@classytic/arc 2.31.0 → 2.32.0

package/dist/{BaseController-De7GqHck.mjs → BaseController-Dk34dxhI.mjs}

@@ -1,15 +1,15 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-D3Dv4LAV.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-J99LGTJI.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Cj42AntO.mjs";
-import { n as getUserRoles, t as getUserId } from "./userHelpers-ChYJ6CdK.mjs";
-import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DjQJ7FKA.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CB5Cuzk9.mjs";
-import { g as ArcQueryParser, n as scheduleBackground } from "./utils-vL8BrDE2.mjs";
-import { t as buildQueryKey } from "./keys-C0_pa1tY.mjs";
+import { a as conjoinPolicyFilters } from "./authorizationDecision-__T3EJDA.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-Bh1KK5ps.mjs";
+import { n as getUserRoles, t as getUserId } from "./userHelpers-BNsOXzOd.mjs";
+import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-DXYX7dIR.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-C4KiMWUa.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DotlxG3L.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-DEi65pGj.mjs";
+import { g as ArcQueryParser, n as scheduleBackground } from "./utils-BtOha_Sp.mjs";
+import { t as buildQueryKey } from "./keys-B-HBTGXl.mjs";
 //#region src/core/AccessControl.ts
 const log$1 = arcLog("access-control");
 var AccessControl = class {
@@ -287,7 +287,9 @@ var BodySanitizer = class {
 			if (!isElevated(scope)) {
 				const fieldPerms = arcContext?.arc?.fields;
 				if (fieldPerms) {
-					const effectiveRoles = resolveEffectiveRoles(getUserRoles(req.user), isMember(scope) ? scope.orgRoles : []);
+					const globalRoles = getUserRoles(req.user);
+					const orgRoles = isMember(scope) ? scope.orgRoles : [];
+					const effectiveRoles = resolveEffectiveRoles(globalRoles, orgRoles);
 					const { body: filtered, deniedFields } = applyFieldWritePermissions(sanitized, fieldPerms, effectiveRoles);
 					if (deniedFields.length > 0 && this.onFieldWriteDenied === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
 					sanitized = filtered;
@@ -1638,7 +1640,8 @@ function SlugMixin(Base) {
 			} else throw createError(501, "Slug lookup not implemented — repository needs getBySlug() or getOne()");
 			if (!this.accessControl.validateItemAccess(item, req)) {
 				const code = item ? "POLICY_FILTERED" : "NOT_FOUND";
-				const err = new NotFoundError(this.resourceName ?? "Resource");
+				const resource = this.resourceName ?? "Resource";
+				const err = new NotFoundError(resource);
 				err.details = {
 					...err.details ?? {},
 					code

package/dist/{EventTransport-9mlTgqzE.mjs → EventTransport-BV10D0oG.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-BcmPyq5I.mjs → HookSystem-vimw5D7Z.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-qq0mn2s9.mjs → ResourceRegistry-BVr7PgA0.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import "./constants-D3Dv4LAV.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import "./constants-J99LGTJI.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -216,22 +216,24 @@ var ResourceRegistry = class {
 				path: r.prefix,
 				operation: "create"
 			});
-			if (!disabled.has("update")) if (updateMethod === "both") {
-				routes.push({
-					method: "PUT",
+			if (!disabled.has("update")) {
+				if (updateMethod === "both") {
+					routes.push({
+						method: "PUT",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+					routes.push({
+						method: "PATCH",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+				} else routes.push({
+					method: updateMethod,
 					path: `${r.prefix}/:id`,
 					operation: "update"
 				});
-				routes.push({
-					method: "PATCH",
-					path: `${r.prefix}/:id`,
-					operation: "update"
-				});
-			} else routes.push({
-				method: updateMethod,
-				path: `${r.prefix}/:id`,
-				operation: "update"
-			});
+			}
 			if (!disabled.has("delete")) routes.push({
 				method: "DELETE",
 				path: `${r.prefix}/:id`,

package/dist/{actionPermissions-BE5NwaQk.mjs → actionPermissions-Dti7ebyv.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-BvLKvOIL.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cj42AntO.mjs";
-import { n as requireSingleHeaderValue } from "../headers-3zvE0rM3.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
-import { o as toJsonSchema } from "../schemaConverter-D--wdJM-.mjs";
-import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-L--QDAir.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Bh1KK5ps.mjs";
+import { n as requireSingleHeaderValue } from "../headers-BXjQYbeC.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-BNsOXzOd.mjs";
+import { o as toJsonSchema } from "../schemaConverter-Crjvczi_.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-Dl_m0NCe.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -346,9 +346,10 @@ function extractBetterAuthOpenApi(authApi, options = {}) {
 		if (excludeServerOnly && endpointOpts.metadata?.SERVER_ONLY) continue;
 		const fullPath = toOpenApiPath(`${normalizedBase}${endpointPath}`);
 		const methods = [];
-		if (endpointOpts.method) if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
-		else methods.push(endpointOpts.method.toLowerCase());
-		else methods.push(endpointOpts.body ? "post" : "get");
+		if (endpointOpts.method) {
+			if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
+			else methods.push(endpointOpts.method.toLowerCase());
+		} else methods.push(endpointOpts.body ? "post" : "get");
 		const openApiMeta = endpointOpts.metadata?.openapi;
 		for (const method of methods) {
 			const operation = {
@@ -1149,7 +1150,7 @@ var MemorySessionStore = class {
 * ```
 */
 function createSessionManager(options) {
-	const { store, secret, maxAge: maxAgeSeconds = 10080 * 60, updateAge: updateAgeSeconds = 1440 * 60, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
+	const { store, secret, maxAge: maxAgeSeconds = 604800, updateAge: updateAgeSeconds = 86400, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
 	if (secret.length < 32) throw new Error(`Session secret must be at least 32 characters (current: ${secret.length}). Use a strong random secret for production.`);
 	const maxAgeMs = maxAgeSeconds * 1e3;
 	const updateAgeMs = updateAgeSeconds * 1e3;

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-ChvUQGG1.mjs → authorizationDecision-__T3EJDA.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Cj42AntO.mjs";
+import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{buildHandler-CDrCJzmB.mjs → buildHandler-Dn7rzUJo.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-_KbifpHF.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-__T3EJDA.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DotlxG3L.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-PMCPR9El.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,
@@ -27,7 +27,8 @@ async function executeAggregation(normalized, deps, ctx) {
 		status: 400,
 		body: guardError
 	};
-	const aggReq = compileAggRequest(normalized, conjoinPolicyFilters(extractCallerFilter(query), policyFilter), tenantOptions, query);
+	const callerFilter = conjoinPolicyFilters(extractCallerFilter(query), policyFilter);
+	const aggReq = compileAggRequest(normalized, callerFilter, tenantOptions, query);
 	if (config.materialized) {
 		const matCtx = {
 			filter: aggReq.filter,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-C0_pa1tY.mjs";
-import { t as MemoryCacheStore } from "../memory-DR6wpa9F.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BZr8v46E.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B-HBTGXl.mjs";
+import { t as MemoryCacheStore } from "../memory-DsuWnj4T.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-Dhps-Ldt.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-BFHA6Scf.mjs → caching-DFJqHyFs.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
 import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
 import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
-import { t as ArcModule } from "../types-CBgvkp8O.mjs";
+import { t as ArcModule } from "../types-CT5vu6M0.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
@@ -255,18 +255,44 @@ declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
 interface DataCleanupModuleDeps {
-  /** The recipes this deployment exposes. Ids must be unique (boot-checked). */
-  recipes: readonly CleanupRecipe[];
-  /** Durable run store — host-owned persistence (atomic create + CAS transitions). */
-  runStore: CleanupRunStore;
+  /**
+   * The recipes this deployment exposes. Ids must be unique (boot-checked).
+   *
+   * May be a THUNK, and for any host whose recipes are built from live engines it
+   * should be. Resolved once, inside `bootstrap` — i.e. after arc has validated the
+   * module graph and run every module's bootstrap — instead of while this factory
+   * runs during composition.
+   *
+   * Why that matters beyond tidiness: a host assembles cleanup recipes by folding
+   * over its composed modules and calling their `preLivePurge()` / `cleanupSteps()`
+   * arms, and those arms read `engine.repositories`. An array forces that fold at
+   * composition time, which in turn forces every contributing domain to allocate its
+   * engine before arc owns the lifecycle — so a graph that then fails validation
+   * leaks every engine built up to that point. A thunk breaks that chain.
+   */
+  recipes: readonly CleanupRecipe[] | (() => readonly CleanupRecipe[] | Promise<readonly CleanupRecipe[]>);
+  /**
+   * Durable run store — host-owned persistence (atomic create + CAS transitions).
+   *
+   * Accepts a THUNK for the same reason `recipes` does. A store is backed by a
+   * model, and constructing it registers that model — so an eager value forces
+   * the host to register `CleanupRun` (and its siblings below) while the module
+   * graph is still being composed, before arc has validated it or opened the
+   * connection. Everything here is read inside `service()`, which is built on
+   * first use at `bootstrap`, so deferral costs nothing.
+   */
+  runStore: CleanupRunStore | (() => CleanupRunStore | Promise<CleanupRunStore>);
   /** Durable evidence + manifest store — host-owned, idempotent by operationId. */
-  evidenceStore: CleanupEvidenceStore;
+  evidenceStore: CleanupEvidenceStore | (() => CleanupEvidenceStore | Promise<CleanupEvidenceStore>);
   /** Permission checks for view / execute / manage. */
   permissions: CleanupPermissions;
-  /** Optional write fence (§8). */
-  writeFence?: CleanupWriteFence | undefined;
-  /** Optional durable job queue (§8) — defaults to microtask-deferred in-process. */
-  jobQueue?: CleanupJobQueue | undefined;
+  /** Optional write fence (§8). Thunk-friendly — see {@link runStore}. */
+  writeFence?: CleanupWriteFence | (() => CleanupWriteFence | Promise<CleanupWriteFence>) | undefined;
+  /**
+   * Optional durable job queue (§8) — defaults to microtask-deferred in-process.
+   * Thunk-friendly — see {@link runStore}.
+   */
+  jobQueue?: CleanupJobQueue | (() => CleanupJobQueue | Promise<CleanupJobQueue>) | undefined;
   /** Framework size caps. */
   limits?: Partial<CleanupLimits> | undefined;
   /** Exclusive worker-lease duration (ms). Default 5 minutes. */
@@ -296,10 +322,6 @@ interface DataCleanupModuleDeps {
   /** Injected clock (tests). */
   now?: () => Date;
 }
-/**
- * Build the Data Cleanup Center Arc module. The module's public export is the
- * live {@link CleanupService} (so other modules / tests can drive it directly).
- */
 declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
 //#endregion
 //#region src/cleanup/plan-digest.d.ts

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-Cys0ko9Z.mjs";
-import { t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
-import { t as defineModule } from "../module-0pFJA6YW.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-DXYX7dIR.mjs";
+import { t as defineResource } from "../defineResource-XFPPUu2c.mjs";
+import { t as defineModule } from "../module-Br81am6m.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -563,7 +563,7 @@ function createCleanupService(deps) {
 		...DEFAULT_CLEANUP_LIMITS,
 		...deps.limits
 	};
-	const leaseMs = deps.leaseMs ?? 300 * 1e3;
+	const leaseMs = deps.leaseMs ?? 3e5;
 	const progressThrottleMs = deps.progressThrottleMs ?? 0;
 	const jobQueue = deps.jobQueue ?? { enqueue: async (job) => {
 		queueMicrotask(() => {
@@ -1140,24 +1140,40 @@ const actionBodySchema = {
 		}
 	}
 };
-/**
-* Build the Data Cleanup Center Arc module. The module's public export is the
-* live {@link CleanupService} (so other modules / tests can drive it directly).
-*/
+async function resolve(input) {
+	return typeof input === "function" ? await input() : input;
+}
 function createDataCleanupModule(deps) {
-	const registry = createCleanupRegistry(deps.recipes);
-	const service = createCleanupService({
-		registry,
-		runStore: deps.runStore,
-		evidenceStore: deps.evidenceStore,
-		writeFence: deps.writeFence,
-		jobQueue: deps.jobQueue,
-		limits: deps.limits,
-		leaseMs: deps.leaseMs,
-		progressThrottleMs: deps.progressThrottleMs,
-		generateId: deps.generateId,
-		now: deps.now
-	});
+	/**
+	* Built on FIRST READ, which is `bootstrap` — never in this factory body.
+	*
+	* Memoized, so the recipe thunk runs exactly once and the id-uniqueness check
+	* still happens at boot (arc calls bootstrap during startup); it simply happens
+	* inside arc's lifecycle rather than ahead of it.
+	*/
+	let cachedRegistry;
+	const registry = async () => {
+		cachedRegistry ??= createCleanupRegistry(typeof deps.recipes === "function" ? await deps.recipes() : deps.recipes);
+		return cachedRegistry;
+	};
+	if (typeof deps.recipes !== "function") cachedRegistry = createCleanupRegistry(deps.recipes);
+	let cached;
+	const service = async () => {
+		if (cached) return cached;
+		cached = createCleanupService({
+			registry: await registry(),
+			runStore: await resolve(deps.runStore),
+			evidenceStore: await resolve(deps.evidenceStore),
+			writeFence: await resolve(deps.writeFence),
+			jobQueue: await resolve(deps.jobQueue),
+			limits: deps.limits,
+			leaseMs: deps.leaseMs,
+			progressThrottleMs: deps.progressThrottleMs,
+			generateId: deps.generateId,
+			now: deps.now
+		});
+		return cached;
+	};
 	const prefix = deps.prefix ?? "/governance/data-cleanup";
 	const resolveActor = deps.resolveActor ?? defaultResolveActor;
 	const resolveAmbient = deps.resolveAmbient;
@@ -1177,7 +1193,7 @@ function createDataCleanupModule(deps) {
 				summary: "List available cleanup recipes",
 				permissions: view,
 				rawHandler: async (_req, reply) => {
-					return reply.send({ recipes: registry.introspect() });
+					return reply.send({ recipes: (await registry()).introspect() });
 				}
 			},
 			{
@@ -1189,7 +1205,7 @@ function createDataCleanupModule(deps) {
 				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
-					const plan = await service.preview({
+					const plan = await (await service()).preview({
 						recipeId: body.recipe,
 						parameters: body.parameters,
 						actor: resolveActor(r),
@@ -1207,7 +1223,7 @@ function createDataCleanupModule(deps) {
 				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
-					const run = await service.execute({
+					const run = await (await service()).execute({
 						recipeId: body.recipe,
 						parameters: body.parameters,
 						planDigest: body.planDigest,
@@ -1227,7 +1243,7 @@ function createDataCleanupModule(deps) {
 				schema: { params: runIdParamsSchema },
 				rawHandler: async (req, reply) => {
 					const { id } = req.params;
-					return reply.send(await service.getRun(id));
+					return reply.send(await (await service()).getRun(id));
 				}
 			},
 			{
@@ -1243,11 +1259,11 @@ function createDataCleanupModule(deps) {
 					const actionActor = resolveActor(req);
 					const { id } = req.params;
 					const { action, reason } = req.body;
-					if (action === "cancel") return reply.send(await service.cancel(id, {
+					if (action === "cancel") return reply.send(await (await service()).cancel(id, {
 						actor: actionActor,
 						reason
 					}));
-					return reply.send(await service.retry(id));
+					return reply.send(await (await service()).retry(id));
 				}
 			}
 		]
@@ -1255,7 +1271,7 @@ function createDataCleanupModule(deps) {
 	return defineModule({
 		name: deps.moduleName ?? "data-cleanup",
 		...deps.owns ? { owns: deps.owns } : {},
-		bootstrap: () => service,
+		bootstrap: () => service(),
 		resources: () => [resource]
 	});
 }

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-D3Dv4LAV.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-qq0mn2s9.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-J99LGTJI.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-BVr7PgA0.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts
@@ -78,9 +78,7 @@ function describePipeline(pipe) {
 			case "transform":
 				transforms.push(desc);
 				break;
-			case "interceptor":
-				interceptors.push(desc);
-				break;
+			case "interceptor": interceptors.push(desc);
 		}
 	}
 	return {

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-B2L4js1v.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-DIRzvxC0.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-D1MJp13f.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-EcA6ui4i.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-CRSG0jTv.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-BEiNZBsJ.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-BbfP8aky.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-D1MJp13f.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-EcA6ui4i.mjs";
-import { t as init } from "../init-BEiNZBsJ.mjs";
+import { t as generate } from "../generate-CRSG0jTv.mjs";
+import { t as init } from "../init-BbfP8aky.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-D3Dv4LAV.mjs → constants-J99LGTJI.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-2TxXOJ7T.mjs";
-import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-B6vQF-sy.mjs";
+import { t as transactionContext } from "../transactionContext-BvLKvOIL.mjs";
 export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
 import { $t as TreeMixin, An as BaseControllerOptions, B as defineResource, Fn as BodySanitizerConfig, Mn as ControllerConstructionOptions, Nn as ListResult, Pn as BodySanitizer, Qt as TreeExt, V as ResourceDefinition, Xt as SoftDeleteExt, Yt as BaseController, Zt as SoftDeleteMixin, an as QueryResolver, cn as AccessControlConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugExt, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as BaseCrudController, jn as ControllerConfigurableOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkExt, on as QueryResolverConfig, pt as AggregationMaterializedContext, rn as BulkMixin, sn as AccessControl, st as AggMeasureInput, tn as SlugMixin, ut as AggregationConfig } from "../index-CpzxqePp.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Bc2ox8_U.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-DXlHwvuE.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-D3Dv4LAV.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-De7GqHck.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
-import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-UPQFatit.mjs";
-import { t as defineAggregation } from "../defineAggregation-DbPPS8RI.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-BGpIxINN.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-J99LGTJI.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-Dk34dxhI.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-XFPPUu2c.mjs";
+import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-CPA-jx0M.mjs";
+import { t as defineAggregation } from "../defineAggregation-gX4No1gt.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-BwwmNSp7.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/{core-BGpIxINN.mjs → core-BwwmNSp7.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import "./constants-D3Dv4LAV.mjs";
-import { t as defineResource } from "./defineResource-Bv6EtN1x.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import "./constants-J99LGTJI.mjs";
+import { t as defineResource } from "./defineResource-XFPPUu2c.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema