@classytic/arc 2.30.0 → 2.32.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Classytic
+Copyright (c) 2025 Classytic LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -324,3 +324,10 @@ arc doctor                                       # diagnose env
 ## License
 
 MIT
+
+
+## Trademark
+
+The code is MIT-licensed. **"Classytic", "arc", and the logos are trademarks of
+Classytic LLC** and are **not** licensed under MIT — see [TRADEMARK.md](TRADEMARK.md).
+Forks must be renamed; the license covers the code, not the brand.

package/TRADEMARK.md

@@ -0,0 +1,22 @@
+# Trademark Notice
+
+The **source code** in this package is licensed under the MIT License (see
+[LICENSE](LICENSE)). Trademarks are **not** part of that license.
+
+**"Classytic", "arc", the Classytic and arc logos**, and related names and marks
+are trademarks of **Classytic LLC** (Wyoming, USA). The MIT License covers the
+code only — it grants **no right** to use Classytic LLC's names, logos, or brand.
+
+## You may
+- use, fork, modify, and redistribute the **code** under the MIT License;
+- state truthfully that your product "uses" or "is built on" arc / Classytic
+  software, without implying endorsement.
+
+## You may not (without written permission from Classytic LLC)
+- use "Classytic", "arc", or confusingly similar names as the name of your own
+  product, package, company, or service;
+- use the Classytic / arc logos or brand styling;
+- imply sponsorship, affiliation, or endorsement by Classytic LLC.
+
+Forks or redistributions must be **renamed** so they are not confused with the
+official project. Permission / questions: **trademark@classytic.com**.

package/dist/{BaseController-B5DwufbB.mjs → BaseController-Dk34dxhI.mjs}

@@ -1,14 +1,15 @@
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-J99LGTJI.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-Cg_y3fBz.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-Dz8k3S4P.mjs";
-import { o as conjoinPolicyFilters } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CQ_7KQWw.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-taUVD4p3.mjs";
-import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-__T3EJDA.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Bh1KK5ps.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-BNsOXzOd.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-DXYX7dIR.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-C4KiMWUa.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DotlxG3L.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-DEi65pGj.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-BtOha_Sp.mjs";
+import { t as buildQueryKey } from "./keys-B-HBTGXl.mjs";
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -33,13 +34,13 @@ var AccessControl = class {
 	* Combines ID filter with policy/org filters for proper security enforcement
 	*/
 	buildIdFilter(id, req) {
-		const filter = { [this.idField]: id };
+		let filter = { [this.idField]: id };
 		const arcContext = this._meta(req);
 		const policyFilters = arcContext?._policyFilters;
-		if (policyFilters) Object.assign(filter, policyFilters);
+		if (policyFilters) filter = conjoinPolicyFilters(filter, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filter[this.tenantField] = orgId;
+		if (this.tenantField && orgId) filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
 		return toRepositoryFilter(filter);
 	}
 	/**
@@ -286,7 +287,9 @@ var BodySanitizer = class {
 			if (!isElevated(scope)) {
 				const fieldPerms = arcContext?.arc?.fields;
 				if (fieldPerms) {
-					const effectiveRoles = resolveEffectiveRoles(getUserRoles(req.user), isMember(scope) ? scope.orgRoles : []);
+					const globalRoles = getUserRoles(req.user);
+					const orgRoles = isMember(scope) ? scope.orgRoles : [];
+					const effectiveRoles = resolveEffectiveRoles(globalRoles, orgRoles);
 					const { body: filtered, deniedFields } = applyFieldWritePermissions(sanitized, fieldPerms, effectiveRoles);
 					if (deniedFields.length > 0 && this.onFieldWriteDenied === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
 					sanitized = filtered;
@@ -1488,10 +1491,8 @@ function BulkMixin(Base) {
 		* Returns the merged filter, or `null` when access must be denied.
 		*/
 		buildBulkFilter(userFilter, req) {
-			const filter = { ...userFilter };
 			const arcContext = this.meta(req);
-			const policyFilters = arcContext?._policyFilters;
-			if (policyFilters) Object.assign(filter, policyFilters);
+			let filter = conjoinPolicyFilters(userFilter, arcContext?._policyFilters);
 			if (this.tenantField) {
 				const scope = arcContext?._scope;
 				if (!scope) return filter;
@@ -1499,7 +1500,7 @@ function BulkMixin(Base) {
 				if (isElevated(scope)) return filter;
 				const orgId = getOrgId(scope);
 				if (!orgId) return null;
-				filter[this.tenantField] = orgId;
+				filter = conjoinPolicyFilters(filter, { [this.tenantField]: orgId });
 			}
 			return filter;
 		}
@@ -1639,7 +1640,8 @@ function SlugMixin(Base) {
 			} else throw createError(501, "Slug lookup not implemented — repository needs getBySlug() or getOne()");
 			if (!this.accessControl.validateItemAccess(item, req)) {
 				const code = item ? "POLICY_FILTERED" : "NOT_FOUND";
-				const err = new NotFoundError(this.resourceName ?? "Resource");
+				const resource = this.resourceName ?? "Resource";
+				const err = new NotFoundError(resource);
 				err.details = {
 					...err.details ?? {},
 					code

package/dist/{EventTransport-QmY7A258.d.mts → EventTransport-2uVV34WU.d.mts}

@@ -1,3 +1,4 @@
+
 import { DeadLetteredEvent, DomainEvent, DomainEvent as DomainEvent$1, EventHandler, EventHandler as EventHandler$1, EventLogger, EventLogger as EventLogger$1, EventTransport, EventTransport as EventTransport$1, PublishManyResult } from "@classytic/primitives/events";
 //#region src/events/EventTransport.d.ts
 interface MemoryEventTransportOptions {

package/dist/{EventTransport-C6YA8xY9.mjs → EventTransport-BV10D0oG.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-WkIougo6.mjs → HookSystem-vimw5D7Z.mjs}

@@ -1,4 +1,5 @@
-import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{QueryCache-DOMT_iq7.d.mts → QueryCache-DFA-QrU9.d.mts}

@@ -1,4 +1,5 @@
-import { r as CacheStore } from "./interface-BGZCzOGL.mjs";
+
+import { r as CacheStore } from "./interface-BOk3YnTz.mjs";
 //#region src/cache/QueryCache.d.ts
 /** Metadata wrapper stored in CacheStore */
 interface CacheEnvelope<T = unknown> {

package/dist/{ResourceRegistry-y9Hnypus.mjs → ResourceRegistry-BVr7PgA0.mjs}

@@ -1,4 +1,5 @@
-import "./constants-DNre0wRg.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import "./constants-J99LGTJI.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -59,7 +60,7 @@ var ResourceRegistry = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
-				raw: r.raw,
+				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),
 			events: Object.keys(resource.events ?? {}),
@@ -215,22 +216,24 @@ var ResourceRegistry = class {
 				path: r.prefix,
 				operation: "create"
 			});
-			if (!disabled.has("update")) if (updateMethod === "both") {
-				routes.push({
-					method: "PUT",
+			if (!disabled.has("update")) {
+				if (updateMethod === "both") {
+					routes.push({
+						method: "PUT",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+					routes.push({
+						method: "PATCH",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+				} else routes.push({
+					method: updateMethod,
 					path: `${r.prefix}/:id`,
 					operation: "update"
 				});
-				routes.push({
-					method: "PATCH",
-					path: `${r.prefix}/:id`,
-					operation: "update"
-				});
-			} else routes.push({
-				method: updateMethod,
-				path: `${r.prefix}/:id`,
-				operation: "update"
-			});
+			}
 			if (!disabled.has("delete")) routes.push({
 				method: "DELETE",
 				path: `${r.prefix}/:id`,

package/dist/{actionPermissions-CAphcmUG.mjs → actionPermissions-Dti7ebyv.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.d.mts

@@ -1,5 +1,6 @@
-import "../index-Q5gzEIWY.mjs";
-import { a as UserBase } from "../types-ChvvVNP8.mjs";
+
+import "../index-CpzxqePp.mjs";
+import { a as UserBase } from "../types-B7XeLEgK.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,4 +1,5 @@
-import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-BvLKvOIL.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.d.mts

@@ -1,3 +1,4 @@
+
 import { FastifyInstance } from "fastify";
 //#region src/auth/audit.d.ts
 /**

package/dist/auth/audit.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,7 +1,8 @@
-import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-Q5gzEIWY.mjs";
-import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
-import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { Ut as AuthHelpers, Wt as AuthPluginOptions } from "../index-CpzxqePp.mjs";
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
+import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
 //#region src/auth/authPlugin.d.ts
 declare module "fastify" {

package/dist/auth/index.mjs

@@ -1,8 +1,9 @@
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BvlQSDMB.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { o as toJsonSchema } from "../schemaConverter-DJvodiHj.mjs";
-import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-Bfu_8y1U.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Bh1KK5ps.mjs";
+import { n as requireSingleHeaderValue } from "../headers-BXjQYbeC.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-BNsOXzOd.mjs";
+import { o as toJsonSchema } from "../schemaConverter-Crjvczi_.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-Dl_m0NCe.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -345,9 +346,10 @@ function extractBetterAuthOpenApi(authApi, options = {}) {
 		if (excludeServerOnly && endpointOpts.metadata?.SERVER_ONLY) continue;
 		const fullPath = toOpenApiPath(`${normalizedBase}${endpointPath}`);
 		const methods = [];
-		if (endpointOpts.method) if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
-		else methods.push(endpointOpts.method.toLowerCase());
-		else methods.push(endpointOpts.body ? "post" : "get");
+		if (endpointOpts.method) {
+			if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
+			else methods.push(endpointOpts.method.toLowerCase());
+		} else methods.push(endpointOpts.body ? "post" : "get");
 		const openApiMeta = endpointOpts.metadata?.openapi;
 		for (const method of methods) {
 			const operation = {
@@ -1148,7 +1150,7 @@ var MemorySessionStore = class {
 * ```
 */
 function createSessionManager(options) {
-	const { store, secret, maxAge: maxAgeSeconds = 10080 * 60, updateAge: updateAgeSeconds = 1440 * 60, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
+	const { store, secret, maxAge: maxAgeSeconds = 604800, updateAge: updateAgeSeconds = 86400, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
 	if (secret.length < 32) throw new Error(`Session secret must be at least 32 characters (current: ${secret.length}). Use a strong random secret for production.`);
 	const maxAgeMs = maxAgeSeconds * 1e3;
 	const updateAgeMs = updateAgeSeconds * 1e3;

package/dist/auth/redis-session.d.mts

@@ -1,4 +1,5 @@
-import { i as SessionData, s as SessionStore } from "../sessionManager-BHOM3N_0.mjs";
+
+import { i as SessionData, s as SessionStore } from "../sessionManager-qimlKV0P.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
 interface RedisLike {

package/dist/auth/redis-session.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{applyPermissionResult-Cf6zUCvb.mjs → authorizationDecision-__T3EJDA.mjs}

@@ -1,5 +1,6 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-DkO8Nk6-.mjs";
+import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.
@@ -93,7 +94,7 @@ function conjoinPolicyFilters(base, incoming) {
 	return result;
 }
 //#endregion
-//#region src/permissions/applyPermissionResult.ts
+//#region src/permissions/authorizationDecision.ts
 const log = arcLog("permissions:enforce");
 /**
 * Normalize a check return into the canonical {@link AuthorizationDecision}.
@@ -102,7 +103,21 @@ const log = arcLog("permissions:enforce");
 * pipeline only ever handles decisions.
 */
 function normalizeToDecision(result) {
-	return typeof result === "boolean" ? { effect: result ? "allow" : "deny" } : result;
+	if (typeof result === "boolean") return { effect: result ? "allow" : "deny" };
+	/**
+	* A returned object MUST carry an `effect`. Without this guard a foreign shape — the
+	* pre-2.30 `{ granted: true }`, a hand-rolled `{ allowed: true }`, a stray Promise
+	* someone forgot to await — passed through as a decision with no effect and was read
+	* as DENY. A gate that says yes and is silently overruled is the worst available
+	* failure: nine `@classytic/arc-*` test suites went red at once and every symptom
+	* pointed at authentication rather than at the return shape.
+	*
+	* Throwing lands in `failed` (fail-closed, still a denial), so behaviour is unchanged
+	* for anything already correct — but the reason now names itself instead of hiding.
+	*/
+	const effect = result?.effect;
+	if (result === null || typeof result !== "object" || effect !== "allow" && effect !== "deny") throw new Error(`[arc] a permission check returned an unrecognized shape: ${JSON.stringify(result)}. Return a boolean or an AuthorizationDecision ({ effect: 'allow' | 'deny', ... }). The pre-2.30 { granted } shape is no longer accepted — it normalized to a silent deny.`);
+	return result;
 }
 /**
 * Run a permission check once and classify the result. The single source of the
@@ -184,12 +199,6 @@ function applyAuthorizationDecision(decision, request) {
 	}
 }
 /**
-* @deprecated Renamed to {@link applyAuthorizationDecision} — the contract is an
-* `AuthorizationDecision`, not a `PermissionResult`. This alias is kept for
-* back-compat and will be removed in a future major.
-*/
-const applyPermissionResult = applyAuthorizationDecision;
-/**
 * Max length of a decision `reason` string before we fall back to the
 * generic default message. Upstream checks can return arbitrary strings; we
 * clamp to prevent accidental leakage of internal diagnostics or oversized
@@ -254,4 +263,4 @@ async function evaluateAndApplyPermission(check, context, request, reply, opts)
 	return true;
 }
 //#endregion
-export { normalizeToDecision as a, evaluatePermissionDecision as i, applyPermissionResult as n, conjoinPolicyFilters as o, evaluateAndApplyPermission as r, applyAuthorizationDecision as t };
+export { conjoinPolicyFilters as a, normalizeToDecision as i, evaluateAndApplyPermission as n, evaluatePermissionDecision as r, applyAuthorizationDecision as t };

package/dist/{buildHandler-BYS3Vkfz.mjs → buildHandler-Dn7rzUJo.mjs}

@@ -1,6 +1,7 @@
-import { t as toRepositoryFilter } from "./repositoryFilter-Dz8k3S4P.mjs";
-import { o as conjoinPolicyFilters } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-Bk44F2yT.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-__T3EJDA.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DotlxG3L.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-PMCPR9El.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,
@@ -26,7 +27,8 @@ async function executeAggregation(normalized, deps, ctx) {
 		status: 400,
 		body: guardError
 	};
-	const aggReq = compileAggRequest(normalized, conjoinPolicyFilters(extractCallerFilter(query), policyFilter), tenantOptions, query);
+	const callerFilter = conjoinPolicyFilters(extractCallerFilter(query), policyFilter);
+	const aggReq = compileAggRequest(normalized, callerFilter, tenantOptions, query);
 	if (config.materialized) {
 		const matCtx = {
 			filter: aggReq.filter,

package/dist/cache/index.d.mts

@@ -1,6 +1,7 @@
-import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BGZCzOGL.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DOMT_iq7.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-br4otiqF.mjs";
+
+import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BOk3YnTz.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DFA-QrU9.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-BzqxconG.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities

package/dist/cache/index.mjs

@@ -1,6 +1,7 @@
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cd316u_y.mjs";
-import { t as MemoryCacheStore } from "../memory-CmnzXE5Z.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DSGuSVLW.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B-HBTGXl.mjs";
+import { t as MemoryCacheStore } from "../memory-DsuWnj4T.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-Dhps-Ldt.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-_NJeDd1_.mjs → caching-DFJqHyFs.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,6 +1,7 @@
-import { L as RequestWithExtras } from "../index-Q5gzEIWY.mjs";
-import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C_ZZRcD6.mjs";
-import { t as ArcModule } from "../types-D_n8L6VY.mjs";
+
+import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
+import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
+import { t as ArcModule } from "../types-CT5vu6M0.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
@@ -254,18 +255,44 @@ declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
 interface DataCleanupModuleDeps {
-  /** The recipes this deployment exposes. Ids must be unique (boot-checked). */
-  recipes: readonly CleanupRecipe[];
-  /** Durable run store — host-owned persistence (atomic create + CAS transitions). */
-  runStore: CleanupRunStore;
+  /**
+   * The recipes this deployment exposes. Ids must be unique (boot-checked).
+   *
+   * May be a THUNK, and for any host whose recipes are built from live engines it
+   * should be. Resolved once, inside `bootstrap` — i.e. after arc has validated the
+   * module graph and run every module's bootstrap — instead of while this factory
+   * runs during composition.
+   *
+   * Why that matters beyond tidiness: a host assembles cleanup recipes by folding
+   * over its composed modules and calling their `preLivePurge()` / `cleanupSteps()`
+   * arms, and those arms read `engine.repositories`. An array forces that fold at
+   * composition time, which in turn forces every contributing domain to allocate its
+   * engine before arc owns the lifecycle — so a graph that then fails validation
+   * leaks every engine built up to that point. A thunk breaks that chain.
+   */
+  recipes: readonly CleanupRecipe[] | (() => readonly CleanupRecipe[] | Promise<readonly CleanupRecipe[]>);
+  /**
+   * Durable run store — host-owned persistence (atomic create + CAS transitions).
+   *
+   * Accepts a THUNK for the same reason `recipes` does. A store is backed by a
+   * model, and constructing it registers that model — so an eager value forces
+   * the host to register `CleanupRun` (and its siblings below) while the module
+   * graph is still being composed, before arc has validated it or opened the
+   * connection. Everything here is read inside `service()`, which is built on
+   * first use at `bootstrap`, so deferral costs nothing.
+   */
+  runStore: CleanupRunStore | (() => CleanupRunStore | Promise<CleanupRunStore>);
   /** Durable evidence + manifest store — host-owned, idempotent by operationId. */
-  evidenceStore: CleanupEvidenceStore;
+  evidenceStore: CleanupEvidenceStore | (() => CleanupEvidenceStore | Promise<CleanupEvidenceStore>);
   /** Permission checks for view / execute / manage. */
   permissions: CleanupPermissions;
-  /** Optional write fence (§8). */
-  writeFence?: CleanupWriteFence | undefined;
-  /** Optional durable job queue (§8) — defaults to microtask-deferred in-process. */
-  jobQueue?: CleanupJobQueue | undefined;
+  /** Optional write fence (§8). Thunk-friendly — see {@link runStore}. */
+  writeFence?: CleanupWriteFence | (() => CleanupWriteFence | Promise<CleanupWriteFence>) | undefined;
+  /**
+   * Optional durable job queue (§8) — defaults to microtask-deferred in-process.
+   * Thunk-friendly — see {@link runStore}.
+   */
+  jobQueue?: CleanupJobQueue | (() => CleanupJobQueue | Promise<CleanupJobQueue>) | undefined;
   /** Framework size caps. */
   limits?: Partial<CleanupLimits> | undefined;
   /** Exclusive worker-lease duration (ms). Default 5 minutes. */
@@ -295,10 +322,6 @@ interface DataCleanupModuleDeps {
   /** Injected clock (tests). */
   now?: () => Date;
 }
-/**
- * Build the Data Cleanup Center Arc module. The module's public export is the
- * live {@link CleanupService} (so other modules / tests can drive it directly).
- */
 declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
 //#endregion
 //#region src/cleanup/plan-digest.d.ts