@classytic/arc 2.31.0 → 2.33.0

package/dist/{ResourceRegistry-qq0mn2s9.mjs → ResourceRegistry-DoALUlOO.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import "./constants-D3Dv4LAV.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import "./constants-BxCoxmiN.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -60,6 +60,7 @@ var ResourceRegistry = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
+				capability: r.capability,
 				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),
@@ -216,22 +217,24 @@ var ResourceRegistry = class {
 				path: r.prefix,
 				operation: "create"
 			});
-			if (!disabled.has("update")) if (updateMethod === "both") {
-				routes.push({
-					method: "PUT",
+			if (!disabled.has("update")) {
+				if (updateMethod === "both") {
+					routes.push({
+						method: "PUT",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+					routes.push({
+						method: "PATCH",
+						path: `${r.prefix}/:id`,
+						operation: "update"
+					});
+				} else routes.push({
+					method: updateMethod,
 					path: `${r.prefix}/:id`,
 					operation: "update"
 				});
-				routes.push({
-					method: "PATCH",
-					path: `${r.prefix}/:id`,
-					operation: "update"
-				});
-			} else routes.push({
-				method: updateMethod,
-				path: `${r.prefix}/:id`,
-				operation: "update"
-			});
+			}
 			if (!disabled.has("delete")) routes.push({
 				method: "DELETE",
 				path: `${r.prefix}/:id`,

package/dist/{actionPermissions-BE5NwaQk.mjs → actionPermissions-CUeCmpUd.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import "../index-CpzxqePp.mjs";
-import { a as UserBase } from "../types-B7XeLEgK.mjs";
+import { d as UserBase } from "../base-Csjc2oF-.mjs";
+import "../index-BcR2bFZQ.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { Ut as AuthHelpers, Wt as AuthPluginOptions } from "../index-CpzxqePp.mjs";
-import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-BcR2bFZQ.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cj42AntO.mjs";
-import { n as requireSingleHeaderValue } from "../headers-3zvE0rM3.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
-import { o as toJsonSchema } from "../schemaConverter-D--wdJM-.mjs";
-import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-L--QDAir.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cd_yy7aW.mjs";
+import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
+import { o as toJsonSchema } from "../schemaConverter-XH1RZRyu.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-BAfwgBxc.mjs";
+import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -346,9 +347,10 @@ function extractBetterAuthOpenApi(authApi, options = {}) {
 		if (excludeServerOnly && endpointOpts.metadata?.SERVER_ONLY) continue;
 		const fullPath = toOpenApiPath(`${normalizedBase}${endpointPath}`);
 		const methods = [];
-		if (endpointOpts.method) if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
-		else methods.push(endpointOpts.method.toLowerCase());
-		else methods.push(endpointOpts.body ? "post" : "get");
+		if (endpointOpts.method) {
+			if (Array.isArray(endpointOpts.method)) methods.push(...endpointOpts.method.map((m) => m.toLowerCase()));
+			else methods.push(endpointOpts.method.toLowerCase());
+		} else methods.push(endpointOpts.body ? "post" : "get");
 		const openApiMeta = endpointOpts.metadata?.openapi;
 		for (const method of methods) {
 			const operation = {
@@ -860,6 +862,25 @@ function createBetterAuthAdapter(options) {
 	if (openapiOpt === false) extractedOpenApi = void 0;
 	else if (typeof openapiOpt === "object") extractedOpenApi = openapiOpt;
 	const betterAuthPlugin = async (fastify) => {
+		/**
+		* `orgContext` without the `organization()` plugin is a SILENT
+		* misconfiguration, so it fails at boot instead.
+		*
+		* Arc resolves org membership through `auth.api.getActiveMember` /
+		* `getActiveMemberRole`. Absent the plugin those methods do not exist,
+		* every lookup returns null, and `request.scope` silently stays
+		* `'authenticated'` — so `requireOrgId()` throws 403 on every
+		* tenant-scoped route. It fails CLOSED (no data leak), but the symptom
+		* points nowhere near the cause: the host sees blanket 403s and no
+		* indication that a plugin is missing. One check at registration turns
+		* that into a sentence.
+		*/
+		if (orgEnabled) {
+			if (!(pickApiMethod(auth, "getActiveMember", "organization") !== void 0 || pickApiMethod(auth, "getActiveMemberRole", "organization") !== void 0)) throw new ArcError("createBetterAuthAdapter({ orgContext: true }) requires Better Auth's `organization()` plugin — `auth.api.getActiveMember` / `getActiveMemberRole` are missing. Without it arc can never resolve membership, so request.scope stays 'authenticated' and every tenant-scoped route answers 403. Add `organization()` to your betterAuth({ plugins }), or drop `orgContext`.", {
+				code: "BETTER_AUTH_ORG_PLUGIN_MISSING",
+				statusCode: 500
+			});
+		}
 		const routeOpts = options.rateLimit && typeof options.rateLimit === "object" ? { config: { rateLimit: options.rateLimit } } : {};
 		fastify.all(`${normalizedBase}/*`, routeOpts, async (request, reply) => {
 			try {
@@ -993,7 +1014,19 @@ function buildSetCookieHeader(name, value, maxAgeSeconds, options) {
 		`Path=${options.path ?? "/"}`
 	];
 	if (options.httpOnly !== false) parts.push("HttpOnly");
-	if (options.secure ?? process.env.NODE_ENV === "production") parts.push("Secure");
+	/**
+	* `Secure` defaults to "is this a production environment?" — via the shared classifier, NOT a
+	* raw `NODE_ENV === "production"` comparison.
+	*
+	* The raw form shipped session cookies WITHOUT `Secure` on any deployment using `NODE_ENV=prod`,
+	* because that comparison recognises only the long spelling. A cookie without `Secure` is sent
+	* over plaintext HTTP, so a session token becomes interceptable — and nothing anywhere reports
+	* it: the cookie is set, login works, the app behaves normally.
+	*
+	* `options.secure` still wins when stated (`??`), including an explicit `false` for local HTTP
+	* development. Only the DEFAULT changed, and only in the direction of being correct more often.
+	*/
+	if (options.secure ?? isProductionEnv(process.env.NODE_ENV)) parts.push("Secure");
 	parts.push(`SameSite=${capitalize(options.sameSite ?? "lax")}`);
 	if (options.domain) parts.push(`Domain=${options.domain}`);
 	return parts.join("; ");
@@ -1149,7 +1182,7 @@ var MemorySessionStore = class {
 * ```
 */
 function createSessionManager(options) {
-	const { store, secret, maxAge: maxAgeSeconds = 10080 * 60, updateAge: updateAgeSeconds = 1440 * 60, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
+	const { store, secret, maxAge: maxAgeSeconds = 604800, updateAge: updateAgeSeconds = 86400, freshAge: freshAgeSeconds = 600, cookieName = "arc.session", cookie: cookieOptions = {} } = options;
 	if (secret.length < 32) throw new Error(`Session secret must be at least 32 characters (current: ${secret.length}). Use a strong random secret for production.`);
 	const maxAgeMs = maxAgeSeconds * 1e3;
 	const updateAgeMs = updateAgeSeconds * 1e3;

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-ChvUQGG1.mjs → authorizationDecision-B3mP_QTy.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Cj42AntO.mjs";
+import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{types-B7XeLEgK.d.mts → base-Csjc2oF-.d.mts}

@@ -1,79 +1,6 @@
 
 import { i as RequestScope } from "./types-ChuShpCP.mjs";
 import { FastifyRequest } from "fastify";
-//#region src/types/base.d.ts
-declare module "fastify" {
-  interface FastifyRequest {
-    /** Request scope — set by auth adapter, read by permissions/presets/guards */
-    scope: RequestScope;
-    /**
-     * Current user — set by auth adapter (Better Auth, JWT, custom).
-     * `undefined` on public routes (`auth: false`) or unauthenticated requests.
-     * Guard with `if (request.user)` on routes that allow anonymous access.
-     *
-     * Kept as required (not `user?`) because `@fastify/jwt` declares it
-     * as required — declaration merges must have identical modifiers.
-     * The `| undefined` in the type achieves the same DX.
-     */
-    user: Record<string, unknown> | undefined;
-    /** Policy-injected query filters (e.g. ownership, org-scoping) */
-    _policyFilters?: Record<string, unknown>;
-    /** Field mask — fields to include/exclude in responses */
-    fieldMask?: {
-      include?: string[];
-      exclude?: string[];
-    };
-    /** Arbitrary policy metadata for downstream consumers */
-    policyMetadata?: Record<string, unknown>;
-    /** Document loaded by policy middleware for ownership checks */
-    document?: unknown;
-    /** Ownership check context (field name + user field) */
-    _ownershipCheck?: Record<string, unknown>;
-  }
-}
-type AnyRecord = Record<string, unknown>;
-/** MongoDB ObjectId — accepts string or any object with a `toString()` (e.g. mongoose ObjectId). */
-type ObjectId = string | {
-  toString(): string;
-};
-/**
- * Flexible user type that accepts any object with id/_id properties.
- * The actual user structure is defined by your app's auth system.
- */
-type UserLike = UserBase & {
-  /** User email (optional) */
-  email?: string;
-};
-interface UserOrganization {
-  userId: string;
-  organizationId: string;
-  [key: string]: unknown;
-}
-interface JWTPayload {
-  sub: string;
-  [key: string]: unknown;
-}
-/**
- * Typed Fastify request with Arc decorations. Use in `rawHandler` routes
- * instead of `(req as any).user`.
- *
- * @example
- * ```typescript
- * import type { ArcRequest } from '@classytic/arc';
- *
- * handler: async (req: ArcRequest, reply) => {
- *   req.user?.id;                    // typed
- *   req.scope.organizationId;        // typed (when member)
- *   req.signal;                      // AbortSignal (Fastify 5)
- * }
- * ```
- */
-type ArcRequest = FastifyRequest & {
-  scope: RequestScope;
-  user: Record<string, unknown> | undefined;
-  signal: AbortSignal;
-};
-//#endregion
 //#region src/utils/userHelpers.d.ts
 /**
  * Extract a user ID from a user object. Accepts `id` or `_id` — returns
@@ -324,4 +251,77 @@ interface PermissionCheckMeta {
   _conditional?: boolean;
 }
 //#endregion
-export { UserBase as a, normalizeRoles as c, JWTPayload as d, ObjectId as f, PermissionContext as i, AnyRecord as l, UserOrganization as m, DataPolicy as n, getUserId as o, UserLike as p, PermissionCheck as r, getUserRoles as s, AuthorizationDecision as t, ArcRequest as u };
+//#region src/types/base.d.ts
+declare module "fastify" {
+  interface FastifyRequest {
+    /** Request scope — set by auth adapter, read by permissions/presets/guards */
+    scope: RequestScope;
+    /**
+     * Current user — set by auth adapter (Better Auth, JWT, custom).
+     * `undefined` on public routes (`auth: false`) or unauthenticated requests.
+     * Guard with `if (request.user)` on routes that allow anonymous access.
+     *
+     * Kept as required (not `user?`) because `@fastify/jwt` declares it
+     * as required — declaration merges must have identical modifiers.
+     * The `| undefined` in the type achieves the same DX.
+     */
+    user: Record<string, unknown> | undefined;
+    /** Policy-injected query filters (e.g. ownership, org-scoping) */
+    _policyFilters?: Record<string, unknown>;
+    /** Field mask — fields to include/exclude in responses */
+    fieldMask?: {
+      include?: string[];
+      exclude?: string[];
+    };
+    /** Arbitrary policy metadata for downstream consumers */
+    policyMetadata?: Record<string, unknown>;
+    /** Document loaded by policy middleware for ownership checks */
+    document?: unknown;
+    /** Ownership check context (field name + user field) */
+    _ownershipCheck?: Record<string, unknown>;
+  }
+}
+type AnyRecord = Record<string, unknown>;
+/** MongoDB ObjectId — accepts string or any object with a `toString()` (e.g. mongoose ObjectId). */
+type ObjectId = string | {
+  toString(): string;
+};
+/**
+ * Flexible user type that accepts any object with id/_id properties.
+ * The actual user structure is defined by your app's auth system.
+ */
+type UserLike = UserBase & {
+  /** User email (optional) */
+  email?: string;
+};
+interface UserOrganization {
+  userId: string;
+  organizationId: string;
+  [key: string]: unknown;
+}
+interface JWTPayload {
+  sub: string;
+  [key: string]: unknown;
+}
+/**
+ * Typed Fastify request with Arc decorations. Use in `rawHandler` routes
+ * instead of `(req as any).user`.
+ *
+ * @example
+ * ```typescript
+ * import type { ArcRequest } from '@classytic/arc';
+ *
+ * handler: async (req: ArcRequest, reply) => {
+ *   req.user?.id;                    // typed
+ *   req.scope.organizationId;        // typed (when member)
+ *   req.signal;                      // AbortSignal (Fastify 5)
+ * }
+ * ```
+ */
+type ArcRequest = FastifyRequest & {
+  scope: RequestScope;
+  user: Record<string, unknown> | undefined;
+  signal: AbortSignal;
+};
+//#endregion
+export { UserLike as a, DataPolicy as c, UserBase as d, getUserId as f, ObjectId as i, PermissionCheck as l, normalizeRoles as m, ArcRequest as n, UserOrganization as o, getUserRoles as p, JWTPayload as r, AuthorizationDecision as s, AnyRecord as t, PermissionContext as u };

package/dist/{buildHandler-CDrCJzmB.mjs → buildHandler-DLE9xX-V.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-_KbifpHF.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CdQlz52F.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,
@@ -27,7 +27,8 @@ async function executeAggregation(normalized, deps, ctx) {
 		status: 400,
 		body: guardError
 	};
-	const aggReq = compileAggRequest(normalized, conjoinPolicyFilters(extractCallerFilter(query), policyFilter), tenantOptions, query);
+	const callerFilter = conjoinPolicyFilters(extractCallerFilter(query), policyFilter);
+	const aggReq = compileAggRequest(normalized, callerFilter, tenantOptions, query);
 	if (config.materialized) {
 		const matCtx = {
 			filter: aggReq.filter,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-C0_pa1tY.mjs";
-import { t as MemoryCacheStore } from "../memory-DR6wpa9F.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BZr8v46E.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-WeKvY1dE.mjs";
+import { t as MemoryCacheStore } from "../memory-qYSB7rMQ.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DhsZ0ZIc.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-BFHA6Scf.mjs → caching-BcGmvnHh.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
-import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
-import { t as ArcModule } from "../types-CBgvkp8O.mjs";
+import { L as RequestWithExtras } from "../index-BcR2bFZQ.mjs";
+import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
+import { t as ArcModule } from "../types-BcTumAz_.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
@@ -75,7 +75,9 @@ type CleanupErrorCode =
 /** No authenticated actor could be resolved for a destructive action (fail-closed). */
 "CLEANUP_ACTOR_REQUIRED" |
 /** Caller lacks permission for the operation. */
-"CLEANUP_FORBIDDEN";
+"CLEANUP_FORBIDDEN" |
+/** The exclusion list names an unknown or protective step (fail-closed). */
+"CLEANUP_INVALID_EXCLUSION";
 /**
  * A framework error carrying BOTH `status` (read directly in code/tests) and
  * `statusCode` (the Fastify convention arc's global error handler recognizes,
@@ -112,6 +114,16 @@ declare const CleanupErrors: {
   readonly alreadyRunning: (runId: string) => CleanupError;
   readonly runNotFound: (id: string) => CleanupError;
   readonly invalidAction: (action: string, status: string) => CleanupError;
+  /**
+   * The operator's exclusion list cannot be honoured as written.
+   *
+   * A 400 rather than a filter: dropping an unrecognised exclusion leaves
+   * someone believing they narrowed a destructive run when they did not, and
+   * dropping a PROTECTIVE one would let a guard be switched off from the same
+   * request that starts the run. `steps` carries the offending ids so a UI can
+   * point at them.
+   */
+  readonly invalidExclusion: (reason: string, steps: readonly string[]) => CleanupError;
   readonly forbidden: (operation: string) => CleanupError;
 };
 //#endregion
@@ -255,18 +267,44 @@ declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
 interface DataCleanupModuleDeps {
-  /** The recipes this deployment exposes. Ids must be unique (boot-checked). */
-  recipes: readonly CleanupRecipe[];
-  /** Durable run store — host-owned persistence (atomic create + CAS transitions). */
-  runStore: CleanupRunStore;
+  /**
+   * The recipes this deployment exposes. Ids must be unique (boot-checked).
+   *
+   * May be a THUNK, and for any host whose recipes are built from live engines it
+   * should be. Resolved once, inside `bootstrap` — i.e. after arc has validated the
+   * module graph and run every module's bootstrap — instead of while this factory
+   * runs during composition.
+   *
+   * Why that matters beyond tidiness: a host assembles cleanup recipes by folding
+   * over its composed modules and calling their `preLivePurge()` / `cleanupSteps()`
+   * arms, and those arms read `engine.repositories`. An array forces that fold at
+   * composition time, which in turn forces every contributing domain to allocate its
+   * engine before arc owns the lifecycle — so a graph that then fails validation
+   * leaks every engine built up to that point. A thunk breaks that chain.
+   */
+  recipes: readonly CleanupRecipe[] | (() => readonly CleanupRecipe[] | Promise<readonly CleanupRecipe[]>);
+  /**
+   * Durable run store — host-owned persistence (atomic create + CAS transitions).
+   *
+   * Accepts a THUNK for the same reason `recipes` does. A store is backed by a
+   * model, and constructing it registers that model — so an eager value forces
+   * the host to register `CleanupRun` (and its siblings below) while the module
+   * graph is still being composed, before arc has validated it or opened the
+   * connection. Everything here is read inside `service()`, which is built on
+   * first use at `bootstrap`, so deferral costs nothing.
+   */
+  runStore: CleanupRunStore | (() => CleanupRunStore | Promise<CleanupRunStore>);
   /** Durable evidence + manifest store — host-owned, idempotent by operationId. */
-  evidenceStore: CleanupEvidenceStore;
+  evidenceStore: CleanupEvidenceStore | (() => CleanupEvidenceStore | Promise<CleanupEvidenceStore>);
   /** Permission checks for view / execute / manage. */
   permissions: CleanupPermissions;
-  /** Optional write fence (§8). */
-  writeFence?: CleanupWriteFence | undefined;
-  /** Optional durable job queue (§8) — defaults to microtask-deferred in-process. */
-  jobQueue?: CleanupJobQueue | undefined;
+  /** Optional write fence (§8). Thunk-friendly — see {@link runStore}. */
+  writeFence?: CleanupWriteFence | (() => CleanupWriteFence | Promise<CleanupWriteFence>) | undefined;
+  /**
+   * Optional durable job queue (§8) — defaults to microtask-deferred in-process.
+   * Thunk-friendly — see {@link runStore}.
+   */
+  jobQueue?: CleanupJobQueue | (() => CleanupJobQueue | Promise<CleanupJobQueue>) | undefined;
   /** Framework size caps. */
   limits?: Partial<CleanupLimits> | undefined;
   /** Exclusive worker-lease duration (ms). Default 5 minutes. */
@@ -296,10 +334,6 @@ interface DataCleanupModuleDeps {
   /** Injected clock (tests). */
   now?: () => Date;
 }
-/**
- * Build the Data Cleanup Center Arc module. The module's public export is the
- * live {@link CleanupService} (so other modules / tests can drive it directly).
- */
 declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
 //#endregion
 //#region src/cleanup/plan-digest.d.ts
@@ -311,4 +345,4 @@ declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
  */
 declare function computeManifestDigest(manifest: Record<string, unknown>): string;
 //#endregion
-export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepResult, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };