvent, DomainEvent, DomainEvent as DomainEvent$1, EventHandler, EventHandler as EventHandler$1, EventLogger, EventLogger as EventLogger$1, EventTransport, EventTransport as EventTransport$1, PublishManyResult } from "@classytic/primitives/events";
 //#region src/events/EventTransport.d.ts
 interface MemoryEventTransportOptions {

package/dist/{EventTransport-C6YA8xY9.mjs → EventTransport-9mlTgqzE.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-WkIougo6.mjs → HookSystem-BcmPyq5I.mjs}

@@ -1,4 +1,5 @@
-import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{QueryCache-DOMT_iq7.d.mts → QueryCache-DFA-QrU9.d.mts}

@@ -1,4 +1,5 @@
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
+
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 //#region src/cache/QueryCache.d.ts
 /** Metadata wrapper stored in CacheStore */
 interface CacheEnvelope<T = unknown> {

package/dist/{ResourceRegistry-y9Hnypus.mjs → ResourceRegistry-qq0mn2s9.mjs}

@@ -1,4 +1,5 @@
-import "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import "./constants-D3Dv4LAV.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -59,7 +60,7 @@ var ResourceRegistry = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
-				raw: r.raw,
+				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),
 			events: Object.keys(resource.events ?? {}),

package/dist/{actionPermissions-CAphcmUG.mjs → actionPermissions-BE5NwaQk.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.d.mts

@@ -1,5 +1,6 @@
-import "../index-Q5gzEIWY.mjs";
-import { a as UserBase } from "../types-ChvvVNP8.mjs";
+
+import "../index-CpzxqePp.mjs";
+import { a as UserBase } from "../types-B7XeLEgK.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,4 +1,5 @@
-import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyInstance } from "fastify";
 //#region src/auth/audit.d.ts
 /**

package/dist/auth/audit.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,7 +1,8 @@
-import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-Q5gzEIWY.mjs";
-import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { Ut as AuthHelpers, Wt as AuthPluginOptions } from "../index-CpzxqePp.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
 //#region src/auth/authPlugin.d.ts
 declare module "fastify" {

package/dist/auth/index.mjs

@@ -1,8 +1,9 @@
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BvlQSDMB.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { o as toJsonSchema } from "../schemaConverter-DJvodiHj.mjs";
-import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-Bfu_8y1U.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cj42AntO.mjs";
+import { n as requireSingleHeaderValue } from "../headers-3zvE0rM3.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
+import { o as toJsonSchema } from "../schemaConverter-D--wdJM-.mjs";
+import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-L--QDAir.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts

package/dist/auth/redis-session.d.mts

@@ -1,4 +1,5 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { i as SessionData, s as SessionStore } from "../sessionManager-qimlKV0P.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
 interface RedisLike {

package/dist/auth/redis-session.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{applyPermissionResult-Cf6zUCvb.mjs → authorizationDecision-ChvUQGG1.mjs}

@@ -1,5 +1,6 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-DkO8Nk6-.mjs";
+import { t as ArcError } from "./errors-Cj42AntO.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.
@@ -93,7 +94,7 @@ function conjoinPolicyFilters(base, incoming) {
 	return result;
 }
 //#endregion
-//#region src/permissions/applyPermissionResult.ts
+//#region src/permissions/authorizationDecision.ts
 const log = arcLog("permissions:enforce");
 /**
 * Normalize a check return into the canonical {@link AuthorizationDecision}.
@@ -102,7 +103,21 @@ const log = arcLog("permissions:enforce");
 * pipeline only ever handles decisions.
 */
 function normalizeToDecision(result) {
-	return typeof result === "boolean" ? { effect: result ? "allow" : "deny" } : result;
+	if (typeof result === "boolean") return { effect: result ? "allow" : "deny" };
+	/**
+	* A returned object MUST carry an `effect`. Without this guard a foreign shape — the
+	* pre-2.30 `{ granted: true }`, a hand-rolled `{ allowed: true }`, a stray Promise
+	* someone forgot to await — passed through as a decision with no effect and was read
+	* as DENY. A gate that says yes and is silently overruled is the worst available
+	* failure: nine `@classytic/arc-*` test suites went red at once and every symptom
+	* pointed at authentication rather than at the return shape.
+	*
+	* Throwing lands in `failed` (fail-closed, still a denial), so behaviour is unchanged
+	* for anything already correct — but the reason now names itself instead of hiding.
+	*/
+	const effect = result?.effect;
+	if (result === null || typeof result !== "object" || effect !== "allow" && effect !== "deny") throw new Error(`[arc] a permission check returned an unrecognized shape: ${JSON.stringify(result)}. Return a boolean or an AuthorizationDecision ({ effect: 'allow' | 'deny', ... }). The pre-2.30 { granted } shape is no longer accepted — it normalized to a silent deny.`);
+	return result;
 }
 /**
 * Run a permission check once and classify the result. The single source of the
@@ -184,12 +199,6 @@ function applyAuthorizationDecision(decision, request) {
 	}
 }
 /**
-* @deprecated Renamed to {@link applyAuthorizationDecision} — the contract is an
-* `AuthorizationDecision`, not a `PermissionResult`. This alias is kept for
-* back-compat and will be removed in a future major.
-*/
-const applyPermissionResult = applyAuthorizationDecision;
-/**
 * Max length of a decision `reason` string before we fall back to the
 * generic default message. Upstream checks can return arbitrary strings; we
 * clamp to prevent accidental leakage of internal diagnostics or oversized
@@ -254,4 +263,4 @@ async function evaluateAndApplyPermission(check, context, request, reply, opts)
 	return true;
 }
 //#endregion
-export { normalizeToDecision as a, evaluatePermissionDecision as i, applyPermissionResult as n, conjoinPolicyFilters as o, evaluateAndApplyPermission as r, applyAuthorizationDecision as t };
+export { conjoinPolicyFilters as a, normalizeToDecision as i, evaluateAndApplyPermission as n, evaluatePermissionDecision as r, applyAuthorizationDecision as t };

package/dist/{buildHandler-BYS3Vkfz.mjs → buildHandler-CDrCJzmB.mjs}

@@ -1,6 +1,7 @@
-import { t as toRepositoryFilter } from "./repositoryFilter-Dz8k3S4P.mjs";
-import { o as conjoinPolicyFilters } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-Bk44F2yT.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-_KbifpHF.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -1,6 +1,7 @@
-import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BGZCzOGL.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DOMT_iq7.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-br4otiqF.mjs";
+
+import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BOk3YnTz.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DFA-QrU9.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-BzqxconG.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities

package/dist/cache/index.mjs

@@ -1,6 +1,7 @@
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cd316u_y.mjs";
-import { t as MemoryCacheStore } from "../memory-CmnzXE5Z.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DSGuSVLW.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-C0_pa1tY.mjs";
+import { t as MemoryCacheStore } from "../memory-DR6wpa9F.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BZr8v46E.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-_NJeDd1_.mjs → caching-BFHA6Scf.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,6 +1,7 @@
-import { L as RequestWithExtras } from "../index-Q5gzEIWY.mjs";
-import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C_ZZRcD6.mjs";
-import { t as ArcModule } from "../types-D_n8L6VY.mjs";
+
+import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
+import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
+import { t as ArcModule } from "../types-CBgvkp8O.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,6 +1,7 @@
-import { g as getUserId } from "../types-CSyCxl2V.mjs";
-import { t as defineResource } from "../defineResource-CxWqDCAy.mjs";
-import { t as defineModule } from "../module-_-M7C5ES.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-Cys0ko9Z.mjs";
+import { t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
+import { t as defineModule } from "../module-0pFJA6YW.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -1175,8 +1176,7 @@ function createDataCleanupModule(deps) {
 				path: "/recipes",
 				summary: "List available cleanup recipes",
 				permissions: view,
-				raw: true,
-				handler: async (_req, reply) => {
+				rawHandler: async (_req, reply) => {
 					return reply.send({ recipes: registry.introspect() });
 				}
 			},
@@ -1185,9 +1185,8 @@ function createDataCleanupModule(deps) {
 				path: "/preview",
 				summary: "Preview a cleanup plan (no mutation)",
 				permissions: view,
-				raw: true,
 				schema: { body: previewBodySchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
 					const plan = await service.preview({
@@ -1204,9 +1203,8 @@ function createDataCleanupModule(deps) {
 				path: "/runs",
 				summary: "Execute a confirmed cleanup plan",
 				permissions: execute,
-				raw: true,
 				schema: { body: runsBodySchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
 					const run = await service.execute({
@@ -1226,9 +1224,8 @@ function createDataCleanupModule(deps) {
 				path: "/runs/:id",
 				summary: "Observe a cleanup run",
 				permissions: view,
-				raw: true,
 				schema: { params: runIdParamsSchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const { id } = req.params;
 					return reply.send(await service.getRun(id));
 				}
@@ -1238,12 +1235,11 @@ function createDataCleanupModule(deps) {
 				path: "/runs/:id/action",
 				summary: "Cancel or retry a cleanup run",
 				permissions: manage,
-				raw: true,
 				schema: {
 					params: runIdParamsSchema,
 					body: actionBodySchema
 				},
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const actionActor = resolveActor(req);
 					const { id } = req.params;
 					const { action, reason } = req.body;

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,5 @@
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-Q5gzEIWY.mjs";
+
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-CpzxqePp.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,5 +1,6 @@
-import { t as CRUD_OPERATIONS } from "../../constants-DNre0wRg.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-y9Hnypus.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-D3Dv4LAV.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-qq0mn2s9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/docs.d.ts
 /**
  * Arc CLI - Docs Command

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,6 @@
-import { t as buildOpenApiSpec } from "../../openapi-B8Vkbxbn.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-B2L4js1v.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/doctor.d.ts
 /**
  * Arc CLI - Doctor Command

package/dist/cli/commands/doctor.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.d.mts

@@ -1,2 +1,3 @@
-import { n as generate, t as ArcProjectConfig } from "../../generate-BnsL9GBm.mjs";
+
+import { n as generate, t as ArcProjectConfig } from "../../generate-DCGuEbqI.mjs";
 export { type ArcProjectConfig, generate };

package/dist/cli/commands/generate.mjs

@@ -1,2 +1,3 @@
-import { t as generate } from "../../generate-D0wZupBg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-EcA6ui4i.mjs";
 export { generate };

package/dist/cli/commands/init.d.mts

@@ -1,2 +1,3 @@
-import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-BPEu8cs-.mjs";
+
+import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-Cscs4lab.mjs";
 export { type DependencyManifest, type InitOptions, type PackageManager, type ProjectConfig, init };

package/dist/cli/commands/init.mjs

@@ -1,2 +1,3 @@
-import { t as init } from "../../init-tlRSt667.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-BEiNZBsJ.mjs";
 export { init };

package/dist/cli/commands/introspect.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/introspect.d.ts
 /**
  * Arc CLI - Introspect Command

package/dist/cli/commands/introspect.mjs

@@ -1,4 +1,5 @@
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.d.mts

@@ -1,7 +1,8 @@
+
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { n as generate } from "../generate-BnsL9GBm.mjs";
-import { t as init } from "../init-BPEu8cs-.mjs";
+import { n as generate } from "../generate-DCGuEbqI.mjs";
+import { t as init } from "../init-Cscs4lab.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/cli/index.mjs

@@ -1,7 +1,8 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-D0wZupBg.mjs";
-import { t as init } from "../init-tlRSt667.mjs";
+import { t as generate } from "../generate-EcA6ui4i.mjs";
+import { t as init } from "../init-BEiNZBsJ.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-DNre0wRg.mjs → constants-D3Dv4LAV.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.d.mts

@@ -1,3 +1,4 @@
+
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.d.ts
 /**

package/dist/context/index.mjs

@@ -1,3 +1,4 @@
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-MrlJwECf.mjs";
-import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-2TxXOJ7T.mjs";
+import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
 export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.d.mts

@@ -1,3 +1,4 @@
-import { $t as SlugExt, An as ControllerConfigurableOptions, B as defineResource, Jt as BaseController, Mn as ListResult, Nn as BodySanitizer, Pn as BodySanitizerConfig, Qt as TreeMixin, V as ResourceDefinition, Xt as SoftDeleteMixin, Yt as SoftDeleteExt, Zt as TreeExt, an as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugMixin, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as QueryResolver, jn as ControllerConstructionOptions, kn as BaseControllerOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkMixin, on as AccessControl, pt as AggregationMaterializedContext, rn as BaseCrudController, sn as AccessControlConfig, st as AggMeasureInput, tn as BulkExt, ut as AggregationConfig } from "../index-Q5gzEIWY.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Cx7bro4R.mjs";
+
+import { $t as TreeMixin, An as BaseControllerOptions, B as defineResource, Fn as BodySanitizerConfig, Mn as ControllerConstructionOptions, Nn as ListResult, Pn as BodySanitizer, Qt as TreeExt, V as ResourceDefinition, Xt as SoftDeleteExt, Yt as BaseController, Zt as SoftDeleteMixin, an as QueryResolver, cn as AccessControlConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugExt, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as BaseCrudController, jn as ControllerConfigurableOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkExt, on as QueryResolverConfig, pt as AggregationMaterializedContext, rn as BulkMixin, sn as AccessControl, st as AggMeasureInput, tn as SlugMixin, ut as AggregationConfig } from "../index-CpzxqePp.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Bc2ox8_U.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,7 +1,8 @@
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-B5DwufbB.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-CxWqDCAy.mjs";
-import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-BJnpkY9i.mjs";
-import { t as defineAggregation } from "../defineAggregation-ufWjUwml.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-poalJLvp.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-D3Dv4LAV.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-De7GqHck.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
+import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-UPQFatit.mjs";
+import { t as defineAggregation } from "../defineAggregation-DbPPS8RI.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-BGpIxINN.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };